path: root/util/signer/bs

#!/bin/bash

#
# Copyright 2016 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
#
# This script is a utility which allows to create differently signed CR50
# images from different sources.
#
set -e
set -u

progname=$(basename $0)
EC_ROOT="$(readlink -f "$(dirname $0)/../..")"

OD="/usr/bin/od"

tmpf="/tmp/bs_manifest.$$"
trap "{ if [[ -f 1.flat ]]; then rm -rf [01].flat ${tmpf} ; fi; }" EXIT

usage() {
  local rv="${1}"
  cat <<EOF

This script allows to sign CR50 RW images. By default it uses ec.RW.elf and
ec.RW_B.elf in build/cr50/RW as inputs and util/signer/ec_RW-manifest-dev.json
as the manifest, and places the newly signed images into build/cr50/ec.bin.

The only outside dependency of this script is the signing utility itself,
which is expected to be available as /usr/bin/cr50-codesigner.

The utility can be installed by running 'sudo emerge cr50-utils',

The following command line options are accepted:

  b1 - generate signature for the b1 version of the H1 chip
  elves <elf1> <elf2> - sign the supplied elf files instead of the default
        ones. Handy if the builder generated files need to be signed
  help - print this message
  hex - generate hex output instead of binary (place in 0.signed.hex and
        1.signed.hex in the local directory)
  prod - sign with prod key (no debug image will be signed)

This script also allows to sign dev images for running on prod RO. To do that
invoke this script as follows:

  H1_DEVIDS='<dev id0> <dev id1>' ${progname} [other options, if any]

where <dev id0> <dev id1> are values reported by sysinfo command in the
DEV_ID: line when run on the CR50 for which the image is built.

The same values can be obtained in the lsusb command output:

  lsusb -vd 18d1:5014 | grep -i serial

note that the lsusb reported values are in hex and need to be prefixed with
0x.

Finally, this script also allows to specify the board ID fields of the RW
headers. The fields come from the evironment variable CR50_BOARD_ID, which is
required to include three colon separated fields. The first field is a four
letter board RLZ code, the second field is board id mask in hex, no 0x prefix,
and the third field - board ID flags, again, hex, no 0x prefix.

CR50_BOARD_ID='XXYY:ffffff00:ff00' ${progname} [other options, if any]

both H1_DEVIDS and CR50_BOARD_ID can be defined independently.

EOF
  exit "${rv}"
}

# This function modifies the manifest to include device ID and board ID nodes,
# if H1_DEVIDS and CR50_BOARD_ID are defined in the environment, respectively,
tweak_manifest () {
  local sub

  # If defined, plug in dev ID nodes before the 'fuses' node.
  if [[ -z "${do_prod}" && -n "${H1_DEVIDS}" ]]; then
    echo "creating a customized DEV image for DEV IDS ${H1_DEVIDS}"
    sub=$(printf "\\\n   \"DEV_ID0\": %s,\\\n   \"DEV_ID1\": %s," ${H1_DEVIDS})
    sed -i "s/\"fuses\": {/\"fuses\": {${sub}/" "${tmpf}"
  fi

  if [[ -z "${CR50_BOARD_ID}" ]]; then
    return
  fi

  # CR50_BOARD_ID is set, let's parse it and plug in the board ID related
  # nodes into manifest before the 'fuses' node.
  local bid_params
  local rlz

  bid_params=( $(echo $CR50_BOARD_ID | sed 's/:/ /g') )
  # A very basic validity check: it needs to consist of three colon separated
  # fields.
  if [[ ${#bid_params[@]} != 3 ]]; then
    echo "Wrong board ID string \"$CR50_BOARD_ID\"}" >&2
    exit 1
  fi

  if [[ "${bid_params[0]}" == "0" ]] ; then
    rlz="0"
  elif [[ ${#bid_params[0]} == 4 ]] ; then
    # Convert 4 char board RLZ code from ASCII to hex
    rlz="0x$(echo -n ${bid_params[0]} | hexdump -ve '/1 "%02x"')"
  else
    echo "Invalid RLZ ${bid_params[0]}"
    exit 1
  fi

