venice/secure_boot: sign_hab_imx8m.sh

#!/bin/bash

# check for required files
for i in flash.bin flash.log .config; do
        if [ ! -f $i ]; then
                echo "Missing $i! Please make sure to 'make flash.bin' first"
                exit 1
        fi
done

# check for required env
if [ -z "$CST_BIN" ] || [ ! -f $CST_BIN ]; then
        echo "Missing CST_BIN variable!"
        exit 1
fi
if [ -z "$SIGN_KEY" ] || [ ! -f $SIGN_KEY ]; then
        echo "Missing SIGN_KEY variable!"
        exit 1
fi
if [ -z "$IMG_KEY" ] || [ ! -f $IMG_KEY ]; then
        echo "Missing IMG_KEY variable!"
        exit 1
fi
if [ -z "$SRK_TABLE" ] || [ ! -f $SRK_TABLE ]; then
        echo "Missing SRK_TABLE variable!"
        exit 1
fi

#
# create csf_spl.txt
#
csf_spl() {
        SPL_START_ADDR=`awk '/spl hab block/{print $4}' flash.log`
        SPL_OFFSET=`awk '/spl hab block/{print $5}' flash.log`
        SPL_LENGTH=`awk '/spl hab block/{print $6}' flash.log`

        cat << EOF
[Header]
    Version = 4.3
    Hash Algorithm = sha256
    Engine = CAAM
    Engine Configuration = 0
    Certificate Format = X509
    Signature Format = CMS

[Install SRK]
    # Index of the key location in the SRK table to be installed
    File = "$SRK_TABLE"
    Source index = 0

[Install CSFK]
    # Key used to authenticate the CSF data
    File = "$SIGN_KEY"

[Authenticate CSF]

[Unlock]
    # Leave Job Ring and DECO master ID registers Unlocked
    Engine = CAAM
    Features = MID

[Install Key]
    # Key slot index used to authenticate the key to be installed
    Verification index = 0
    # Target key slot in HAB key store where key will be installed
    Target index = 2
    # Key to install
    File = "$IMG_KEY"

[Authenticate Data]
    # Key slot index used to authenticate the image data
    Verification index = 2
    # Authenticate Start Address, Offset, Length and file
    Blocks = $SPL_START_ADDR $SPL_OFFSET $SPL_LENGTH "flash.bin"
EOF
}

#
# create csf_fit.txt
#
# Assumes using FIT generator (arch/arm/mach-imx/mkimage_fit_atf.sh)
# which puts blobs in this order:
#  u-boot-nodtb.bin (U-Boot)
#  u-boot.dtb (dtb's)
#  bl31.bin (ATF)
#
csf_fit() {
        cat << EOF
[Header]
    Version = 4.3
    Hash Algorithm = sha256
    Engine = CAAM
    Engine Configuration = 0
    Certificate Format = X509
    Signature Format = CMS

[Install SRK]
    # Index of the key location in the SRK table to be installed
    File = "$SRK_TABLE"
    Source index = 0

[Install CSFK]
    # Key used to authenticate the CSF data
    File = "$SIGN_KEY"

[Authenticate CSF]

[Install Key]
    # Key slot index used to authenticate the key to be installed
    Verification index = 0
    # Target key slot in HAB key store where key will be installed
    Target index = 2
    # Key to install
    File = "$IMG_KEY"

[Authenticate Data]
    # Key slot index used to authenticate the image data
    Verification index = 2
    # Authenticate Start Address, Offset, Length and file
    Blocks = \\
EOF

        # FIT
        FIT_START_ADDR=`awk '/sld hab block/{print $4}' flash.log`
        FIT_OFFSET=`awk '/sld hab block/{print $5}' flash.log`
        FIT_LENGTH=`awk '/sld hab block/{print $6}' flash.log`
        printf "        0x%08x 0x%08x 0x%08x \"flash.bin\", \\ \n" \
                $FIT_START_ADDR $FIT_OFFSET $FIT_LENGTH

