mkeficapsule.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * Copyright 2018 Linaro Limited
  4. * Author: AKASHI Takahiro
  5. */
  6. #include <getopt.h>
  7. #include <pe.h>
  8. #include <stdbool.h>
  9. #include <stdint.h>
  10. #include <stdio.h>
  11. #include <stdlib.h>
  12. #include <string.h>
  13. #include <linux/types.h>
  14. #include <sys/stat.h>
  15. #include <sys/types.h>
  16. #include <uuid/uuid.h>
  17. #include <linux/kconfig.h>
  18. #include <gnutls/gnutls.h>
  19. #include <gnutls/pkcs7.h>
  20. #include <gnutls/abstract.h>
  21. #include "eficapsule.h"
  22. static const char *tool_name = "mkeficapsule";
  23. efi_guid_t efi_guid_fm_capsule = EFI_FIRMWARE_MANAGEMENT_CAPSULE_ID_GUID;
  24. efi_guid_t efi_guid_cert_type_pkcs7 = EFI_CERT_TYPE_PKCS7_GUID;
  25. static const char *opts_short = "g:i:I:v:p:c:m:o:dhAR";
  26. enum {
  27. CAPSULE_NORMAL_BLOB = 0,
  28. CAPSULE_ACCEPT,
  29. CAPSULE_REVERT,
  30. } capsule_type;
  31. static struct option options[] = {
  32. {"guid", required_argument, NULL, 'g'},
  33. {"index", required_argument, NULL, 'i'},
  34. {"instance", required_argument, NULL, 'I'},
  35. {"fw-version", required_argument, NULL, 'v'},
  36. {"private-key", required_argument, NULL, 'p'},
  37. {"certificate", required_argument, NULL, 'c'},
  38. {"monotonic-count", required_argument, NULL, 'm'},
  39. {"dump-sig", no_argument, NULL, 'd'},
  40. {"fw-accept", no_argument, NULL, 'A'},
  41. {"fw-revert", no_argument, NULL, 'R'},
  42. {"capoemflag", required_argument, NULL, 'o'},
  43. {"help", no_argument, NULL, 'h'},
  44. {NULL, 0, NULL, 0},
  45. };
  46. static void print_usage(void)
  47. {
  48. fprintf(stderr, "Usage: %s [options] <image blob> <output file>\n"
  49. "Options:\n"
  50. "\t-g, --guid <guid string> guid for image blob type\n"
  51. "\t-i, --index <index> update image index\n"
  52. "\t-I, --instance <instance> update hardware instance\n"
  53. "\t-v, --fw-version <version> firmware version\n"
  54. "\t-p, --private-key <privkey file> private key file\n"
  55. "\t-c, --certificate <cert file> signer's certificate file\n"
  56. "\t-m, --monotonic-count <count> monotonic count\n"
  57. "\t-d, --dump_sig dump signature (*.p7)\n"
  58. "\t-A, --fw-accept firmware accept capsule, requires GUID, no image blob\n"
  59. "\t-R, --fw-revert firmware revert capsule, takes no GUID, no image blob\n"
  60. "\t-o, --capoemflag Capsule OEM Flag, an integer between 0x0000 and 0xffff\n"
  61. "\t-h, --help print a help message\n",
  62. tool_name);
  63. }
  64. /**
  65. * auth_context - authentication context
  66. * @key_file: Path to a private key file
  67. * @cert_file: Path to a certificate file
  68. * @image_data: Pointer to firmware data
  69. * @image_size: Size of firmware data
  70. * @auth: Authentication header
  71. * @sig_data: Signature data
  72. * @sig_size: Size of signature data
  73. *
  74. * Data structure used in create_auth_data(). @key_file through
  75. * @image_size are input parameters. @auth, @sig_data and @sig_size
  76. * are filled in by create_auth_data().
