Add --subkey_in and --subkey_out options to firmware signing utility.

src/platform/vboot_reference/utility/kernel_utility.cc

 // Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // Utility for manipulating verified boot kernel images.
 //
 
 #include "kernel_utility.h"
 
 #include <getopt.h>
@@ skipping 96 matching lines @@
     OPT_IN,
     OPT_OUT,
     OPT_GENERATE,
     OPT_VERIFY,
     OPT_DESCRIBE,
     OPT_VBLOCK,
     OPT_BOOTLOADER,
     OPT_VMLINUZ,
     OPT_CONFIG,
     OPT_PADDING,
-    OPT_SUBKEY,
+    OPT_SUBKEY_OUT,
   };
   static struct option long_options[] = {
     {"firmware_key", 1, 0,              OPT_FIRMWARE_KEY            },
     {"firmware_key_pub", 1, 0,          OPT_FIRMWARE_KEY_PUB        },
     {"kernel_key", 1, 0,                OPT_KERNEL_KEY              },
     {"kernel_key_pub", 1, 0,            OPT_KERNEL_KEY_PUB          },
     {"subkey_in", 1, 0,                 OPT_SUBKEY_IN               },
     {"firmware_sign_algorithm", 1, 0,   OPT_FIRMWARE_SIGN_ALGORITHM },
     {"kernel_sign_algorithm", 1, 0,     OPT_KERNEL_SIGN_ALGORITHM   },
     {"kernel_key_version", 1, 0,        OPT_KERNEL_KEY_VERSION      },
     {"kernel_version", 1, 0,            OPT_KERNEL_VERSION          },
     {"in", 1, 0,                        OPT_IN                      },
     {"out", 1, 0,                       OPT_OUT                     },
     {"generate", 0, 0,                  OPT_GENERATE                },
     {"verify", 0, 0,                    OPT_VERIFY                  },
     {"describe", 0, 0,                  OPT_DESCRIBE                },
     {"vblock", 0, 0,                    OPT_VBLOCK                  },
     {"bootloader", 1, 0,                OPT_BOOTLOADER              },
     {"vmlinuz", 1, 0,                   OPT_VMLINUZ                 },
     {"config", 1, 0,                    OPT_CONFIG                  },
     {"padding", 1, 0,                   OPT_PADDING                 },
-    {"subkey_out", 0, 0,                OPT_SUBKEY                  },
+    {"subkey_out", 0, 0,                OPT_SUBKEY_OUT              },
     {NULL, 0, 0, 0}
   };
   while ((i = getopt_long(argc, argv, "", long_options, &option_index)) != -1) {
     switch (i) {
     case '?':
       return false;
       break;
     case OPT_FIRMWARE_KEY:
       firmware_key_file_ = optarg;
       break;
@@ skipping 74 matching lines @@
       break;
     case OPT_PADDING:
       padding_ = strtol(optarg, &e, 0);
       if (!*optarg || (e && *e)) {
         cerr << "Invalid argument to --"
              << long_options[option_index].name
              << ": " << optarg << "\n";
         return false;
       }
       break;
-    case OPT_SUBKEY:
+    case OPT_SUBKEY_OUT:
       is_subkey_out_ = true;
       break;
     }
   }
   return CheckOptions();
 }
 
 void KernelUtility::OutputSignedImage(void) {
   if (image_) {
     if (!WriteKernelImage(out_file_.c_str(), image_,
@@ skipping 31 matching lines @@
                                              &kernel_key_pub_len);
     if (!image_->kernel_sign_key)
       return false;
     image_->kernel_key_version = kernel_key_version_;
 
     // Update header length.
     image_->header_len = GetKernelHeaderLen(image_);
     // Calculate header checksum.
     CalculateKernelHeaderChecksum(image_, image_->header_checksum);
 
-    // Generate and add the signatures.
+    // Generate and add the key signatures.
     if (!AddKernelKeySignature(image_, firmware_key_file_.c_str())) {
       cerr << "Couldn't write key signature to verified boot kernel image.\n";
       return false;
     }
   } else {
     // Use existing subkey header.
     MemcpyState st;
     uint8_t* subkey_header_buf = NULL;
     uint64_t subkey_len;
     int header_len;
@@ skipping 14 matching lines @@
     // TODO(gauravsh): This is basically the same code as the first half of
     // of ReadKernelImage(). Refactor to eliminate code duplication.
 
