1#!/bin/bash 2# 3# Copyright (c) 2020 Fuzhou Rockchip Electronics Co., Ltd 4# 5# SPDX-License-Identifier: GPL-2.0 6# 7set -e 8 9FIT_DIR="fit" 10IMG_UBOOT="uboot.img" 11IMG_BOOT="boot.img" 12IMG_RECOVERY="recovery.img" 13ITB_UBOOT="${FIT_DIR}/uboot.itb" 14ITB_BOOT="${FIT_DIR}/boot.itb" 15ITB_RECOVERY="${FIT_DIR}/recovery.itb" 16SIG_BIN="data2sign.bin" 17SIG_UBOOT="${FIT_DIR}/uboot.data2sign" 18SIG_BOOT="${FIT_DIR}/boot.data2sign" 19SIG_RECOVERY="${FIT_DIR}/recovery.data2sign" 20# offs 21OFFS_DATA="0x1000" 22# file 23CHIP_FILE="arch/arm/lib/.asm-offsets.s.cmd" 24# placeholder address 25FDT_ADDR_PLACEHOLDER="0xffffff00" 26KERNEL_ADDR_PLACEHOLDER="0xffffff01" 27RAMDISK_ADDR_PLACEHOLDER="0xffffff02" 28# tools 29MKIMAGE="./tools/mkimage" 30RK_SIGN_TOOL="../rkbin/tools/rk_sign_tool" 31FIT_UNPACK="./scripts/fit-unpack.sh" 32CHECK_SIGN="./tools/fit_check_sign" 33# key 34KEY_DIR="keys/" 35RSA_PRI_KEY="keys/dev.key" 36RSA_PUB_KEY="keys/dev.pubkey" 37RSA_CRT_KEY="keys/dev.crt" 38SIGNATURE_KEY_NODE="/signature/key-dev" 39SPL_DTB="spl/u-boot-spl.dtb" 40UBOOT_DTB="u-boot.dtb" 41# its 42ITS_UBOOT="u-boot.its" 43ITS_BOOT="boot.its" 44ITS_RECOVERY="recovery.its" 45ARG_VER_UBOOT="0" 46ARG_VER_BOOT="0" 47ARG_VER_RECOVERY="0" 48 49function help() 50{ 51 echo 52 echo "usage:" 53 echo " $0 [args]" 54 echo 55 echo "args:" 56 echo " --rollback-index-recovery <decimal integer>" 57 echo " --rollback-index-boot <decimal integer>" 58 echo " --rollback-index-uboot <decimal integer>" 59 echo " --version-recovery <decimal integer>" 60 echo " --version-boot <decimal integer>" 61 echo " --version-uboot <decimal integer>" 62 echo " --boot_img <boot image>" 63 echo " --recovery_img <recovery image>" 64 echo " --args <arg>" 65 echo " --ini-loader <loader ini file>" 66 echo " --ini-trust <trust ini file>" 67 echo " --no-check" 68 echo " --spl-new" 69 echo 70} 71 72function arg_check_decimal() 73{ 74 if [ -z $1 ]; then 75 help 76 exit 1 77 fi 78 79 decimal=`echo $1 |sed 's/[0-9]//g'` 80 if [ ! -z ${decimal} ]; then 81 echo "ERROR: $1 is not decimal integer" 82 help 83 exit 1 84 fi 85} 86 87function check_its() 88{ 89 cat $1 | while read line 90 do 91 file=`echo ${line} | sed -n "/incbin/p" | awk -F '"' '{ printf $2 }' | tr -d ' '` 92 if [ ! -f ${file} ]; then 93 echo "ERROR: No ${file}" 94 exit 1 95 fi 96 done 97} 98 99function check_rsa_keys() 100{ 101 if [ ! -f ${RSA_PRI_KEY} ]; then 102 echo "ERROR: No ${RSA_PRI_KEY} " 103 exit 1 104 elif [ ! -f ${RSA_PUB_KEY} ]; then 105 echo "ERROR: No ${RSA_PUB_KEY} " 106 exit 1 107 elif [ ! -f ${RSA_CRT_KEY} ]; then 108 echo "ERROR: No ${RSA_CRT_KEY} " 109 exit 1 110 fi 111} 112 113function validate_arg() 114{ 115 case $1 in 116 --no-check|--spl-new|--burn-key-hash) 117 shift=1 118 ;; 119 --ini-trust|--ini-loader|--rollback-index-boot|--rollback-index-recovery|--rollback-index-uboot|--boot_img|--recovery_img|--version-uboot|--version-boot|--version-recovery|--chip) 