1#!/bin/bash 2# 3# Copyright (c) 2022 Rockchip Electronics Co., Ltd 4# 5# SPDX-License-Identifier: GPL-2.0 6# 7set -e 8 9FIT_DIR="fit" 10IMG_UBOOT="uboot.img" 11IMG_BOOT="boot.img" 12IMG_RECOVERY="recovery.img" 13ITB_UBOOT="${FIT_DIR}/uboot.itb" 14ITB_BOOT="${FIT_DIR}/boot.itb" 15ITB_RECOVERY="${FIT_DIR}/recovery.itb" 16SIG_BIN="data2sign.bin" 17SIG_UBOOT="${FIT_DIR}/uboot.data2sign" 18SIG_BOOT="${FIT_DIR}/boot.data2sign" 19SIG_RECOVERY="${FIT_DIR}/recovery.data2sign" 20SIG_CFG_DIR="${FIT_DIR}/fit_signcfg" 21SIG_CONFIG="${SIG_CFG_DIR}/sign.readonly_config" 22MINIALL_INI="${SIG_CFG_DIR}/MINIALL.ini" 23# offs 24OFFS_DATA="0x1200" 25# placeholder address 26FDT_ADDR_PLACEHOLDER="0xffffff00" 27KERNEL_ADDR_PLACEHOLDER="0xffffff01" 28RAMDISK_ADDR_PLACEHOLDER="0xffffff02" 29# tools 30MKIMAGE="./tools/mkimage" 31RK_SIGN_TOOL="../rkbin/tools/rk_sign_tool" 32FIT_UNPACK="./scripts/fit-unpack.sh" 33CHECK_SIGN="./tools/fit_check_sign" 34# key 35KEY_DIR="keys/" 36RSA_PRI_KEY="keys/dev.key" 37RSA_PUB_KEY="keys/dev.pubkey" 38RSA_CRT_KEY="keys/dev.crt" 39LEGACY_RSA_PRI_KEY="legacy_keys/dev.key" 40LEGACY_RSA_PUB_KEY="legacy_keys/dev.pubkey" 41LEGACY_RSA_CRT_KEY="legacy_keys/dev.crt" 42SIGNATURE_KEY_NODE="/signature/key-dev" 43SPL_DTB="spl/u-boot-spl.dtb" 44UBOOT_DTB="u-boot.dtb" 45# its 46ITS_UBOOT="u-boot.its" 47ITS_BOOT="boot.its" 48ITS_RECOVERY="recovery.its" 49ARG_VER_UBOOT="0" 50ARG_VER_BOOT="0" 51ARG_VER_RECOVERY="0" 52 53function help() 54{ 55 echo 56 echo "usage:" 57 echo " $0 [args]" 58 echo 59 echo "args:" 60 echo " --rollback-index-recovery <decimal integer>" 61 echo " --rollback-index-boot <decimal integer>" 62 echo " --rollback-index-uboot <decimal integer>" 63 echo " --version-recovery <decimal integer>" 64 echo " --version-boot <decimal integer>" 65 echo " --version-uboot <decimal integer>" 66 echo " --boot_img <boot image>" 67 echo " --recovery_img <recovery image>" 68 echo " --args <arg>" 69 echo " --ini-loader <loader ini file>" 70 echo " --ini-trust <trust ini file>" 71 echo " --no-check" 72 echo " --no-sign" 73 echo " --spl-new" 74 echo 75} 76 77function arg_check_decimal() 78{ 79 if [ -z $1 ]; then 80 help 81 exit 1 82 fi 83 84 decimal=`echo $1 |sed 's/[0-9]//g'` 85 if [ ! -z ${decimal} ]; then 86 echo "ERROR: $1 is not decimal integer" 87 help 88 exit 1 89 fi 90} 91 92function check_its() 93{ 94 cat $1 | while read line 95 do 96 file=`echo ${line} | sed -n "/incbin/p" | awk -F '"' '{ printf $2 }' | tr -d ' '` 97 if [ ! -f ${file} ]; then 98 echo "ERROR: No ${file}" 99 exit 1 100 fi 101 done 102} 103 104function check_rsa_algo() 105{ 106 if grep -q '^CONFIG_FIT_ENABLE_RSA4096_SUPPORT=y' .config ; then 107 rsa_algo="rsa4096" 108 else 109 rsa_algo="rsa2048" 110 fi 111 if ! grep -qr ${rsa_algo} $1 ; then 112 echo "ERROR: Wrong rsa_algo in its file. It should be ${rsa_algo}." 