1#!/bin/bash 2# 3# Copyright (c) 2022 Rockchip Electronics Co., Ltd 4# 5# SPDX-License-Identifier: GPL-2.0 6# 7set -e 8 9FIT_DIR="fit" 10IMG_UBOOT="uboot.img" 11IMG_BOOT="boot.img" 12IMG_RECOVERY="recovery.img" 13ITB_UBOOT="${FIT_DIR}/uboot.itb" 14ITB_BOOT="${FIT_DIR}/boot.itb" 15ITB_RECOVERY="${FIT_DIR}/recovery.itb" 16SIG_BIN="data2sign.bin" 17SIG_UBOOT="${FIT_DIR}/uboot.data2sign" 18SIG_BOOT="${FIT_DIR}/boot.data2sign" 19SIG_RECOVERY="${FIT_DIR}/recovery.data2sign" 20SIG_CFG_DIR="${FIT_DIR}/fit_signcfg" 21SIG_CONFIG="${SIG_CFG_DIR}/sign.readonly_config" 22MINIALL_INI="${SIG_CFG_DIR}/MINIALL.ini" 23# offs 24OFFS_DATA="0x1200" 25# placeholder address 26FDT_ADDR_PLACEHOLDER="0xffffff00" 27KERNEL_ADDR_PLACEHOLDER="0xffffff01" 28RAMDISK_ADDR_PLACEHOLDER="0xffffff02" 29# tools 30MKIMAGE="./tools/mkimage" 31RK_SIGN_TOOL="../rkbin/tools/rk_sign_tool" 32FIT_UNPACK="./scripts/fit-unpack.sh" 33CHECK_SIGN="./tools/fit_check_sign" 34# key 35KEY_DIR="keys/" 36RSA_PRI_KEY="keys/dev.key" 37RSA_PUB_KEY="keys/dev.pubkey" 38RSA_CRT_KEY="keys/dev.crt" 39SIGNATURE_KEY_NODE="/signature/key-dev" 40SPL_DTB="spl/u-boot-spl.dtb" 41UBOOT_DTB="u-boot.dtb" 42# its 43ITS_UBOOT="u-boot.its" 44ITS_BOOT="boot.its" 45ITS_RECOVERY="recovery.its" 46ARG_VER_UBOOT="0" 47ARG_VER_BOOT="0" 48ARG_VER_RECOVERY="0" 49 50function help() 51{ 52 echo 53 echo "usage:" 54 echo " $0 [args]" 55 echo 56 echo "args:" 57 echo " --rollback-index-recovery <decimal integer>" 58 echo " --rollback-index-boot <decimal integer>" 59 echo " --rollback-index-uboot <decimal integer>" 60 echo " --version-recovery <decimal integer>" 61 echo " --version-boot <decimal integer>" 62 echo " --version-uboot <decimal integer>" 63 echo " --boot_img <boot image>" 64 echo " --recovery_img <recovery image>" 65 echo " --args <arg>" 66 echo " --ini-loader <loader ini file>" 67 echo " --ini-trust <trust ini file>" 68 echo " --no-check" 69 echo " --no-sign" 70 echo " --spl-new" 71 echo 72} 73 74function arg_check_decimal() 75{ 76 if [ -z $1 ]; then 77 help 78 exit 1 79 fi 80 81 decimal=`echo $1 |sed 's/[0-9]//g'` 82 if [ ! -z ${decimal} ]; then 83 echo "ERROR: $1 is not decimal integer" 84 help 85 exit 1 86 fi 87} 88 89function check_its() 90{ 91 cat $1 | while read line 92 do 93 file=`echo ${line} | sed -n "/incbin/p" | awk -F '"' '{ printf $2 }' | tr -d ' '` 94 if [ ! -f ${file} ]; then 95 echo "ERROR: No ${file}" 96 exit 1 97 fi 98 done 99} 100 101function check_rsa_algo() 102{ 103 if grep -q '^CONFIG_FIT_ENABLE_RSA4096_SUPPORT=y' .config ; then 104 rsa_algo="rsa4096" 105 else 106 rsa_algo="rsa2048" 107 fi 108 if ! grep -qr ${rsa_algo} $1 ; then 109 echo "ERROR: Wrong rsa_algo in its file. It should be ${rsa_algo}." 