blob: 8b36850f83f3f1ff807e204327d3df1e257c4d9c [file] [log] [blame]
Gunnar Mills6b5b27e2017-03-01 21:37:01 -06001#!/bin/bash
Gunnar Millsf8f11302017-03-08 13:11:33 -06002set -eo pipefail
Gunnar Millse8221902017-02-03 15:59:06 -06003
Lei YUdcb3fd72019-02-21 13:19:03 +08004help=$'Generate Tarball with PNOR image and MANIFEST Script
Gunnar Millse8221902017-02-03 15:59:06 -06005
Lei YUdcb3fd72019-02-21 13:19:03 +08006Generates a PNOR SquashFS image from the PNOR image for VPNOR,
7Or use a static layout raw PNOR image,
Gunnar Mills29414352017-10-25 11:07:43 -05008Creates a MANIFEST for image verification and recreation
Lei YUdcb3fd72019-02-21 13:19:03 +08009Packages the image and MANIFEST together in a tarball
Gunnar Millse8221902017-02-03 15:59:06 -060010
Lei YUdcb3fd72019-02-21 13:19:03 +080011usage: generate-tar [OPTION] <PNOR FILE>...
Gunnar Millse8221902017-02-03 15:59:06 -060012
13Options:
Patrick Williams15513db2022-12-08 06:23:24 -060014-i, --image <squashfs|static>
15Generate SquashFS image or use static PNOR
16-f, --file <file> Specify destination file. Defaults to
17$(pwd)/<PNOR FILE>.pnor.<image_type>.tar[.gz] if
18unspecified.
19(For example,
20 * "generate-tar -i squashfs my.pnor" would generate
21 $(pwd)/my.pnor.squashfs.tar
22 * "generate-tar -i static my.pnor" would generate
23$(pwd)/my.pnor.static.tar.gz)
24-s, --sign <path> Sign the image. The optional path argument specifies
25the private key file. Defaults to the bash variable
26PRIVATE_KEY_PATH if available, or else uses the
27open-source private key in this script.
28-m, --machine <name> Optionally specify the target machine name of this
29image.
30-h, --help Display this help text and exit.
Gunnar Millse8221902017-02-03 15:59:06 -060031'
Eddie James643e7302018-02-26 15:23:43 -060032
33private_key=$'-----BEGIN PRIVATE KEY-----
34MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAPvSDLu6slkP1gri
35PaeQXL9ysD69J/HjbBCIQ0RPfeWBb75US1tRTjPP0Ub8CtH8ExVf8iF1ulsZA78B
36zIjBYZVp9pyD6LbpZ/hjV7rIH6dTNhoVpdA+F8LzmQ7cyhHG8l2JMvdunwF2uX5k
37D4WDcZt/ITKZNQNavPtmIyD5HprdAgMBAAECgYEAuQkTSi5ZNpAoWz76xtGRFSwU
38zUT4wQi3Mz6tDtjKTYXasiQGa0dHC1M9F8fDu6BZ9W7W4Dc9hArRcdzEighuxoI/
39nZI/0uL89iUEywnDEIHuS6D5JlZaj86/nx9YvQnO8F/seM+MX0EAWVrd5wC7aAF1
40h6Fu7ykZB4ggUjQAWwECQQD+AUiDOEO+8btLJ135dQfSGc5VFcZiequnKWVm6uXt
41rX771hEYjYMjLqWGFg9G4gE3GuABM5chMINuQQUivy8tAkEA/cxfy19XkjtqcMgE
