1#!/bin/bash 2# 3# Copyright (c) 2022 Rockchip Electronics Co., Ltd 4# 5# SPDX-License-Identifier: GPL-2.0 6# 7set -e 8 9FIT_DIR="fit" 10IMG_UBOOT="uboot.img" 11IMG_BOOT="boot.img" 12IMG_RECOVERY="recovery.img" 13ITB_UBOOT="${FIT_DIR}/uboot.itb" 14ITB_BOOT="${FIT_DIR}/boot.itb" 15ITB_RECOVERY="${FIT_DIR}/recovery.itb" 16SIG_BIN="data2sign.bin" 17SIG_UBOOT="${FIT_DIR}/uboot.data2sign" 18SIG_BOOT="${FIT_DIR}/boot.data2sign" 19SIG_RECOVERY="${FIT_DIR}/recovery.data2sign" 20SIG_CFG_DIR="${FIT_DIR}/fit_signcfg" 21SIG_CONFIG="${SIG_CFG_DIR}/sign.readonly_config" 22MINIALL_INI="${SIG_CFG_DIR}/MINIALL.ini" 23# offs 24OFFS_DATA="0x1200" 25# placeholder address 26FDT_ADDR_PLACEHOLDER="0xffffff00" 27KERNEL_ADDR_PLACEHOLDER="0xffffff01" 28RAMDISK_ADDR_PLACEHOLDER="0xffffff02" 29# tools 30MKIMAGE="./tools/mkimage" 31RK_SIGN_TOOL="../rkbin/tools/rk_sign_tool" 32FIT_UNPACK="./scripts/fit-unpack.sh" 33CHECK_SIGN="./tools/fit_check_sign" 34# key 35KEY_DIR="keys/" 36RSA_PRI_KEY="keys/dev.key" 37RSA_PUB_KEY="keys/dev.pubkey" 38RSA_CRT_KEY="keys/dev.crt" 39SIGNATURE_KEY_NODE="/signature/key-dev" 40SPL_DTB="spl/u-boot-spl.dtb" 41UBOOT_DTB="u-boot.dtb" 42# its 43ITS_UBOOT="u-boot.its" 44ITS_BOOT="boot.its" 45ITS_RECOVERY="recovery.its" 46ARG_VER_UBOOT="0" 47ARG_VER_BOOT="0" 48ARG_VER_RECOVERY="0" 49 50function help() 51{ 52 echo 53 echo "usage:" 54 echo " $0 [args]" 55 echo 56 echo "args:" 57 echo " --rollback-index-recovery <decimal integer>" 58 echo " --rollback-index-boot <decimal integer>" 59 echo " --rollback-index-uboot <decimal integer>" 60 echo " --version-recovery <decimal integer>" 61 echo " --version-boot <decimal integer>" 62 echo " --version-uboot <decimal integer>" 63 echo " --boot_img <boot image>" 64 echo " --recovery_img <recovery image>" 65 echo " --args <arg>" 66 echo " --ini-loader <loader ini file>" 67 echo " --ini-trust <trust ini file>" 68 echo " --no-check" 69 echo " --no-sign" 70 echo " --spl-new" 71 echo 72} 73 74function arg_check_decimal() 75{ 76 if [ -z $1 ]; then 77 help 78 exit 1 79 fi 80 81 decimal=`echo $1 |sed 's/[0-9]//g'` 82 if [ ! -z ${decimal} ]; then 83 echo "ERROR: $1 is not decimal integer" 84 help 85 exit 1 86 fi 87} 88 89function check_its() 90{ 91 cat $1 | while read line 92 do 93 file=`echo ${line} | sed -n "/incbin/p" | awk -F '"' '{ printf $2 }' | tr -d ' '` 94 if [ ! -f ${file} ]; then 95 echo "ERROR: No ${file}" 96 exit 1 97 fi 98 done 99} 100 101function check_rsa_algo() 102{ 103 if grep -q '^CONFIG_FIT_ENABLE_RSA4096_SUPPORT=y' .config ; then 104 rsa_algo="rsa4096" 105 else 106 rsa_algo="rsa2048" 107 fi 108 if ! grep -qr ${rsa_algo} $1 ; then 109 echo "ERROR: Wrong rsa_algo in its file. It should be ${rsa_algo}." 