MTK efuse 2.1 烧录配置过程

此教程适合kernel 4.14/4.19平台 

例如MT6761 MT6833 MT6877等

=====================生成efuse key相关文件==========================
cd vendor/mediatek/proprietary/scripts/sign-image_v2/der_extractor/
openssl genrsa -out root_prvk.pem 2048
python pem_to_der.py root_prvk.pem root_prvk.der
openssl rsa -in root_prvk.pem -pubout > root_pubk.pem
python pem_to_der.py root_pubk.pem root_pubk.der

openssl genrsa -out img_prvk.pem 2048
python pem_to_der.py img_prvk.pem img_prvk.der
openssl rsa -in img_prvk.pem -pubout > img_pubk.pem
python pem_to_der.py img_pubk.pem img_pubk.der

chmod +x der_extractor 
./der_extractor root_pubk.der oemkey.h ANDROID_SBC
./der_extractor root_pubk.der dakey.h ANDROID_SBC

dakey.h里面oem改成DA，否则编译不过

DA签名需要
./der_extractor img_prvk.der VERIFIED_BOOT_IMG_AUTH_KEY.ini ANDROID_SIGN

替换文件
cp -var ./img_prvk.pem ../../../bootable/bootloader/preloader/custom/tb8789p2_64/security/chip_config/s/key/img_prvk.pem
cp -var ./root_prvk.pem ../../../bootable/bootloader/preloader/custom/tb8789p2_64/security/chip_config/s/key/root_prvk.pem
cp -var ./dakey.h ../../../bootable/bootloader/preloader/custom/tb8789p2_64/inc/dakey.h
cp -var ./oemkey.h ../../../bootable/bootloader/preloader/custom/tb8789p2_64/inc/oemkey.h
cp -var ./oemkey.h ../../../bootable/bootloader/lk/target/tb8789p2_64/inc/oemkey.h

=====================修改开关 没有就加上===========================

vendor/mediatek/proprietary/bootable/bootloader/preloader/custom/tb8789p2_64/tb8789p2_64.mk
MTK_SECURITY_SW_SUPPORT=yes
MTK_SEC_USBDL=ATTR_SUSBDL_ENABLE
MTK_SEC_BOOT=ATTR_SBOOT_ENABLE

vendor/mediatek/proprietary/bootable/bootloader/lk/project/tb8789p2_64.mk
MTK_SECURITY_SW_SUPPORT=yes

kernel-4.4/arch/arm64/configs/hct_kernel_config
CONFIG_MTK_SECURITY_SW_SUPPORT=y

======================生成cert1和cert2 key==========================

cd vendor/mediatek/proprietary/scripts/sign-image_v2/

PYTHONDONTWRITEBYTECODE=True python img_key_deploy.py mt6785 tb8789p2_64 cert1_key_path=./der_extractor/root_prvk.pem cert2_key_path=./der_extractor/img_prvk.pem root_key_padding=pss | tee img_key_deploy.log

在这个目录
vendor/mediatek/proprietary/custom/mt6785/security/cert_config

==================正常编译。=====================

====================签名img================================
cd vendor/mediatek/proprietary/scripts/sign-image_v2/

修改env.cfg文件
in_path = ../../../../../out/target/product/tb8789p2_64
out_path = ../../../../../out/target/product/tb8789p2_64

PYTHONDONTWRITEBYTECODE=True BOARD_AVB_ENABLE=true python sign_flow.py -env_cfg env.cfg mt6785 tb8789p2_64 | tee sign_flow.log

===================生成DA文件=============================
https://launchpad.net/gcc-arm-embedded/4.9/4.9-2015-q1-update/+download/gcc-arm-none-eabi-4_9-2015q1-20150306-win32.zip
使用的编译器GCC，需要在window上编译，GCC安装路径：C:\Program Files\GCC\arm-2015q1\ ；该路径是固定不能更改的，要不然会出现编译报错

https://online.mediatek.com/Tool里找FLASHLIB_DA_EXE。
下载后解压会得到
FLASHLIB_DA_EXE(Official)_ALPS/FLASHLIB_DA_EXE_v5.2152.00.000/bin/Customization_Kit_buildspec.zip
这个文件注意，mtk打包的有问题，解压时要用winrar 选择解压到当前文件夹。否则会缺失文件。

替换Customization_Kit_buildspec/Raphael-da/custom/MT6785/下的oemkey.h
替换Customization_Kit_buildspec/Raphael-da/custom/security_export/usbdl4enduser_dummy/VERIFIED_BOOT_IMG_AUTH_KEY.ini

编译DA_BR：make BBCHIP=MT6785   Note：MT需要大写
编译DA_PL：make BBCHIP=MT6785 DA_PL=yes   Note：MT需要大写

编译完成之后会生成:
DA_BR文件Customization_Kit_buildspec\bin\MTK_AllInOne_DA.bin
DA_PL文件Customization_Kit_buildspec\bin_nsla\DA_PL.bin

=================签名DA========================================
将生成的MTK_AllInOne_DA.bin和DA_PL.bin放到下面路径的文件：
vendor/mediatek/proprietary/scripts/secure_chip_tools/prebuilt/resignda/
将生成的root_prvk.pem重命名为da_prvk.pem和epp_prvk.pem，替换下面的文件：
vendor/mediatek/proprietary/scripts/secure_chip_tools/keys/resignda/da_prvk.pem
vendor/mediatek/proprietary/scripts/secure_chip_tools/keys/resignda/epp_prvk.pem

cd vendor/mediatek/proprietary/scripts/secure_chip_tools
python resign_da.py prebuilt/resignda/MTK_AllInOne_DA.bin MT6785 settings/resignda/bbchips_pss.ini all out/resignda/MTK_AllInOne_DA.bin
python resign_da.py prebuilt/resignda/DA_PL.bin MT6785 settings/resignda/bbchips_pss.ini all out/resignda/DA_PL.bin

生成的新文件
vendor/mediatek/proprietary/scripts/secure_chip_tools/out/resignda
MTK_AllInOne_DA.bin和DA_PL.bin

=========================efuse_MT6785.xml================

efuse_MT6785.xml文件只需要修改2个栏位的内容就行
Enable_SBC改为true
<pub-key-n>改为oemkey.h OEM_PUBK，去掉最前面的0x
这次是
B1D07D9A7B2D1EC058E31F0ED14490139E773FA46F132E1667A42262358A6F2B196F47DFE6BC8B36D9A9BF021FA24BCE474171D08D494A3C300381E529E83E209A862991B1D5A952C61A239E6C33A6681799FD17E7256F879A8A88E3E40906DA82637E5D4AA1E61CB2BE125DA8FE8E86CF830B74613B489054CCC25A9132101E35369E7777A26249996D253BF490EDF116C43506794B1190DC939B14796678D37CE7208E74FADB5830316FEA8B28A0DD094E414FD9C92734F805B7FB06459F6DADED4850F2EEE46ED9A501077F444A08F898971F81CEB06D0E72F974AAD198C254F95325304B5CF4FE7C1C96AA388810A52894F19E29F9010D83CFF5435A035F