k3_gen_x509_cert.sh 6.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252
  1. #!/bin/bash
  2. # SPDX-License-Identifier: GPL-2.0+ OR BSD-3-Clause
  3. #
  4. # Script to add K3 specific x509 cetificate to a binary.
  5. #
  6. # Variables
  7. OUTPUT=tiboot3.bin
  8. TEMP_X509=x509-temp.cert
  9. CERT=certificate.bin
  10. RAND_KEY=eckey.pem
  11. LOADADDR=0x41c00000
  12. BOOTCORE_OPTS=0
  13. BOOTCORE=16
  14. DEBUG_TYPE=0
  15. gen_degen_template() {
  16. cat << 'EOF' > degen-template.txt
  17. asn1=SEQUENCE:rsa_key
  18. [rsa_key]
  19. version=INTEGER:0
  20. modulus=INTEGER:0xDEGEN_MODULUS
  21. pubExp=INTEGER:1
  22. privExp=INTEGER:1
  23. p=INTEGER:0xDEGEN_P
  24. q=INTEGER:0xDEGEN_Q
  25. e1=INTEGER:1
  26. e2=INTEGER:1
  27. coeff=INTEGER:0xDEGEN_COEFF
  28. EOF
  29. }
  30. # Generate x509 Template
  31. gen_template() {
  32. cat << 'EOF' > x509-template.txt
  33. [ req ]
  34. distinguished_name = req_distinguished_name
  35. x509_extensions = v3_ca
  36. prompt = no
  37. dirstring_type = nobmp
  38. [ req_distinguished_name ]
  39. C = US
  40. ST = TX
  41. L = Dallas
  42. O = Texas Instruments Incorporated
  43. OU = Processors
  44. CN = TI support
  45. emailAddress = support@ti.com
  46. [ v3_ca ]
  47. basicConstraints = CA:true
  48. 1.3.6.1.4.1.294.1.1 = ASN1:SEQUENCE:boot_seq
  49. 1.3.6.1.4.1.294.1.2 = ASN1:SEQUENCE:image_integrity
  50. 1.3.6.1.4.1.294.1.3 = ASN1:SEQUENCE:swrv
  51. # 1.3.6.1.4.1.294.1.4 = ASN1:SEQUENCE:encryption
  52. 1.3.6.1.4.1.294.1.8 = ASN1:SEQUENCE:debug
  53. [ boot_seq ]
  54. certType = INTEGER:TEST_CERT_TYPE
  55. bootCore = INTEGER:TEST_BOOT_CORE
  56. bootCoreOpts = INTEGER:TEST_BOOT_CORE_OPTS
  57. destAddr = FORMAT:HEX,OCT:TEST_BOOT_ADDR
  58. imageSize = INTEGER:TEST_IMAGE_LENGTH
  59. [ image_integrity ]
  60. shaType = OID:2.16.840.1.101.3.4.2.3
  61. shaValue = FORMAT:HEX,OCT:TEST_IMAGE_SHA_VAL
  62. [ swrv ]
  63. swrv = INTEGER:0
  64. # [ encryption ]
  65. # initalVector = FORMAT:HEX,OCT:TEST_IMAGE_ENC_IV
  66. # randomString = FORMAT:HEX,OCT:TEST_IMAGE_ENC_RS
  67. # iterationCnt = INTEGER:TEST_IMAGE_KEY_DERIVE_INDEX
  68. # salt = FORMAT:HEX,OCT:TEST_IMAGE_KEY_DERIVE_SALT
  69. [ debug ]
  70. debugUID = FORMAT:HEX,OCT:0000000000000000000000000000000000000000000000000000000000000000
  71. debugType = INTEGER:TEST_DEBUG_TYPE
  72. coreDbgEn = INTEGER:0
  73. coreDbgSecEn = INTEGER:0
  74. EOF
  75. }
  76. parse_key() {
  77. sed '/\ \ \ \ /s/://g' key.txt | awk '!/\ \ \ \ / {printf("\n%s\n", $0)}; /\ \ \ \ / {printf("%s", $0)}' | sed 's/\ \ \ \ //g' | awk "/$1:/{getline; print}"
  78. }
  79. gen_degen_key() {
  80. # Generate a 4096 bit RSA Key
  81. openssl genrsa -out key.pem 1024 >>/dev/null 2>&1
  82. openssl rsa -in key.pem -text -out key.txt >>/dev/null 2>&1
  83. DEGEN_MODULUS=$( parse_key 'modulus' )
  84. DEGEN_P=$( parse_key 'prime1' )
  85. DEGEN_Q=$( parse_key 'prime2' )
  86. DEGEN_COEFF=$( parse_key 'coefficient' )
  87. gen_degen_template
  88. sed -e "s/DEGEN_MODULUS/$DEGEN_MODULUS/"\
  89. -e "s/DEGEN_P/$DEGEN_P/" \
  90. -e "s/DEGEN_Q/$DEGEN_Q/" \
  91. -e "s/DEGEN_COEFF/$DEGEN_COEFF/" \
  92. degen-template.txt > degenerateKey.txt
  93. openssl asn1parse -genconf degenerateKey.txt -out degenerateKey.der >>/dev/null 2>&1
  94. openssl rsa -in degenerateKey.der -inform DER -outform PEM -out $RAND_KEY >>/dev/null 2>&1
  95. KEY=$RAND_KEY
  96. rm key.pem key.txt degen-template.txt degenerateKey.txt degenerateKey.der
  97. }
  98. declare -A options_help
  99. usage() {
  100. if [ -n "$*" ]; then
  101. echo "ERROR: $*"
  102. fi
  103. echo -n "Usage: $0 "
  104. for option in "${!options_help[@]}"
  105. do
  106. arg=`echo ${options_help[$option]}|cut -d ':' -f1`
  107. if [ -n "$arg" ]; then
  108. arg=" $arg"
  109. fi
  110. echo -n "[-$option$arg] "
  111. done
  112. echo
  113. echo -e "\nWhere:"
  114. for option in "${!options_help[@]}"
  115. do
  116. arg=`echo ${options_help[$option]}|cut -d ':' -f1`
  117. txt=`echo ${options_help[$option]}|cut -d ':' -f2`
  118. tb="\t\t\t"
  119. if [ -n "$arg" ]; then
  120. arg=" $arg"
  121. tb="\t"
  122. fi
  123. echo -e " -$option$arg:$tb$txt"
  124. done
  125. echo
  126. echo "Examples of usage:-"
  127. echo "# Example of signing the SYSFW binary with rsa degenerate key"
  128. echo " $0 -c 0 -b ti-sci-firmware-am6x.bin -o sysfw.bin -l 0x40000"
  129. echo "# Example of signing the SPL binary with rsa degenerate key"
  130. echo " $0 -c 16 -b spl/u-boot-spl.bin -o tiboot3.bin -l 0x41c00000"
  131. }
  132. options_help[b]="bin_file:Bin file that needs to be signed"
  133. options_help[k]="key_file:file with key inside it. If not provided script generates a rsa degenerate key."