  77. */
  78. struct auth_context {
  79. char *key_file;
  80. char *cert_file;
  81. uint8_t *image_data;
  82. size_t image_size;
  83. struct efi_firmware_image_authentication auth;
  84. uint8_t *sig_data;
  85. size_t sig_size;
  86. };
  87. static int dump_sig;
  88. /**
  89. * read_bin_file - read a firmware binary file
  90. * @bin: Path to a firmware binary file
  91. * @data: Pointer to pointer of allocated buffer
  92. * @bin_size: Size of allocated buffer
  93. *
  94. * Read out a content of binary, @bin, into @data.
  95. * A caller should free @data.
  96. *
  97. * Return:
  98. * * 0 - on success
  99. * * -1 - on failure
  100. */
  101. static int read_bin_file(char *bin, uint8_t **data, off_t *bin_size)
  102. {
  103. FILE *g;
  104. struct stat bin_stat;
  105. void *buf;
  106. size_t size;
  107. int ret = 0;
  108. g = fopen(bin, "r");
  109. if (!g) {
  110. fprintf(stderr, "cannot open %s\n", bin);
  111. return -1;
  112. }
  113. if (stat(bin, &bin_stat) < 0) {
  114. fprintf(stderr, "cannot determine the size of %s\n", bin);
  115. ret = -1;
  116. goto err;
  117. }
  118. if (bin_stat.st_size > SIZE_MAX) {
  119. fprintf(stderr, "file size is too large for malloc: %s\n", bin);
  120. ret = -1;
  121. goto err;
  122. }
  123. buf = malloc(bin_stat.st_size);
  124. if (!buf) {
  125. fprintf(stderr, "cannot allocate memory: %zx\n",
  126. (size_t)bin_stat.st_size);
  127. ret = -1;
  128. goto err;
  129. }
  130. size = fread(buf, 1, bin_stat.st_size, g);
  131. if (size < bin_stat.st_size) {
  132. fprintf(stderr, "read failed (%zx)\n", size);
  133. ret = -1;
  134. goto err;
  135. }
  136. *data = buf;
  137. *bin_size = bin_stat.st_size;
  138. err:
  139. fclose(g);
  140. return ret;
  141. }
  142. /**
  143. * write_capsule_file - write a capsule file
  144. * @bin: FILE stream
  145. * @data: Pointer to data
  146. * @bin_size: Size of data
  147. *
  148. * Write out data, @data, with the size @bin_size.
  149. *
  150. * Return:
  151. * * 0 - on success
  152. * * -1 - on failure
  153. */
  154. static int write_capsule_file(FILE *f, void *data, size_t size, const char *msg)
  155. {
  156. size_t size_written;
  157. size_written = fwrite(data, 1, size, f);
  158. if (size_written < size) {
  159. fprintf(stderr, "%s: write failed (%zx != %zx)\n", msg,
  160. size_written, size);
  161. return -1;
  162. }
  163. return 0;
  164. }
  165. /**
  166. * create_auth_data - compose authentication data in capsule
  167. * @auth_context: Pointer to authentication context
  168. *
  169. * Fill up an authentication header (.auth) and signature data (.sig_data)
  170. * in @auth_context, using library functions from openssl.
  171. * All the parameters in @auth_context must be filled in by a caller.