110 exit 1 111 fi 112} 113 114function check_rsa_keys() 115{ 116 if [ ! -f ${RSA_PRI_KEY} ]; then 117 echo "ERROR: No ${RSA_PRI_KEY} " 118 exit 1 119 elif [ ! -f ${RSA_PUB_KEY} ]; then 120 echo "ERROR: No ${RSA_PUB_KEY} " 121 exit 1 122 elif [ ! -f ${RSA_CRT_KEY} ]; then 123 echo "ERROR: No ${RSA_CRT_KEY} " 124 exit 1 125 fi 126} 127 128function validate_arg() 129{ 130 case $1 in 131 --no-check|--no-sign|--spl-new|--burn-key-hash) 132 shift=1 133 ;; 134 --ini-trust|--ini-loader|--rollback-index-boot|--rollback-index-recovery|--rollback-index-uboot|--boot_img|--recovery_img|--version-uboot|--version-boot|--version-recovery|--chip) 135 shift=2 136 ;; 137 *) 138 shift=0 139 ;; 140 esac 141 echo ${shift} 142} 143 144function fit_process_args() 145{ 146 if [ $# -eq 0 ]; then 147 help 148 exit 0 149 fi 150 151 if grep -q '^CONFIG_FIT_SIGNATURE=y' .config ; then 152 ARG_SIGN="y" 153 fi 154 155 while [ $# -gt 0 ]; do 156 case $1 in 157 --args) 158 ARG_VALIDATE=$2 159 shift 2 160 ;; 161 --boot_img) # boot.img 162 ARG_BOOT_IMG=$2 163 shift 2 164 ;; 165 --chip) 166 ARG_CHIP=$2 167 shift 2 168 ;; 169 --recovery_img) # recovery.img 170 ARG_RECOVERY_IMG=$2 171 shift 2 172 ;; 173 --boot_img_dir) # boot.img components directory 174 ARG_BOOT_IMG_DIR=$2 175 shift 2 176 ;; 177 --no-check) # No hostcc fit signature check 178 ARG_NO_CHECK="y" 179 shift 1 180 ;; 181 --no-sign) 182 ARG_NO_SIGN="y" 183 ARG_SIGN="n" 184 shift 1 185 ;; 186 --ini-trust) # Assign trust ini file 187 ARG_INI_TRUST=$2 188 shift 2 189 ;; 190 --ini-loader) # Assign loader ini file 191 ARG_INI_LOADER=$2 192 shift 2 193 ;; 194 --spl-new) # Use current build u-boot-spl.bin to pack loader 195 ARG_SPL_NEW="y" 196 shift 1 197 ;; 198 --rollback-index-boot) 199 ARG_ROLLBACK_IDX_BOOT=$2 200 arg_check_decimal $2 201 shift 2 202 ;; 203 --rollback-index-recovery) 204 ARG_ROLLBACK_IDX_RECOVERY=$2 205 arg_check_decimal $2 206 shift 2 207 ;; 208 --rollback-index-uboot) 209 ARG_ROLLBACK_IDX_UBOOT=$2 210 arg_check_decimal $2 211 shift 2 212 ;; 213 --version-uboot) 214 ARG_VER_UBOOT=$2 215 arg_check_decimal $2 216 shift 2 217 ;; 218 --version-boot) 219 ARG_VER_BOOT=$2 220 arg_check_decimal $2 221 shift 2 222 ;; 223 --version-recovery) 224 ARG_VER_RECOVERY=$2 225 arg_check_decimal $2 226 shift 2 227 ;; 228 --burn-key-hash) 229 ARG_BURN_KEY_HASH="y" 230 shift 1 231 ;; 232 *) 233 help 234 exit 1 235 ;; 236 esac 237 done 238} 239 240function fit_raw_compile() 241{ 242 # Verified-boot: should rebuild code but don't need to repack images. 243 if [ "${ARG_SIGN}" == "y" ]; then 244 ./make.sh --raw-compile 245 fi 246 rm ${FIT_DIR} -rf && mkdir -p ${FIT_DIR} && mkdir -p ${SIG_CFG_DIR} 247} 248 249function fit_gen_uboot_itb() 250{ 251 # generate u-boot.its file 252 ./make.sh itb ${ARG_INI_TRUST} 253 254 # check existance of file in its 255 check_its ${ITS_UBOOT} 256 257 if [ "${ARG_SIGN}" != "y" ]; then 258 ${MKIMAGE} -f ${ITS_UBOOT} -E -p ${OFFS_DATA} ${ITB_UBOOT} -v ${ARG_VER_UBOOT} 259 if [ "${ARG_SPL_NEW}" == "y" ]; then 260 ./make.sh --spl ${ARG_INI_LOADER} 261 echo "pack loader with new: spl/u-boot-spl.bin" 262 else 263 ./make.sh loader ${ARG_INI_LOADER} 264 fi 265 else 266 check_rsa_keys 267 268 if ! grep -q '^CONFIG_SPL_FIT_SIGNATURE=y' .config ; then 269 echo "ERROR: CONFIG_SPL_FIT_SIGNATURE is disabled" 270 exit 1 271 fi 272 273 # rollback-index 274 if grep -q '^CONFIG_SPL_FIT_ROLLBACK_PROTECT=y' .config ; then 275 ARG_SPL_ROLLBACK_PROTECT="y" 276 if [ -z ${ARG_ROLLBACK_IDX_UBOOT} ]; then 277 echo "ERROR: No arg \"--rollback-index-uboot <n>\"" 278 exit 1 279 fi 280 fi 281 282 if [ "${ARG_SPL_ROLLBACK_PROTECT}" == "y" ]; then 283 VERSION=`grep 'rollback-index' ${ITS_UBOOT} | awk -F '=' '{ printf $2 }' | tr -d ' '` 284 sed -i "s/rollback-index = ${VERSION}/rollback-index = <${ARG_ROLLBACK_IDX_UBOOT}>;/g" ${ITS_UBOOT} 285 fi 286 287 # Generally, boot.img is signed before uboot.img, so the ras key can be found 288 # in u-boot.dtb. If not found, let's insert rsa key anyway. 289 if ! fdtget -l ${UBOOT_DTB} /signature >/dev/null 2>&1 ; then 290 ${MKIMAGE} -f ${ITS_UBOOT} -k ${KEY_DIR} -K ${UBOOT_DTB} -E -p ${OFFS_DATA} -r ${ITB_UBOOT} -v ${ARG_VER_UBOOT} 291 echo "## Adding RSA public key into ${UBOOT_DTB}" 292 fi 293 294 # Pack 295 ${MKIMAGE} -f ${ITS_UBOOT} -k ${KEY_DIR} -K ${SPL_DTB} -E -p ${OFFS_DATA} -r ${ITB_UBOOT} -v ${ARG_VER_UBOOT} 296 mv ${SIG_BIN} ${SIG_UBOOT} 297 298 # burn-key-hash 299 if [ "${ARG_BURN_KEY_HASH}" == "y" ]; then 300 if grep -q '^CONFIG_SPL_FIT_HW_CRYPTO=y' .config ; then 301 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} burn-key-hash 0x1 302 else 303 echo "ERROR: --burn-key-hash requires CONFIG_SPL_FIT_HW_CRYPTO=y" 304 exit 1 305 fi 306 fi 307 308 # rollback-index read back check 309 if [ "${ARG_SPL_ROLLBACK_PROTECT}" == "y" ]; then 310 VERSION=`fdtget -ti ${ITB_UBOOT} /configurations/conf rollback-index` 311 if [ "${VERSION}" != "${ARG_ROLLBACK_IDX_UBOOT}" ]; then 312 echo "ERROR: Failed to set rollback-index for ${ITB_UBOOT}"; 313 exit 1 314 fi 315 fi 316 317 # burn-key-hash read back check 318 if [ "${ARG_BURN_KEY_HASH}" == "y" ]; then 319 if [ "`fdtget -ti ${SPL_DTB} ${SIGNATURE_KEY_NODE} burn-key-hash`" != "1" ]; then 320 echo "ERROR: Failed to set burn-key-hash for ${SPL_DTB}"; 321 exit 1 322 fi 323 fi 324 325 # host check signature 326 if [ "${ARG_NO_CHECK}" != "y" ]; then 327 if [ "${ARG_SPL_NEW}" == "y" ]; then 328 ${CHECK_SIGN} -f ${ITB_UBOOT} -k ${SPL_DTB} -s 329 else 330 spl_file="../rkbin/"`sed -n "/FlashBoot=/s/FlashBoot=//p" ${ARG_INI_LOADER} |tr -d '\r'` 331 offs=`fdtdump -s ${spl_file} | head -1 | awk -F ":" '{ print $2 }' | sed "s/ found fdt at offset //g" | tr -d " "` 332 if [ -z ${offs} ]; then 333 echo "ERROR: invalid ${spl_file} , unable to find fdt blob" 334 fi 335 offs=`printf %d ${offs} ` # hex -> dec 336 dd if=${spl_file} of=spl/u-boot-spl-old.dtb bs=${offs} skip=1 >/dev/null 2>&1 337 ${CHECK_SIGN} -f ${ITB_UBOOT} -k spl/u-boot-spl-old.dtb -s 338 fi 339 fi 340 341 # minimize u-boot-spl.dtb: clear as 0 but not remove property. 