110 exit 1 111 fi 112} 113 114function check_rsa_keys() 115{ 116 if [ ! -f ${RSA_PRI_KEY} ]; then 117 echo "ERROR: No ${RSA_PRI_KEY} " 118 exit 1 119 elif [ ! -f ${RSA_PUB_KEY} ]; then 120 echo "ERROR: No ${RSA_PUB_KEY} " 121 exit 1 122 elif [ ! -f ${RSA_CRT_KEY} ]; then 123 echo "ERROR: No ${RSA_CRT_KEY} " 124 exit 1 125 fi 126} 127 128function validate_arg() 129{ 130 case $1 in 131 --no-check|--no-sign|--spl-new|--burn-key-hash) 132 shift=1 133 ;; 134 --ini-trust|--ini-loader|--rollback-index-boot|--rollback-index-recovery|--rollback-index-uboot|--boot_img|--recovery_img|--version-uboot|--version-boot|--version-recovery|--chip) 135 shift=2 136 ;; 137 *) 138 shift=0 139 ;; 140 esac 141 echo ${shift} 142} 143 144function fit_process_args() 145{ 146 if [ $# -eq 0 ]; then 147 help 148 exit 0 149 fi 150 151 if grep -q '^CONFIG_FIT_SIGNATURE=y' .config ; then 152 ARG_SIGN="y" 153 fi 154 155 while [ $# -gt 0 ]; do 156 case $1 in 157 --args) 158 ARG_VALIDATE=$2 159 shift 2 160 ;; 161 --boot_img) # boot.img 162 ARG_BOOT_IMG=$2 163 shift 2 164 ;; 165 --chip) 166 ARG_CHIP=$2 167 shift 2 168 ;; 169 --recovery_img) # recovery.img 170 ARG_RECOVERY_IMG=$2 171 shift 2 172 ;; 173 --boot_img_dir) # boot.img components directory 174 ARG_BOOT_IMG_DIR=$2 175 shift 2 176 ;; 177 --no-check) # No hostcc fit signature check 178 ARG_NO_CHECK="y" 179 shift 1 180 ;; 181 --no-sign) 182 ARG_NO_SIGN="y" 183 ARG_SIGN="n" 184 shift 1 185 ;; 186 --ini-trust) # Assign trust ini file 187 ARG_INI_TRUST=$2 188 shift 2 189 ;; 190 --ini-loader) # Assign loader ini file 191 ARG_INI_LOADER=$2 192 shift 2 193 ;; 194 --spl-new) # Use current build u-boot-spl.bin to pack loader 195 ARG_SPL_NEW="y" 196 shift 1 197 ;; 198 --rollback-index-boot) 199 ARG_ROLLBACK_IDX_BOOT=$2 200 arg_check_decimal $2 201 shift 2 202 ;; 203 --rollback-index-recovery) 204 ARG_ROLLBACK_IDX_RECOVERY=$2 205 arg_check_decimal $2 206 shift 2 207 ;; 208 --rollback-index-uboot) 209 ARG_ROLLBACK_IDX_UBOOT=$2 210 arg_check_decimal $2 211 shift 2 212 ;; 213 --version-uboot) 214 ARG_VER_UBOOT=$2 215 arg_check_decimal $2 216 shift 2 217 ;; 218 --version-boot) 219 ARG_VER_BOOT=$2 220 arg_check_decimal $2 221 shift 2 222 ;; 223 --version-recovery) 224 ARG_VER_RECOVERY=$2 225 arg_check_decimal $2 226 shift 2 227 ;; 228 --burn-key-hash) 229 ARG_BURN_KEY_HASH="y" 230 shift 1 231 ;; 232 --spl-fwver) 233 ARG_FIT_FWVER="${ARG_FIT_FWVER} --spl-fwver $2" 234 shift 2 235 ;; 236 --fwver) 237 ARG_FIT_FWVER="${ARG_FIT_FWVER} --fwver $2" 238 shift 2 239 ;; 240 *) 241 help 242 exit 1 243 ;; 244 esac 245 done 246} 247 248function fit_raw_compile() 249{ 250 # Verified-boot: should rebuild code but don't need to repack images. 