BaseTools/Capsule: Remove support for PopulateSystemTable
[mirror_edk2.git] / BaseTools / Source / Python / Capsule / GenerateCapsule.py
1 ## @file
2 # Generate a capsule.
3 #
4 # Copyright (c) 2018, Intel Corporation. All rights reserved.<BR>
5 # This program and the accompanying materials
6 # are licensed and made available under the terms and conditions of the BSD License
7 # which accompanies this distribution. The full text of the license may be found at
8 # http://opensource.org/licenses/bsd-license.php
9 #
10 # THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
11 # WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
12 #
13
14 '''
15 GenerateCapsule
16 '''
17
18 import sys
19 import argparse
20 import uuid
21 import struct
22 import subprocess
23 import os
24 import tempfile
25 import shutil
26 import platform
27 from Common.Uefi.Capsule.UefiCapsuleHeader import UefiCapsuleHeaderClass
28 from Common.Uefi.Capsule.FmpCapsuleHeader import FmpCapsuleHeaderClass
29 from Common.Uefi.Capsule.FmpAuthHeader import FmpAuthHeaderClass
30 from Common.Edk2.Capsule.FmpPayloadHeader import FmpPayloadHeaderClass
31
32 #
33 # Globals for help information
34 #
35 __prog__ = 'GenerateCapsule'
36 __version__ = '0.9'
37 __copyright__ = 'Copyright (c) 2018, Intel Corporation. All rights reserved.'
38 __description__ = 'Generate a capsule.\n'
39
40 def SignPayloadSignTool (Payload, ToolPath, PfxFile):
41 #
42 # Create a temporary directory
43 #
44 TempDirectoryName = tempfile.mkdtemp()
45
46 #
47 # Generate temp file name for the payload contents
48 #
49 TempFileName = os.path.join (TempDirectoryName, 'Payload.bin')
50
51 #
52 # Create temporary payload file for signing
53 #
54 try:
55 File = open (TempFileName, mode='wb')
56 File.write (Payload)
57 File.close ()
58 except:
59 shutil.rmtree (TempDirectoryName)
60 raise ValueError ('GenerateCapsule: error: can not write temporary payload file.')
61
62 #
63 # Build signtool command
64 #
65 if ToolPath is None:
66 ToolPath = ''
67 Command = ''
68 Command = Command + '"{Path}" '.format (Path = os.path.join (ToolPath, 'signtool.exe'))
69 Command = Command + 'sign /fd sha256 /p7ce DetachedSignedData /p7co 1.2.840.113549.1.7.2 '
70 Command = Command + '/p7 {TempDir} '.format (TempDir = TempDirectoryName)
71 Command = Command + '/f {PfxFile} '.format (PfxFile = PfxFile)
72 Command = Command + TempFileName
73
74 #
75 # Sign the input file using the specified private key
76 #
77 try:
78 Process = subprocess.Popen (Command, stdin = subprocess.PIPE, stdout = subprocess.PIPE, stderr = subprocess.PIPE, shell = True)
79 Result = Process.communicate('')
80 except:
81 shutil.rmtree (TempDirectoryName)
82 raise ValueError ('GenerateCapsule: error: can not run signtool.')
83
84 if Process.returncode != 0:
85 shutil.rmtree (TempDirectoryName)
86 print (Result[1].decode())
87 raise ValueError ('GenerateCapsule: error: signtool failed.')
88
89 #
90 # Read the signature from the generated output file
91 #
92 try:
93 File = open (TempFileName + '.p7', mode='rb')
94 Signature = File.read ()
95 File.close ()
96 except:
97 shutil.rmtree (TempDirectoryName)
98 raise ValueError ('GenerateCapsule: error: can not read signature file.')
99
100 shutil.rmtree (TempDirectoryName)
101 return Signature
102
103 def VerifyPayloadSignTool (Payload, CertData, ToolPath, PfxFile):
104 print ('signtool verify is not supported.')
105 raise ValueError ('GenerateCapsule: error: signtool verify is not supported.')
106
107 def SignPayloadOpenSsl (Payload, ToolPath, SignerPrivateCertFile, OtherPublicCertFile, TrustedPublicCertFile):
108 #
109 # Build openssl command
110 #
111 if ToolPath is None:
112 ToolPath = ''
113 Command = ''
114 Command = Command + '"{Path}" '.format (Path = os.path.join (ToolPath, 'openssl'))
115 Command = Command + 'smime -sign -binary -outform DER -md sha256 '
116 Command = Command + '-signer "{Private}" -certfile "{Public}"'.format (Private = SignerPrivateCertFile, Public = OtherPublicCertFile)
117
118 #
119 # Sign the input file using the specified private key and capture signature from STDOUT
120 #
121 try:
122 Process = subprocess.Popen (Command, stdin = subprocess.PIPE, stdout = subprocess.PIPE, stderr = subprocess.PIPE, shell = True)
123 Result = Process.communicate(input = Payload)
124 Signature = Result[0]
125 except:
126 raise ValueError ('GenerateCapsule: error: can not run openssl.')