        # U-Boot
        BL32="tee.bin"
        BL31="bl31.bin"
        source .config
        # TODO: this should be calculated from
        #       CONFIG_SYS_MMCSD_RAW_MODE_U_BOOT_SECTOR in include/autoconf.mk
        #       (0x300*512)
        fit_off=0x60000
        if grep -Eq "^CONFIG_IMX8MQ=y$" .config; then
                TEE_LOAD_ADDR=0xfe000000
                ATF_LOAD_ADDR=0x00910000
                VERSION=v1
        elif grep -Eq "^CONFIG_IMX8MM=y$" .config; then
                TEE_LOAD_ADDR=0xbe000000
                ATF_LOAD_ADDR=0x00920000
                VERSION=v1
        elif grep -Eq "^CONFIG_IMX8MN=y$" .config; then
                TEE_LOAD_ADDR=0xbe000000
                ATF_LOAD_ADDR=0x00960000
                VERSION=v2
        fi
        if [ -z "$ATF_LOAD_ADDR" ]; then
                echo "ERROR: BL31 load address is not set" >&2
                exit 0
        fi
        if [ "$VERSION" = "v1" ]; then
                ivt_off=0x400
        else
                ivt_off=0x0
        fi
        # IMX8MM: flash.bin goes to 33KB (0x8400 = 0x8000 + 0x400)
        # IMX8MN: flash.bin goes to 32KB (0x8000 = 0x8000 + 0x0)
        uboot_sign_off=$((fit_off - 0x8000 - ivt_off + 0x3000))
        uboot_size=$(stat -c "%s" u-boot-nodtb.bin)
        uboot_load_addr=$CONFIG_SYS_TEXT_BASE
        last_sign_off=$(((uboot_sign_off + uboot_size + 3) & ~3))
        last_load_addr=$((uboot_load_addr + uboot_size))
        printf "        0x%08x 0x%08x 0x%08x \"flash.bin\", \\ \n" \
                $uboot_load_addr $uboot_sign_off $uboot_size

        # DTB's
        for i in $CONFIG_OF_LIST; do
                fdt_size=$(stat -c "%s" arch/arm/dts/$i.dtb)
                fdt_sign_off=$((last_sign_off))
                fdt_load_addr=$((last_load_addr))
                last_size=$((fdt_size))
                last_sign_off=$(((last_sign_off + fdt_size + 3) & ~3))
                last_load_addr=$((last_load_addr + fdt_size))
                printf "        0x%08x 0x%08x 0x%08x \"flash.bin\", \\ \n" \
                        $fdt_load_addr $fdt_sign_off $fdt_size
        done

        # ATF
        atf_sign_off=$((last_sign_off))
        atf_load_addr=$ATF_LOAD_ADDR
        atf_size=$(stat -c "%s" $BL31)
        if [ ! -f $BL32 ]; then
                printf "        0x%08x 0x%08x 0x%08x \"flash.bin\"\n" \
                        $atf_load_addr $atf_sign_off $atf_size
        else
                tee_size=$(stat -c "%s" tee.bin)
                tee_sign_off=$(((atf_sign_off + atf_size + 3) & ~3))
                tee_load_addr=$TEE_LOAD_ADDR
                printf "        0x%08x 0x%08x 0x%08x \"flash.bin\", \\ \n" \
                        $atf_load_addr $atf_sign_off $atf_size
                printf "        0x%08x 0x%08x 0x%08x \"flash.bin\"\n" \
                        $tee_load_addr $tee_sign_off $tee_size
        fi
}

# generate templates
csf_spl > csf_spl.txt
csf_fit > csf_fit.txt

# generate signatures
$CST_BIN -i csf_spl.txt -o csf_spl.bin
$CST_BIN -i csf_fit.txt -o csf_fit.bin

# copy signatures into binary
CSF_SPL_OFFSET=`awk '/csf_off/{print $2}' flash.log | head -n 1`
CSF_FIT_OFFSET=`awk '/csf_off/{print $2}' flash.log | tail -n 1`
cp flash.bin signed_flash.bin
dd if=csf_spl.bin of=signed_flash.bin seek=$(($CSF_SPL_OFFSET)) bs=1 conv=notrunc
dd if=csf_fit.bin of=signed_flash.bin seek=$(($CSF_FIT_OFFSET)) bs=1 conv=notrunc

echo "signed_flash.bin is ready!"