xref: /openbmc/openpower-pnor-code-mgmt/generate-tar (revision 647d6134d448178e6b32892322596a5cc3d78b2d) 
1#!/bin/bash
2set -eo pipefail
3
4help=$'Generate Tarball with PNOR image and MANIFEST Script
5
6Generates a PNOR SquashFS image from the PNOR image for VPNOR,
7Or use a static layout raw PNOR image,
8Creates a MANIFEST for image verification and recreation
9Packages the image and MANIFEST together in a tarball
10
11usage: generate-tar [OPTION] <PNOR FILE>...
12
13Options:
14   -i, --image <squashfs|static>
15                          Generate SquashFS image or use static PNOR
16   -f, --file <file>      Specify destination file. Defaults to
17                          `pwd`/<PNOR FILE>.pnor.<image_type>.tar[.gz] if
18                          unspecified.
19                          (For example,
20                          * "generate-tar -i squashfs my.pnor" would generate
21                          `pwd`/my.pnor.squashfs.tar
22                          * "generate-tar -i static my.pnor" would generate
23                          `pwd`/my.pnor.static.tar.gz)
24   -s, --sign <path>      Sign the image. The optional path argument specifies
25                          the private key file. Defaults to the bash variable
26                          PRIVATE_KEY_PATH if available, or else uses the
27                          open-source private key in this script.
28   -m, --machine <name>   Optionally specify the target machine name of this
29                          image.
30   -h, --help             Display this help text and exit.
31'
32
33private_key=$'-----BEGIN PRIVATE KEY-----
34MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAPvSDLu6slkP1gri
35PaeQXL9ysD69J/HjbBCIQ0RPfeWBb75US1tRTjPP0Ub8CtH8ExVf8iF1ulsZA78B
36zIjBYZVp9pyD6LbpZ/hjV7rIH6dTNhoVpdA+F8LzmQ7cyhHG8l2JMvdunwF2uX5k
37D4WDcZt/ITKZNQNavPtmIyD5HprdAgMBAAECgYEAuQkTSi5ZNpAoWz76xtGRFSwU
38zUT4wQi3Mz6tDtjKTYXasiQGa0dHC1M9F8fDu6BZ9W7W4Dc9hArRcdzEighuxoI/
39nZI/0uL89iUEywnDEIHuS6D5JlZaj86/nx9YvQnO8F/seM+MX0EAWVrd5wC7aAF1
40h6Fu7ykZB4ggUjQAWwECQQD+AUiDOEO+8btLJ135dQfSGc5VFcZiequnKWVm6uXt
41rX771hEYjYMjLqWGFg9G4gE3GuABM5chMINuQQUivy8tAkEA/cxfy19XkjtqcMgE
42x/UDt6Nr+Ky/tk+4Y65WxPRDas0uxFOPk/vEjgVmz1k/TAy9G4giisluTvtmltr5
43DCLocQJBAJnRHx9PiD7uVhRJz6/L/iNuOzPtTsi+Loq5F83+O6T15qsM1CeBMsOw
44cM5FN5UeMcwz+yjfHAsePMkcmMaU7jUCQHlg9+N8upXuIo7Dqj2zOU7nMmkgvSNE
455yuNImRZabC3ZolwaTdd7nf5r1y1Eyec5Ag5yENV6JKPe1Xkbb1XKJECQDngA0h4
466ATvfP1Vrx4CbP11eKXbCsZ9OGPHSgyvVjn68oY5ZP3uPsIattoN7dE2BRfuJm7m
47F0nIdUAhR0yTfKM=
48-----END PRIVATE KEY-----
49'
50
51# Reference the ffs structures at:
52# https://github.com/open-power/hostboot/blob/master/src/usr/pnor/common/ffs_hb.H
53# https://github.com/open-power/hostboot/blob/master/src/usr/pnor/ffs.h
54let ffs_entry_size=128
55let vercheck_offset=112
56do_sign=false
57private_key_path="${PRIVATE_KEY_PATH}"
58image_type=""
59outfile=""
60declare -a partitions=()
61tocfile="pnor.toc"
62machine_name=""
63
64while [[ $# -gt 0 ]]; do
65  key="$1"
66  case $key in
67    -i|--image)
68      image_type="$2"
69      shift 2
70      ;;
71    -f|--file)
72      outfile="$2"
73      shift 2
74      ;;
75    -s|--sign)
76      do_sign=true
77      if [[ ! -z "${2}"  && "${2}" != -* ]]; then
78        private_key_path="$2"
79        shift 2
80      else
81        shift 1
82      fi
83      ;;
84    -m|--machine)
85      machine_name="$2"
86      shift 2
87      ;;
88    -h|--help)
89      echo "$help"
90      exit
91      ;;
92    *)
93      pnorfile="$1"
94      shift 1
95      ;;
96  esac
97done
98
99if [ ! -f "${pnorfile}" ]; then
100  echo "Please enter a valid PNOR file."