  172. *
  173. * Return:
  174. * * 0 - on success
  175. * * -1 - on failure
  176. */
  177. static int create_auth_data(struct auth_context *ctx)
  178. {
  179. gnutls_datum_t cert;
  180. gnutls_datum_t key;
  181. off_t file_size;
  182. gnutls_privkey_t pkey;
  183. gnutls_x509_crt_t x509;
  184. gnutls_pkcs7_t pkcs7;
  185. gnutls_datum_t data;
  186. gnutls_datum_t signature;
  187. int ret;
  188. ret = read_bin_file(ctx->cert_file, &cert.data, &file_size);
  189. if (ret < 0)
  190. return -1;
  191. if (file_size > UINT_MAX)
  192. return -1;
  193. cert.size = file_size;
  194. ret = read_bin_file(ctx->key_file, &key.data, &file_size);
  195. if (ret < 0)
  196. return -1;
  197. if (file_size > UINT_MAX)
  198. return -1;
  199. key.size = file_size;
  200. /*
  201. * For debugging,
  202. * gnutls_global_set_time_function(mytime);
  203. * gnutls_global_set_log_function(tls_log_func);
  204. * gnutls_global_set_log_level(6);
  205. */
  206. ret = gnutls_privkey_init(&pkey);
  207. if (ret < 0) {
  208. fprintf(stderr, "error in gnutls_privkey_init(): %s\n",
  209. gnutls_strerror(ret));
  210. return -1;
  211. }
  212. ret = gnutls_x509_crt_init(&x509);
  213. if (ret < 0) {
  214. fprintf(stderr, "error in gnutls_x509_crt_init(): %s\n",
  215. gnutls_strerror(ret));
  216. return -1;
  217. }
  218. /* load a private key */
  219. ret = gnutls_privkey_import_x509_raw(pkey, &key, GNUTLS_X509_FMT_PEM,
  220. 0, 0);
  221. if (ret < 0) {
  222. fprintf(stderr,
  223. "error in gnutls_privkey_import_x509_raw(): %s\n",
  224. gnutls_strerror(ret));
  225. return -1;
  226. }
  227. /* load x509 certificate */
  228. ret = gnutls_x509_crt_import(x509, &cert, GNUTLS_X509_FMT_PEM);
  229. if (ret < 0) {
  230. fprintf(stderr, "error in gnutls_x509_crt_import(): %s\n",
  231. gnutls_strerror(ret));
  232. return -1;
  233. }
  234. /* generate a PKCS #7 structure */
  235. ret = gnutls_pkcs7_init(&pkcs7);
  236. if (ret < 0) {
  237. fprintf(stderr, "error in gnutls_pkcs7_init(): %s\n",
  238. gnutls_strerror(ret));
  239. return -1;
  240. }
  241. /* sign */
  242. /*
  243. * Data should have
  244. * * firmware image
  245. * * monotonic count
  246. * in this order!
  247. * See EDK2's FmpAuthenticatedHandlerRsa2048Sha256()
  248. */
  249. data.size = ctx->image_size + sizeof(ctx->auth.monotonic_count);
  250. data.data = malloc(data.size);
  251. if (!data.data) {
  252. fprintf(stderr, "allocating memory (0x%x) failed\n", data.size);
  253. return -1;
  254. }
  255. memcpy(data.data, ctx->image_data, ctx->image_size);
  256. memcpy(data.data + ctx->image_size, &ctx->auth.monotonic_count,
  257. sizeof(ctx->auth.monotonic_count));
  258. ret = gnutls_pkcs7_sign(pkcs7, x509, pkey, &data, NULL, NULL,
  259. GNUTLS_DIG_SHA256,
  260. /* GNUTLS_PKCS7_EMBED_DATA? */
  261. GNUTLS_PKCS7_INCLUDE_CERT |
  262. GNUTLS_PKCS7_INCLUDE_TIME);
  263. if (ret < 0) {
  264. fprintf(stderr, "error in gnutls_pkcs7)sign(): %s\n",
  265. gnutls_strerror(ret));
  266. return -1;
  267. }
  268. /* export */
  269. ret = gnutls_pkcs7_export2(pkcs7, GNUTLS_X509_FMT_DER, &signature);
  270. if (ret < 0) {
  271. fprintf(stderr, "error in gnutls_pkcs7_export2: %s\n",
  272. gnutls_strerror(ret));
  273. return -1;
  274. }
  275. ctx->sig_data = signature.data;
  276. ctx->sig_size = signature.size;
  277. /* fill auth_info */
  278. ctx->auth.auth_info.hdr.dwLength = sizeof(ctx->auth.auth_info)
  279. + ctx->sig_size;
  280. ctx->auth.auth_info.hdr.wRevision = WIN_CERT_REVISION_2_0;
  281. ctx->auth.auth_info.hdr.wCertificateType = WIN_CERT_TYPE_EFI_GUID;
  282. memcpy(&ctx->auth.auth_info.cert_type, &efi_guid_cert_type_pkcs7,
  283. sizeof(efi_guid_cert_type_pkcs7));
  284. /*
  285. * For better clean-ups,
  286. * gnutls_pkcs7_deinit(pkcs7);
  287. * gnutls_privkey_deinit(pkey);
  288. * gnutls_x509_crt_deinit(x509);
  289. * free(cert.data);
  290. * free(key.data);
  291. * if error
  292. * gnutls_free(signature.data);
  293. */
  294. return 0;
  295. }
  296. /**
  297. * dump_signature - dump out a signature
  298. * @path: Path to a capsule file
  299. * @signature: Signature data
  300. * @sig_size: Size of signature data
  301. *
  302. * Signature data pointed to by @signature will be saved into
  303. * a file whose file name is @path with ".p7" suffix.
