BPI-CM9-Linux/aml-comp/uboot/fip/c4/bin/sign-tee.sh

#
# Copyright (C) 2025 Amlogic, Inc. All rights reserved.
#

#!/bin/bash

EXEC_BASEDIR=$(dirname $(readlink -f $0))
BASEDIR_TOP=$(readlink -f ${EXEC_BASEDIR}/..)
ACPU_IMAGETOOL=${EXEC_BASEDIR}/../binary-tool/acpu-imagetool

#
# Settings
#
#BASEDIR_BUILD="${BASEDIR_TOP}/output"
BASEDIR_BUILD="${BASEDIR_TOP}/`date +%Y%m%d%H%M%S%N`"
postfix=.signed

input_bl32=""

function align_4k() {
	local file=$1
	local raw_size=
	local file_size=
	local rem_val=

	raw_size=`stat -c %s ${file}`
	file_size=`expr ${raw_size} + 4095`
	rem_val=`expr ${file_size} % 4096`
	file_size=`expr ${file_size} - ${rem_val}`
	#echo ==== align file ${file} from ${raw_size} to ${file_size} ====
	dd if=/dev/zero of=${file}_tmp.bin bs=1 count=${file_size} &> /dev/null
	dd if=${file} of=${file}_tmp.bin bs=1 count=${file_size} conv=notrunc &> /dev/null
	mv ${file}_tmp.bin ${file}
}

function check_file() {
	if [ ! -f "$1" ]; then
		echo "Error: file \""$1"\" does NOT exist"
		exit 1
	fi
	bl32_file=$1
	bl32_size=`stat -c %s ${bl32_file}`
	echo "1111 $bl32_size"

	if [ $bl32_size -gt 524288 ]; then
		echo "Error: bl32 size exceed limit 524288"
		exit -1
	elif [ $bl32_size -lt 65536 ]; then
		dd if=/dev/zero of=${bl32_file}.tmp bs=65536 count=1 &> /dev/null
		dd if=${bl32_file} of=${bl32_file}.tmp conv=notrunc &> /dev/null
		mv ${bl32_file}.tmp ${bl32_file}
	else
		align_4k ${bl32_file}
	fi
}

function sign_tee() {
	local argv=("$@")
	local i=0

	# Parse args

	while [ $i -lt $# ]; do
		arg="${argv[$i]}"
		#echo "i=$i argv[$i]=${argv[$i]}"
		i=$((i + 1))
		case "$arg" in
			--bl32)
				input_bl32="${argv[$i]}" ;;
			--output)
				output="${argv[$i]}" ;;
			--chipset_name)
				chipset_name="${argv[$i]}" ;;
			--chipset_variant)
				chipset_variant="${argv[$i]}" ;;
			--key_type)
				key_type="${argv[$i]}" ;;
			--soc)
				soc="${argv[$i]}" ;;
			--build_type)
				build_type="${argv[$i]}" ;;
			*)
				echo "Unknown option $arg"; exit 1
				;;
		esac
		i=$((i + 1))
	done

	# bl32 must exist
	if [ -z ${input_bl32} ]; then
		echo "input missing 32 ${input_bl32}"
		exit 1
	fi
	if [ ! -z ${input_bl32} ]; then
		check_file "$input_bl32"
	fi

	if [ -z ${output} ]; then
		echo "output ${output} invalid"
		exit 1
	fi

	if [ -z ${chipset_name} ]; then
		chipset_name="n611x1"
	fi

	if [ -z ${key_type} ]; then
		key_type="dev-keys"
	fi

	if [ -z ${soc} ]; then
		soc="c4"
	fi

	mkdir ${BASEDIR_BUILD}

	echo "BASEDIR_BUILD is ${BASEDIR_BUILD}"

	${EXEC_BASEDIR}/download-keys.sh ${key_type} ${soc} chipset

	#
	# Settings
	#

	BASEDIR_AESKEY_PROT_BL2="${BASEDIR_TOP}/keys/${key_type}/${soc}/chipset/bl2/aes/${chipset_name}${EXT_SUFFIX}"
	BASEDIR_RSAKEY_LVLX_BL2="${BASEDIR_TOP}/keys/${key_type}/${soc}/chipset/bl2/rsa/${chipset_name}${EXT_SUFFIX}"

	BASEDIR_AESKEY_PROT_BL32="${BASEDIR_TOP}/keys/${key_type}/${soc}/chipset/bl32/aes/${chipset_name}${EXT_SUFFIX}"
	BASEDIR_RSAKEY_LVLX_BL32="${BASEDIR_TOP}/keys/${key_type}/${soc}/chipset/bl32/rsa/${chipset_name}${EXT_SUFFIX}"

	BASEDIR_OUTPUT_BLOB=${output}
	postfix=.signed

	#
	# Arguments
	#

	_BASEDIR_AESKEY_PROT_DIR_BL31="BASEDIR_AESKEY_PROT_BL31"
	BASEDIR_AESKEY_PROT_DIR_BL31=${!_BASEDIR_AESKEY_PROT_DIR_BL31}

	_BASEDIR_AESKEY_PROT_DIR_BL32="BASEDIR_AESKEY_PROT_BL32"
	BASEDIR_AESKEY_PROT_DIR_BL32=${!_BASEDIR_AESKEY_PROT_DIR_BL32}

	bl32_size=`stat -c %s ${input_bl32}`
	cp ${input_bl32} ${BASEDIR_BUILD}/bl32-payload.bin

	EXEC_ARGS="${EXEC_ARGS}"

	if [ -f "${input_bl32}" ]; then
		EXEC_ARGS="${EXEC_ARGS} --infile-bl32-payload=${BASEDIR_BUILD}/bl32-payload.bin"
		EXEC_ARGS="${EXEC_ARGS} --infile-aes256-bl32-payload=${BASEDIR_AESKEY_PROT_DIR_BL32}/genkey-prot-bl32.bin"
		EXEC_ARGS="${EXEC_ARGS} --size-payload-bl32=${bl32_size}"
	fi

	### Input: Chipset Level-1/2 Private RSA keys
	EXEC_ARGS="${EXEC_ARGS} --infile-signkey-chipset-lvl2=${BASEDIR_RSAKEY_LVLX_BL2}/level-2-rsa-priv.pem"

	### Output: blobs ###
	EXEC_ARGS="${EXEC_ARGS} --outfile-blob-bl3-tee=${BASEDIR_OUTPUT_BLOB}"

	### boot blobs args
	EXEC_ARGS="${EXEC_ARGS} --scs-family=${soc}"

	echo "$EXEC_ARGS"

	${ACPU_IMAGETOOL} \
		create-boot-blobs \
		${EXEC_ARGS}

	#cp ${BASEDIR_BUILD}/blob-bl3-tee.bin${postfix} $output
}

rm -rf ${BASEDIR_BUILD}
sign_tee $@
rm -rf ${BASEDIR_BUILD}