MTK 平台 Secure boot

1 key 的产生

cd vendor/mediatek/proprietary/scripts/sign-image_v2/der_extractor/

openssl genrsa -out root_prvk.pem 2048

python pem_to_der.py root_prvk.pem root_prvk.der

openssl rsa -in root_prvk.pem -pubout > root_pubk.pem

python pem_to_der.py root_pubk.pem root_pubk.der

openssl genrsa -out img_prvk.pem 2048

python pem_to_der.py img_prvk.pem img_prvk.der

openssl rsa -in img_prvk.pem -pubout > img_pubk.pem

python pem_to_der.py img_pubk.pem img_pubk.der

1.1 产生 oemkey.h

chmod 777 der_extractor

./der_extractor root_pubk.der oemkey.h ANDROID_SBC

./der_extractor root_pubk.der dakey.h ANDROID_SBC

1.3 Build SW

cd …/…/…/…/…/…

make -j24 2>&1 | tee build.log

二、 Preloader 签名

2.1涉及路径：

vendor/mediatek/proprietary/bootable/bootloader/preloader/custom/tb8788p1_64_bsp/security/chip_config/s/key
vendor\mediatek\proprietary\bootable\bootloader\preloader\custom\tb8788p1_64_bsp\security\chip_config\s\gfh

2.2 resign preloder

cd vendor/mediatek/proprietary/scripts/secure_chip_tools/

python pbp.py -i settings/pbp/pl_key.ini -k out/pbp/key_cert.bin -g settings/pbp/pl_gfh_config_cert_chain.ini -c settings/pbp/pl_content.ini -func sign -o out/pbp/preloader-signed.bin prebuilt/pbp/preloader.bin

python pbp.py -k prebuilt/pbp/key_cert.bin -g settings/pbp/pl_gfh_config_cert_chain.ini -c settings/pbp/pl_content.ini -func sign -o out/pbp/preloader-signed.bin prebuilt/pbp/preloader.bin

三、 Sign Image flow

3.1 产生cert1和cert2 key

cd …/…/…/…/…/
用root_prvk.pem、image_prvk.pem 产生cert1和cert2key

./vendor/mediatek/proprietary/scripts/sign-image_v2/img_key_deploy.py mt6771 cert1_key_path=vendor/mediatek/proprietary/scripts/sign-image_v2/der_extractor/root_prvk.pem cert2_key_path=vendor/mediatek/proprietary/scripts/sign-image_v2/der_extractor/img_prvk.pem root_key_padding=pss | tee SecureGen.log

./vendor/mediatek/proprietary/scripts/sign-image/sign_image.sh

https://launchpad.net/gcc-arm-embedded/+download

cd vendor/mediatek/proprietary/scripts/secure_chip_tools
python resign_da.py prebuilt/resignda/MTK_AllInOne_DA.bin MT6771 settings/resignda/bbchips_pss.ini all out/resignda/MTK_AllInOne_DA.bin-resign

python toolauth.py -i settings/toolauth/toolauth_key.ini -g settings/toolauth/toolauth_gfh_config_pss.ini out/toolauth/auth_sv5.auth

python sctrlcert.py -i settings/sctrlcert/scc_key.ini -k out/sctrlcert/key_cert.bin -g settings/sctrlcert/scc_gfh_config_cert_chain.ini -q settings/sctrlcert/scc_primary_dbg.ini -p out/sctrlcert/primary_dbg_cert.bin -s settings/sctrlcert/scc_secondary_dbg.ini out/sctrlcert/scc_sv5.cert

python sctrlcert.py -k prebuilt/sctrlcert/key_cert.bin -g settings/sctrlcert/scc_gfh_config_cert_chain.ini -p prebuilt/sctrlcert/primary_dbg_cert.bin -s settings/sctrlcert/scc_secondary_dbg.ini out/sctrlcert/scc_sv5.cert

make BBCHIP=MT6771 DA_PL=yes

python vendor/mediatek/proprietary/scripts/sign-image_v2/img_key_deploy.py mt6771 cert1_key_path=vendor/mediatek/proprietary/scripts/sign-image_v2/mykey/root_prvk.pem cert2_key_path=vendor/mediatek/proprietary/scripts/sign-image_v2/mykey/img_prvk.pem root_key_padding=pss | tee securegen.log