120 shift=2 121 ;; 122 *) 123 shift=0 124 ;; 125 esac 126 echo ${shift} 127} 128 129function fit_process_args() 130{ 131 if [ $# -eq 0 ]; then 132 help 133 exit 0 134 fi 135 136 while [ $# -gt 0 ]; do 137 case $1 in 138 --args) 139 ARG_VALIDATE=$2 140 shift 2 141 ;; 142 --boot_img) # boot.img 143 ARG_BOOT_IMG=$2 144 shift 2 145 ;; 146 --chip) 147 ARG_CHIP=$2 148 shift 2 149 ;; 150 --recovery_img) # recovery.img 151 ARG_RECOVERY_IMG=$2 152 shift 2 153 ;; 154 --boot_img_dir) # boot.img components directory 155 ARG_BOOT_IMG_DIR=$2 156 shift 2 157 ;; 158 --no-check) # No hostcc fit signature check 159 ARG_NO_CHECK="y" 160 shift 1 161 ;; 162 --ini-trust) # Assign trust ini file 163 ARG_INI_TRUST=$2 164 shift 2 165 ;; 166 --ini-loader) # Assign loader ini file 167 ARG_INI_LOADER=$2 168 shift 2 169 ;; 170 --spl-new) # Use current build u-boot-spl.bin to pack loader 171 ARG_SPL_NEW="y" 172 shift 1 173 ;; 174 --rollback-index-boot) 175 ARG_ROLLBACK_IDX_BOOT=$2 176 arg_check_decimal $2 177 shift 2 178 ;; 179 --rollback-index-recovery) 180 ARG_ROLLBACK_IDX_RECOVERY=$2 181 arg_check_decimal $2 182 shift 2 183 ;; 184 --rollback-index-uboot) 185 ARG_ROLLBACK_IDX_UBOOT=$2 186 arg_check_decimal $2 187 shift 2 188 ;; 189 --version-uboot) 190 ARG_VER_UBOOT=$2 191 arg_check_decimal $2 192 shift 2 193 ;; 194 --version-boot) 195 ARG_VER_BOOT=$2 196 arg_check_decimal $2 197 shift 2 198 ;; 199 --version-recovery) 200 ARG_VER_RECOVERY=$2 201 arg_check_decimal $2 202 shift 2 203 ;; 204 --burn-key-hash) 205 ARG_BURN_KEY_HASH="y" 206 shift 1 207 ;; 208 *) 209 help 210 exit 1 211 ;; 212 esac 213 done 214 215 if grep -q '^CONFIG_FIT_SIGNATURE=y' .config ; then 216 ARG_SIGN="y" 217 fi 218} 219 220function fit_raw_compile() 221{ 222 # Verified-boot: should rebuild code but don't need to repack images. 223 if [ "${ARG_SIGN}" == "y" ]; then 224 ./make.sh --raw-compile 225 fi 226 rm ${FIT_DIR} -rf && mkdir -p ${FIT_DIR} 227} 228 229function fit_gen_uboot_itb() 230{ 231 # generate u-boot.its file 232 ./make.sh itb ${ARG_INI_TRUST} 233 234 # check existance of file in its 235 check_its ${ITS_UBOOT} 236 237 if [ "${ARG_SIGN}" != "y" ]; then 238 ${MKIMAGE} -f ${ITS_UBOOT} -E -p ${OFFS_DATA} ${ITB_UBOOT} -v ${ARG_VER_UBOOT} 239 if [ "${ARG_SPL_NEW}" == "y" ]; then 240 ./make.sh --spl ${ARG_INI_LOADER} 241 echo "pack loader with new: spl/u-boot-spl.bin" 242 else 243 ./make.sh loader ${ARG_INI_LOADER} 244 fi 245 else 246 check_rsa_keys 247 248 if ! grep -q '^CONFIG_SPL_FIT_SIGNATURE=y' .config ; then 249 echo "ERROR: CONFIG_SPL_FIT_SIGNATURE is disabled" 250 exit 1 251 fi 252 253 # rollback-index 254 if grep -q '^CONFIG_SPL_FIT_ROLLBACK_PROTECT=y' .config ; then 255 ARG_SPL_ROLLBACK_PROTECT="y" 256 if [ -z ${ARG_ROLLBACK_IDX_UBOOT} ]; then 257 echo "ERROR: No arg \"--rollback-index-uboot <n>\"" 258 exit 1 259 fi 260 fi 261 262 if [ "${ARG_SPL_ROLLBACK_PROTECT}" == "y" ]; then 263 VERSION=`grep 'rollback-index' ${ITS_UBOOT} | awk -F '=' '{ printf $2 }' | tr -d ' '` 264 sed -i "s/rollback-index = ${VERSION}/rollback-index = <${ARG_ROLLBACK_IDX_UBOOT}>;/g" ${ITS_UBOOT} 265 fi 266 267 # Generally, boot.img is signed before uboot.img, so the ras key can be found 268 # in u-boot.dtb. If not found, let's insert rsa key anyway. 