     StatefulMemcpy(&st, &image_->header_version, FIELD_LEN(header_version));
     StatefulMemcpy(&st, &image_->header_len, FIELD_LEN(header_len));
     StatefulMemcpy(&st, &image_->firmware_sign_algorithm,
                    FIELD_LEN(firmware_sign_algorithm));
     StatefulMemcpy(&st, &image_->kernel_sign_algorithm,
                    FIELD_LEN(kernel_sign_algorithm));
 
-    /* Valid Kernel Key signing algorithm. */
+    // Valid Kernel Key signing algorithm.
     if (image_->firmware_sign_algorithm >= kNumAlgorithms) {
       Free(subkey_header_buf);
       return NULL;
     }
 
-    /* Valid Kernel Signing Algorithm? */
+    // Valid Kernel Signing Algorithm?
     if (image_->kernel_sign_algorithm >= kNumAlgorithms) {
       Free(subkey_header_buf);
       return NULL;
     }
 
-    /* Compute size of pre-processed RSA public keys and signatures. */
+    // Compute size of pre-processed RSA public keys and signatures.
     kernel_key_signature_len  = siglen_map[image_->firmware_sign_algorithm];
     kernel_sign_key_len = RSAProcessedKeySize(image_->kernel_sign_algorithm);
 
-    /* Check whether key header length is correct. */
+    // Check whether key header length is correct.
     header_len = GetKernelHeaderLen(image_);
     if (header_len != image_->header_len) {
       debug("Header length mismatch. Got: %d, Expected: %d\n",
             image_->header_len, header_len);
       Free(subkey_header_buf);
       return NULL;
     }
 
-    /* Read pre-processed public half of the kernel signing key. */
+    // Read pre-processed public half of the kernel signing key.
     StatefulMemcpy(&st, &image_->kernel_key_version,
                    FIELD_LEN(kernel_key_version));
     image_->kernel_sign_key = (uint8_t*) Malloc(kernel_sign_key_len);
     StatefulMemcpy(&st, image_->kernel_sign_key, kernel_sign_key_len);
     StatefulMemcpy(&st, image_->header_checksum, FIELD_LEN(header_checksum));
 
-    /* Check whether the header checksum matches. */
+    // Check whether the header checksum matches.
     CalculateKernelHeaderChecksum(image_, header_checksum);
     if (SafeMemcmp(header_checksum, image_->header_checksum,
                    FIELD_LEN(header_checksum))) {
       debug("Invalid kernel header checksum!\n");
       Free(subkey_header_buf);
       return NULL;
     }
 
-    /* Read key signature. */
+    // Read key signature.
     image_->kernel_key_signature = (uint8_t*) Malloc(kernel_key_signature_len);
     StatefulMemcpy(&st, image_->kernel_key_signature,
                    kernel_key_signature_len);
+
     Free(subkey_header_buf);
     if (st.overrun || st.remaining_len != 0)  /* Overrun or underrun. */
       return false;
     return true;
   }
 
   // Fill up kernel preamble and kernel data.
   image_->kernel_version = kernel_version_;
   if (padding_)
     image_->padded_header_size = padding_;
   image_->kernel_data = GenerateKernelBlob(vmlinuz_file_.c_str(),
                                            config_file_.c_str(),
                                            bootloader_file_.c_str(),
                                            &image_->kernel_len,
                                            &image_->bootloader_offset,
                                            &image_->bootloader_size);
   if (!image_->kernel_data)
     return false;
 
+  // Generate and add the preamble and data signatures.
   if (!AddKernelSignature(image_, kernel_key_file_.c_str())) {
     cerr << "Couldn't write firmware signature to verified boot kernel image.\n";
     return false;
   }
   return true;
 }
 
 bool KernelUtility::VerifySignedImage(void) {
   int error;
   firmware_key_pub_ = RSAPublicKeyFromFile(firmware_key_pub_file_.c_str());
@@ skipping 118 matching lines @@
   }
   else if (ku.is_verify()) {
     cerr << "Verification ";
     if (ku.VerifySignedImage())
       cerr << "SUCCESS.\n";
     else
       cerr << "FAILURE.\n";
   }
   return 0;
 }