42x/UDt6Nr+Ky/tk+4Y65WxPRDas0uxFOPk/vEjgVmz1k/TAy9G4giisluTvtmltr5
43DCLocQJBAJnRHx9PiD7uVhRJz6/L/iNuOzPtTsi+Loq5F83+O6T15qsM1CeBMsOw
44cM5FN5UeMcwz+yjfHAsePMkcmMaU7jUCQHlg9+N8upXuIo7Dqj2zOU7nMmkgvSNE
455yuNImRZabC3ZolwaTdd7nf5r1y1Eyec5Ag5yENV6JKPe1Xkbb1XKJECQDngA0h4
466ATvfP1Vrx4CbP11eKXbCsZ9OGPHSgyvVjn68oY5ZP3uPsIattoN7dE2BRfuJm7m
47F0nIdUAhR0yTfKM=
48-----END PRIVATE KEY-----
49'
50
Adriana Kobylak1e4a7f22017-07-09 16:12:36 -050051# Reference the ffs structures at:
52# https://github.com/open-power/hostboot/blob/master/src/usr/pnor/common/ffs_hb.H
53# https://github.com/open-power/hostboot/blob/master/src/usr/pnor/ffs.h
Adriana Kobylak7bd45a32021-04-20 19:45:05 +000054ffs_entry_size=128
55vercheck_offset=112
Eddie James643e7302018-02-26 15:23:43 -060056do_sign=false
Adriana Kobylak7bd45a32021-04-20 19:45:05 +000057PRIVATE_KEY_PATH=${PRIVATE_KEY_PATH:-}
Eddie James643e7302018-02-26 15:23:43 -060058private_key_path="${PRIVATE_KEY_PATH}"
Lei YUdcb3fd72019-02-21 13:19:03 +080059image_type=""
Michael Tritz8f396732017-06-09 10:55:35 -050060outfile=""
Gunnar Mills6b5b27e2017-03-01 21:37:01 -060061declare -a partitions=()
62tocfile="pnor.toc"
Lei YU647d6132019-12-31 14:35:00 +080063machine_name=""
Gunnar Mills37751f92017-02-07 21:05:01 -060064
Gunnar Millse8221902017-02-03 15:59:06 -060065while [[ $# -gt 0 ]]; do
66 key="$1"
67 case $key in
Lei YUdcb3fd72019-02-21 13:19:03 +080068 -i|--image)
69 image_type="$2"
70 shift 2
71 ;;
Gunnar Mills37751f92017-02-07 21:05:01 -060072 -f|--file)
73 outfile="$2"
74 shift 2
75 ;;
Eddie James643e7302018-02-26 15:23:43 -060076 -s|--sign)
77 do_sign=true
Adriana Kobylak7bd45a32021-04-20 19:45:05 +000078 if [[ -n "${2}" && "${2}" != -* ]]; then
Eddie James643e7302018-02-26 15:23:43 -060079 private_key_path="$2"
80 shift 2
81 else
82 shift 1
83 fi
84 ;;
Lei YU647d6132019-12-31 14:35:00 +080085 -m|--machine)
86 machine_name="$2"
87 shift 2
88 ;;
Gunnar Millse8221902017-02-03 15:59:06 -060089 -h|--help)
90 echo "$help"
91 exit
92 ;;
93 *)
Gunnar Millsc15b02d2017-03-03 10:28:37 -060094 pnorfile="$1"
95 shift 1
Gunnar Millse8221902017-02-03 15:59:06 -060096 ;;
97 esac
98done
Gunnar Mills18f7cdb2017-02-07 16:44:19 -060099
Gunnar Millsc15b02d2017-03-03 10:28:37 -0600100if [ ! -f "${pnorfile}" ]; then
101 echo "Please enter a valid PNOR file."