269 if ! fdtget -l ${UBOOT_DTB} /signature >/dev/null 2>&1 ; then 270 ${MKIMAGE} -f ${ITS_UBOOT} -k ${KEY_DIR} -K ${UBOOT_DTB} -E -p ${OFFS_DATA} -r ${ITB_UBOOT} -v ${ARG_VER_UBOOT} 271 echo "## Adding RSA public key into ${UBOOT_DTB}" 272 fi 273 274 # Pack 275 ${MKIMAGE} -f ${ITS_UBOOT} -k ${KEY_DIR} -K ${SPL_DTB} -E -p ${OFFS_DATA} -r ${ITB_UBOOT} -v ${ARG_VER_UBOOT} 276 mv ${SIG_BIN} ${SIG_UBOOT} 277 278 # burn-key-hash 279 if [ "${ARG_BURN_KEY_HASH}" == "y" ]; then 280 if grep -q '^CONFIG_SPL_FIT_HW_CRYPTO=y' .config ; then 281 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} burn-key-hash 0x1 282 else 283 echo "ERROR: --burn-key-hash requires CONFIG_SPL_FIT_HW_CRYPTO=y" 284 exit 1 285 fi 286 fi 287 288 # rollback-index read back check 289 if [ "${ARG_SPL_ROLLBACK_PROTECT}" == "y" ]; then 290 VERSION=`fdtget -ti ${ITB_UBOOT} /configurations/conf rollback-index` 291 if [ "${VERSION}" != "${ARG_ROLLBACK_IDX_UBOOT}" ]; then 292 echo "ERROR: Failed to set rollback-index for ${ITB_UBOOT}"; 293 exit 1 294 fi 295 fi 296 297 # burn-key-hash read back check 298 if [ "${ARG_BURN_KEY_HASH}" == "y" ]; then 299 if [ "`fdtget -ti ${SPL_DTB} ${SIGNATURE_KEY_NODE} burn-key-hash`" != "1" ]; then 300 echo "ERROR: Failed to set burn-key-hash for ${SPL_DTB}"; 301 exit 1 302 fi 303 fi 304 305 # host check signature 306 if [ "${ARG_NO_CHECK}" != "y" ]; then 307 if [ "${ARG_SPL_NEW}" == "y" ]; then 308 ${CHECK_SIGN} -f ${ITB_UBOOT} -k ${SPL_DTB} -s 309 else 310 spl_file="../rkbin/"`sed -n "/FlashBoot=/s/FlashBoot=//p" ${ARG_INI_LOADER} |tr -d '\r'` 311 offs=`fdtdump -s ${spl_file} | head -1 | awk -F ":" '{ print $2 }' | sed "s/ found fdt at offset //g" | tr -d " "` 312 if [ -z ${offs} ]; then 313 echo "ERROR: invalid ${spl_file} , unable to find fdt blob" 314 fi 315 offs=`printf %d ${offs} ` # hex -> dec 316 dd if=${spl_file} of=spl/u-boot-spl-old.dtb bs=${offs} skip=1 >/dev/null 2>&1 317 ${CHECK_SIGN} -f ${ITB_UBOOT} -k spl/u-boot-spl-old.dtb -s 318 fi 319 fi 320 321 # minimize u-boot-spl.dtb: clear as 0 but not remove property. 322 if grep -q '^CONFIG_SPL_FIT_HW_CRYPTO=y' .config ; then 323 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,r-squared 0x0 324 if grep -q '^CONFIG_SPL_ROCKCHIP_CRYPTO_V1=y' .config ; then 325 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 326 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@np 327 else 328 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 329 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@c 330 fi 331 else 332 