342 if grep -q '^CONFIG_SPL_FIT_HW_CRYPTO=y' .config ; then 343 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,r-squared 0x0 344 if grep -q '^CONFIG_SPL_ROCKCHIP_CRYPTO_V1=y' .config ; then 345 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 346 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@np 347 else 348 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 349 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@c 350 fi 351 else 352 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 353 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 354 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,exponent-BN 0x0 355 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@c 356 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@np 357 fi 358 359 # repack spl 360 if [ "${ARG_SPL_NEW}" == "y" ]; then 361 cat spl/u-boot-spl-nodtb.bin > spl/u-boot-spl.bin 362 if ! grep -q '^CONFIG_SPL_SEPARATE_BSS=y' .config ; then 363 cat spl/u-boot-spl-pad.bin >> spl/u-boot-spl.bin 364 fi 365 cat ${SPL_DTB} >> spl/u-boot-spl.bin 366 367 ./make.sh --spl ${ARG_INI_LOADER} 368 echo "## pack loader with new: spl/u-boot-spl.bin" 369 else 370 ./make.sh loader ${ARG_INI_LOADER} 371 fi 372 373 if [ "${ARG_BURN_KEY_HASH}" == "y" ]; then 374 echo "## ${SPL_DTB}: burn-key-hash=1" 375 fi 376 fi 377 378 rm -f u-boot.itb u-boot.img u-boot-dtb.img 379 mv ${ITS_UBOOT} ${FIT_DIR} 380} 381 382function fit_gen_boot_itb() 383{ 384 if [ ! -z ${ARG_BOOT_IMG} ]; then 385 ${FIT_UNPACK} -f ${ARG_BOOT_IMG} -o ${FIT_DIR}/unpack 386 ITS_BOOT="${FIT_DIR}/unpack/image.its" 387 else 388 compression=`awk -F"," '/COMPRESSION=/ { printf $1 }' ${ARG_INI_TRUST} | tr -d ' ' | cut -c 13-` 389 if [ -z "${compression}" ]; then 390 compression="none" 391 fi 392 ./arch/arm/mach-rockchip/make_fit_boot.sh -c ${compression} > ${ITS_BOOT} 393 check_its ${ITS_BOOT} 394 fi 395 396 if [ "${ARG_SIGN}" != "y" ]; then 397 ${MKIMAGE} -f ${ITS_BOOT} -E -p ${OFFS_DATA} ${ITB_BOOT} -v ${ARG_VER_BOOT} 398 else 399 check_rsa_keys 400 401 check_rsa_algo ${ITS_BOOT} 402 403 if [ "${ARG_SIGN}" != "y" ]; then 404 echo "ERROR: CONFIG_FIT_SIGNATURE is disabled" 405 exit 1 406 fi 407 408 if grep -q '^CONFIG_FIT_ROLLBACK_PROTECT=y' .config ; then 409 ARG_ROLLBACK_PROTECT="y" 410 if [ -z ${ARG_ROLLBACK_IDX_BOOT} ]; then 411 echo "ERROR: No arg \"--rollback-index-boot <n>\"" 412 exit 1 413 fi 414 if ! grep -q '^CONFIG_OPTEE_CLIENT=y' .config ; then 415 echo "ERROR: Don't support \"--rollback-index-boot <n>\"" 416 exit 1 417 fi 418 fi 419 420 # fixup 421 FDT_ADDR_R=`strings env/built-in.o | grep 'fdt_addr_r=' | awk -F "=" '{ print $2 }'` 422 KERNEL_ADDR_R=`strings env/built-in.o | grep 'kernel_addr_r=' | awk -F "=" '{ print $2 }'` 423 RMADISK_ADDR_R=`strings env/built-in.o | grep 'ramdisk_addr_r=' | awk -F "=" '{ print $2 }'` 424 sed -i "s/${FDT_ADDR_PLACEHOLDER}/${FDT_ADDR_R}/g" ${ITS_BOOT} 425 sed -i "s/${KERNEL_ADDR_PLACEHOLDER}/${KERNEL_ADDR_R}/g" ${ITS_BOOT} 426 sed -i "s/${RAMDISK_ADDR_PLACEHOLDER}/${RMADISK_ADDR_R}/g" ${ITS_BOOT} 427 if grep -q '^CONFIG_ARM64=y' .config ; then 428 sed -i 's/arch = "arm";/arch = "arm64";/g' ${ITS_BOOT} 429 fi 430 431 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 432 VERSION=`grep 'rollback-index' ${ITS_BOOT} | awk -F '=' '{ printf $2 }' | tr -d ' '` 433 sed -i "s/rollback-index = ${VERSION}/rollback-index = <${ARG_ROLLBACK_IDX_BOOT}>;/g" ${ITS_BOOT} 434 fi 435 436 ${MKIMAGE} -f ${ITS_BOOT} -k ${KEY_DIR} -K ${UBOOT_DTB} -E -p ${OFFS_DATA} -r ${ITB_BOOT} -v ${ARG_VER_BOOT} 437 mv ${SIG_BIN} ${SIG_BOOT} 438 439 # rollback-index read back check 440 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 441 VERSION=`fdtget -ti ${ITB_BOOT} /configurations/conf rollback-index` 442 if [ "${VERSION}" != "${ARG_ROLLBACK_IDX_BOOT}" ]; then 443 echo "ERROR: Failed to set rollback-index for ${ITB_BOOT}"; 444 exit 1 445 fi 446 fi 447 448 # host check signature 449 if [ "${ARG_NO_CHECK}" != "y" ]; then 450 ${CHECK_SIGN} -f ${ITB_BOOT} -k ${UBOOT_DTB} 451 fi 452 453 # minimize u-boot.dtb: clearn as 0 but not remove property. 454 if grep -q '^CONFIG_FIT_HW_CRYPTO=y' .config ; then 455 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,r-squared 0x0 456 if grep -q '^CONFIG_ROCKCHIP_CRYPTO_V1=y' .config ; then 457 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 458 else 459 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 460 fi 461 else 462 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 463 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 464 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,exponent-BN 0x0 465 fi 466 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@c 467 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@np 468 fi 469 470 mv ${ITS_BOOT} ${FIT_DIR} 471} 472 473function fit_gen_recovery_itb() 474{ 475 if [ ! -z ${ARG_RECOVERY_IMG} ]; then 476 ${FIT_UNPACK} -f ${ARG_RECOVERY_IMG} -o ${FIT_DIR}/unpack 477 ITS_RECOVERY="${FIT_DIR}/unpack/image.its" 478 else 479 echo "ERROR: No recovery.img" 480 exit 1 481 fi 482 483 if [ "${ARG_SIGN}" != "y" ]; then 484 ${MKIMAGE} -f ${ITS_RECOVERY} -E -p ${OFFS_DATA} ${ITB_RECOVERY} -v ${ARG_VER_RECOVERY} 485 else 486 check_rsa_keys 487 488 check_rsa_algo ${ITS_RECOVERY} 489 490 if [ "${ARG_SIGN}" != "y" ]; then 491 echo "ERROR: CONFIG_FIT_SIGNATURE is disabled" 492 exit 1 493 fi 494 495 if grep -q '^CONFIG_FIT_ROLLBACK_PROTECT=y' .config ; then 496 ARG_ROLLBACK_PROTECT="y" 