BPI-CM9-Linux/aml-comp/uboot/fip/x1/bin/sign-tee.sh

#
# Copyright (C) 2025 Amlogic, Inc. All rights reserved.
#

#!/bin/bash

EXEC_BASEDIR=$(dirname $(readlink -f $0))
BASEDIR_TOP=$(readlink -f ${EXEC_BASEDIR}/..)
ACPU_IMAGETOOL=${EXEC_BASEDIR}/../binary-tool/acpu-imagetool

#
# Settings
#
#BASEDIR_BUILD="${BASEDIR_TOP}/output"
BASEDIR_BUILD="${BASEDIR_TOP}/`date +%Y%m%d%H%M%S%N`"
postfix=.signed
declare -a BLX_BIN_SIZE=("262144" "524288")

input_bl31=""
input_bl32=""
input_bl3_tee=""

function check_file() {
	if [ ! -f "$1" ]; then
		echo "Error: file \""$1"\" does NOT exist"
		exit 1
	fi
}

function sign_tee() {
	local argv=("$@")
	local i=0

	# Parse args

	while [ $i -lt $# ]; do
		arg="${argv[$i]}"
		#echo "i=$i argv[$i]=${argv[$i]}"
		i=$((i + 1))
		case "$arg" in
			--bl31)
				input_bl31="${argv[$i]}" ;;
			--bl32)
				input_bl32="${argv[$i]}" ;;
			--bl3_tee)
				input_bl3_tee="${argv[$i]}" ;;
			--output)
				output="${argv[$i]}" ;;
			--chipset_name)
				chipset_name="${argv[$i]}" ;;
			--chipset_variant)
				chipset_variant="${argv[$i]}" ;;
			--key_type)
				key_type="${argv[$i]}" ;;
			--soc)
				soc="${argv[$i]}" ;;
			--build_type)
				build_type="${argv[$i]}" ;;
			*)
				echo "Unknown option $arg"; exit 1
				;;
		esac
		i=$((i + 1))
	done

	# At least one of bl31 or bl32 must exist
	if [ -z ${input_bl31} ] && [ -z ${input_bl32} ]; then
		echo "input missing 31 or 32 ${input_bl31} ${input_bl32}"
		exit 1
	fi
	if [ ! -z ${input_bl31} ]; then
		check_file "$input_bl31"
	fi
	if [ ! -z ${input_bl32} ]; then
		check_file "$input_bl32"
	fi
	if [ -z ${input_bl3_tee} ]; then
		if [ -z ${input_bl31} ] || [ -z ${input_bl32} ]; then
			# If bl3_tee does not exist, both bl31 and bl32 must exist.
			echo "input ${input_bl3_tee} invalid"
			exit 1
		fi
	else
		check_file "$input_bl3_tee"
	fi

	if [ -z ${output} ]; then
		echo "output ${output} invalid"
		exit 1
	fi

	if [ -z ${chipset_name} ]; then
		chipset_name="n611x1"
	fi

	if [ -z ${key_type} ]; then
		key_type="dev-keys"
	fi

	if [ -z ${soc} ]; then
		soc="x1"
	fi

	mkdir ${BASEDIR_BUILD}

	echo "BASEDIR_BUILD is ${BASEDIR_BUILD}"

	if [ -f "${input_bl31}" ]; then
		dd if=/dev/zero of=${BASEDIR_BUILD}/bl31-payload.bin bs=${BLX_BIN_SIZE[0]} count=1  &> /dev/null
		dd if=${input_bl31} of=${BASEDIR_BUILD}/bl31-payload.bin conv=notrunc  &> /dev/null
	fi

	if [ -f "${input_bl32}" ]; then
		dd if=/dev/zero of=${BASEDIR_BUILD}/bl32-payload.bin bs=${BLX_BIN_SIZE[1]} count=1  &> /dev/null
		dd if=${input_bl32} of=${BASEDIR_BUILD}/bl32-payload.bin conv=notrunc  &> /dev/null
	fi

	if [ -f "${input_bl3_tee}" ]; then
		cp ${input_bl3_tee} ${BASEDIR_BUILD}/blob-bl3-tee.bin
	fi