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 333 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 334 fdtput -tx ${SPL_DTB} ${SIGNATURE_KEY_NODE} rsa,exponent-BN 0x0 335 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@c 336 fdtput -r ${SPL_DTB} ${SIGNATURE_KEY_NODE}/hash@np 337 fi 338 339 # repack spl 340 rm -f *_loader_*.bin 341 if [ "${ARG_SPL_NEW}" == "y" ]; then 342 cat spl/u-boot-spl-nodtb.bin > spl/u-boot-spl.bin 343 if ! grep -q '^CONFIG_SPL_SEPARATE_BSS=y' .config ; then 344 cat spl/u-boot-spl-pad.bin >> spl/u-boot-spl.bin 345 fi 346 cat ${SPL_DTB} >> spl/u-boot-spl.bin 347 348 ./make.sh --spl ${ARG_INI_LOADER} 349 echo "## pack loader with new: spl/u-boot-spl.bin" 350 else 351 ./make.sh loader ${ARG_INI_LOADER} 352 fi 353 354 if [ "${ARG_BURN_KEY_HASH}" == "y" ]; then 355 echo "## ${SPL_DTB}: burn-key-hash=1" 356 fi 357 fi 358 359 rm -f u-boot.itb u-boot.img u-boot-dtb.img 360 mv ${ITS_UBOOT} ${FIT_DIR} 361} 362 363function fit_gen_boot_itb() 364{ 365 if [ ! -z ${ARG_BOOT_IMG} ]; then 366 ${FIT_UNPACK} -f ${ARG_BOOT_IMG} -o ${FIT_DIR}/unpack 367 ITS_BOOT="${FIT_DIR}/unpack/image.its" 368 else 369 compression=`awk -F"," '/COMPRESSION=/ { printf $1 }' ${ARG_INI_TRUST} | tr -d ' ' | cut -c 13-` 370 if [ -z "${compression}" ]; then 371 compression="none" 372 fi 373 ./arch/arm/mach-rockchip/make_fit_boot.sh -c ${compression} > ${ITS_BOOT} 374 check_its ${ITS_BOOT} 375 fi 376 377 if [ "${ARG_SIGN}" != "y" ]; then 378 ${MKIMAGE} -f ${ITS_BOOT} -E -p ${OFFS_DATA} ${ITB_BOOT} -v ${ARG_VER_BOOT} 379 else 380 check_rsa_keys 381 382 if ! grep -q '^CONFIG_FIT_SIGNATURE=y' .config ; then 383 echo "ERROR: CONFIG_FIT_SIGNATURE is disabled" 384 exit 1 385 fi 386 387 if grep -q '^CONFIG_FIT_ROLLBACK_PROTECT=y' .config ; then 388 ARG_ROLLBACK_PROTECT="y" 389 if [ -z ${ARG_ROLLBACK_IDX_BOOT} ]; then 390 echo "ERROR: No arg \"--rollback-index-boot <n>\"" 391 exit 1 392 fi 393 fi 394 395 # fixup 396 COMMON_FILE=`sed -n "/_common.h/p" ${CHIP_FILE} | awk '{ print $1 }'` 397 FDT_ADDR_R=`awk /fdt_addr_r/ ${COMMON_FILE} | awk -F '=' '{ print $2 }' | awk -F '\\' '{ print $1 }'` 398 KERNEL_ADDR_R=`awk /kernel_addr_r/ ${COMMON_FILE} | awk -F '=' '{ print $2 }' | awk -F '\\' '{ print $1 }'` 399 RMADISK_ADDR_R=`awk /ramdisk_addr_r/ ${COMMON_FILE} | awk -F '=' '{ print $2 }' | awk -F '\\' '{ print $1 }'` 400 sed -i "s/${FDT_ADDR_PLACEHOLDER}/${FDT_ADDR_R}/g" ${ITS_BOOT} 401 sed -i "s/${KERNEL_ADDR_PLACEHOLDER}/${KERNEL_ADDR_R}/g" ${ITS_BOOT} 402 sed -i "s/${RAMDISK_ADDR_PLACEHOLDER}/${RMADISK_ADDR_R}/g" ${ITS_BOOT} 403 if grep -q '^CONFIG_ARM64=y' .config ; then 404 sed -i 's/arch = "arm";/arch = "arm64";/g' ${ITS_BOOT} 405 fi 406 407 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 408 VERSION=`grep 'rollback-index' ${ITS_BOOT} | awk -F '=' '{ printf $2 }' | tr -d ' '` 409 sed -i "s/rollback-index = ${VERSION}/rollback-index = <${ARG_ROLLBACK_IDX_BOOT}>;/g" ${ITS_BOOT} 410 