113 exit 1 114 fi 115} 116 117function check_rsa_keys() 118{ 119 if [ ! -f ${RSA_PRI_KEY} ]; then 120 echo "ERROR: No ${RSA_PRI_KEY} " 121 exit 1 122 elif [ ! -f ${RSA_PUB_KEY} ]; then 123 echo "ERROR: No ${RSA_PUB_KEY} " 124 exit 1 125 elif [ ! -f ${RSA_CRT_KEY} ]; then 126 echo "ERROR: No ${RSA_CRT_KEY} " 127 exit 1 128 fi 129} 130 131function validate_arg() 132{ 133 case $1 in 134 --no-check|--no-sign|--spl-new|--burn-key-hash) 135 shift=1 136 ;; 137 --ini-trust|--ini-loader|--rollback-index-boot|--rollback-index-recovery|--rollback-index-uboot|--boot_img|--recovery_img|--version-uboot|--version-boot|--version-recovery|--chip) 138 shift=2 139 ;; 140 *) 141 shift=0 142 ;; 143 esac 144 echo ${shift} 145} 146 147function fit_process_args() 148{ 149 if [ $# -eq 0 ]; then 150 help 151 exit 0 152 fi 153 154 if grep -q '^CONFIG_FIT_SIGNATURE=y' .config ; then 155 ARG_SIGN="y" 156 fi 157 158 while [ $# -gt 0 ]; do 159 case $1 in 160 --args) 161 ARG_VALIDATE=$2 162 shift 2 163 ;; 164 --boot_img) # boot.img 165 ARG_BOOT_IMG=$2 166 shift 2 167 ;; 168 --chip) 169 ARG_CHIP=$2 170 shift 2 171 ;; 172 --recovery_img) # recovery.img 173 ARG_RECOVERY_IMG=$2 174 shift 2 175 ;; 176 --boot_img_dir) # boot.img components directory 177 ARG_BOOT_IMG_DIR=$2 178 shift 2 179 ;; 180 --no-check) # No hostcc fit signature check 181 ARG_NO_CHECK="y" 182 shift 1 183 ;; 184 --no-sign) 185 ARG_NO_SIGN="y" 186 ARG_SIGN="n" 187 shift 1 188 ;; 189 --ini-trust) # Assign trust ini file 190 ARG_INI_TRUST=$2 191 shift 2 192 ;; 193 --ini-loader) # Assign loader ini file 194 ARG_INI_LOADER=$2 195 shift 2 196 ;; 197 --spl-new) # Use current build u-boot-spl.bin to pack loader 198 ARG_SPL_NEW="y" 199 # Whether aarch32 or not, spl only support 64 bits version. 200 if grep -q '^CONFIG_ARM64_BOOT_AARCH32=y' .config ; then 201 echo "ERROR: SPL doesn't support 32-bit. Please build 64-bit defconfig and update u-boot-spl.bin to rkbin first." 202 exit 1 203 fi 204 shift 1 205 ;; 206 --rollback-index-boot) 207 ARG_ROLLBACK_IDX_BOOT=$2 208 arg_check_decimal $2 209 shift 2 210 ;; 211 --rollback-index-recovery) 212 ARG_ROLLBACK_IDX_RECOVERY=$2 213 arg_check_decimal $2 214 shift 2 215 ;; 216 --rollback-index-uboot) 217 ARG_ROLLBACK_IDX_UBOOT=$2 218 arg_check_decimal $2 219 shift 2 220 ;; 221 --version-uboot) 222 ARG_VER_UBOOT=$2 223 arg_check_decimal $2 224 shift 2 225 ;; 226 --version-boot) 227 ARG_VER_BOOT=$2 228 arg_check_decimal $2 229 shift 2 230 ;; 231 --version-recovery) 232 ARG_VER_RECOVERY=$2 233 arg_check_decimal $2 234 shift 2 235 ;; 236 --burn-key-hash) 237 ARG_BURN_KEY_HASH="y" 238 shift 1 239 ;; 240 --spl-fwver) 241 ARG_FIT_FWVER="${ARG_FIT_FWVER} --spl-fwver $2" 242 shift 2 243 ;; 244 --fwver) 245 ARG_FIT_FWVER="${ARG_FIT_FWVER} --fwver $2" 246 shift 2 247 ;; 248 *) 249 help 250 exit 1 251 ;; 252 esac 253 done 254} 255 256function fit_raw_compile() 257{ 258 # Verified-boot: should rebuild code but don't need to repack images. 