102 echo "$help"
103 exit 1
104fi
105
Lei YUdcb3fd72019-02-21 13:19:03 +0800106if [[ "${image_type}" == "squashfs" ]]; then
107 echo "Will generate squashfs image for VPNOR"
108elif [[ "${image_type}" == "static" ]]; then
109 echo "Will use static image for PNOR"
110else
111 echo "Please specify the image type, \"squashfs\" or \"static\""
112 echo
113 echo "$help"
114 exit 1
115fi
116
Michael Tritz8f396732017-06-09 10:55:35 -0500117if [[ -z $outfile ]]; then
118 if [[ ${pnorfile##*.} == "pnor" ]]; then
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000119 outfile=$(pwd)/${pnorfile##*/}.$image_type.tar
Michael Tritz8f396732017-06-09 10:55:35 -0500120 else
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000121 outfile=$(pwd)/${pnorfile##*/}.pnor.$image_type.tar
Lei YUdcb3fd72019-02-21 13:19:03 +0800122 fi
123 if [[ "${image_type}" == "static" ]]; then
124 # Append .gz so the tarball is compressed
125 outfile=$outfile.gz
Michael Tritz8f396732017-06-09 10:55:35 -0500126 fi
127else
128 if [[ $outfile != /* ]]; then
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000129 outfile=$(pwd)/$outfile
Michael Tritz8f396732017-06-09 10:55:35 -0500130 fi
131fi
132
Lei YUdcb3fd72019-02-21 13:19:03 +0800133
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000134scratch_dir=$(mktemp -d)
Lei YU00d8ade2020-01-14 11:30:04 +0800135# Remove the temp directory on exit.
136# The files in the temp directory may contain read-only files, so add
137# --interactive=never to skip the prompt.
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000138trap '{ rm -r --interactive=never ${scratch_dir}; }' EXIT
Gunnar Mills6b5b27e2017-03-01 21:37:01 -0600139
Eddie James643e7302018-02-26 15:23:43 -0600140if [[ "${do_sign}" == true ]]; then
141 if [[ -z "${private_key_path}" ]]; then
142 private_key_path=${scratch_dir}/OpenBMC.priv
143 echo "${private_key}" > "${private_key_path}"
144 echo "Image is NOT secure!! Signing with the open private key!"
145 else
146 if [[ ! -f "${private_key_path}" ]]; then
147 echo "Couldn't find private key ${private_key_path}."
148 exit 1
149 fi
150
151 echo "Signing with ${private_key_path}."
152 fi
153
154 public_key_file=publickey
155 public_key_path=${scratch_dir}/$public_key_file
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000156 openssl pkey -in "${private_key_path}" -pubout -out "${public_key_path}"
Eddie James643e7302018-02-26 15:23:43 -0600157fi
158
Gunnar Mills6b5b27e2017-03-01 21:37:01 -0600159echo "Parsing PNOR TOC..."
Gunnar Millsd4908a42017-03-07 08:25:59 -0600160
Adriana Kobylak851bc062019-06-05 14:33:06 -0500161pnor_dir="${scratch_dir}/pnor"
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000162mkdir "${pnor_dir}"
Adriana Kobylak851bc062019-06-05 14:33:06 -0500163
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000164pflash --partition=part --read="${pnor_dir}"/part -F "${pnorfile}"
165pflash --partition=VERSION --read="${pnor_dir}"/VERSION -F "${pnorfile}"
166version_size=$(wc -c "${pnor_dir}"/VERSION | cut -d' ' -f 1)
167magic_number=$(xxd -p -l 4 "${pnor_dir}"/VERSION)
Samuel Mendoza-Jonasd1d19212018-06-01 14:02:24 +1000168# Check if VERSION is signed. A signed version partition will have an extra
169# 4K header starting with the magic number 0x17082011, see:
170# https://github.com/open-power/skiboot/blob/master/libstb/container.h#L47
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000171if [ "$version_size" == "8192" ] && [ "$magic_number" == "17082011" ]; then
Samuel Mendoza-Jonasd1d19212018-06-01 14:02:24 +1000172 # Advance past the STB header (4K, indexed from 1)