  304. *
  305. * Return:
  306. * * 0 - on success
  307. * * -1 - on failure
  308. */
  309. static int dump_signature(const char *path, uint8_t *signature, size_t sig_size)
  310. {
  311. char *sig_path;
  312. FILE *f;
  313. size_t size;
  314. int ret = -1;
  315. sig_path = malloc(strlen(path) + 3 + 1);
  316. if (!sig_path)
  317. return ret;
  318. sprintf(sig_path, "%s.p7", path);
  319. f = fopen(sig_path, "w");
  320. if (!f)
  321. goto err;
  322. size = fwrite(signature, 1, sig_size, f);
  323. if (size == sig_size)
  324. ret = 0;
  325. fclose(f);
  326. err:
  327. free(sig_path);
  328. return ret;
  329. }
  330. /**
  331. * free_sig_data - free out signature data
  332. * @ctx: Pointer to authentication context
  333. *
  334. * Free signature data allocated in create_auth_data().
  335. */
  336. static void free_sig_data(struct auth_context *ctx)
  337. {
  338. if (ctx->sig_size)
  339. gnutls_free(ctx->sig_data);
  340. }
  341. /**
  342. * create_fwbin - create an uefi capsule file
  343. * @path: Path to a created capsule file
  344. * @bin: Path to a firmware binary to encapsulate
  345. * @guid: GUID of related FMP driver
  346. * @index: Index number in capsule
  347. * @instance: Instance number in capsule
  348. * @mcount: Monotonic count in authentication information
  349. * @private_file: Path to a private key file
  350. * @cert_file: Path to a certificate file
  351. * @oemflags: Capsule OEM Flags, bits 0-15
  352. *
  353. * This function actually does the job of creating an uefi capsule file.
  354. * All the arguments must be supplied.
  355. * If either @private_file ror @cert_file is NULL, the capsule file
  356. * won't be signed.
  357. *
  358. * Return:
  359. * * 0 - on success
  360. * * -1 - on failure
  361. */
  362. static int create_fwbin(char *path, char *bin, efi_guid_t *guid,
  363. unsigned long index, unsigned long instance,
  364. struct fmp_payload_header_params *fmp_ph_params,
  365. uint64_t mcount, char *privkey_file, char *cert_file,
  366. uint16_t oemflags)
  367. {
  368. struct efi_capsule_header header;
  369. struct efi_firmware_management_capsule_header capsule;
  370. struct efi_firmware_management_capsule_image_header image;
  371. struct auth_context auth_context;
  372. FILE *f;
  373. uint8_t *data, *new_data, *buf;
  374. off_t bin_size;
  375. uint64_t offset;
  376. int ret;
  377. struct fmp_payload_header payload_header;
  378. #ifdef DEBUG
  379. fprintf(stderr, "For output: %s\n", path);
  380. fprintf(stderr, "\tbin: %s\n\ttype: %pUl\n", bin, guid);
  381. fprintf(stderr, "\tindex: %lu\n\tinstance: %lu\n", index, instance);
  382. #endif
  383. auth_context.sig_size = 0;
  384. f = NULL;
  385. data = NULL;
  386. new_data = NULL;
  387. ret = -1;
  388. /*
  389. * read a firmware binary
  390. */
  391. if (read_bin_file(bin, &data, &bin_size))
  392. goto err;
  393. buf = data;
  394. /* insert fmp payload header right before the payload */
  395. if (fmp_ph_params->have_header) {
  396. new_data = malloc(bin_size + sizeof(payload_header));
  397. if (!new_data)
  398. goto err;
  399. payload_header.signature = FMP_PAYLOAD_HDR_SIGNATURE;
  400. payload_header.header_size = sizeof(payload_header);
  401. payload_header.fw_version = fmp_ph_params->fw_version;
  402. payload_header.lowest_supported_version = 0; /* not used */
  403. memcpy(new_data, &payload_header, sizeof(payload_header));
  404. memcpy(new_data + sizeof(payload_header), data, bin_size);
  405. buf = new_data;
  406. bin_size += sizeof(payload_header);
  407. }
  408. /* first, calculate signature to determine its size */
