Add a --subkey switch to kernel signing utility.

src/platform/vboot_reference/utility/kernel_utility.cc

 // Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // Utility for manipulating verified boot kernel images.
 //
 
 #include "kernel_utility.h"
 
 #include <errno.h>
@@ skipping 58 matching lines @@
       "  --firmware_sign_algorithm <algoid>\tSigning algorithm for firmware\n"
       "  --kernel_sign_algorithm <algoid>\tSigning algorithm for kernel\n"
       "  --kernel_key_version <number>\t\tKernel signing key version number\n"
       "  --kernel_version <number>\t\tKernel Version number\n"
       "  --config <file>\t\t\tEmbedded kernel command-line parameters\n"
       "  --bootloader <file>\t\t\tEmbedded bootloader stub\n"
       "  --vmlinuz <file>\t\t\tEmbedded kernel image\n"
       "  --out <outfile>\t\t\tOutput file for verified boot image\n"
       "\n"
       "Optional arguments for \"--generate\" are:\n"
+      "  --padding <size>\t\t\tPad the header to this size\n"
+      "  --subkey_out\t\t\t\tJust output the subkey (key verification) header\n"
       "  --vblock\t\t\t\tJust output the verification block\n"
-      "  --padding\t\t\t\tPad the header to this size\n"
       "\n"
       "<algoid> (for --*_sign_algorithm) is one of the following:\n";
   for (int i = 0; i < kNumAlgorithms; i++) {
     cerr << "  " << i << " for " << algo_strings[i] << "\n";
   }
   cerr << "\n\n";
 }
 
 bool KernelUtility::ParseCmdLineOptions(int argc, char* argv[]) {
   int option_index, i;
@@ skipping 10 matching lines @@
     OPT_IN,
     OPT_OUT,
     OPT_GENERATE,
     OPT_VERIFY,
     OPT_DESCRIBE,
     OPT_VBLOCK,
     OPT_BOOTLOADER,
     OPT_VMLINUZ,
     OPT_CONFIG,
     OPT_PADDING,
+    OPT_SUBKEY,
   };
   static struct option long_options[] = {
     {"firmware_key", 1, 0,              OPT_FIRMWARE_KEY            },
     {"firmware_key_pub", 1, 0,          OPT_FIRMWARE_KEY_PUB        },
     {"kernel_key", 1, 0,                OPT_KERNEL_KEY              },
     {"kernel_key_pub", 1, 0,            OPT_KERNEL_KEY_PUB          },
     {"firmware_sign_algorithm", 1, 0,   OPT_FIRMWARE_SIGN_ALGORITHM },
     {"kernel_sign_algorithm", 1, 0,     OPT_KERNEL_SIGN_ALGORITHM   },
     {"kernel_key_version", 1, 0,        OPT_KERNEL_KEY_VERSION      },
     {"kernel_version", 1, 0,            OPT_KERNEL_VERSION          },
     {"in", 1, 0,                        OPT_IN                      },
     {"out", 1, 0,                       OPT_OUT                     },
     {"generate", 0, 0,                  OPT_GENERATE                },
     {"verify", 0, 0,                    OPT_VERIFY                  },
     {"describe", 0, 0,                  OPT_DESCRIBE                },
     {"vblock", 0, 0,                    OPT_VBLOCK                  },
     {"bootloader", 1, 0,                OPT_BOOTLOADER              },
     {"vmlinuz", 1, 0,                   OPT_VMLINUZ                 },
     {"config", 1, 0,                    OPT_CONFIG                  },
     {"padding", 1, 0,                   OPT_PADDING                 },
+    {"subkey_out", 0, 0,                OPT_SUBKEY                  },
     {NULL, 0, 0, 0}
   };
   while ((i = getopt_long(argc, argv, "", long_options, &option_index)) != -1) {
     switch (i) {
     case '?':
       return false;
       break;
     case OPT_FIRMWARE_KEY:
       firmware_key_file_ = optarg;
       break;
@@ skipping 74 matching lines @@
       break;
     case OPT_PADDING:
       padding_ = strtol(optarg, &e, 0);
       if (!*optarg || (e && *e)) {
         cerr << "Invalid argument to --"
              << long_options[option_index].name
              << ": " << optarg << "\n";
         return false;
       }
       break;
+    case OPT_SUBKEY:
+      is_subkey_out_ = true;
+      break;
     }
   }
   return CheckOptions();
 }
 
 void KernelUtility::OutputSignedImage(void) {
   if (image_) {
-    if (!WriteKernelImage(out_file_.c_str(), image_, is_only_vblock_)) {
+    if (!WriteKernelImage(out_file_.c_str(), image_,
+                          is_only_vblock_,
+                          is_subkey_out_)) {
       cerr << "Couldn't write verified boot kernel image to file "
            << out_file_ <<".\n";
     }
   }
 }
 
 void KernelUtility::DescribeSignedImage(void) {
   image_ = ReadKernelImage(in_file_.c_str());
   if (!image_) {
     cerr << "Couldn't read kernel image or malformed image.\n";
@@ skipping 139 matching lines @@
       return false;
     }
     if (bootloader_file_.empty()) {
       cerr << "No bootloader file specified.\n";
       return false;
     }
     if (vmlinuz_file_.empty()) {
       cerr << "No vmlinuz file specified.\n";
       return false;
     }
+    // TODO(gauravsh): Enforce only one of --vblock or --subkey_out is specified
   }
   return true;
 }
 
 }  // namespace vboot_reference
 
 int main(int argc, char* argv[]) {
   vboot_reference::KernelUtility ku;
   if (!ku.ParseCmdLineOptions(argc, argv)) {
     ku.PrintUsage();
     return -1;
   }
   if (ku.is_describe()) {
     ku.DescribeSignedImage();
   }
   else if (ku.is_generate()) {
     if (!ku.GenerateSignedImage())
       return -1;
     ku.OutputSignedImage();
   }
   else if (ku.is_verify()) {
     cerr << "Verification ";
     if (ku.VerifySignedImage())
       cerr << "SUCCESS.\n";
     else
       cerr << "FAILURE.\n";
   }
   return 0;
 }