127
128 if Process.returncode != 0:
129 print (Result[1].decode())
130 raise ValueError ('GenerateCapsule: error: openssl failed.')
131
132 return Signature
133
134 def VerifyPayloadOpenSsl (Payload, CertData, ToolPath, SignerPrivateCertFile, OtherPublicCertFile, TrustedPublicCertFile):
135 #
136 # Create a temporary directory
137 #
138 TempDirectoryName = tempfile.mkdtemp()
139
140 #
141 # Generate temp file name for the payload contents
142 #
143 TempFileName = os.path.join (TempDirectoryName, 'Payload.bin')
144
145 #
146 # Create temporary payload file for verification
147 #
148 try:
149 File = open (TempFileName, mode='wb')
150 File.write (Payload)
151 File.close ()
152 except:
153 shutil.rmtree (TempDirectoryName)
154 raise ValueError ('GenerateCapsule: error: can not write temporary payload file.')
155
156 #
157 # Build openssl command
158 #
159 if ToolPath is None:
160 ToolPath = ''
161 Command = ''
162 Command = Command + '"{Path}" '.format (Path = os.path.join (ToolPath, 'openssl'))
163 Command = Command + 'smime -verify -inform DER '
164 Command = Command + '-content {Content} -CAfile "{Public}"'.format (Content = TempFileName, Public = TrustedPublicCertFile)
165
166 #
167 # Verify signature
168 #
169 try:
170 Process = subprocess.Popen (Command, stdin = subprocess.PIPE, stdout = subprocess.PIPE, stderr = subprocess.PIPE, shell = True)
171 Result = Process.communicate(input = CertData)
172 except:
173 shutil.rmtree (TempDirectoryName)
174 raise ValueError ('GenerateCapsule: error: can not run openssl.')
175
176 if Process.returncode != 0:
177 shutil.rmtree (TempDirectoryName)
178 print (Result[1].decode())
179 raise ValueError ('GenerateCapsule: error: openssl failed.')
180
181 shutil.rmtree (TempDirectoryName)
182 return Payload
183
184 if __name__ == '__main__':
185 def convert_arg_line_to_args(arg_line):
186 for arg in arg_line.split():
187 if not arg.strip():
188 continue
189 yield arg
190
191 def ValidateUnsignedInteger (Argument):
192 try:
193 Value = int (Argument, 0)
194 except:
195 Message = '{Argument} is not a valid integer value.'.format (Argument = Argument)
196 raise argparse.ArgumentTypeError (Message)
197 if Value < 0:
198 Message = '{Argument} is a negative value.'.format (Argument = Argument)
199 raise argparse.ArgumentTypeError (Message)
200 return Value
201
202 def ValidateRegistryFormatGuid (Argument):
203 try:
204 Value = uuid.UUID (Argument)
205 except:
206 Message = '{Argument} is not a valid registry format GUID value.'.format (Argument = Argument)
207 raise argparse.ArgumentTypeError (Message)
208 return Value
209
210 #
211 # Create command line argument parser object
212 #
213 parser = argparse.ArgumentParser (
214 prog = __prog__,
215 description = __description__ + __copyright__,
216 conflict_handler = 'resolve',
217 fromfile_prefix_chars = '@'
218 )
219 parser.convert_arg_line_to_args = convert_arg_line_to_args
220
221 #
222 # Add input and output file arguments
223 #
224 parser.add_argument("InputFile", type = argparse.FileType('rb'),
225 help = "Input binary payload filename.")
226 parser.add_argument("-o", "--output", dest = 'OutputFile', type = argparse.FileType('wb'),
227 help = "Output filename.")
228 #
229 # Add group for -e and -d flags that are mutually exclusive and required
230 #
231 group = parser.add_mutually_exclusive_group (required = True)
232 group.add_argument ("-e", "--encode", dest = 'Encode', action = "store_true",
233 help = "Encode file")
234 group.add_argument ("-d", "--decode", dest = 'Decode', action = "store_true",
235 help = "Decode file")
236 group.add_argument ("--dump-info", dest = 'DumpInfo', action = "store_true",
237 help = "Display FMP Payload Header information")
238 #
239 # Add optional arguments for this command
240 #
241 parser.add_argument ("--capflag", dest = 'CapsuleFlag', action='append', default = [],
242 choices=['PersistAcrossReset', 'InitiateReset'],
243 help = "Capsule flag can be PersistAcrossReset or InitiateReset or not set")
244 parser.add_argument ("--capoemflag", dest = 'CapsuleOemFlag', type = ValidateUnsignedInteger, default = 0x0000,
245 help = "Capsule OEM Flag is an integer between 0x0000 and 0xffff.")