259 if [ "${ARG_SIGN}" == "y" ]; then 260 ./make.sh --raw-compile ${ARG_FIT_FWVER} 261 fi 262 rm ${FIT_DIR} -rf && mkdir -p ${FIT_DIR} && mkdir -p ${SIG_CFG_DIR} 263} 264 265function fit_gen_uboot_itb() 266{ 267 # generate u-boot.its file 268 ./make.sh itb ${ARG_INI_TRUST} 269 270 # check existance of file in its 271 check_its ${ITS_UBOOT} 272 273 if [ "${ARG_SIGN}" != "y" ]; then 274 ${MKIMAGE} -f ${ITS_UBOOT} -E -p ${OFFS_DATA} ${ITB_UBOOT} -v ${ARG_VER_UBOOT} 275 if [ "${ARG_SPL_NEW}" == "y" ]; then 276 ./make.sh --spl ${ARG_INI_LOADER} 277 echo "pack loader with new: spl/u-boot-spl.bin" 278 else 279 ./make.sh loader ${ARG_INI_LOADER} 280 fi 281 else 282 check_rsa_keys 283 284 if ! grep -q '^CONFIG_SPL_FIT_SIGNATURE=y' .config ; then 285 echo "ERROR: CONFIG_SPL_FIT_SIGNATURE is disabled" 286 exit 1 287 fi 288 289 # rollback-index 290 if grep -q '^CONFIG_SPL_FIT_ROLLBACK_PROTECT=y' .config ; then 291 ARG_SPL_ROLLBACK_PROTECT="y" 292 if [ -z ${ARG_ROLLBACK_IDX_UBOOT} ]; then 293 echo "ERROR: No arg \"--rollback-index-uboot <n>\"" 294 exit 1 295 fi 296 fi 297 298 if [ "${ARG_SPL_ROLLBACK_PROTECT}" == "y" ]; then 299 VERSION=`grep 'rollback-index' ${ITS_UBOOT} | awk -F '=' '{ printf $2 }' | tr -d ' '` 300 sed -i "s/rollback-index = ${VERSION}/rollback-index = <${ARG_ROLLBACK_IDX_UBOOT}>;/g" ${ITS_UBOOT} 301 fi 302 303 # Generally, boot.img is signed before uboot.img, so the ras key can be found 304 # in u-boot.dtb. If not found, let's insert rsa key anyway. 305 if ! fdtget -l ${UBOOT_DTB} /signature >/dev/null 2>&1 ; then 306 ${MKIMAGE} -f ${ITS_UBOOT} -k ${KEY_DIR} -K ${UBOOT_DTB} -E -p ${OFFS_DATA} -r ${ITB_UBOOT} -v ${ARG_VER_UBOOT} 307 echo "## Adding RSA public key into ${UBOOT_DTB}" 308 fi 309 310 # Pack 311 ${MKIMAGE} -f ${ITS_UBOOT} -k ${KEY_DIR} -K ${SPL_DTB} -E -p ${OFFS_DATA} -r ${ITB_UBOOT} -v ${ARG_VER_UBOOT} 312 mv ${SIG_BIN} ${SIG_UBOOT} 313 314 # burn-key-hash 315 if [ "${ARG_BURN_KEY_HASH}" == "y" ]; then 316 if grep -q '^CONFIG_SPL_FIT_HW_CRYPTO=y' .config ; then 317 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} burn-key-hash 0x1 318 else 319 echo "ERROR: --burn-key-hash requires CONFIG_SPL_FIT_HW_CRYPTO=y" 320 exit 1 321 fi 322 fi 323 324 # rollback-index read back check 325 if [ "${ARG_SPL_ROLLBACK_PROTECT}" == "y" ]; then 326 VERSION=`fdtget -ti ${ITB_UBOOT} /configurations/conf rollback-index` 327 if [ "${VERSION}" != "${ARG_ROLLBACK_IDX_UBOOT}" ]; then 328 echo "ERROR: Failed to set rollback-index for ${ITB_UBOOT}"; 329 exit 1 330 fi 331 fi 332 333 # burn-key-hash read back check 334 if [ "${ARG_BURN_KEY_HASH}" == "y" ]; then 335 if [ "`fdtget -ti ${SPL_DTB} ${SIGNATURE_KEY_NODE} burn-key-hash`" != "1" ]; then 336 echo "ERROR: Failed to set burn-key-hash for ${SPL_DTB}"; 337 exit 1 338 fi 339 fi 340 341 # host check signature 342 if [ "${ARG_NO_CHECK}" != "y" ]; then 343 if [ "${ARG_SPL_NEW}" == "y" ]; then 344 ${CHECK_SIGN} -f ${ITB_UBOOT} -k ${SPL_DTB} -s 345 else 346 spl_file="../rkbin/"`sed -n "/FlashBoot=/s/FlashBoot=//p" ${ARG_INI_LOADER} |tr -d '\r'` 347 offs=`fdtdump -s ${spl_file} | head -1 | awk -F ":" '{ print $2 }' | sed "s/ found fdt at offset //g" | tr -d " "` 348 if [ -z ${offs} ]; then 349 echo "ERROR: invalid ${spl_file} , unable to find fdt blob" 350 fi 351 offs=`printf %d ${offs} ` # hex -> dec 352 dd if=${spl_file} of=spl/u-boot-spl-old.dtb bs=${offs} skip=1 >/dev/null 2>&1 353 ${CHECK_SIGN} -f ${ITB_UBOOT} -k spl/u-boot-spl-old.dtb -s 354 fi 355 fi 356 357 # minimize u-boot-spl.dtb: clear as 0 but not remove property. 358 if grep -q '^CONFIG_SPL_FIT_HW_CRYPTO=y' .config ; then 359 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,r-squared 0x0 360 if grep -q '^CONFIG_SPL_ROCKCHIP_CRYPTO_V1=y' .config ; then 361 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 362 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@np 363 else 364 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 365 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@c 366 fi 367 else 368 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 369 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 370 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,exponent-BN 0x0 371 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@c 372 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@np 373 fi 374 375 # repack spl 376 if [ "${ARG_SPL_NEW}" == "y" ]; then 377 cat spl/u-boot-spl-nodtb.bin > spl/u-boot-spl.bin 378 if ! grep -q '^CONFIG_SPL_SEPARATE_BSS=y' .config ; then 379 cat spl/u-boot-spl-pad.bin >> spl/u-boot-spl.bin 380 fi 381 cat ${SPL_DTB} >> spl/u-boot-spl.bin 382 383 ./make.sh --spl ${ARG_INI_LOADER} 384 echo "## pack loader with new: spl/u-boot-spl.bin" 385 else 386 ./make.sh loader ${ARG_INI_LOADER} 387 fi 388 389 if [ "${ARG_BURN_KEY_HASH}" == "y" ]; then 390 echo "## ${SPL_DTB}: burn-key-hash=1" 391 fi 392 fi 393 394 rm -f u-boot.itb u-boot.img u-boot-dtb.img 395 mv ${ITS_UBOOT} ${FIT_DIR} 396} 397 398function fit_gen_boot_itb() 399{ 400 if [ ! -z ${ARG_BOOT_IMG} ]; then 401 ${FIT_UNPACK} -f ${ARG_BOOT_IMG} -o ${FIT_DIR}/unpack 402 ITS_BOOT="${FIT_DIR}/unpack/image.its" 403 else 404 compression=`awk -F"," '/COMPRESSION=/ { printf $1 }' ${ARG_INI_TRUST} | tr -d ' ' | cut -c 13-` 405 if [ -z "${compression}" ]; then 406 compression="none" 407 fi 408 ./arch/arm/mach-rockchip/make_fit_boot.sh -c ${compression} > ${ITS_BOOT} 409 check_its ${ITS_BOOT} 410 fi 411 412 if [ "${ARG_SIGN}" != "y" ]; then 413 ${MKIMAGE} -f ${ITS_BOOT} -E -p ${OFFS_DATA} ${ITB_BOOT} -v ${ARG_VER_BOOT} 414 else 415 check_rsa_keys 416 417 check_rsa_algo ${ITS_BOOT} 418 419 if [ "${ARG_SIGN}" != "y" ]; then 420 echo "ERROR: CONFIG_FIT_SIGNATURE is disabled" 421 exit 1 422 fi 423 424 if grep -q '^CONFIG_FIT_ROLLBACK_PROTECT=y' .config ; then 425 ARG_ROLLBACK_PROTECT="y" 426 if [ -z ${ARG_ROLLBACK_IDX_BOOT} ]; then 