101  echo "$help"
102  exit 1
103fi
104
105if [[ "${image_type}" == "squashfs" ]]; then
106  echo "Will generate squashfs image for VPNOR"
107elif [[ "${image_type}" == "static" ]]; then
108  echo "Will use static image for PNOR"
109else
110  echo "Please specify the image type, \"squashfs\" or \"static\""
111  echo
112  echo "$help"
113  exit 1
114fi
115
116if [[ -z $outfile ]]; then
117    if [[ ${pnorfile##*.} == "pnor" ]]; then
118        outfile=`pwd`/${pnorfile##*/}.$image_type.tar
119    else
120        outfile=`pwd`/${pnorfile##*/}.pnor.$image_type.tar
121    fi
122    if [[ "${image_type}" == "static" ]]; then
123        # Append .gz so the tarball is compressed
124        outfile=$outfile.gz
125    fi
126else
127    if [[ $outfile != /* ]]; then
128        outfile=`pwd`/$outfile
129    fi
130fi
131
132
133scratch_dir=`mktemp -d`
134# Remove the temp directory on exit.
135# The files in the temp directory may contain read-only files, so add
136# --interactive=never to skip the prompt.
137trap "{ rm -r --interactive=never ${scratch_dir}; }" EXIT
138
139if [[ "${do_sign}" == true ]]; then
140  if [[ -z "${private_key_path}" ]]; then
141    private_key_path=${scratch_dir}/OpenBMC.priv
142    echo "${private_key}" > "${private_key_path}"
143    echo "Image is NOT secure!! Signing with the open private key!"
144  else
145    if [[ ! -f "${private_key_path}" ]]; then
146      echo "Couldn't find private key ${private_key_path}."
147      exit 1
148    fi
149
150    echo "Signing with ${private_key_path}."
151  fi
152
153  public_key_file=publickey
154  public_key_path=${scratch_dir}/$public_key_file
155  openssl pkey -in "${private_key_path}" -pubout -out ${public_key_path}
156fi
157
158echo "Parsing PNOR TOC..."
