136 lines
5.0 KiB
Bash
Executable File
136 lines
5.0 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -e
|
|
# set -x
|
|
|
|
#
|
|
# Variables
|
|
#
|
|
|
|
EXEC_BASEDIR=$(dirname $(readlink -f $0))
|
|
ACPU_IMAGETOOL=${EXEC_BASEDIR}/../../binary-tool/acpu-imagetool
|
|
|
|
BASEDIR_TOP=$(readlink -f ${EXEC_BASEDIR}/..)
|
|
|
|
#
|
|
# Settings
|
|
#
|
|
|
|
#BASEDIR_DEVICE_TEMPLATE="${BASEDIR_ROOTRSA_X}/data/template/device"
|
|
BASEDIR_CHIPSET_TEMPLATE=$1
|
|
|
|
BASEDIR_ROOT=${BASEDIR_ROOT:-$BASEDIR_TEMPLATE}
|
|
|
|
#BASEDIR_AESKEY_PROT="${BASEDIR_ROOTRSA_X}/data/key/aesroot"
|
|
#BASEDIR_RSAKEY_LVLX="${BASEDIR_ROOTRSA_X}/data/key/lvlxrsa"
|
|
|
|
BASEDIR_PAYLOAD=$2
|
|
|
|
#BASEDIR_EPK="${BASEDIR_ROOTRSA_X}/data/epk"
|
|
|
|
BASEDIR_OUTPUT=$3
|
|
|
|
input_postfix=.signed
|
|
output_postfix=.device.signed
|
|
|
|
echo "============ ROOTRSA_INDEX ${DEVICE_ROOTRSA_INDEX}"
|
|
echo "============ KEY_DIR ${BASEDIR_ROOT}"
|
|
echo "============ PROJECT ${PROJECT}"
|
|
|
|
if [ -z "$PROJECT" ]; then
|
|
BASEDIR_FIP_SIGKEY_ROOT="${BASEDIR_ROOT}/fip/rsa/trustchain-${DEVICE_ROOTRSA_INDEX}"
|
|
BASEDIR_FIP_AESKEY_ROOT="${BASEDIR_ROOT}/fip/aes/protkey"
|
|
BASEDIR_FIP_TEMPLATE_ROOT="${BASEDIR_ROOT}/fip/template/trustchain-${DEVICE_ROOTRSA_INDEX}"
|
|
else
|
|
BASEDIR_FIP_SIGKEY_ROOT="${BASEDIR_ROOT}/fip/$DV_SIGNING_SCHEME/${PROJECT}/trustchain-${DEVICE_ROOTRSA_INDEX}"
|
|
BASEDIR_FIP_AESKEY_ROOT="${BASEDIR_ROOT}/fip/aes/${PROJECT}/protkey"
|
|
BASEDIR_FIP_TEMPLATE_ROOT="${BASEDIR_ROOT}/fip/template/${PROJECT}/trustchain-${DEVICE_ROOTRSA_INDEX}"
|
|
fi
|
|
|
|
BASEDIR_DEVICE_TEMPLATE="${BASEDIR_FIP_TEMPLATE_ROOT}"
|
|
|
|
#
|
|
# Arguments
|
|
#
|
|
|
|
BLOB_NAME=$1
|
|
|
|
EXEC_ARGS="${EXEC_ARGS}"
|
|
|
|
### Input: template ###
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-template-device-fip-header=${BASEDIR_DEVICE_TEMPLATE}/device-fip-header.bin"
|
|
|
|
### Input: payload ###
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-bl30-payload=${BASEDIR_PAYLOAD}/bl30-payload.bin"
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-bl33-payload=${BASEDIR_PAYLOAD}/bl33-payload.bin"
|
|
|
|
### Input: Device Level-3 private signing keys and EPKs ###
|
|
|
|
# Device Vendor binaries
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-signkey-bl30-device-lvl3=${BASEDIR_FIP_SIGKEY_ROOT}/key/bl30-level-3-rsa-priv.pem"
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-aes256-bl30-payload=${BASEDIR_FIP_AESKEY_ROOT}/genkey-prot-bl30.bin"
|
|
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-signkey-bl33-device-lvl3=${BASEDIR_FIP_SIGKEY_ROOT}/key/bl33-level-3-rsa-priv.pem"
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-aes256-bl33-payload=${BASEDIR_FIP_AESKEY_ROOT}/genkey-prot-bl33.bin"
|
|
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-signkey-bl40-device-lvl3=${BASEDIR_FIP_SIGKEY_ROOT}/key/bl40-level-3-rsa-priv.pem"
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-signkey-bl31-device-lvl3=${BASEDIR_FIP_SIGKEY_ROOT}/key/bl31-level-3-rsa-priv.pem"