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000173 cp "${pnor_dir}"/VERSION "${pnor_dir}"/VERSION_FULL
174 tail --bytes=+4097 "${pnor_dir}"/VERSION_FULL > "${pnor_dir}"/VERSION
Samuel Mendoza-Jonasd1d19212018-06-01 14:02:24 +1000175fi
Gunnar Mills6b5b27e2017-03-01 21:37:01 -0600176{
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000177 version=$(head -n 1 "${pnor_dir}"/VERSION)
Gunnar Mills2f27b742017-03-20 13:46:30 -0500178 echo "version=$version"
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000179 # shellcheck disable=SC2005,SC2046 # Need the echo to remove new lines, same
180 # reason for not quoting the tail command
181 extended_version=$(echo $(tail -n +2 "${pnor_dir}"/VERSION)|tr ' ' ',')
Saqib Khan029b8252017-03-22 21:38:07 -0500182 echo "extended_version=$extended_version"
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000183 while read -r line; do
Gunnar Mills6b5b27e2017-03-01 21:37:01 -0600184 if [[ $line == "ID="* ]]; then
Gunnar Millse0ed3022017-03-02 16:16:19 -0600185 # This line looks like
186 # "ID=05 MVPD 000d9000..00169000 (actual=00090000) [ECC]"
Gunnar Mills6b5b27e2017-03-01 21:37:01 -0600187 read -r -a fields <<< "$line"
Gunnar Millse0ed3022017-03-02 16:16:19 -0600188
Gunnar Millsd4908a42017-03-07 08:25:59 -0600189 id=${fields[0]##*=}
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000190 offset=$((ffs_entry_size * 10#${id} + vercheck_offset))
191 vercheck=$(xxd -p -l 0x1 -seek ${offset} "${pnor_dir}"/part)
192 # shellcheck disable=SC2155 # Need the export in the same line to avoid
193 # pflash error
194 export flags=$(pflash --detail=$((10#$id)) -F "${pnorfile}" | grep "\[" |
Michael Tritz1bd65ac2017-05-07 17:40:14 -0500195 sed 's/....$//' | tr '\n' ',' | sed 's/.$//')
196 if [[ $flags != "" ]]; then
197 flags=,$flags
198 fi
199
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000200 if [[ $(echo "$flags" | grep "READONLY") == "" &&
201 $(echo "$flags" | grep "PRESERVED") == "" ]]; then
Michael Tritz1bd65ac2017-05-07 17:40:14 -0500202 flags=$flags,READWRITE
Gunnar Millsd4908a42017-03-07 08:25:59 -0600203 fi
204
Gunnar Millse0ed3022017-03-02 16:16:19 -0600205 # Need the partition ID, name, start location, end location, and flags
Adriana Kobylak1e4a7f22017-07-09 16:12:36 -0500206 echo "partition${id}=${fields[1]},${fields[2]/../,},${vercheck}${flags}"
Gunnar Millsd4908a42017-03-07 08:25:59 -0600207
Gunnar Mills6b5b27e2017-03-01 21:37:01 -0600208 # Save the partition name
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000209 partitions+=("${fields[1]}")
Gunnar Mills6b5b27e2017-03-01 21:37:01 -0600210 fi
Adriana Kobylak1e4a7f22017-07-09 16:12:36 -0500211 # Don't need the BACKUP_PART partition
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000212 done < <(pflash --info -F "${pnorfile}" | grep -v "BACKUP")
213} > "${pnor_dir}"/${tocfile}
Gunnar Mills37751f92017-02-07 21:05:01 -0600214
Gunnar Mills18f7cdb2017-02-07 16:44:19 -0600215for partition in "${partitions[@]}"; do
216 echo "Reading ${partition}..."
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000217 pflash --partition="${partition}" \
218 --read="${pnor_dir}"/"${partition}" \
219 -F "${pnorfile}"
Gunnar Mills18f7cdb2017-02-07 16:44:19 -0600220done
Gunnar Mills37751f92017-02-07 21:05:01 -0600221
Lei YUdcb3fd72019-02-21 13:19:03 +0800222manifest_location="MANIFEST"
223files_to_sign="$manifest_location $public_key_file"
224
225# Go to scratch_dir
226
227if [[ "${image_type}" == "squashfs" ]]; then
228 echo "Creating SquashFS image..."