  134. options_help[o]="output_file:Name of the final output file. default to $OUTPUT"
  135. options_help[c]="core_id:target core id on which the image would be running. Default to $BOOTCORE"
  136. options_help[l]="loadaddr: Target load address of the binary in hex. Default to $LOADADDR"
  137. options_help[d]="debug_type: Debug type, set to 4 to enable early JTAG. Default to $DEBUG_TYPE"
  138. while getopts "b:k:o:c:l:d:h" opt
  139. do
  140. case $opt in
  141. b)
  142. BIN=$OPTARG
  143. ;;
  144. k)
  145. KEY=$OPTARG
  146. ;;
  147. o)
  148. OUTPUT=$OPTARG
  149. ;;
  150. l)
  151. LOADADDR=$OPTARG
  152. ;;
  153. c)
  154. BOOTCORE=$OPTARG
  155. ;;
  156. d)
  157. DEBUG_TYPE=$OPTARG
  158. ;;
  159. h)
  160. usage
  161. exit 0
  162. ;;
  163. \?)
  164. usage "Invalid Option '-$OPTARG'"
  165. exit 1
  166. ;;
  167. :)
  168. usage "Option '-$OPTARG' Needs an argument."
  169. exit 1
  170. ;;
  171. esac
  172. done
  173. if [ "$#" -eq 0 ]; then
  174. usage "Arguments missing"
  175. exit 1
  176. fi
  177. if [ -z "$BIN" ]; then
  178. usage "Bin file missing in arguments"
  179. exit 1
  180. fi
  181. # Generate rsa degenerate key if user doesn't provide a key
  182. if [ -z "$KEY" ]; then
  183. gen_degen_key
  184. fi
  185. if [ $BOOTCORE == 0 ]; then # BOOTCORE M3, loaded by ROM
  186. CERTTYPE=2
  187. elif [ $BOOTCORE == 16 ]; then # BOOTCORE R5, loaded by ROM
  188. CERTTYPE=1
  189. else # Non BOOTCORE, loaded by SYSFW
  190. BOOTCORE_OPTS_VER=$(printf "%01x" 1)
  191. # Add input args option for SET and CLR flags.
  192. BOOTCORE_OPTS_SETFLAG=$(printf "%08x" 0)
  193. BOOTCORE_OPTS_CLRFLAG=$(printf "%08x" 0x100) # Clear FLAG_ARMV8_AARCH32
  194. BOOTCORE_OPTS="0x$BOOTCORE_OPTS_VER$BOOTCORE_OPTS_SETFLAG$BOOTCORE_OPTS_CLRFLAG"
  195. # Set the cert type to zero.
  196. # We are not using public/private key store now
  197. CERTTYPE=$(printf "0x%08x" 0)
  198. fi
  199. SHA_VAL=`openssl dgst -sha512 -hex $BIN | sed -e "s/^.*= //g"`
  200. BIN_SIZE=`cat $BIN | wc -c`
  201. ADDR=`printf "%08x" $LOADADDR`
  202. gen_cert() {
  203. #echo "Certificate being generated :"
  204. #echo " LOADADDR = 0x$ADDR"
  205. #echo " IMAGE_SIZE = $BIN_SIZE"
  206. #echo " CERT_TYPE = $CERTTYPE"
  207. #echo " DEBUG_TYPE = $DEBUG_TYPE"
  208. sed -e "s/TEST_IMAGE_LENGTH/$BIN_SIZE/" \
  209. -e "s/TEST_IMAGE_SHA_VAL/$SHA_VAL/" \
  210. -e "s/TEST_CERT_TYPE/$CERTTYPE/" \
  211. -e "s/TEST_BOOT_CORE_OPTS/$BOOTCORE_OPTS/" \
  212. -e "s/TEST_BOOT_CORE/$BOOTCORE/" \
  213. -e "s/TEST_BOOT_ADDR/$ADDR/" \
  214. -e "s/TEST_DEBUG_TYPE/$DEBUG_TYPE/" \
  215. x509-template.txt > $TEMP_X509
  216. openssl req -new -x509 -key $KEY -nodes -outform DER -out $CERT -config $TEMP_X509 -sha512
  217. }
  218. gen_template
  219. gen_cert
  220. cat $CERT $BIN > $OUTPUT
  221. # Remove all intermediate files
  222. rm $TEMP_X509 $CERT x509-template.txt
  223. if [ "$KEY" == "$RAND_KEY" ]; then
  224. rm $RAND_KEY
  225. fi