  409. if (privkey_file && cert_file) {
  410. auth_context.key_file = privkey_file;
  411. auth_context.cert_file = cert_file;
  412. auth_context.auth.monotonic_count = mcount;
  413. auth_context.image_data = buf;
  414. auth_context.image_size = bin_size;
  415. if (create_auth_data(&auth_context)) {
  416. fprintf(stderr, "Signing firmware image failed\n");
  417. goto err;
  418. }
  419. if (dump_sig &&
  420. dump_signature(path, auth_context.sig_data,
  421. auth_context.sig_size)) {
  422. fprintf(stderr, "Creating signature file failed\n");
  423. goto err;
  424. }
  425. }
  426. /*
  427. * write a capsule file
  428. */
  429. f = fopen(path, "w");
  430. if (!f) {
  431. fprintf(stderr, "cannot open %s\n", path);
  432. goto err;
  433. }
  434. /*
  435. * capsule file header
  436. */
  437. header.capsule_guid = efi_guid_fm_capsule;
  438. header.header_size = sizeof(header);
  439. /* TODO: The current implementation ignores flags */
  440. header.flags = CAPSULE_FLAGS_PERSIST_ACROSS_RESET;
  441. if (oemflags)
  442. header.flags |= oemflags;
  443. header.capsule_image_size = sizeof(header)
  444. + sizeof(capsule) + sizeof(uint64_t)
  445. + sizeof(image)
  446. + bin_size;
  447. if (auth_context.sig_size)
  448. header.capsule_image_size += sizeof(auth_context.auth)
  449. + auth_context.sig_size;
  450. if (write_capsule_file(f, &header, sizeof(header),
  451. "Capsule header"))
  452. goto err;
  453. /*
  454. * firmware capsule header
  455. * This capsule has only one firmware capsule image.
  456. */
  457. capsule.version = 0x00000001;
  458. capsule.embedded_driver_count = 0;
  459. capsule.payload_item_count = 1;
  460. if (write_capsule_file(f, &capsule, sizeof(capsule),
  461. "Firmware capsule header"))
  462. goto err;
  463. offset = sizeof(capsule) + sizeof(uint64_t);
  464. if (write_capsule_file(f, &offset, sizeof(offset),
  465. "Offset to capsule image"))
  466. goto err;
  467. /*
  468. * firmware capsule image header
  469. */
  470. image.version = 0x00000003;
  471. memcpy(&image.update_image_type_id, guid, sizeof(*guid));
  472. image.update_image_index = index;
  473. image.reserved[0] = 0;
  474. image.reserved[1] = 0;
  475. image.reserved[2] = 0;
  476. image.update_image_size = bin_size;
  477. if (auth_context.sig_size)
  478. image.update_image_size += sizeof(auth_context.auth)
  479. + auth_context.sig_size;
  480. image.update_vendor_code_size = 0; /* none */
  481. image.update_hardware_instance = instance;
  482. image.image_capsule_support = 0;
  483. if (auth_context.sig_size)
  484. image.image_capsule_support |= CAPSULE_SUPPORT_AUTHENTICATION;
  485. if (write_capsule_file(f, &image, sizeof(image),
  486. "Firmware capsule image header"))
  487. goto err;
  488. /*
  489. * signature
  490. */
  491. if (auth_context.sig_size) {
  492. if (write_capsule_file(f, &auth_context.auth,
  493. sizeof(auth_context.auth),
  494. "Authentication header"))
  495. goto err;
  496. if (write_capsule_file(f, auth_context.sig_data,
  497. auth_context.sig_size, "Signature"))
  498. goto err;
  499. }
  500. /*
  501. * firmware binary
  502. */
  503. if (write_capsule_file(f, buf, bin_size, "Firmware binary"))
  504. goto err;
  505. ret = 0;
  506. err:
  507. if (f)
  508. fclose(f);
  509. free_sig_data(&auth_context);
  510. free(data);
  511. free(new_data);
  512. return ret;
  513. }
  514. /**
  515. * convert_uuid_to_guid() - convert UUID to GUID
  516. * @buf: UUID binary
  517. *
  518. * UUID and GUID have the same data structure, but their binary
  519. * formats are different due to the endianness. See lib/uuid.c.