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-signkey-bl32-device-lvl3=${BASEDIR_FIP_SIGKEY_ROOT}/key/bl32-level-3-rsa-priv.pem"
|
|
|
|
if [ "$DV_SIGNING_SCHEME" == "rsa-mldsa" ] || [ "$DV_SIGNING_SCHEME" == "mldsa" ]; then
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-signkey-bl30-device-lvl3-pqc=${BASEDIR_FIP_SIGKEY_ROOT}/key/bl30-level-3-mldsa-draft1-priv.pem"
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-signkey-bl33-device-lvl3-pqc=${BASEDIR_FIP_SIGKEY_ROOT}/key/bl33-level-3-mldsa-draft1-priv.pem"
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-signkey-bl40-device-lvl3-pqc=${BASEDIR_FIP_SIGKEY_ROOT}/key/bl40-level-3-mldsa-draft1-priv.pem"
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-signkey-bl31-device-lvl3-pqc=${BASEDIR_FIP_SIGKEY_ROOT}/key/bl31-level-3-mldsa-draft1-priv.pem"
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-signkey-bl32-device-lvl3-pqc=${BASEDIR_FIP_SIGKEY_ROOT}/key/bl32-level-3-mldsa-draft1-priv.pem"
|
|
fi
|
|
|
|
if [ "$CS_SIGNING_SCHEME" == "rsa" ]; then
|
|
EXEC_ARGS="${EXEC_ARGS} --chipset-authen-algorithm=rsa,none"
|
|
elif [ "$CS_SIGNING_SCHEME" == "rsa-mldsa" ]; then
|
|
EXEC_ARGS="${EXEC_ARGS} --chipset-authen-algorithm=rsa,mldsa-draft1"
|
|
elif [ "$CS_SIGNING_SCHEME" == "mldsa" ]; then
|
|
EXEC_ARGS="${EXEC_ARGS} --chipset-authen-algorithm=none,mldsa-draft1"
|
|
fi
|
|
if [ "$DV_SIGNING_SCHEME" == "rsa" ]; then
|
|
EXEC_ARGS="${EXEC_ARGS} --device-authen-algorithm=rsa,none"
|
|
elif [ "$DV_SIGNING_SCHEME" == "rsa-mldsa" ]; then
|
|
EXEC_ARGS="${EXEC_ARGS} --device-authen-algorithm=rsa,mldsa-draft1"
|
|
elif [ "$DV_SIGNING_SCHEME" == "mldsa" ]; then
|
|
EXEC_ARGS="${EXEC_ARGS} --device-authen-algorithm=none,mldsa-draft1"
|
|
fi
|
|
|
|
# Chipset Manufacturer binaries
|
|
|
|
### Input: chipset blobs ###
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-blob-bl40=${BASEDIR_CHIPSET_TEMPLATE}/blob-bl40.bin${input_postfix}"
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-blob-bl31=${BASEDIR_CHIPSET_TEMPLATE}/blob-bl31.bin${input_postfix}"
|
|
EXEC_ARGS="${EXEC_ARGS} --infile-blob-bl32=${BASEDIR_CHIPSET_TEMPLATE}/blob-bl32.bin${input_postfix}"
|
|
|
|
### Features, flags and switches ###
|
|
EXEC_ARGS="${EXEC_ARGS} --header-layout=mini"
|
|
#v1.3.0-test12 support 3 sizes of bl30: 94208, 90112, default 65536
|
|
EXEC_ARGS="${EXEC_ARGS} --size-payload-bl30=94208"
|
|
|
|
# arb info
|
|
EXEC_ARGS="${EXEC_ARGS} --val-device-vendor-segid=${DEVICE_VENDOR_SEGID}"
|
|
EXEC_ARGS="${EXEC_ARGS} --val-device-tee-vers=${DEVICE_TEE_VERS}"
|
|
EXEC_ARGS="${EXEC_ARGS} --val-device-ree-vers=${DEVICE_REE_VERS}"
|
|
|
|
### Output: Device FIP ###
|
|
EXEC_ARGS="${EXEC_ARGS} --outfile-device-fip=${BASEDIR_OUTPUT}/device-fip.bin${output_postfix}"
|
|
|
|
#echo ${EXEC_ARGS}
|
|
|
|
#
|
|
# Main
|
|
#
|
|
|
|
set -x
|
|
|
|
${ACPU_IMAGETOOL} \
|
|
create-device-fip \
|
|
${EXEC_ARGS}
|
|
|
|
# vim: set tabstop=2 expandtab shiftwidth=2:
|