246
247 parser.add_argument ("--guid", dest = 'Guid', type = ValidateRegistryFormatGuid,
248 help = "The FMP/ESRT GUID in registry format. Required for encode operations.")
249 parser.add_argument ("--hardware-instance", dest = 'HardwareInstance', type = ValidateUnsignedInteger, default = 0x0000000000000000,
250 help = "The 64-bit hardware instance. The default is 0x0000000000000000")
251
252
253 parser.add_argument ("--monotonic-count", dest = 'MonotonicCount', type = ValidateUnsignedInteger, default = 0x0000000000000000,
254 help = "64-bit monotonic count value in header. Default is 0x0000000000000000.")
255
256 parser.add_argument ("--fw-version", dest = 'FwVersion', type = ValidateUnsignedInteger,
257 help = "The 32-bit version of the binary payload (e.g. 0x11223344 or 5678).")
258 parser.add_argument ("--lsv", dest = 'LowestSupportedVersion', type = ValidateUnsignedInteger,
259 help = "The 32-bit lowest supported version of the binary payload (e.g. 0x11223344 or 5678).")
260
261 parser.add_argument ("--pfx-file", dest='SignToolPfxFile', type=argparse.FileType('rb'),
262 help="signtool PFX certificate filename.")
263
264 parser.add_argument ("--signer-private-cert", dest='OpenSslSignerPrivateCertFile', type=argparse.FileType('rb'),
265 help="OpenSSL signer private certificate filename.")
266 parser.add_argument ("--other-public-cert", dest='OpenSslOtherPublicCertFile', type=argparse.FileType('rb'),
267 help="OpenSSL other public certificate filename.")
268 parser.add_argument ("--trusted-public-cert", dest='OpenSslTrustedPublicCertFile', type=argparse.FileType('rb'),
269 help="OpenSSL trusted public certificate filename.")
270
271 parser.add_argument ("--signing-tool-path", dest = 'SigningToolPath',
272 help = "Path to signtool or OpenSSL tool. Optional if path to tools are already in PATH.")
273
274 #
275 # Add optional arguments common to all operations
276 #
277 parser.add_argument ('--version', action='version', version='%(prog)s ' + __version__)
278 parser.add_argument ("-v", "--verbose", dest = 'Verbose', action = "store_true",
279 help = "Turn on verbose output with informational messages printed, including capsule headers and warning messages.")
280 parser.add_argument ("-q", "--quiet", dest = 'Quiet', action = "store_true",
281 help = "Disable all messages except fatal errors.")
282 parser.add_argument ("--debug", dest = 'Debug', type = int, metavar = '[0-9]', choices = range (0, 10), default = 0,
283 help = "Set debug level")
284
285 #
286 # Parse command line arguments
287 #
288 args = parser.parse_args()
289
290 #
291 # Perform additional argument verification
292 #
293 if args.Encode:
294 if args.Guid is None:
295 parser.error ('the following option is required: --guid')
296 if 'PersistAcrossReset' not in args.CapsuleFlag:
297 if 'InitiateReset' in args.CapsuleFlag:
298 parser.error ('--capflag InitiateReset also requires --capflag PersistAcrossReset')
299 if args.CapsuleOemFlag > 0xFFFF:
300 parser.error ('--capoemflag must be an integer between 0x0000 and 0xffff')
301 if args.HardwareInstance > 0xFFFFFFFFFFFFFFFF:
302 parser.error ('--hardware-instance must be an integer in range 0x0..0xffffffffffffffff')
303 if args.MonotonicCount > 0xFFFFFFFFFFFFFFFF:
304 parser.error ('--monotonic-count must be an integer in range 0x0..0xffffffffffffffff')
305
306 UseSignTool = args.SignToolPfxFile is not None
307 UseOpenSsl = (args.OpenSslSignerPrivateCertFile is not None and
308 args.OpenSslOtherPublicCertFile is not None and
309 args.OpenSslTrustedPublicCertFile is not None)
310 AnyOpenSsl = (args.OpenSslSignerPrivateCertFile is not None or
311 args.OpenSslOtherPublicCertFile is not None or
312 args.OpenSslTrustedPublicCertFile is not None)
313 if args.Encode or args.Decode:
314 if args.OutputFile is None:
315 parser.error ('the following option is required for all encode and decode operations: --output')
316
317 if UseSignTool and AnyOpenSsl:
318 parser.error ('Providing both signtool and OpenSSL options is not supported')
319 if not UseSignTool and not UseOpenSsl and AnyOpenSsl:
320 parser.error ('all the following options are required for OpenSSL: --signer-private-cert, --other-public-cert, --trusted-public-cert')
321 if UseSignTool and platform.system() != 'Windows':
322 parser.error ('Use of signtool is not supported on this operating system.')