  520. * Since uuid_parse() can handle only UUID, this function must
  521. * be called to get correct data for GUID when parsing a string.
  522. *
  523. * The correct data will be returned in @buf.
  524. */
  525. void convert_uuid_to_guid(unsigned char *buf)
  526. {
  527. unsigned char c;
  528. c = buf[0];
  529. buf[0] = buf[3];
  530. buf[3] = c;
  531. c = buf[1];
  532. buf[1] = buf[2];
  533. buf[2] = c;
  534. c = buf[4];
  535. buf[4] = buf[5];
  536. buf[5] = c;
  537. c = buf[6];
  538. buf[6] = buf[7];
  539. buf[7] = c;
  540. }
  541. static int create_empty_capsule(char *path, efi_guid_t *guid, bool fw_accept)
  542. {
  543. struct efi_capsule_header header = { 0 };
  544. FILE *f = NULL;
  545. int ret = -1;
  546. efi_guid_t fw_accept_guid = FW_ACCEPT_OS_GUID;
  547. efi_guid_t fw_revert_guid = FW_REVERT_OS_GUID;
  548. efi_guid_t capsule_guid;
  549. f = fopen(path, "w");
  550. if (!f) {
  551. fprintf(stderr, "cannot open %s\n", path);
  552. goto err;
  553. }
  554. capsule_guid = fw_accept ? fw_accept_guid : fw_revert_guid;
  555. memcpy(&header.capsule_guid, &capsule_guid, sizeof(efi_guid_t));
  556. header.header_size = sizeof(header);
  557. header.flags = 0;
  558. header.capsule_image_size = fw_accept ?
  559. sizeof(header) + sizeof(efi_guid_t) : sizeof(header);
  560. if (write_capsule_file(f, &header, sizeof(header),
  561. "Capsule header"))
  562. goto err;
  563. if (fw_accept) {
  564. if (write_capsule_file(f, guid, sizeof(*guid),
  565. "FW Accept Capsule Payload"))
  566. goto err;
  567. }
  568. ret = 0;
  569. err:
  570. if (f)
  571. fclose(f);
  572. return ret;
  573. }
  574. /**
  575. * main - main entry function of mkeficapsule
  576. * @argc: Number of arguments
  577. * @argv: Array of pointers to arguments
  578. *
  579. * Create an uefi capsule file, optionally signing it.
  580. * Parse all the arguments and pass them on to create_fwbin().