251 if [ "${ARG_SIGN}" == "y" ]; then 252 ./make.sh --raw-compile ${ARG_FIT_FWVER} 253 fi 254 rm ${FIT_DIR} -rf && mkdir -p ${FIT_DIR} && mkdir -p ${SIG_CFG_DIR} 255} 256 257function fit_gen_uboot_itb() 258{ 259 # generate u-boot.its file 260 ./make.sh itb ${ARG_INI_TRUST} 261 262 # check existance of file in its 263 check_its ${ITS_UBOOT} 264 265 if [ "${ARG_SIGN}" != "y" ]; then 266 ${MKIMAGE} -f ${ITS_UBOOT} -E -p ${OFFS_DATA} ${ITB_UBOOT} -v ${ARG_VER_UBOOT} 267 if [ "${ARG_SPL_NEW}" == "y" ]; then 268 ./make.sh --spl ${ARG_INI_LOADER} 269 echo "pack loader with new: spl/u-boot-spl.bin" 270 else 271 ./make.sh loader ${ARG_INI_LOADER} 272 fi 273 else 274 check_rsa_keys 275 276 if ! grep -q '^CONFIG_SPL_FIT_SIGNATURE=y' .config ; then 277 echo "ERROR: CONFIG_SPL_FIT_SIGNATURE is disabled" 278 exit 1 279 fi 280 281 # rollback-index 282 if grep -q '^CONFIG_SPL_FIT_ROLLBACK_PROTECT=y' .config ; then 283 ARG_SPL_ROLLBACK_PROTECT="y" 284 if [ -z ${ARG_ROLLBACK_IDX_UBOOT} ]; then 285 echo "ERROR: No arg \"--rollback-index-uboot <n>\"" 286 exit 1 287 fi 288 fi 289 290 if [ "${ARG_SPL_ROLLBACK_PROTECT}" == "y" ]; then 291 VERSION=`grep 'rollback-index' ${ITS_UBOOT} | awk -F '=' '{ printf $2 }' | tr -d ' '` 292 sed -i "s/rollback-index = ${VERSION}/rollback-index = <${ARG_ROLLBACK_IDX_UBOOT}>;/g" ${ITS_UBOOT} 293 fi 294 295 # Generally, boot.img is signed before uboot.img, so the ras key can be found 296 # in u-boot.dtb. If not found, let's insert rsa key anyway. 297 if ! fdtget -l ${UBOOT_DTB} /signature >/dev/null 2>&1 ; then 298 ${MKIMAGE} -f ${ITS_UBOOT} -k ${KEY_DIR} -K ${UBOOT_DTB} -E -p ${OFFS_DATA} -r ${ITB_UBOOT} -v ${ARG_VER_UBOOT} 299 echo "## Adding RSA public key into ${UBOOT_DTB}" 300 fi 301 302 # Pack 303 ${MKIMAGE} -f ${ITS_UBOOT} -k ${KEY_DIR} -K ${SPL_DTB} -E -p ${OFFS_DATA} -r ${ITB_UBOOT} -v ${ARG_VER_UBOOT} 304 mv ${SIG_BIN} ${SIG_UBOOT} 305 306 # burn-key-hash 307 if [ "${ARG_BURN_KEY_HASH}" == "y" ]; then 308 if grep -q '^CONFIG_SPL_FIT_HW_CRYPTO=y' .config ; then 309 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} burn-key-hash 0x1 310 else 311 echo "ERROR: --burn-key-hash requires CONFIG_SPL_FIT_HW_CRYPTO=y" 312 exit 1 313 fi 314 fi 315 316 # rollback-index read back check 317 if [ "${ARG_SPL_ROLLBACK_PROTECT}" == "y" ]; then 318 VERSION=`fdtget -ti ${ITB_UBOOT} /configurations/conf rollback-index` 319 if [ "${VERSION}" != "${ARG_ROLLBACK_IDX_UBOOT}" ]; then 320 echo "ERROR: Failed to set rollback-index for ${ITB_UBOOT}"; 321 exit 1 322 fi 323 fi 324 325 # burn-key-hash read back check 326 if [ "${ARG_BURN_KEY_HASH}" == "y" ]; then 327 if [ "`fdtget -ti ${SPL_DTB} ${SIGNATURE_KEY_NODE} burn-key-hash`" != "1" ]; then 328 echo "ERROR: Failed to set burn-key-hash for ${SPL_DTB}"; 329 exit 1 330 fi 331 fi 332 333 # host check signature 334 if [ "${ARG_NO_CHECK}" != "y" ]; then 335 if [ "${ARG_SPL_NEW}" == "y" ]; then 336 ${CHECK_SIGN} -f ${ITB_UBOOT} -k ${SPL_DTB} -s 337 else 338 spl_file="../rkbin/"`sed -n "/FlashBoot=/s/FlashBoot=//p" ${ARG_INI_LOADER} |tr -d '\r'` 339 offs=`fdtdump -s ${spl_file} | head -1 | awk -F ":" '{ print $2 }' | sed "s/ found fdt at offset //g" | tr -d " "` 340 if [ -z ${offs} ]; then 341 echo "ERROR: invalid ${spl_file} , unable to find fdt blob" 342 fi 343 offs=`printf %d ${offs} ` # hex -> dec 344 dd if=${spl_file} of=spl/u-boot-spl-old.dtb bs=${offs} skip=1 >/dev/null 2>&1 345 ${CHECK_SIGN} -f ${ITB_UBOOT} -k spl/u-boot-spl-old.dtb -s 346 fi 347 fi 348 349 # minimize u-boot-spl.dtb: clear as 0 but not remove property. 