497 if [ -z ${ARG_ROLLBACK_IDX_RECOVERY} ]; then 498 echo "ERROR: No arg \"--rollback-index-recovery <n>\"" 499 exit 1 500 fi 501 if ! grep -q '^CONFIG_OPTEE_CLIENT=y' .config ; then 502 echo "ERROR: Don't support \"--rollback-index-recovery <n>\"" 503 exit 1 504 fi 505 fi 506 507 # fixup 508 FDT_ADDR_R=`strings env/built-in.o | grep 'fdt_addr_r=' | awk -F "=" '{ print $2 }'` 509 KERNEL_ADDR_R=`strings env/built-in.o | grep 'kernel_addr_r=' | awk -F "=" '{ print $2 }'` 510 RMADISK_ADDR_R=`strings env/built-in.o | grep 'ramdisk_addr_r=' | awk -F "=" '{ print $2 }'` 511 sed -i "s/${FDT_ADDR_PLACEHOLDER}/${FDT_ADDR_R}/g" ${ITS_RECOVERY} 512 sed -i "s/${KERNEL_ADDR_PLACEHOLDER}/${KERNEL_ADDR_R}/g" ${ITS_RECOVERY} 513 sed -i "s/${RAMDISK_ADDR_PLACEHOLDER}/${RMADISK_ADDR_R}/g" ${ITS_RECOVERY} 514 if grep -q '^CONFIG_ARM64=y' .config ; then 515 sed -i 's/arch = "arm";/arch = "arm64";/g' ${ITS_RECOVERY} 516 fi 517 518 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 519 VERSION=`grep 'rollback-index' ${ITS_RECOVERY} | awk -F '=' '{ printf $2 }' | tr -d ' '` 520 sed -i "s/rollback-index = ${VERSION}/rollback-index = <${ARG_ROLLBACK_IDX_RECOVERY}>;/g" ${ITS_RECOVERY} 521 fi 522 523 ${MKIMAGE} -f ${ITS_RECOVERY} -k ${KEY_DIR} -K ${UBOOT_DTB} -E -p ${OFFS_DATA} -r ${ITB_RECOVERY} -v ${ARG_VER_RECOVERY} 524 mv ${SIG_BIN} ${SIG_RECOVERY} 525 526 # rollback-index read back check 527 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 528 VERSION=`fdtget -ti ${ITB_RECOVERY} /configurations/conf rollback-index` 529 if [ "${VERSION}" != "${ARG_ROLLBACK_IDX_RECOVERY}" ]; then 530 echo "ERROR: Failed to set rollback-index for ${ITB_RECOVERY}"; 531 exit 1 532 fi 533 fi 534 535 # host check signature 536 if [ "${ARG_NO_CHECK}" != "y" ]; then 537 ${CHECK_SIGN} -f ${ITB_RECOVERY} -k ${UBOOT_DTB} 538 fi 539 540 # minimize u-boot.dtb: clearn as 0 but not remove property. 541 if grep -q '^CONFIG_FIT_HW_CRYPTO=y' .config ; then 542 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,r-squared 0x0 543 if grep -q '^CONFIG_ROCKCHIP_CRYPTO_V1=y' .config ; then 544 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 545 else 546 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 547 fi 548 else 549 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 550 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 551 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,exponent-BN 0x0 552 fi 553 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@c 554 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@np 555 fi 556 557 mv ${ITS_RECOVERY} ${FIT_DIR} 558} 559 560function fit_gen_uboot_img() 561{ 562 ITB=$1 563 564 if [ -z ${ITB} ]; then 565 ITB=${ITB_UBOOT} 566 fi 567 568 ITB_MAX_NUM=`sed -n "/SPL_FIT_IMAGE_MULTIPLE/p" .config | awk -F "=" '{ print $2 }'` 569 ITB_MAX_KB=`sed -n "/SPL_FIT_IMAGE_KB/p" .config | awk -F "=" '{ print $2 }'` 570 ITB_MAX_BS=$((ITB_MAX_KB*1024)) 571 ITB_BS=`ls -l ${ITB} | awk '{ print $5 }'` 572 573 if [ ${ITB_BS} -gt ${ITB_MAX_BS} ]; then 574 echo "ERROR: pack ${IMG_UBOOT} failed! ${ITB} actual: ${ITB_BS} bytes, max limit: ${ITB_MAX_BS} bytes" 575 exit 1 576 fi 577 578 rm -f ${IMG_UBOOT} 579 for ((i = 0; i < ${ITB_MAX_NUM}; i++)); 580 do 581 cat ${ITB} >> ${IMG_UBOOT} 582 truncate -s %${ITB_MAX_KB}K ${IMG_UBOOT} 583 done 584} 585 586function fit_gen_boot_img() 587{ 588 ITB=$1 589 590 if [ -z ${ITB} ]; then 591 ITB=${ITB_BOOT} 592 fi 593 594 if [ "${ITB}" != "${IMG_BOOT}" ]; then 595 cp ${ITB} ${IMG_BOOT} -f 596 fi 597} 598 599function fit_gen_recovery_img() 600{ 601 ITB=$1 602 603 if [ -z ${ITB} ]; then 604 ITB=${ITB_RECOVERY} 605 fi 606 607 if [ "${ITB}" != "${IMG_RECOVERY}" ]; then 608 cp ${ITB} ${IMG_RECOVERY} -f 609 fi 610} 611 612function fit_gen_loader() 613{ 614 if [ "${ARG_SIGN}" == "y" ]; then 615 ${RK_SIGN_TOOL} cc --chip ${ARG_CHIP: 2: 6} 616 ${RK_SIGN_TOOL} lk --key ${RSA_PRI_KEY} --pubkey ${RSA_PUB_KEY} 617 if ls *loader*.bin >/dev/null 2>&1 ; then 618 ${RK_SIGN_TOOL} sl --loader *loader*.bin 619 fi 620 if ls *download*.bin >/dev/null 2>&1 ; then 621 ${RK_SIGN_TOOL} sl --loader *download*.bin 622 fi 623 if ls *idblock*.img >/dev/null 2>&1 ; then 624 ${RK_SIGN_TOOL} sb --idb *idblock*.img 625 fi 626 fi 627} 628 629function fit_msg_uboot() 630{ 631 if [ "${ARG_SIGN}" != "y" ]; then 632 MSG_SIGN="no-signed" 633 else 634 MSG_SIGN="signed" 635 fi 636 637 VERSION=`fdtget -ti ${ITB_UBOOT} / version` 638 if [ "${VERSION}" != "" ]; then 639 MSG_VER=", version=${VERSION}" 640 fi 641 642 if [ "${ARG_SPL_ROLLBACK_PROTECT}" == "y" ]; then 643 echo "Image(${MSG_SIGN}${MSG_VER}, rollback-index=${ARG_ROLLBACK_IDX_UBOOT}): ${IMG_UBOOT} (with uboot, trust...) is ready" 644 else 645 echo "Image(${MSG_SIGN}${MSG_VER}): ${IMG_UBOOT} (FIT with uboot, trust...) is ready" 646 fi 647} 648 649function fit_msg_boot() 650{ 651 if [ -z "${ARG_BOOT_IMG}" ]; then 652 return; 653 fi 654 655 if [ "${ARG_SIGN}" != "y" ]; then 656 MSG_SIGN="no-signed" 657 else 658 MSG_SIGN="signed" 659 fi 660 661 VERSION=`fdtget -ti ${ITB_BOOT} / version` 662 if [ "${VERSION}" != "" ]; then 663 MSG_VER=", version=${VERSION}" 664 fi 665 666 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 667 echo "Image(${MSG_SIGN}${MSG_VER}, rollback-index=${ARG_ROLLBACK_IDX_BOOT}): ${IMG_BOOT} is ready" 668 else 669 echo "Image(${MSG_SIGN}${MSG_VER}): ${IMG_BOOT} (FIT with kernel, fdt, resource...) is ready" 670 fi 671} 672 673function fit_msg_recovery() 674{ 675 if [ -z "${ARG_RECOVERY_IMG}" ]; then 676 return; 677 fi 678 679 if [ "${ARG_SIGN}" != "y" ]; then 680 MSG_SIGN="no-signed" 681 else 682 MSG_SIGN="signed" 683 fi 684 685 VERSION=`fdtget -ti ${ITB_RECOVERY} / version` 686 if [ "${VERSION}" != "" ]; then 687 MSG_VER=", version=${VERSION}" 688 fi 689 690 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 691 echo "Image(${MSG_SIGN}${MSG_VER}, rollback-index=${ARG_ROLLBACK_IDX_RECOVERY}): ${IMG_RECOVERY} is ready" 692 else 693 echo "Image(${MSG_SIGN}${MSG_VER}): ${IMG_RECOVERY} (FIT with kernel, fdt, resource...) is ready" 694 fi 695} 696 697function fit_msg_loader() 698{ 699 if ls *loader*.bin >/dev/null 2>&1 ; then 700 LOADER=`ls *loader*.bin` 701 fi 702 703 if ls *idblock*.img >/dev/null 2>&1 ; then 704 LOADER=`ls *idblock*.img` 705 fi 706 707 if [ "${ARG_SIGN}" == "y" ]; then 708 echo "Image(signed): ${LOADER} (with spl, ddr...) is ready" 709 else 710 echo "Image(no-signed): ${LOADER} (with spl, ddr...) is ready" 711 fi 712} 713 714function fit_msg_u_boot_loader() 715{ 716 if ls *loader*.bin >/dev/null 2>&1 ; then 717 LOADER=`ls *loader*.bin` 718 fi 719 720 if ls *idblock*.img >/dev/null 2>&1 ; then 721 LOADER=`ls *idblock*.img` 722 fi 723 724 if [ "${ARG_SIGN}" == "y" ]; then 725 echo "Image(signed): ${LOADER} (with u-boot, ddr...) is ready" 726 else 727 echo "Image(no-signed): ${LOADER} (with u-boot, ddr...) is ready" 728 fi 729} 730 731function fit_signcfg_export() 732{ 733 if [ "${ARG_NO_SIGN}" == "y" ]; then 734 if ls *loader*.bin >/dev/null 2>&1 ; then 735 LOADER=`ls *loader*.bin` 736 elif ls *download*.bin >/dev/null 2>&1 ; then 737 LOADER=`ls *download*.bin` 738 else 739 echo "ERROR: No loader found" 740 exit 1 741 fi 742 cp ${ARG_INI_LOADER} ${MINIALL_INI} 743 cp .config ${SIG_CONFIG} 744 745 mkdir -p ${SIG_CFG_DIR}/test_images/ 746 cp uboot.img ${SIG_CFG_DIR}/test_images/ 747 cp ${LOADER} ${SIG_CFG_DIR}/test_images/ 748 tar zcvf ${SIG_CFG_DIR}/test_images.tar.gz ${SIG_CFG_DIR}/test_images >/dev/null 2>&1 749 rm -rf ${SIG_CFG_DIR}/test_images/ 750 751 FDT_ADDR_R=`strings env/built-in.o | grep 'fdt_addr_r=' | awk -F "=" '{ print $2 }'` 752 KERNEL_ADDR_R=`strings env/built-in.o | grep 'kernel_addr_r=' | awk -F "=" '{ print $2 }'` 753 RMADISK_ADDR_R=`strings env/built-in.o | grep 'ramdisk_addr_r=' | awk -F "=" '{ print $2 }'` 754 echo "fdt_addr_r=${FDT_ADDR_R}" >> ${SIG_CONFIG} 755 echo "kernel_addr_r=${KERNEL_ADDR_R}" >> ${SIG_CONFIG} 756 echo "ramdisk_addr_r=${RMADISK_ADDR_R}" >> ${SIG_CONFIG} 757 758 CSUM=`sha256sum u-boot-nodtb.bin | awk '{ print $1 }'` 759 echo "uboot_sha256sum=${CSUM}" >> ${SIG_CONFIG} 760 CSUM=`sha256sum spl/u-boot-spl-nodtb.bin | awk '{ print $1 }'` 761 echo "spl_sha256sum=${CSUM}" >> ${SIG_CONFIG} 762 SIZE=`ls -l spl/u-boot-spl-nodtb.bin | awk '{ print $5 }'` 763 echo "spl_size=${SIZE}" >> ${SIG_CONFIG} 764 765 BUILD_MAIL=`git config --get user.email` 766 BUILD_HOST=`hostname` 767 BUILD_USER=${USER} 768 BUILD_DATE=`date` 769 echo "BUILD: ${BUILD_MAIL} # ${BUILD_USER}@${BUILD_HOST} # ${BUILD_DATE}" >> ${SIG_CONFIG} 770 fi 771}