427 echo "ERROR: No arg \"--rollback-index-boot <n>\"" 428 exit 1 429 fi 430 if ! grep -q '^CONFIG_OPTEE_CLIENT=y' .config ; then 431 echo "ERROR: Don't support \"--rollback-index-boot <n>\"" 432 exit 1 433 fi 434 fi 435 436 # fixup 437 FDT_ADDR_R=`strings env/built-in.o | grep 'fdt_addr_r=' | awk -F "=" '{ print $2 }'` 438 KERNEL_ADDR_R=`strings env/built-in.o | grep 'kernel_addr_r=' | awk -F "=" '{ print $2 }'` 439 RMADISK_ADDR_R=`strings env/built-in.o | grep 'ramdisk_addr_r=' | awk -F "=" '{ print $2 }'` 440 sed -i "s/${FDT_ADDR_PLACEHOLDER}/${FDT_ADDR_R}/g" ${ITS_BOOT} 441 sed -i "s/${KERNEL_ADDR_PLACEHOLDER}/${KERNEL_ADDR_R}/g" ${ITS_BOOT} 442 sed -i "s/${RAMDISK_ADDR_PLACEHOLDER}/${RMADISK_ADDR_R}/g" ${ITS_BOOT} 443 444 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 445 VERSION=`grep 'rollback-index' ${ITS_BOOT} | awk -F '=' '{ printf $2 }' | tr -d ' '` 446 sed -i "s/rollback-index = ${VERSION}/rollback-index = <${ARG_ROLLBACK_IDX_BOOT}>;/g" ${ITS_BOOT} 447 fi 448 449 ${MKIMAGE} -f ${ITS_BOOT} -k ${KEY_DIR} -K ${UBOOT_DTB} -E -p ${OFFS_DATA} -r ${ITB_BOOT} -v ${ARG_VER_BOOT} 450 mv ${SIG_BIN} ${SIG_BOOT} 451 452 # rollback-index read back check 453 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 454 VERSION=`fdtget -ti ${ITB_BOOT} /configurations/conf rollback-index` 455 if [ "${VERSION}" != "${ARG_ROLLBACK_IDX_BOOT}" ]; then 456 echo "ERROR: Failed to set rollback-index for ${ITB_BOOT}"; 457 exit 1 458 fi 459 fi 460 461 # host check signature 462 if [ "${ARG_NO_CHECK}" != "y" ]; then 463 ${CHECK_SIGN} -f ${ITB_BOOT} -k ${UBOOT_DTB} 464 fi 465 466 # minimize u-boot.dtb: clearn as 0 but not remove property. 467 if grep -q '^CONFIG_FIT_HW_CRYPTO=y' .config ; then 468 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,r-squared 0x0 469 if grep -q '^CONFIG_ROCKCHIP_CRYPTO_V1=y' .config ; then 470 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 471 else 472 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 473 fi 474 else 475 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 476 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 477 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,exponent-BN 0x0 478 fi 479 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@c 480 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@np 481 fi 482 483 mv ${ITS_BOOT} ${FIT_DIR} 484} 485 486function fit_gen_recovery_itb() 487{ 488 if [ ! -z ${ARG_RECOVERY_IMG} ]; then 489 ${FIT_UNPACK} -f ${ARG_RECOVERY_IMG} -o ${FIT_DIR}/unpack 490 ITS_RECOVERY="${FIT_DIR}/unpack/image.its" 491 else 492 echo "ERROR: No recovery.img" 493 exit 1 494 fi 495 496 if [ "${ARG_SIGN}" != "y" ]; then 497 ${MKIMAGE} -f ${ITS_RECOVERY} -E -p ${OFFS_DATA} ${ITB_RECOVERY} -v ${ARG_VER_RECOVERY} 498 else 499 check_rsa_keys 500 501 check_rsa_algo ${ITS_RECOVERY} 502 503 if [ "${ARG_SIGN}" != "y" ]; then 504 echo "ERROR: CONFIG_FIT_SIGNATURE is