350 if grep -q '^CONFIG_SPL_FIT_HW_CRYPTO=y' .config ; then 351 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,r-squared 0x0 352 if grep -q '^CONFIG_SPL_ROCKCHIP_CRYPTO_V1=y' .config ; then 353 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 354 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@np 355 else 356 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 357 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@c 358 fi 359 else 360 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 361 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 362 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,exponent-BN 0x0 363 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@c 364 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@np 365 fi 366 367 # repack spl 368 if [ "${ARG_SPL_NEW}" == "y" ]; then 369 cat spl/u-boot-spl-nodtb.bin > spl/u-boot-spl.bin 370 if ! grep -q '^CONFIG_SPL_SEPARATE_BSS=y' .config ; then 371 cat spl/u-boot-spl-pad.bin >> spl/u-boot-spl.bin 372 fi 373 cat ${SPL_DTB} >> spl/u-boot-spl.bin 374 375 ./make.sh --spl ${ARG_INI_LOADER} 376 echo "## pack loader with new: spl/u-boot-spl.bin" 377 else 378 ./make.sh loader ${ARG_INI_LOADER} 379 fi 380 381 if [ "${ARG_BURN_KEY_HASH}" == "y" ]; then 382 echo "## ${SPL_DTB}: burn-key-hash=1" 383 fi 384 fi 385 386 rm -f u-boot.itb u-boot.img u-boot-dtb.img 387 mv ${ITS_UBOOT} ${FIT_DIR} 388} 389 390function fit_gen_boot_itb() 391{ 392 if [ ! -z ${ARG_BOOT_IMG} ]; then 393 ${FIT_UNPACK} -f ${ARG_BOOT_IMG} -o ${FIT_DIR}/unpack 394 ITS_BOOT="${FIT_DIR}/unpack/image.its" 395 else 396 compression=`awk -F"," '/COMPRESSION=/ { printf $1 }' ${ARG_INI_TRUST} | tr -d ' ' | cut -c 13-` 397 if [ -z "${compression}" ]; then 398 compression="none" 399 fi 400 ./arch/arm/mach-rockchip/make_fit_boot.sh -c ${compression} > ${ITS_BOOT} 401 check_its ${ITS_BOOT} 402 fi 403 404 if [ "${ARG_SIGN}" != "y" ]; then 405 ${MKIMAGE} -f ${ITS_BOOT} -E -p ${OFFS_DATA} ${ITB_BOOT} -v ${ARG_VER_BOOT} 406 else 407 check_rsa_keys 408 409 check_rsa_algo ${ITS_BOOT} 410 411 if [ "${ARG_SIGN}" != "y" ]; then 412 echo "ERROR: CONFIG_FIT_SIGNATURE is disabled" 413 exit 1 414 fi 415 416 if grep -q '^CONFIG_FIT_ROLLBACK_PROTECT=y' .config ; then 417 ARG_ROLLBACK_PROTECT="y" 418 if [ -z ${ARG_ROLLBACK_IDX_BOOT} ]; then 419 echo "ERROR: No arg \"--rollback-index-boot <n>\"" 420 exit 1 421 fi 422 if ! grep -q '^CONFIG_OPTEE_CLIENT=y' .config ; then 423 echo "ERROR: Don't support \"--rollback-index-boot <n>\"" 424 exit 1 425 