  # Prepare text of all three board ID related nodes
  sub="$(printf "\\\n\"board_id\": %s,\\\n" "${rlz}")"
  sub+="$(printf "\"board_id_mask\": %s,\\\n" "0x${bid_params[1]}")"
  sub+="$(printf "\"board_id_flags\": %s,\\\n" "0x${bid_params[2]}")"
  sed -i "s/\"fuses\": {/${sub}\"fuses\": {/" "${tmpf}"
}

# This function accepts two arguments, names of two binary files.
#
# It searches the first passed in file for the first 8 bytes of the second
# passed in file. The od utility is used to generate full hex dump of the
# first file (16 bytes per line) and the first 8 bytes of the second file.
#
# grep is used to check if the pattern is present in the full dump. If the
# pattern is not found, the first file is dumped again, this time with an 8
# byte offset into the file. This makes sure that if the match is present, but
# is spanning two lines of the original hex dump, it is in a single dump line
# the second time around.
find_blob_in_blob() {
  local main_blob="${1}"
  local pattern_blob="${2}"
  local pattern
  local od_options="-An -tx1"

  # Get the first 8 bytes of the pattern blob.
  pattern="$(${OD} ${od_options} -N8 "${pattern_blob}")"

  if "${OD}" ${od_options} "${main_blob}" | grep "${pattern}" > /dev/null; then
    return 0
  fi

  # Just in case pattern was wrapped in the previous od output, let's do it
  # again with an 8 bytes offset
  if "${OD}" ${od_options} -j8 "${main_blob}" |
      grep "${pattern}" > /dev/null; then
    return 0
  fi

  return 1
}

# This function accepts two arguments, names of the two elf files.
#
# The files are searched for test RMA public key patterns - x25519 or p256,
# both files are supposed to have pattern of one of these keys and not the
# other. If this holds true the function prints the public key base name. If
# not both files include the same key, or include more than one key, the
# function reports failure and exits the script.
determine_rma_key_base() {
  local base_name="${EC_ROOT}/board/cr50/rma_key_blob"
  local curve
  local curves=( "x25519" "p256" )
  local elf
  local elves=( "$1" "$2" )
  local key_file
  local mask=1
  local result=0

  for curve in ${curves[@]}; do
    key_file="${base_name}.${curve}.test"
    for elf in ${elves[@]}; do
      if find_blob_in_blob "${elf}" "${key_file}"; then
        result=$(( result | mask ))
      fi
      mask=$(( mask << 1 ))
    done
  done

  case "${result}" in
    (3)  curve="x25519";;
    (12) curve="p256";;
    (*) echo "could not determine key type in the elves" >&2
        exit 1
        ;;
  esac

  echo "${base_name}.${curve}"
}

SIGNER="cr50-codesigner"
if ! which "${SIGNER}" 2>/dev/null > /dev/null; then
  echo "${SIGNER} is not available, try running 'sudo emerge cr50-utils'" >&2
  exit 1
fi

# This is where the new signed image will be pasted into.
: ${RESULT_FILE=build/cr50/ec.bin}
TMP_RESULT_FILE="${RESULT_FILE}.tmp"

if [[ -z "${CROS_WORKON_SRCROOT}" ]]; then
  echo "${progname}: This script must run inside Chrome OS chroot" >&2
  exit 1
fi

: ${CR50_BOARD_ID=}
: ${H1_DEVIDS=}
EC_BIN_ROOT="${EC_ROOT}/util/signer"

do_hex=
do_b1=
do_prod=

# Prepare the default manifest.
cp "${EC_BIN_ROOT}/ec_RW-manifest-dev.json" "${tmpf}"

elves=( build/cr50/RW/ec.RW.elf build/cr50/RW/ec.RW_B.elf )
cd "${EC_ROOT}"
while (( $# )); do
  param="${1}"
  case "${param}" in
    (hex) do_hex='true';;
    (b1)
      do_b1='true'
      sed -i 's/\(.*FW_DEFINED_DATA_BLK0.*\): 2/\1: 0/' "${tmpf}"
      ;;
    (elves)
      if [[ (( $# < 3 )) ]]; then
        echo "two elf file names are required" >&2
        exit 1
      fi
      elves=( $2 $3 )
      shift
      shift
      ;;
    (prod)
      do_prod='true'
      ;;
    (help)
      usage 0
      ;;
    (*)
      usage 1
      ;;
  esac
  shift
done