disabled" 505 exit 1 506 fi 507 508 if grep -q '^CONFIG_FIT_ROLLBACK_PROTECT=y' .config ; then 509 ARG_ROLLBACK_PROTECT="y" 510 if [ -z ${ARG_ROLLBACK_IDX_RECOVERY} ]; then 511 echo "ERROR: No arg \"--rollback-index-recovery <n>\"" 512 exit 1 513 fi 514 if ! grep -q '^CONFIG_OPTEE_CLIENT=y' .config ; then 515 echo "ERROR: Don't support \"--rollback-index-recovery <n>\"" 516 exit 1 517 fi 518 fi 519 520 # fixup 521 FDT_ADDR_R=`strings env/built-in.o | grep 'fdt_addr_r=' | awk -F "=" '{ print $2 }'` 522 KERNEL_ADDR_R=`strings env/built-in.o | grep 'kernel_addr_r=' | awk -F "=" '{ print $2 }'` 523 RMADISK_ADDR_R=`strings env/built-in.o | grep 'ramdisk_addr_r=' | awk -F "=" '{ print $2 }'` 524 sed -i "s/${FDT_ADDR_PLACEHOLDER}/${FDT_ADDR_R}/g" ${ITS_RECOVERY} 525 sed -i "s/${KERNEL_ADDR_PLACEHOLDER}/${KERNEL_ADDR_R}/g" ${ITS_RECOVERY} 526 sed -i "s/${RAMDISK_ADDR_PLACEHOLDER}/${RMADISK_ADDR_R}/g" ${ITS_RECOVERY} 527 528 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 529 VERSION=`grep 'rollback-index' ${ITS_RECOVERY} | awk -F '=' '{ printf $2 }' | tr -d ' '` 530 sed -i "s/rollback-index = ${VERSION}/rollback-index = <${ARG_ROLLBACK_IDX_RECOVERY}>;/g" ${ITS_RECOVERY} 531 fi 532 533 ${MKIMAGE} -f ${ITS_RECOVERY} -k ${KEY_DIR} -K ${UBOOT_DTB} -E -p ${OFFS_DATA} -r ${ITB_RECOVERY} -v ${ARG_VER_RECOVERY} 534 mv ${SIG_BIN} ${SIG_RECOVERY} 535 536 # rollback-index read back check 537 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 538 VERSION=`fdtget -ti ${ITB_RECOVERY} /configurations/conf rollback-index` 539 if [ "${VERSION}" != "${ARG_ROLLBACK_IDX_RECOVERY}" ]; then 540 echo "ERROR: Failed to set rollback-index for ${ITB_RECOVERY}"; 541 exit 1 542 fi 543 fi 544 545 # host check signature 546 if [ "${ARG_NO_CHECK}" != "y" ]; then 547 ${CHECK_SIGN} -f ${ITB_RECOVERY} -k ${UBOOT_DTB} 548 fi 549 550 # minimize u-boot.dtb: clearn as 0 but not remove property. 551 if grep -q '^CONFIG_FIT_HW_CRYPTO=y' .config ; then 552 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,r-squared 0x0 553 if grep -q '^CONFIG_ROCKCHIP_CRYPTO_V1=y' .config ; then 554 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 555 else 556 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 557 fi 558 else 559 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 560 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 561 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,exponent-BN 0x0 562 fi 563 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@c 564 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@np 565 fi 566 567 mv ${ITS_RECOVERY} ${FIT_DIR} 568} 569 570function fit_gen_uboot_img() 571{ 572 ITB=$1 573 574 if [ -z ${ITB} ]; then 575 ITB=${ITB_UBOOT} 576 fi 577 578 ITB_MAX_NUM=`sed -n "/SPL_FIT_IMAGE_MULTIPLE/p" .config | awk -F "=" '{ print $2 }'` 579 ITB_MAX_KB=`sed -n "/SPL_FIT_IMAGE_KB/p" .config | awk -F "=" '{ print $2 }'` 580 ITB_MAX_BS=$((ITB_MAX_KB*1024)) 