fi 426 fi 427 428 # fixup 429 FDT_ADDR_R=`strings env/built-in.o | grep 'fdt_addr_r=' | awk -F "=" '{ print $2 }'` 430 KERNEL_ADDR_R=`strings env/built-in.o | grep 'kernel_addr_r=' | awk -F "=" '{ print $2 }'` 431 RMADISK_ADDR_R=`strings env/built-in.o | grep 'ramdisk_addr_r=' | awk -F "=" '{ print $2 }'` 432 sed -i "s/${FDT_ADDR_PLACEHOLDER}/${FDT_ADDR_R}/g" ${ITS_BOOT} 433 sed -i "s/${KERNEL_ADDR_PLACEHOLDER}/${KERNEL_ADDR_R}/g" ${ITS_BOOT} 434 sed -i "s/${RAMDISK_ADDR_PLACEHOLDER}/${RMADISK_ADDR_R}/g" ${ITS_BOOT} 435 if grep -q '^CONFIG_ARM64=y' .config ; then 436 sed -i 's/arch = "arm";/arch = "arm64";/g' ${ITS_BOOT} 437 fi 438 439 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 440 VERSION=`grep 'rollback-index' ${ITS_BOOT} | awk -F '=' '{ printf $2 }' | tr -d ' '` 441 sed -i "s/rollback-index = ${VERSION}/rollback-index = <${ARG_ROLLBACK_IDX_BOOT}>;/g" ${ITS_BOOT} 442 fi 443 444 ${MKIMAGE} -f ${ITS_BOOT} -k ${KEY_DIR} -K ${UBOOT_DTB} -E -p ${OFFS_DATA} -r ${ITB_BOOT} -v ${ARG_VER_BOOT} 445 mv ${SIG_BIN} ${SIG_BOOT} 446 447 # rollback-index read back check 448 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 449 VERSION=`fdtget -ti ${ITB_BOOT} /configurations/conf rollback-index` 450 if [ "${VERSION}" != "${ARG_ROLLBACK_IDX_BOOT}" ]; then 451 echo "ERROR: Failed to set rollback-index for ${ITB_BOOT}"; 452 exit 1 453 fi 454 fi 455 456 # host check signature 457 if [ "${ARG_NO_CHECK}" != "y" ]; then 458 ${CHECK_SIGN} -f ${ITB_BOOT} -k ${UBOOT_DTB} 459 fi 460 461 # minimize u-boot.dtb: clearn as 0 but not remove property. 462 if grep -q '^CONFIG_FIT_HW_CRYPTO=y' .config ; then 463 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,r-squared 0x0 464 if grep -q '^CONFIG_ROCKCHIP_CRYPTO_V1=y' .config ; then 465 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 466 else 467 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 468 fi 469 else 470 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 471 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 472 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,exponent-BN 0x0 473 fi 474 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@c 475 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@np 476 fi 477 478 mv ${ITS_BOOT} ${FIT_DIR} 479} 480 481function fit_gen_recovery_itb() 482{ 483 if [ ! -z ${ARG_RECOVERY_IMG} ]; then 484 ${FIT_UNPACK} -f ${ARG_RECOVERY_IMG} -o ${FIT_DIR}/unpack 485 ITS_RECOVERY="${FIT_DIR}/unpack/image.its" 486 else 487 echo "ERROR: No recovery.img" 488 exit 1 489 fi 490 491 if [ "${ARG_SIGN}" != "y" ]; then 492 ${MKIMAGE} -f ${ITS_RECOVERY} -E -p ${OFFS_DATA} ${ITB_RECOVERY} -v ${ARG_VER_RECOVERY} 493 else 494 check_rsa_keys 495 496 check_rsa_algo ${ITS_RECOVERY} 497 498 if [ "${ARG_SIGN}" != "y" ]; then 499 echo "ERROR: CONFIG_FIT_SIGNATURE is disabled" 500 exit 1 501 fi 502 503 if grep -q '^CONFIG_FIT_ROLLBACK_PROTECT=y' .config ; then 504 ARG_ROLLBACK_PROTECT="y" 505 if [ -z ${ARG_ROLLBACK_IDX_RECOVERY} ]; then 506 echo "ERROR: No arg \"--rollback-index-recovery <n>\"" 507 exit 1 508 fi 509 if ! grep -q '^CONFIG_OPTEE_CLIENT=y' .config ; then 510 echo "ERROR: Don't support \"--rollback-index-recovery <n>\"" 511 exit 1 512 fi 513 fi 514 515 # fixup 516 FDT_ADDR_R=`strings env/built-in.o | grep 'fdt_addr_r=' | awk -F "=" '{ print $2 }'` 517 KERNEL_ADDR_R=`strings env/built-in.o | grep 'kernel_addr_r=' | awk -F "=" '{ print $2 }'` 518 RMADISK_ADDR_R=`strings env/built-in.o | grep 'ramdisk_addr_r=' | awk -F "=" '{ print $2 }'` 519 sed -i "s/${FDT_ADDR_PLACEHOLDER}/${FDT_ADDR_R}/g" ${ITS_RECOVERY} 520 sed -i "s/${KERNEL_ADDR_PLACEHOLDER}/${KERNEL_ADDR_R}/g" ${ITS_RECOVERY} 521 sed -i "s/${RAMDISK_ADDR_PLACEHOLDER}/${RMADISK_ADDR_R}/g" ${ITS_RECOVERY} 522 if grep -q '^CONFIG_ARM64=y' .config ; then 523 sed -i 's/arch = "arm";/arch = "arm64";/g' ${ITS_RECOVERY} 524 fi 525 526 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 527 VERSION=`grep 'rollback-index' ${ITS_RECOVERY} | awk -F '=' '{ printf $2 }' | tr -d ' '` 528 sed -i "s/rollback-index = ${VERSION}/rollback-index = <${ARG_ROLLBACK_IDX_RECOVERY}>;/g" ${ITS_RECOVERY} 529 fi 530 531 ${MKIMAGE} -f ${ITS_RECOVERY} -k ${KEY_DIR} -K ${UBOOT_DTB} -E -p ${OFFS_DATA} -r ${ITB_RECOVERY} -v ${ARG_VER_RECOVERY} 532 mv ${SIG_BIN} ${SIG_RECOVERY} 533 534 # rollback-index read back check 535 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 536 VERSION=`fdtget -ti ${ITB_RECOVERY} /configurations/conf rollback-index` 537 if [ "${VERSION}" != "${ARG_ROLLBACK_IDX_RECOVERY}" ]; then 538 echo "ERROR: Failed to set rollback-index for ${ITB_RECOVERY}"; 539 exit 1 540 fi 541 fi 542 543 # host check signature 544 if [ "${ARG_NO_CHECK}" != "y" ]; then 545 ${CHECK_SIGN} -f ${ITB_RECOVERY} -k ${UBOOT_DTB} 546 fi 547 548 # minimize u-boot.dtb: clearn as 0 but not remove property. 549 if grep -q '^CONFIG_FIT_HW_CRYPTO=y' .config ; then 550 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,r-squared 0x0 551 if grep -q '^CONFIG_ROCKCHIP_CRYPTO_V1=y' .config ; then 552 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 553 else 554 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 555 fi 556 else 557 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 558 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 559 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,exponent-BN 0x0 560 fi 561 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@c 562 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@np 563 fi 564 565 mv ${ITS_RECOVERY} ${FIT_DIR} 566} 567 568function fit_gen_uboot_img() 569{ 570 ITB=$1 571 572 if [ -z ${ITB} ]; then 573 ITB=${ITB_UBOOT} 574 fi 575 576 ITB_MAX_NUM=`sed -n "/SPL_FIT_IMAGE_MULTIPLE/p" .config | awk -F "=" '{ print $2 }'` 