323 if args.Encode and (UseSignTool or UseOpenSsl):
324 if args.FwVersion is None or args.LowestSupportedVersion is None:
325 parser.error ('the following options are required: --fw-version, --lsv')
326 if args.FwVersion > 0xFFFFFFFF:
327 parser.error ('--fw-version must be an integer in range 0x0..0xffffffff')
328 if args.LowestSupportedVersion > 0xFFFFFFFF:
329 parser.error ('--lsv must be an integer in range 0x0..0xffffffff')
330
331 if UseSignTool:
332 args.SignToolPfxFile.close()
333 args.SignToolPfxFile = args.SignToolPfxFile.name
334 if UseOpenSsl:
335 args.OpenSslSignerPrivateCertFile.close()
336 args.OpenSslOtherPublicCertFile.close()
337 args.OpenSslTrustedPublicCertFile.close()
338 args.OpenSslSignerPrivateCertFile = args.OpenSslSignerPrivateCertFile.name
339 args.OpenSslOtherPublicCertFile = args.OpenSslOtherPublicCertFile.name
340 args.OpenSslTrustedPublicCertFile = args.OpenSslTrustedPublicCertFile.name
341
342 #
343 # Read binary input file
344 #
345 try:
346 if args.Verbose:
347 print ('Read binary input file {File}'.format (File = args.InputFile.name))
348 Buffer = args.InputFile.read ()
349 args.InputFile.close ()
350 except:
351 print ('GenerateCapsule: error: can not read binary input file {File}'.format (File = args.InputFile.name))
352 sys.exit (1)
353
354 #
355 # Create objects
356 #
357 UefiCapsuleHeader = UefiCapsuleHeaderClass ()
358 FmpCapsuleHeader = FmpCapsuleHeaderClass ()
359 FmpAuthHeader = FmpAuthHeaderClass ()
360 FmpPayloadHeader = FmpPayloadHeaderClass ()
361
362 if args.Encode:
363 Result = Buffer
364 if UseSignTool or UseOpenSsl:
365 try:
366 FmpPayloadHeader.FwVersion = args.FwVersion
367 FmpPayloadHeader.LowestSupportedVersion = args.LowestSupportedVersion
368 FmpPayloadHeader.Payload = Result
369 Result = FmpPayloadHeader.Encode ()
370 if args.Verbose:
371 FmpPayloadHeader.DumpInfo ()
372 except:
373 print ('GenerateCapsule: error: can not encode FMP Payload Header')
374 sys.exit (1)
375
376 #
377 # Sign image with 64-bit MonotonicCount appended to end of image
378 #
379 try:
380 if UseSignTool:
381 CertData = SignPayloadSignTool (
382 Result + struct.pack ('<Q', args.MonotonicCount),
383 args.SigningToolPath,
384 args.SignToolPfxFile
385 )
386 else:
387 CertData = SignPayloadOpenSsl (
388 Result + struct.pack ('<Q', args.MonotonicCount),
389 args.SigningToolPath,
390 args.OpenSslSignerPrivateCertFile,
391 args.OpenSslOtherPublicCertFile,
392 args.OpenSslTrustedPublicCertFile
393 )
394 except:
395 print ('GenerateCapsule: error: can not sign payload')
396 raise
397 sys.exit (1)
398
399 try:
400 FmpAuthHeader.MonotonicCount = args.MonotonicCount
401 FmpAuthHeader.CertData = CertData
402 FmpAuthHeader.Payload = Result
403 Result = FmpAuthHeader.Encode ()
404 if args.Verbose:
405 FmpAuthHeader.DumpInfo ()
406 except:
407 print ('GenerateCapsule: error: can not encode FMP Auth Header')
408 sys.exit (1)
409
410 try:
411 FmpCapsuleHeader.AddPayload (args.Guid, Result, HardwareInstance = args.HardwareInstance)
412 Result = FmpCapsuleHeader.Encode ()
413 if args.Verbose:
414 FmpCapsuleHeader.DumpInfo ()
415 except:
416 print ('GenerateCapsule: error: can not encode FMP Capsule Header')
417 sys.exit (1)
418
419 try:
420 UefiCapsuleHeader.OemFlags = args.CapsuleOemFlag