	${EXEC_BASEDIR}/download-keys.sh ${key_type} ${soc} chipset

	#
	# Settings
	#

	BASEDIR_AESKEY_PROT_BL2="${BASEDIR_TOP}/keys/${key_type}/${soc}/chipset/bl2/aes/${chipset_name}${EXT_SUFFIX}"
	BASEDIR_RSAKEY_LVLX_BL2="${BASEDIR_TOP}/keys/${key_type}/${soc}/chipset/bl2/rsa/${chipset_name}${EXT_SUFFIX}"

	BASEDIR_AESKEY_PROT_BL31="${BASEDIR_TOP}/keys/${key_type}/${soc}/chipset/bl31/aes/${chipset_name}${EXT_SUFFIX}"
	BASEDIR_RSAKEY_LVLX_BL31="${BASEDIR_TOP}/keys/${key_type}/${soc}/chipset/bl31/rsa/${chipset_name}${EXT_SUFFIX}"

	BASEDIR_AESKEY_PROT_BL32="${BASEDIR_TOP}/keys/${key_type}/${soc}/chipset/bl32/aes/${chipset_name}${EXT_SUFFIX}"
	BASEDIR_RSAKEY_LVLX_BL32="${BASEDIR_TOP}/keys/${key_type}/${soc}/chipset/bl32/rsa/${chipset_name}${EXT_SUFFIX}"

	BASEDIR_OUTPUT_BLOB=${output}
	postfix=.signed

	#
	# Arguments
	#

	_BASEDIR_AESKEY_PROT_DIR_BL31="BASEDIR_AESKEY_PROT_BL31"
	BASEDIR_AESKEY_PROT_DIR_BL31=${!_BASEDIR_AESKEY_PROT_DIR_BL31}

	_BASEDIR_AESKEY_PROT_DIR_BL32="BASEDIR_AESKEY_PROT_BL32"
	BASEDIR_AESKEY_PROT_DIR_BL32=${!_BASEDIR_AESKEY_PROT_DIR_BL32}

	EXEC_ARGS="${EXEC_ARGS}"

	### Input: payload ###
	if [ -f "${input_bl31}" ]; then
		EXEC_ARGS="${EXEC_ARGS} --infile-bl31-payload=${BASEDIR_BUILD}/bl31-payload.bin"
		EXEC_ARGS="${EXEC_ARGS} --infile-aes256-bl31-payload=${BASEDIR_AESKEY_PROT_DIR_BL31}/genkey-prot-bl31.bin"
		EXEC_ARGS="${EXEC_ARGS} --size-payload-bl31=262144"
	fi

	if [ -f "${input_bl32}" ]; then
		EXEC_ARGS="${EXEC_ARGS} --infile-bl32-payload=${BASEDIR_BUILD}/bl32-payload.bin"
		EXEC_ARGS="${EXEC_ARGS} --infile-aes256-bl32-payload=${BASEDIR_AESKEY_PROT_DIR_BL32}/genkey-prot-bl32.bin"
		EXEC_ARGS="${EXEC_ARGS} --size-payload-bl32=524288"
	fi

	if [ -f "${input_bl3_tee}" ]; then
		EXEC_ARGS="${EXEC_ARGS} --infile-blob-bl3-tee=${BASEDIR_BUILD}/blob-bl3-tee.bin"
	fi

	### Input: Chipset Level-1/2 Private RSA keys
	EXEC_ARGS="${EXEC_ARGS} --infile-signkey-chipset-lvl2=${BASEDIR_RSAKEY_LVLX_BL2}/level-2-rsa-priv.pem"

	### Output: blobs ###
	EXEC_ARGS="${EXEC_ARGS} --outfile-blob-bl3-tee=${BASEDIR_OUTPUT_BLOB}"

	### boot blobs args
	EXEC_ARGS="${EXEC_ARGS} --scs-family=${soc}"

	echo "$EXEC_ARGS"

	${ACPU_IMAGETOOL} \
		create-boot-blobs \
		${EXEC_ARGS}

	#cp ${BASEDIR_BUILD}/blob-bl3-tee.bin${postfix} $output
}

rm -rf ${BASEDIR_BUILD}
sign_tee $@
rm -rf ${BASEDIR_BUILD}