577 ITB_MAX_KB=`sed -n "/SPL_FIT_IMAGE_KB/p" .config | awk -F "=" '{ print $2 }'` 578 ITB_MAX_BS=$((ITB_MAX_KB*1024)) 579 ITB_BS=`ls -l ${ITB} | awk '{ print $5 }'` 580 581 if [ ${ITB_BS} -gt ${ITB_MAX_BS} ]; then 582 echo "ERROR: pack ${IMG_UBOOT} failed! ${ITB} actual: ${ITB_BS} bytes, max limit: ${ITB_MAX_BS} bytes" 583 exit 1 584 fi 585 586 rm -f ${IMG_UBOOT} 587 for ((i = 0; i < ${ITB_MAX_NUM}; i++)); 588 do 589 cat ${ITB} >> ${IMG_UBOOT} 590 truncate -s %${ITB_MAX_KB}K ${IMG_UBOOT} 591 done 592} 593 594function fit_gen_boot_img() 595{ 596 ITB=$1 597 598 if [ -z ${ITB} ]; then 599 ITB=${ITB_BOOT} 600 fi 601 602 if [ "${ITB}" != "${IMG_BOOT}" ]; then 603 cp ${ITB} ${IMG_BOOT} -f 604 fi 605} 606 607function fit_gen_recovery_img() 608{ 609 ITB=$1 610 611 if [ -z ${ITB} ]; then 612 ITB=${ITB_RECOVERY} 613 fi 614 615 if [ "${ITB}" != "${IMG_RECOVERY}" ]; then 616 cp ${ITB} ${IMG_RECOVERY} -f 617 fi 618} 619 620function fit_gen_loader() 621{ 622 if [ "${ARG_SIGN}" == "y" ]; then 623 ${RK_SIGN_TOOL} cc --chip ${ARG_CHIP: 2: 6} 624 ${RK_SIGN_TOOL} lk --key ${RSA_PRI_KEY} --pubkey ${RSA_PUB_KEY} 625 if ls *loader*.bin >/dev/null 2>&1 ; then 626 ${RK_SIGN_TOOL} sl --loader *loader*.bin 627 fi 628 if ls *download*.bin >/dev/null 2>&1 ; then 629 ${RK_SIGN_TOOL} sl --loader *download*.bin 630 fi 631 if ls *idblock*.img >/dev/null 2>&1 ; then 632 ${RK_SIGN_TOOL} sb --idb *idblock*.img 633 fi 634 fi 635} 636 637function fit_msg_uboot() 638{ 639 if [ "${ARG_SIGN}" != "y" ]; then 640 MSG_SIGN="no-signed" 641 else 642 MSG_SIGN="signed" 643 fi 644 645 VERSION=`fdtget -ti ${ITB_UBOOT} / version` 646 if [ "${VERSION}" != "" ]; then 647 MSG_VER=", version=${VERSION}" 648 fi 649 650 if [ "${ARG_SPL_ROLLBACK_PROTECT}" == "y" ]; then 651 echo "Image(${MSG_SIGN}${MSG_VER}, rollback-index=${ARG_ROLLBACK_IDX_UBOOT}): ${IMG_UBOOT} (with uboot, trust...) is ready" 652 else 653 echo "Image(${MSG_SIGN}${MSG_VER}): ${IMG_UBOOT} (FIT with uboot, trust...) is ready" 654 fi 655} 656 657function fit_msg_boot() 658{ 659 if [ -z "${ARG_BOOT_IMG}" ]; then 660 return; 661 fi 662 663 if [ "${ARG_SIGN}" != "y" ]; then 664 MSG_SIGN="no-signed" 665 else 666 MSG_SIGN="signed" 667 fi 668 669 VERSION=`fdtget -ti ${ITB_BOOT} / version` 670 if [ "${VERSION}" != "" ]; then 671 MSG_VER=", version=${VERSION}" 672 fi 673 674 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 675 echo "Image(${MSG_SIGN}${MSG_VER}, rollback-index=${ARG_ROLLBACK_IDX_BOOT}): ${IMG_BOOT} is ready" 676 else 677 echo "Image(${MSG_SIGN}${MSG_VER}): ${IMG_BOOT} (FIT with kernel, fdt, resource...) is ready" 678 fi 679} 680 681function fit_msg_recovery() 682{ 683 if [ -z "${ARG_RECOVERY_IMG}" ]; then 684 return; 685 fi 686 687 if [ "${ARG_SIGN}" != "y" ]; then 688 MSG_SIGN="no-signed" 689 else 690 MSG_SIGN="signed" 691 fi 692 693 VERSION=`fdtget -ti ${ITB_RECOVERY} / version` 