  581. *
  582. * Return:
  583. * * 0 - on success
  584. * * -1 - on failure
  585. */
  586. int main(int argc, char **argv)
  587. {
  588. efi_guid_t *guid;
  589. unsigned char uuid_buf[16];
  590. unsigned long index, instance;
  591. uint64_t mcount;
  592. unsigned long oemflags;
  593. char *privkey_file, *cert_file;
  594. int c, idx;
  595. struct fmp_payload_header_params fmp_ph_params = { 0 };
  596. guid = NULL;
  597. index = 0;
  598. instance = 0;
  599. mcount = 0;
  600. privkey_file = NULL;
  601. cert_file = NULL;
  602. dump_sig = 0;
  603. capsule_type = CAPSULE_NORMAL_BLOB;
  604. oemflags = 0;
  605. for (;;) {
  606. c = getopt_long(argc, argv, opts_short, options, &idx);
  607. if (c == -1)
  608. break;
  609. switch (c) {
  610. case 'g':
  611. if (guid) {
  612. fprintf(stderr,
  613. "Image type already specified\n");
  614. exit(EXIT_FAILURE);
  615. }
  616. if (uuid_parse(optarg, uuid_buf)) {
  617. fprintf(stderr, "Wrong guid format\n");
  618. exit(EXIT_FAILURE);
  619. }
  620. convert_uuid_to_guid(uuid_buf);
  621. guid = (efi_guid_t *)uuid_buf;
  622. break;
  623. case 'i':
  624. index = strtoul(optarg, NULL, 0);
  625. break;
  626. case 'I':
  627. instance = strtoul(optarg, NULL, 0);
  628. break;
  629. case 'v':
  630. fmp_ph_params.fw_version = strtoul(optarg, NULL, 0);
  631. fmp_ph_params.have_header = true;
  632. break;
  633. case 'p':
  634. if (privkey_file) {
  635. fprintf(stderr,
  636. "Private Key already specified\n");
  637. exit(EXIT_FAILURE);
  638. }
  639. privkey_file = optarg;
  640. break;
  641. case 'c':
  642. if (cert_file) {
  643. fprintf(stderr,
  644. "Certificate file already specified\n");
  645. exit(EXIT_FAILURE);
  646. }
  647. cert_file = optarg;
  648. break;
  649. case 'm':
  650. mcount = strtoul(optarg, NULL, 0);
  651. break;
  652. case 'd':
  653. dump_sig = 1;
  654. break;
  655. case 'A':
  656. if (capsule_type) {
  657. fprintf(stderr,
  658. "Select either of Accept or Revert capsule generation\n");
  659. exit(1);
  660. }
  661. capsule_type = CAPSULE_ACCEPT;
  662. break;
  663. case 'R':
  664. if (capsule_type) {
  665. fprintf(stderr,
  666. "Select either of Accept or Revert capsule generation\n");
  667. exit(1);
  668. }
  669. capsule_type = CAPSULE_REVERT;
  670. break;
  671. case 'o':
  672. oemflags = strtoul(optarg, NULL, 0);
  673. if (oemflags > 0xffff) {
  674. fprintf(stderr,
  675. "oemflags must be between 0x0 and 0xffff\n");
  676. exit(1);
  677. }
  678. break;
  679. default:
  680. print_usage();
  681. exit(EXIT_SUCCESS);
  682. }
  683. }
  684. /* check necessary parameters */
  685. if ((capsule_type == CAPSULE_NORMAL_BLOB &&
  686. ((argc != optind + 2) || !guid ||
  687. ((privkey_file && !cert_file) ||
  688. (!privkey_file && cert_file)))) ||
  689. (capsule_type != CAPSULE_NORMAL_BLOB &&
  690. ((argc != optind + 1) ||
  691. ((capsule_type == CAPSULE_ACCEPT) && !guid) ||
  692. ((capsule_type == CAPSULE_REVERT) && guid)))) {
  693. print_usage();
  694. exit(EXIT_FAILURE);
  695. }
  696. if (capsule_type != CAPSULE_NORMAL_BLOB) {
  697. if (create_empty_capsule(argv[argc - 1], guid,
  698. capsule_type == CAPSULE_ACCEPT) < 0) {
  699. fprintf(stderr, "Creating empty capsule failed\n");
  700. exit(EXIT_FAILURE);
  701. }
  702. } else if (create_fwbin(argv[argc - 1], argv[argc - 2], guid,
  703. index, instance, &fmp_ph_params, mcount, privkey_file,
  704. cert_file, (uint16_t)oemflags) < 0) {
  705. fprintf(stderr, "Creating firmware capsule failed\n");
  706. exit(EXIT_FAILURE);
  707. }
  708. exit(EXIT_SUCCESS);
  709. }