if [[ -z "${do_hex}" && ! -f "${RESULT_FILE}" ]]; then
  echo "${RESULT_FILE} not found. Run 'make BOARD=cr50' first" >&2
  exit 1
fi

if [[ -n "${do_prod}" && -n "${do_b1}" ]]; then
  echo "can not build prod images for B1, sorry..."
  exit 1
fi

# If signing a chip factory image (version 0.0.22) do not try figuring out the
# RMA keys.
ignore_rma_keys="$(awk '
  BEGIN {count = 0};
   /"major": 0,/ {count += 1};
   /"minor": 22,/ {count += 1};
   END {{if (count == 2) {print "yes"};}}' \
        "${EC_BIN_ROOT}/ec_RW-manifest-prod.json")"

if [ "${ignore_rma_keys}" != "yes" ]; then
  rma_key_base="$(determine_rma_key_base ${elves[@]})"
else
  echo "Ignofing RMA keys for factory branch"
fi

signer_command_params=()
signer_command_params+=(--b -x ${EC_BIN_ROOT}/fuses.xml)
if [[ -z "${do_prod}" ]]; then
  signer_command_params+=(-k ${EC_BIN_ROOT}/cr50_rom0-dev-blsign.pem.pub)
else
  cp "${EC_BIN_ROOT}/ec_RW-manifest-prod.json" "${tmpf}"
  signer_command_params+=(-k ${EC_BIN_ROOT}/cr50_RW-prod.pem.pub)
  # Swap test public RMA server key with the prod version.
  if [ "${ignore_rma_keys}" != "yes" ]; then
    signer_command_params+=(-S "${rma_key_base}.test","${rma_key_base}.prod")
  fi
fi
signer_command_params+=(-j ${tmpf})

if [[ -n "${do_hex}" ]]; then
  dst_suffix='signed.hex'
else
  signer_command_params+=(--format=bin)
  dst_suffix='flat'
fi

tweak_manifest

count=0
for elf in ${elves[@]}; do
  if [[ -n "${do_prod}" ]]; then
    if strings "${elf}" | egrep -q "(DBG|SQA)/cr50"; then
      echo "Will not sign debug or SQA image with prod keys" >&2
      exit 1
    fi
  fi
  signed_file="${count}.${dst_suffix}"

  # Make sure output file is not owned by root
  touch "${signed_file}"
  command="${SIGNER} ${signer_command_params[@]} -i ${elf} -o ${signed_file}"
  if ! ${command}; then
    echo "${progname}: \"${command}\" failed" >&2
    exit 1
  fi

  if [ "${ignore_rma_keys}" != "yes" ]; then
    if find_blob_in_blob  "${signed_file}" "${rma_key_base}.test"; then
      echo "${progname}: test RMA key in the signed image!" >&2
      rm *."${dst_suffix}"
      exit 1
    fi

    if ! find_blob_in_blob "${signed_file}" "${rma_key_base}.prod"; then
      echo "${progname}: prod RMA key not in the signed image!" >&2
      rm *."${dst_suffix}"
      exit 1
    fi
  fi
  : $(( count++ ))
done

if [[ -z "${do_hex}" ]]; then
  # Full binary image is required, paste the newly signed blobs into the
  # output image, preserving it in case dd fails for whatever reason.
  cp "${RESULT_FILE}" "${TMP_RESULT_FILE}"
  dd if="0.flat" of="${TMP_RESULT_FILE}" seek=16384 bs=1 conv=notrunc
  dd if="1.flat" of="${TMP_RESULT_FILE}" seek=278528 bs=1 conv=notrunc
  rm [01].flat
  mv "${TMP_RESULT_FILE}" "${RESULT_FILE}"
fi

echo "SUCCESS!!!"