581 ITB_BS=`ls -l ${ITB} | awk '{ print $5 }'` 582 583 if [ ${ITB_BS} -gt ${ITB_MAX_BS} ]; then 584 echo "ERROR: pack ${IMG_UBOOT} failed! ${ITB} actual: ${ITB_BS} bytes, max limit: ${ITB_MAX_BS} bytes" 585 exit 1 586 fi 587 588 rm -f ${IMG_UBOOT} 589 for ((i = 0; i < ${ITB_MAX_NUM}; i++)); 590 do 591 cat ${ITB} >> ${IMG_UBOOT} 592 truncate -s %${ITB_MAX_KB}K ${IMG_UBOOT} 593 done 594} 595 596function fit_gen_boot_img() 597{ 598 ITB=$1 599 600 if [ -z ${ITB} ]; then 601 ITB=${ITB_BOOT} 602 fi 603 604 if [ "${ITB}" != "${IMG_BOOT}" ]; then 605 cp ${ITB} ${IMG_BOOT} -f 606 fi 607} 608 609function fit_gen_recovery_img() 610{ 611 ITB=$1 612 613 if [ -z ${ITB} ]; then 614 ITB=${ITB_RECOVERY} 615 fi 616 617 if [ "${ITB}" != "${IMG_RECOVERY}" ]; then 618 cp ${ITB} ${IMG_RECOVERY} -f 619 fi 620} 621 622function fit_gen_loader() 623{ 624 if [ "${ARG_SIGN}" == "y" ]; then 625 ${RK_SIGN_TOOL} cc --chip ${ARG_CHIP: 2: 6} 626 if grep -q '^CONFIG_SPL_REVOKE_PUB_KEY=y' .config ; then 627 ${RK_SIGN_TOOL} lk --key ${LEGACY_RSA_PRI_KEY} --pubkey ${LEGACY_RSA_PUB_KEY} 628 ${RK_SIGN_TOOL} ss --flag=0x80 629 else 630 ${RK_SIGN_TOOL} lk --key ${RSA_PRI_KEY} --pubkey ${RSA_PUB_KEY} 631 fi 632 if ls *loader*.bin >/dev/null 2>&1 ; then 633 ${RK_SIGN_TOOL} sl --loader *loader*.bin 634 fi 635 if ls *download*.bin >/dev/null 2>&1 ; then 636 ${RK_SIGN_TOOL} sl --loader *download*.bin 637 fi 638 if ls *idblock*.img >/dev/null 2>&1 ; then 639 ${RK_SIGN_TOOL} sb --idb *idblock*.img 640 fi 641 fi 642} 643 644function fit_msg_uboot() 645{ 646 if [ "${ARG_SIGN}" != "y" ]; then 647 MSG_SIGN="no-signed" 648 else 649 MSG_SIGN="signed" 650 fi 651 652 VERSION=`fdtget -ti ${ITB_UBOOT} / version` 653 if [ "${VERSION}" != "" ]; then 654 MSG_VER=", version=${VERSION}" 655 fi 656 657 if [ "${ARG_SPL_ROLLBACK_PROTECT}" == "y" ]; then 658 echo "Image(${MSG_SIGN}${MSG_VER}, rollback-index=${ARG_ROLLBACK_IDX_UBOOT}): ${IMG_UBOOT} (with uboot, trust...) is ready" 659 else 660 echo "Image(${MSG_SIGN}${MSG_VER}): ${IMG_UBOOT} (FIT with uboot, trust...) is ready" 661 fi 662} 663 664function fit_msg_boot() 665{ 666 if [ -z "${ARG_BOOT_IMG}" ]; then 667 return; 668 fi 669 670 if [ "${ARG_SIGN}" != "y" ]; then 671 MSG_SIGN="no-signed" 672 else 673 MSG_SIGN="signed" 674 fi 675 676 VERSION=`fdtget -ti ${ITB_BOOT} / version` 677 if [ "${VERSION}" != "" ]; then 678 MSG_VER=", version=${VERSION}" 679 fi 680 681 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 682 echo "Image(${MSG_SIGN}${MSG_VER}, rollback-index=${ARG_ROLLBACK_IDX_BOOT}): ${IMG_BOOT} is ready" 683 else 684 echo "Image(${MSG_SIGN}${MSG_VER}): ${IMG_BOOT} (FIT with kernel, fdt, resource...) is ready" 685 fi 686} 687 688function fit_msg_recovery() 689{ 690 if [ -z "${ARG_RECOVERY_IMG}" ]; then 691 return; 692 fi 693 694 if [ "${ARG_SIGN}" != "y" ]; then 695 MSG_SIGN="no-signed" 696 else 697 MSG_SIGN="signed" 698 fi 699 700 