1#!/bin/bash 2# 3# Copyright (c) 2020 Fuzhou Rockchip Electronics Co., Ltd 4# 5# SPDX-License-Identifier: GPL-2.0 6# 7set -e 8 9# [Keys] 10# mkdir -p keys 11# openssl genpkey -algorithm RSA -out keys/dev.key -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:65537 12# openssl req -batch -new -x509 -key keys/dev.key -out keys/dev.crt 13# [Sign] 14# openssl dgst -sha256 -sign keys/dev.key -sigopt rsa_padding_mode:pss -out sha256-rsa2048.sign fit/boot.data2sign 15 16IMG_UBOOT="uboot.img" 17IMG_BOOT="boot.img" 18 19function usage_resign() 20{ 21 echo 22 echo "usage:" 23 echo " $0 -f [itb] -s [sig]" 24 echo 25} 26 27function fit_resign() 28{ 29 if [ $# -ne 4 ]; then 30 usage_resign 31 exit 1 32 fi 33 34 while [ $# -gt 0 ]; do 35 case $1 in 36 -f) 37 ITB=$2 38 shift 2 39 ;; 40 -s) 41 SIG=$2 42 shift 2 43 ;; 44 *) 45 usage_resign 46 exit 1 47 ;; 48 esac 49 done 50 51 if [ ! -f ${ITB} ]; then 52 echo "ERROR: No ${ITB}" 53 exit 1 54 elif ! file ${ITB} | grep 'Device Tree Blob' ; then 55 echo "ERROR: ${ITB} is not FIT image" 56 exit 1 57 elif [ ! -f ${SIG} ]; then 58 echo "ERROR: No ${SIG}" 59 exit 1 60 fi 61 62 copies=`strings ${ITB} | grep "signer-version" | wc -l` 63 if [ ${copies} -ne 1 ]; then 64 echo "ERROR: ${ITB} seems not a itb but a image, ${copies}" 65 exit 1 66 fi 67 68 SIG_SZ=`ls -l ${SIG} | awk '{ print $5 }'` 69 LEN=`./tools/fit_info -f ${ITB} -n /configurations/conf/signature -p value | sed -n "/LEN:/p" | awk '{ print $2 }'` 70 OFF=`./tools/fit_info -f ${ITB} -n /configurations/conf/signature -p value | sed -n "/OFF:/p" | awk '{ print $2 }'` 71 END=`./tools/fit_info -f ${ITB} -n /configurations/conf/signature -p value | sed -n "/END:/p" | awk '{ print $2 }'` 72 73 if [ -z ${LEN} ]; then 74 echo "ERROR: No signature in ${ITB}" 75 exit 1 76 strings uboot.img | grep "rollback-index" | wc -l 77 elif [ "${SIG_SZ}" -ne "${LEN}" ]; then 78 echo "ERROR: ${SIG} size ${SIG_SZ} != ${ITB} Signature size ${LEN}" 79 exit 1 80 fi 81 82 dd if=${ITB} of=${ITB}.half1 count=1 bs=${OFF} 83 dd if=${ITB} of=${ITB}.half2 skip=1 ibs=${END} 84 85 ITB_RESIGN="${ITB}.resign" 86 cat ${ITB}.half1 > ${ITB_RESIGN} 87 cat ${SIG} >> ${ITB_RESIGN} 88 cat ${ITB}.half2 >> ${ITB_RESIGN} 89 echo 90 91 if fdtget -l ${ITB_RESIGN} /images/uboot >/dev/null 2>&1 ; then 92 ITB_MAX_NUM=`sed -n "/SPL_FIT_IMAGE_MULTIPLE/p" .config | awk -F "=" '{ print $2 }'` 93 ITB_MAX_KB=`sed -n "/SPL_FIT_IMAGE_KB/p" .config | awk -F "=" '{ print $2 }'` 94 ITB_MAX_BS=$((ITB_MAX_KB*1024)) 95 ITB_BS=`ls -l ${ITB} | awk '{ print $5 }'` 96 if [ ${ITB_BS} -gt ${ITB_MAX_BS} ]; then 97 echo "ERROR: pack ${IMG_UBOOT} failed! ${ITB} actual: ${ITB_BS} bytes, max limit: ${ITB_MAX_BS} bytes" 98 exit 1 99 fi 100 101 rm -f ${IMG_UBOOT} 102 for ((i = 0; i < ${ITB_MAX_NUM}; i++)); 103 do 104 cat ${ITB_RESIGN} >> ${IMG_UBOOT} 105 truncate -s %${ITB_MAX_KB}K ${IMG_UBOOT} 106 done 107 echo "Image(re-signed): ${IMG_UBOOT} is ready" 108 else 109 cp ${ITB_RESIGN} ${IMG_BOOT} 110 echo "Image(re-signed): ${IMG_BOOT} is ready" 111 fi 112 113 rm -f ${ITB}.half1 ${ITB}.half2 ${ITB_RESIGN} 114} 115 116fit_resign $* 117 118