xref: /rk3399_rockchip-uboot/scripts/fit-resign.sh (revision ee147fea37b5216568bf52e551c2df499ebd777c)

#!/bin/bash
#
# Copyright (c) 2020 Fuzhou Rockchip Electronics Co., Ltd
#
# SPDX-License-Identifier: GPL-2.0
#
set -e

# [Keys]
#	mkdir -p keys
#	openssl genpkey -algorithm RSA -out keys/dev.key -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:65537
#	openssl req -batch -new -x509 -key keys/dev.key -out keys/dev.crt
#	openssl rsa -in keys/dev.key -pubout -out keys/dev.pubkey
# [Sign]
#	openssl dgst -sha256 -sign keys/dev.key -sigopt rsa_padding_mode:pss -out sha256-rsa2048.sign fit/boot.data2sign

IMG_UBOOT="uboot.img"
IMG_BOOT="boot.img"

function usage_resign()
{
	echo
	echo "usage:"
	echo "    $0 -f [itb] -s [sig]"
	echo
}

function fit_resign()
{
	if [ $# -ne 4 ]; then
		usage_resign
		exit 1
	fi

	while [ $# -gt 0 ]; do
		case $1 in
			-f)
				ITB=$2
				shift 2
				;;
			-s)
				SIG=$2
				shift 2
				;;
			*)
				usage_resign
				exit 1
				;;
		esac
	done

	if [ ! -f ${ITB} ]; then
		echo "ERROR: No ${ITB}"
		exit 1
	elif ! file ${ITB} | grep 'Device Tree Blob' ; then
		echo "ERROR: ${ITB} is not FIT image"
		exit 1
	elif [ ! -f ${SIG} ]; then
		echo "ERROR: No ${SIG}"
		exit 1
	fi

	copies=`strings ${ITB} | grep "signer-version"  | wc -l`
	if [ ${copies} -ne 1 ]; then
		echo "ERROR: ${ITB} seems not a itb but a image, ${copies}"
		exit 1
	fi

	SIG_SZ=`ls -l ${SIG} | awk '{ print $5 }'`
	LEN=`./tools/fit_info -f ${ITB} -n /configurations/conf/signature -p value | sed -n "/LEN:/p" | awk '{ print $2 }'`
	OFF=`./tools/fit_info -f ${ITB} -n /configurations/conf/signature -p value | sed -n "/OFF:/p" | awk '{ print $2 }'`
	END=`./tools/fit_info -f ${ITB} -n /configurations/conf/signature -p value | sed -n "/END:/p" | awk '{ print $2 }'`

	if [ -z ${LEN} ]; then
		echo "ERROR: No signature in ${ITB}"
		exit 1
		strings uboot.img | grep "rollback-index" | wc -l
	elif [ "${SIG_SZ}" -ne "${LEN}" ]; then
		echo "ERROR: ${SIG} size ${SIG_SZ} != ${ITB} Signature size ${LEN}"
		exit 1
	fi

	dd if=${ITB} of=${ITB}.half1 count=1 bs=${OFF}
	dd if=${ITB} of=${ITB}.half2 skip=1 ibs=${END}

	ITB_RESIGN="${ITB}.resign"
	cat ${ITB}.half1  >  ${ITB_RESIGN}
	cat ${SIG}        >> ${ITB_RESIGN}
	cat ${ITB}.half2  >> ${ITB_RESIGN}
	echo

	if fdtget -l ${ITB_RESIGN} /images/uboot >/dev/null 2>&1 ; then
		ITB_MAX_NUM=`sed -n "/SPL_FIT_IMAGE_MULTIPLE/p" .config | awk -F "=" '{ print $2 }'`
		ITB_MAX_KB=`sed  -n "/SPL_FIT_IMAGE_KB/p" .config | awk -F "=" '{ print $2 }'`
		ITB_MAX_BS=$((ITB_MAX_KB*1024))
		ITB_BS=`ls -l ${ITB} | awk '{ print $5 }'`
		if [ ${ITB_BS} -gt ${ITB_MAX_BS} ]; then
			echo "ERROR: pack ${IMG_UBOOT} failed! ${ITB} actual: ${ITB_BS} bytes, max limit: ${ITB_MAX_BS} bytes"
			exit 1
		fi

		rm -f ${IMG_UBOOT}
		for ((i = 0; i < ${ITB_MAX_NUM}; i++));
		do
			cat ${ITB_RESIGN} >> ${IMG_UBOOT}
			truncate -s %${ITB_MAX_KB}K ${IMG_UBOOT}
		done
		echo "Image(re-signed):  ${IMG_UBOOT} is ready"
	else
		cp ${ITB_RESIGN} ${IMG_BOOT}
		echo "Image(re-signed):  ${IMG_BOOT} is ready"
	fi

	rm -f ${ITB}.half1 ${ITB}.half2 ${ITB_RESIGN}
}

fit_resign $*