fi 411 412 ${MKIMAGE} -f ${ITS_BOOT} -k ${KEY_DIR} -K ${UBOOT_DTB} -E -p ${OFFS_DATA} -r ${ITB_BOOT} -v ${ARG_VER_BOOT} 413 mv ${SIG_BIN} ${SIG_BOOT} 414 415 # rollback-index read back check 416 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 417 VERSION=`fdtget -ti ${ITB_BOOT} /configurations/conf rollback-index` 418 if [ "${VERSION}" != "${ARG_ROLLBACK_IDX_BOOT}" ]; then 419 echo "ERROR: Failed to set rollback-index for ${ITB_BOOT}"; 420 exit 1 421 fi 422 fi 423 424 # host check signature 425 if [ "${ARG_NO_CHECK}" != "y" ]; then 426 ${CHECK_SIGN} -f ${ITB_BOOT} -k ${UBOOT_DTB} 427 fi 428 429 # minimize u-boot.dtb: clearn as 0 but not remove property. 430 if grep -q '^CONFIG_FIT_HW_CRYPTO=y' .config ; then 431 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,r-squared 0x0 432 if grep -q '^CONFIG_ROCKCHIP_CRYPTO_V1=y' .config ; then 433 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 434 else 435 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 436 fi 437 else 438 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 439 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 440 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,exponent-BN 0x0 441 fi 442 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@c 443 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@np 444 fi 445 446 mv ${ITS_BOOT} ${FIT_DIR} 447} 448 449function fit_gen_recovery_itb() 450{ 451 if [ ! -z ${ARG_RECOVERY_IMG} ]; then 452 ${FIT_UNPACK} -f ${ARG_RECOVERY_IMG} -o ${FIT_DIR}/unpack 453 ITS_RECOVERY="${FIT_DIR}/unpack/image.its" 454 else 455 echo "ERROR: No recovery.img" 456 exit 1 457 fi 458 459 if [ "${ARG_SIGN}" != "y" ]; then 460 ${MKIMAGE} -f ${ITS_RECOVERY} -E -p ${OFFS_DATA} ${ITB_RECOVERY} -v ${ARG_VER_RECOVERY} 461 else 462 check_rsa_keys 463 464 if ! grep -q '^CONFIG_FIT_SIGNATURE=y' .config ; then 465 echo "ERROR: CONFIG_FIT_SIGNATURE is disabled" 466 exit 1 467 fi 468 469 if grep -q '^CONFIG_FIT_ROLLBACK_PROTECT=y' .config ; then 470 ARG_ROLLBACK_PROTECT="y" 471 if [ -z ${ARG_ROLLBACK_IDX_RECOVERY} ]; then 472 echo "ERROR: No arg \"--rollback-index-recovery <n>\"" 473 exit 1 474 fi 475 fi 476 477 # fixup 478 COMMON_FILE=`sed -n "/_common.h/p" ${CHIP_FILE} | awk '{ print $1 }'` 479 FDT_ADDR_R=`awk /fdt_addr_r/ ${COMMON_FILE} | awk -F '=' '{ print $2 }' | awk -F '\\' '{ print $1 }'` 480 KERNEL_ADDR_R=`awk /kernel_addr_r/ ${COMMON_FILE} | awk -F '=' '{ print $2 }' | awk -F '\\' '{ print $1 }'` 481 RMADISK_ADDR_R=`awk /ramdisk_addr_r/ ${COMMON_FILE} | awk -F '=' '{ print $2 }' | awk -F '\\' '{ print $1 }'` 482 sed -i "s/${FDT_ADDR_PLACEHOLDER}/${FDT_ADDR_R}/g" ${ITS_RECOVERY} 483 sed -i "s/${KERNEL_ADDR_PLACEHOLDER}/${KERNEL_ADDR_R}/g" ${ITS_RECOVERY} 484 sed -i "s/${RAMDISK_ADDR_PLACEHOLDER}/${RMADISK_ADDR_R}/g" ${ITS_RECOVERY} 485 if grep -q '^CONFIG_ARM64=y' .config ; then 486 sed -i 's/arch = "arm";/arch = "arm64";/g' ${ITS_RECOVERY} 