694 if [ "${VERSION}" != "" ]; then 695 MSG_VER=", version=${VERSION}" 696 fi 697 698 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 699 echo "Image(${MSG_SIGN}${MSG_VER}, rollback-index=${ARG_ROLLBACK_IDX_RECOVERY}): ${IMG_RECOVERY} is ready" 700 else 701 echo "Image(${MSG_SIGN}${MSG_VER}): ${IMG_RECOVERY} (FIT with kernel, fdt, resource...) is ready" 702 fi 703} 704 705function fit_msg_loader() 706{ 707 if ls *loader*.bin >/dev/null 2>&1 ; then 708 LOADER=`ls *loader*.bin` 709 fi 710 711 if ls *idblock*.img >/dev/null 2>&1 ; then 712 LOADER=`ls *idblock*.img` 713 fi 714 715 if [ "${ARG_SIGN}" == "y" ]; then 716 echo "Image(signed): ${LOADER} (with spl, ddr...) is ready" 717 else 718 echo "Image(no-signed): ${LOADER} (with spl, ddr...) is ready" 719 fi 720} 721 722function fit_msg_u_boot_loader() 723{ 724 if ls *loader*.bin >/dev/null 2>&1 ; then 725 LOADER=`ls *loader*.bin` 726 fi 727 728 if ls *idblock*.img >/dev/null 2>&1 ; then 729 LOADER=`ls *idblock*.img` 730 fi 731 732 if [ "${ARG_SIGN}" == "y" ]; then 733 echo "Image(signed): ${LOADER} (with u-boot, ddr...) is ready" 734 else 735 echo "Image(no-signed): ${LOADER} (with u-boot, ddr...) is ready" 736 fi 737} 738 739function fit_signcfg_export() 740{ 741 if [ "${ARG_NO_SIGN}" == "y" ]; then 742 if ls *loader*.bin >/dev/null 2>&1 ; then 743 LOADER=`ls *loader*.bin` 744 elif ls *download*.bin >/dev/null 2>&1 ; then 745 LOADER=`ls *download*.bin` 746 else 747 echo "ERROR: No loader found" 748 exit 1 749 fi 750 cp ${ARG_INI_LOADER} ${MINIALL_INI} 751 cp .config ${SIG_CONFIG} 752 753 mkdir -p ${SIG_CFG_DIR}/test_images/ 754 cp uboot.img ${SIG_CFG_DIR}/test_images/ 755 cp ${LOADER} ${SIG_CFG_DIR}/test_images/ 756 tar zcvf ${SIG_CFG_DIR}/test_images.tar.gz ${SIG_CFG_DIR}/test_images >/dev/null 2>&1 757 rm -rf ${SIG_CFG_DIR}/test_images/ 758 759 FDT_ADDR_R=`strings env/built-in.o | grep 'fdt_addr_r=' | awk -F "=" '{ print $2 }'` 760 KERNEL_ADDR_R=`strings env/built-in.o | grep 'kernel_addr_r=' | awk -F "=" '{ print $2 }'` 761 RMADISK_ADDR_R=`strings env/built-in.o | grep 'ramdisk_addr_r=' | awk -F "=" '{ print $2 }'` 762 echo "fdt_addr_r=${FDT_ADDR_R}" >> ${SIG_CONFIG} 763 echo "kernel_addr_r=${KERNEL_ADDR_R}" >> ${SIG_CONFIG} 764 echo "ramdisk_addr_r=${RMADISK_ADDR_R}" >> ${SIG_CONFIG} 765 766 CSUM=`sha256sum u-boot-nodtb.bin | awk '{ print $1 }'` 767 echo "uboot_sha256sum=${CSUM}" >> ${SIG_CONFIG} 768 CSUM=`sha256sum spl/u-boot-spl-nodtb.bin | awk '{ print $1 }'` 769 echo "spl_sha256sum=${CSUM}" >> ${SIG_CONFIG} 770 SIZE=`ls -l spl/u-boot-spl-nodtb.bin | awk '{ print $5 }'` 771 echo "spl_size=${SIZE}" >> ${SIG_CONFIG} 772 773 BUILD_MAIL=`git config --get user.email` 774 BUILD_HOST=`hostname` 775 BUILD_USER=${USER} 776 BUILD_DATE=`date` 777 echo "BUILD: ${BUILD_MAIL} # ${BUILD_USER}@${BUILD_HOST} # ${BUILD_DATE}" >> ${SIG_CONFIG} 778 fi 779} 780