421 UefiCapsuleHeader.PersistAcrossReset = 'PersistAcrossReset' in args.CapsuleFlag
422 UefiCapsuleHeader.PopulateSystemTable = False
423 UefiCapsuleHeader.InitiateReset = 'InitiateReset' in args.CapsuleFlag
424 UefiCapsuleHeader.Payload = Result
425 Result = UefiCapsuleHeader.Encode ()
426 if args.Verbose:
427 UefiCapsuleHeader.DumpInfo ()
428 except:
429 print ('GenerateCapsule: error: can not encode UEFI Capsule Header')
430 sys.exit (1)
431
432 elif args.Decode:
433 try:
434 Result = UefiCapsuleHeader.Decode (Buffer)
435 FmpCapsuleHeader.Decode (Result)
436 Result = FmpCapsuleHeader.GetFmpCapsuleImageHeader (0).Payload
437 if args.Verbose:
438 print ('========')
439 UefiCapsuleHeader.DumpInfo ()
440 print ('--------')
441 FmpCapsuleHeader.DumpInfo ()
442 if UseSignTool or UseOpenSsl:
443 Result = FmpAuthHeader.Decode (Result)
444
445 #
446 # Verify Image with 64-bit MonotonicCount appended to end of image
447 #
448 try:
449 if UseSignTool:
450 CertData = VerifyPayloadSignTool (
451 FmpAuthHeader.Payload + struct.pack ('<Q', FmpAuthHeader.MonotonicCount),
452 FmpAuthHeader.CertData,
453 args.SigningToolPath,
454 args.SignToolPfxFile
455 )
456 else:
457 CertData = VerifyPayloadOpenSsl (
458 FmpAuthHeader.Payload + struct.pack ('<Q', FmpAuthHeader.MonotonicCount),
459 FmpAuthHeader.CertData,
460 args.SigningToolPath,
461 args.OpenSslSignerPrivateCertFile,
462 args.OpenSslOtherPublicCertFile,
463 args.OpenSslTrustedPublicCertFile
464 )
465 except ValueError:
466 print ('GenerateCapsule: warning: can not verify payload.')
467
468 Result = FmpPayloadHeader.Decode (Result)
469 if args.Verbose:
470 print ('--------')
471 FmpAuthHeader.DumpInfo ()
472 print ('--------')
473 FmpPayloadHeader.DumpInfo ()
474 else:
475 if args.Verbose:
476 print ('--------')
477 print ('No EFI_FIRMWARE_IMAGE_AUTHENTICATION')
478 print ('--------')
479 print ('No FMP_PAYLOAD_HEADER')
480 if args.Verbose:
481 print ('========')
482 except:
483 print ('GenerateCapsule: error: can not decode capsule')
484 raise
485 sys.exit (1)
486
487 elif args.DumpInfo:
488 try:
489 Result = UefiCapsuleHeader.Decode (Buffer)
490 FmpCapsuleHeader.Decode (Result)
491 Result = FmpCapsuleHeader.GetFmpCapsuleImageHeader (0).Payload
492 print ('========')
493 UefiCapsuleHeader.DumpInfo ()
494 print ('--------')
495 FmpCapsuleHeader.DumpInfo ()
496 try:
497 Result = FmpAuthHeader.Decode (Result)
498 Result = FmpPayloadHeader.Decode (Result)
499 print ('--------')
500 FmpAuthHeader.DumpInfo ()
501 print ('--------')
502 FmpPayloadHeader.DumpInfo ()
503 except:
504 print ('--------')
505 print ('No EFI_FIRMWARE_IMAGE_AUTHENTICATION')
506 print ('--------')
507 print ('No FMP_PAYLOAD_HEADER')
508 print ('========')
509 except:
510 print ('GenerateCapsule: error: can not decode capsule')
511 sys.exit (1)
512 else:
513 print('GenerateCapsule: error: invalid options')
514 sys.exit (1)
515
516 #
517 # Write binary output file
518 #
519 if args.OutputFile is not None:
520 try:
521 if args.Verbose:
522 print ('Write binary output file {File}'.format (File = args.OutputFile.name))
523 args.OutputFile.write (Result)
524 args.OutputFile.close ()
525 except:
526 print ('GenerateCapsule: error: can not write binary output file {File}'.format (File = args.OutputFile.name))
527 sys.exit (1)
528
529 if args.Verbose:
530 print('Success')