487 fi 488 489 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 490 VERSION=`grep 'rollback-index' ${ITS_RECOVERY} | awk -F '=' '{ printf $2 }' | tr -d ' '` 491 sed -i "s/rollback-index = ${VERSION}/rollback-index = <${ARG_ROLLBACK_IDX_RECOVERY}>;/g" ${ITS_RECOVERY} 492 fi 493 494 ${MKIMAGE} -f ${ITS_RECOVERY} -k ${KEY_DIR} -K ${UBOOT_DTB} -E -p ${OFFS_DATA} -r ${ITB_RECOVERY} -v ${ARG_VER_RECOVERY} 495 mv ${SIG_BIN} ${SIG_RECOVERY} 496 497 # rollback-index read back check 498 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 499 VERSION=`fdtget -ti ${ITB_RECOVERY} /configurations/conf rollback-index` 500 if [ "${VERSION}" != "${ARG_ROLLBACK_IDX_RECOVERY}" ]; then 501 echo "ERROR: Failed to set rollback-index for ${ITB_RECOVERY}"; 502 exit 1 503 fi 504 fi 505 506 # host check signature 507 if [ "${ARG_NO_CHECK}" != "y" ]; then 508 ${CHECK_SIGN} -f ${ITB_RECOVERY} -k ${UBOOT_DTB} 509 fi 510 511 # minimize u-boot.dtb: clearn as 0 but not remove property. 512 if grep -q '^CONFIG_FIT_HW_CRYPTO=y' .config ; then 513 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,r-squared 0x0 514 if grep -q '^CONFIG_ROCKCHIP_CRYPTO_V1=y' .config ; then 515 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 516 else 517 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 518 fi 519 else 520 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,c 0x0 521 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,np 0x0 522 fdtput -tx ${UBOOT_DTB} ${SIGNATURE_KEY_NODE} rsa,exponent-BN 0x0 523 fi 524 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@c 525 fdtput -r ${UBOOT_DTB} ${SIGNATURE_KEY_NODE}/hash@np 526 fi 527 528 mv ${ITS_RECOVERY} ${FIT_DIR} 529} 530 531function fit_gen_uboot_img() 532{ 533 ITB=$1 534 535 if [ -z ${ITB} ]; then 536 ITB=${ITB_UBOOT} 537 fi 538 539 ITB_MAX_NUM=`sed -n "/SPL_FIT_IMAGE_MULTIPLE/p" .config | awk -F "=" '{ print $2 }'` 540 ITB_MAX_KB=`sed -n "/SPL_FIT_IMAGE_KB/p" .config | awk -F "=" '{ print $2 }'` 541 ITB_MAX_BS=$((ITB_MAX_KB*1024)) 542 ITB_BS=`ls -l ${ITB} | awk '{ print $5 }'` 543 544 if [ ${ITB_BS} -gt ${ITB_MAX_BS} ]; then 545 echo "ERROR: pack ${IMG_UBOOT} failed! ${ITB} actual: ${ITB_BS} bytes, max limit: ${ITB_MAX_BS} bytes" 546 exit 1 547 fi 548 549 rm -f ${IMG_UBOOT} 550 for ((i = 0; i < ${ITB_MAX_NUM}; i++)); 551 do 552 cat ${ITB} >> ${IMG_UBOOT} 553 truncate -s %${ITB_MAX_KB}K ${IMG_UBOOT} 554 done 555} 556 557function fit_gen_boot_img() 558{ 559 ITB=$1 560 561 if [ -z ${ITB} ]; then 562 ITB=${ITB_BOOT} 563 fi 564 565 if [ "${ITB}" != "${IMG_BOOT}" ]; then 566 cp ${ITB} ${IMG_BOOT} -f 567 fi 568} 569 570function fit_gen_recovery_img() 571{ 572 ITB=$1 573 574 if [ -z ${ITB} ]; then 575 ITB=${ITB_RECOVERY} 576 fi 577 578 if [ "${ITB}" != "${IMG_RECOVERY}" ]; then 579 cp ${ITB} ${IMG_RECOVERY} -f 580 fi 581} 582 583function fit_gen_loader() 584{ 585 if grep -Eq '^CONFIG_FIT_SIGNATURE=y' .config ; then 586 ${RK_SIGN_TOOL} cc --chip ${ARG_CHIP: 2: 6} 587 ${RK_SIGN_TOOL} sl --key ${RSA_PRI_KEY} --pubkey ${RSA_PUB_KEY} --loader *_loader_*.bin 588 if [ $? -ne 0 ]; then 589 echo "ERROR: ${RK_SIGN_TOOL} failed to sign loader" 590 exit 1 591 fi 592 fi 593} 594 595function fit_msg_uboot() 596{ 597 if [ "${ARG_SIGN}" != "y" ]; then 598 MSG_SIGN="no-signed" 599 else 600 MSG_SIGN="signed" 601 fi 602 603 VERSION=`fdtget -ti ${ITB_UBOOT} / version` 604 if [ "${VERSION}" != "" ]; then 605 MSG_VER=", version=${VERSION}" 606 fi 607 608 if [ "${ARG_SPL_ROLLBACK_PROTECT}" == "y" ]; then 609 echo "Image(${MSG_SIGN}${MSG_VER}, rollback-index=${ARG_ROLLBACK_IDX_UBOOT}): ${IMG_UBOOT} (with uboot, trust...) is ready" 610 else 611 echo "Image(${MSG_SIGN}${MSG_VER}): ${IMG_UBOOT} (FIT with uboot, trust...) is ready" 612 fi 613} 614 615function fit_msg_boot() 616{ 617 if [ -z "${ARG_BOOT_IMG}" ]; then 618 return; 619 fi 620 621 if [ "${ARG_SIGN}" != "y" ]; then 622 MSG_SIGN="no-signed" 623 else 624 MSG_SIGN="signed" 625 fi 626 627 VERSION=`fdtget -ti ${ITB_BOOT} / version` 628 if [ "${VERSION}" != "" ]; then 629 MSG_VER=", version=${VERSION}" 630 fi 631 632 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 633 echo "Image(${MSG_SIGN}${MSG_VER}, rollback-index=${ARG_ROLLBACK_IDX_BOOT}): ${IMG_BOOT} is ready" 634 else 635 echo "Image(${MSG_SIGN}${MSG_VER}): ${IMG_BOOT} (FIT with kernel, fdt, resource...) is ready" 636 fi 637} 638 639function fit_msg_recovery() 640{ 641 if [ -z "${ARG_RECOVERY_IMG}" ]; then 642 return; 643 fi 644 645 if [ "${ARG_SIGN}" != "y" ]; then 646 MSG_SIGN="no-signed" 647 else 648 MSG_SIGN="signed" 649 fi 650 651 VERSION=`fdtget -ti ${ITB_RECOVERY} / version` 652 if [ "${VERSION}" != "" ]; then 653 MSG_VER=", version=${VERSION}" 654 fi 655 656 if [ "${ARG_ROLLBACK_PROTECT}" == "y" ]; then 657 echo "Image(${MSG_SIGN}${MSG_VER}, rollback-index=${ARG_ROLLBACK_IDX_RECOVERY}): ${IMG_RECOVERY} is ready" 658 else 659 echo "Image(${MSG_SIGN}${MSG_VER}): ${IMG_RECOVERY} (FIT with kernel, fdt, resource...) is ready" 660 fi 661} 662 663function fit_msg_loader() 664{ 665 LOADER=`ls *loader*.bin` 666 667 if grep -q '^CONFIG_FIT_SIGNATURE=y' .config ; then 668 echo "Image(signed): ${LOADER} (with spl, ddr, usbplug) is ready" 669 else 670 echo "Image(no-signed): ${LOADER} (with spl, ddr, usbplug) is ready" 671 fi 672} 673 674fit_process_args $* 675 676if [ ! -z "${ARG_VALIDATE}" ]; then 677 validate_arg ${ARG_VALIDATE} 678else 679 fit_raw_compile 680 if [ ! -z "${ARG_RECOVERY_IMG}" ]; then 681 fit_gen_recovery_itb 682 fit_gen_recovery_img 683 fi 684 # "--boot_img_dir" is for U-Boot debug only 685 if [ ! -z "${ARG_BOOT_IMG}" -o ! -z "${ARG_BOOT_IMG_DIR}" ]; then 686 fit_gen_boot_itb 687 fit_gen_boot_img 688 fi 689 fit_gen_uboot_itb 690 fit_gen_uboot_img 691 fit_gen_loader 692 693 echo 694 fit_msg_uboot 695 fit_msg_recovery 696 fit_msg_boot 697 fit_msg_loader 698fi 699