Adriana Kobylak851bc062019-06-05 14:33:06 -0500229 # Prepare pnor file in ${pnor_dir}
230 cd "${pnor_dir}"
Adriana Kobylak85f25402019-10-09 13:56:59 -0500231 # Set permissions of partition files to read only
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000232 chmod 440 -- *
Adriana Kobylak095b1a02022-05-23 20:44:59 +0000233 # shellcheck disable=SC2048,SC2086 # Do not quote partitions since it lists
234 # multiple files and mksquashfs would assume to be a single file name within
235 # quotes
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000236 mksquashfs ${tocfile} ${partitions[*]} "${scratch_dir}"/pnor.xz.squashfs -all-root
Lei YUdcb3fd72019-02-21 13:19:03 +0800237 cd "${scratch_dir}"
Lei YUdcb3fd72019-02-21 13:19:03 +0800238 files_to_sign+=" pnor.xz.squashfs"
239else
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000240 cp "${pnorfile}" "${scratch_dir}"
Lei YUdcb3fd72019-02-21 13:19:03 +0800241 cd "${scratch_dir}"
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000242 files_to_sign+=" $(basename "${pnorfile}")"
Lei YUdcb3fd72019-02-21 13:19:03 +0800243fi
Gunnar Mills37751f92017-02-07 21:05:01 -0600244
Saqib Khan93433f02017-03-23 22:24:27 -0500245echo "Creating MANIFEST for the image"
Leonel Gonzalezc14a3d22017-06-22 12:49:38 -0500246echo -e "purpose=xyz.openbmc_project.Software.Version.VersionPurpose.Host\nversion=$version\n\
Saqib Khan7254f0e2017-04-10 21:45:37 -0500247extended_version=$extended_version" >> $manifest_location
Saqib Khan93433f02017-03-23 22:24:27 -0500248
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000249if [[ -n "${machine_name}" ]]; then
Lei YU647d6132019-12-31 14:35:00 +0800250 echo -e "MachineName=${machine_name}" >> $manifest_location
251fi
252
Eddie James643e7302018-02-26 15:23:43 -0600253if [[ "${do_sign}" == true ]]; then
254 private_key_name=$(basename "${private_key_path}")
255 key_type="${private_key_name%.*}"
256 echo KeyType="${key_type}" >> $manifest_location
257 echo HashType="RSA-SHA256" >> $manifest_location
258
Lei YUdcb3fd72019-02-21 13:19:03 +0800259 for file in $files_to_sign; do
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000260 openssl dgst -sha256 -sign "${private_key_path}" -out "${file}.sig" "$file"
Eddie James643e7302018-02-26 15:23:43 -0600261 done
262
Lei YUdcb3fd72019-02-21 13:19:03 +0800263 additional_files="*.sig"
Eddie James643e7302018-02-26 15:23:43 -0600264fi
265
Lei YUdcb3fd72019-02-21 13:19:03 +0800266if [[ "${image_type}" == "squashfs" ]]; then
267 echo "Generating tarball to contain the SquashFS image and its MANIFEST"
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000268 # shellcheck disable=SC2086 # Do not quote the files variables since they list
269 # multiple files and tar would assume to be a single file name within quotes
270 tar -cvf "$outfile" $files_to_sign $additional_files
Lei YUdcb3fd72019-02-21 13:19:03 +0800271 echo "SquashFSTarball at ${outfile}"
272else
Adriana Kobylak7bd45a32021-04-20 19:45:05 +0000273 # shellcheck disable=SC2086 # Do not quote the files variables since they list
274 # multiple files and tar would assume to be a single file name within quotes
275 tar -czvf "$outfile" $files_to_sign $additional_files
Lei YUdcb3fd72019-02-21 13:19:03 +0800276 echo "Static layout tarball at $outfile"
277fi