VERSION=`fdtget -ti ${ITB_RECOVERY} / version` 701 if [ "${VERSION}" != "" ]; then 702 MSG_VER=", version=${VERSION}" 703 fi 704 705 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 706 echo "Image(${MSG_SIGN}${MSG_VER}, rollback-index=${ARG_ROLLBACK_IDX_RECOVERY}): ${IMG_RECOVERY} is ready" 707 else 708 echo "Image(${MSG_SIGN}${MSG_VER}): ${IMG_RECOVERY} (FIT with kernel, fdt, resource...) is ready" 709 fi 710} 711 712function fit_msg_loader() 713{ 714 if ls *loader*.bin >/dev/null 2>&1 ; then 715 LOADER=`ls *loader*.bin` 716 fi 717 718 if ls *idblock*.img >/dev/null 2>&1 ; then 719 LOADER=`ls *idblock*.img` 720 fi 721 722 if [ "${ARG_SIGN}" == "y" ]; then 723 echo "Image(signed): ${LOADER} (with spl, ddr...) is ready" 724 else 725 echo "Image(no-signed): ${LOADER} (with spl, ddr...) is ready" 726 fi 727} 728 729function fit_msg_u_boot_loader() 730{ 731 if ls *loader*.bin >/dev/null 2>&1 ; then 732 LOADER=`ls *loader*.bin` 733 fi 734 735 if ls *idblock*.img >/dev/null 2>&1 ; then 736 LOADER=`ls *idblock*.img` 737 fi 738 739 if [ "${ARG_SIGN}" == "y" ]; then 740 echo "Image(signed): ${LOADER} (with u-boot, ddr...) is ready" 741 else 742 echo "Image(no-signed): ${LOADER} (with u-boot, ddr...) is ready" 743 fi 744} 745 746function fit_signcfg_export() 747{ 748 if [ "${ARG_NO_SIGN}" == "y" ]; then 749 if ls *loader*.bin >/dev/null 2>&1 ; then 750 LOADER=`ls *loader*.bin` 751 elif ls *download*.bin >/dev/null 2>&1 ; then 752 LOADER=`ls *download*.bin` 753 else 754 echo "ERROR: No loader found" 755 exit 1 756 fi 757 cp ${ARG_INI_LOADER} ${MINIALL_INI} 758 cp .config ${SIG_CONFIG} 759 760 mkdir -p ${SIG_CFG_DIR}/test_images/ 761 cp uboot.img ${SIG_CFG_DIR}/test_images/ 762 cp ${LOADER} ${SIG_CFG_DIR}/test_images/ 763 tar zcvf ${SIG_CFG_DIR}/test_images.tar.gz ${SIG_CFG_DIR}/test_images >/dev/null 2>&1 764 rm -rf ${SIG_CFG_DIR}/test_images/ 765 766 FDT_ADDR_R=`strings env/built-in.o | grep 'fdt_addr_r=' | awk -F "=" '{ print $2 }'` 767 KERNEL_ADDR_R=`strings env/built-in.o | grep 'kernel_addr_r=' | awk -F "=" '{ print $2 }'` 768 RMADISK_ADDR_R=`strings env/built-in.o | grep 'ramdisk_addr_r=' | awk -F "=" '{ print $2 }'` 769 echo "fdt_addr_r=${FDT_ADDR_R}" >> ${SIG_CONFIG} 770 echo "kernel_addr_r=${KERNEL_ADDR_R}" >> ${SIG_CONFIG} 771 echo "ramdisk_addr_r=${RMADISK_ADDR_R}" >> ${SIG_CONFIG} 772 773 CSUM=`sha256sum u-boot-nodtb.bin | awk '{ print $1 }'` 774 echo "uboot_sha256sum=${CSUM}" >> ${SIG_CONFIG} 775 CSUM=`sha256sum spl/u-boot-spl-nodtb.bin | awk '{ print $1 }'` 776 echo "spl_sha256sum=${CSUM}" >> ${SIG_CONFIG} 777 SIZE=`ls -l spl/u-boot-spl-nodtb.bin | awk '{ print $5 }'` 778 echo "spl_size=${SIZE}" >> ${SIG_CONFIG} 779 780 BUILD_MAIL=`git config --get user.email` 781 BUILD_HOST=`hostname` 782 BUILD_USER=${USER} 783 BUILD_DATE=`date` 784 echo "BUILD: ${BUILD_MAIL} # ${BUILD_USER}@${BUILD_HOST} # ${BUILD_DATE}" >> ${SIG_CONFIG} 785 fi 786} 787