159
160pnor_dir="${scratch_dir}/pnor"
161mkdir ${pnor_dir}
162
163pflash --partition=part --read=${pnor_dir}/part -F ${pnorfile}
164pflash --partition=VERSION --read=${pnor_dir}/VERSION -F ${pnorfile}
165version_size=$(wc -c ${pnor_dir}/VERSION | cut -d' ' -f 1)
166magic_number=$(xxd -p -l 4 ${pnor_dir}/VERSION)
167# Check if VERSION is signed. A signed version partition will have an extra
168# 4K header starting with the magic number 0x17082011, see:
169# https://github.com/open-power/skiboot/blob/master/libstb/container.h#L47
170if [ "$version_size" == "8192" -a "$magic_number" == "17082011" ]; then
171  # Advance past the STB header (4K, indexed from 1)
172  cp ${pnor_dir}/VERSION ${pnor_dir}/VERSION_FULL
173  tail --bytes=+4097 ${pnor_dir}/VERSION_FULL > ${pnor_dir}/VERSION
174fi
175{
176  version=$(head -n 1 ${pnor_dir}/VERSION)
177  echo "version=$version"
178  extended_version=$(echo $(tail -n +2 ${pnor_dir}/VERSION)|tr ' ' ',')
179  echo "extended_version=$extended_version"
180  while read line; do
181    if [[ $line == "ID="* ]]; then
182        # This line looks like
183        # "ID=05 MVPD 000d9000..00169000 (actual=00090000) [ECC]"
184        read -r -a fields <<< "$line"
185
186        id=${fields[0]##*=}
187        offset=$((${ffs_entry_size} * 10#${id} + ${vercheck_offset}))
188        vercheck=$(xxd -p -l  0x1 -seek ${offset} ${pnor_dir}/part)
189        export flags=$(pflash --detail=$((10#$id)) -F ${pnorfile} | grep "\[" |
190                sed 's/....$//' | tr '\n' ',' | sed 's/.$//')
191        if [[ $flags != "" ]]; then
192            flags=,$flags
193        fi
194
195        if [[ $(echo $flags | grep "READONLY") == "" &&
196              $(echo $flags | grep "PRESERVED") == "" ]]; then
197            flags=$flags,READWRITE
198        fi
199
200        # Need the partition ID, name, start location, end location, and flags
201        echo  "partition${id}=${fields[1]},${fields[2]/../,},${vercheck}${flags}"
202
203        # Save the partition name
204        partitions+=(${fields[1]})
205    fi
206  # Don't need the BACKUP_PART partition
207  done < <(pflash --info -F ${pnorfile} | grep -v "BACKUP")
208} > ${pnor_dir}/${tocfile}
209
210for partition in "${partitions[@]}"; do
211  echo "Reading ${partition}..."
212  pflash --partition=${partition} \
213    --read=${pnor_dir}/${partition} \
214    -F ${pnorfile}
215done
216
217manifest_location="MANIFEST"
218files_to_sign="$manifest_location $public_key_file"
219
220# Go to scratch_dir
221
222if [[ "${image_type}" == "squashfs" ]]; then
223  echo "Creating SquashFS image..."
224  # Prepare pnor file in ${pnor_dir}
225  cd "${pnor_dir}"
226  # Set permissions of partition files to read only
227  chmod 440 *
228  mksquashfs ${tocfile} ${partitions[*]} ${scratch_dir}/pnor.xz.squashfs -all-root
229  cd "${scratch_dir}"
230  files_to_sign+=" pnor.xz.squashfs"
231else
232  cp ${pnorfile} ${scratch_dir}
233  cd "${scratch_dir}"
234  files_to_sign+=" $(basename ${pnorfile})"
235fi
236
237echo "Creating MANIFEST for the image"
238echo -e "purpose=xyz.openbmc_project.Software.Version.VersionPurpose.Host\nversion=$version\n\
239extended_version=$extended_version" >> $manifest_location
240
241if [[ ! -z "${machine_name}" ]]; then
242    echo -e "MachineName=${machine_name}" >> $manifest_location
243fi
244
245if [[ "${do_sign}" == true ]]; then
246  private_key_name=$(basename "${private_key_path}")
247  key_type="${private_key_name%.*}"
248  echo KeyType="${key_type}" >> $manifest_location
249  echo HashType="RSA-SHA256" >> $manifest_location
250
251  for file in $files_to_sign; do
252    openssl dgst -sha256 -sign ${private_key_path} -out "${file}.sig" $file
253  done
254
255  additional_files="*.sig"
256fi
257
258if [[ "${image_type}" == "squashfs" ]]; then
259  echo "Generating tarball to contain the SquashFS image and its MANIFEST"
260  tar -cvf $outfile $files_to_sign $additional_files
261  echo "SquashFSTarball at ${outfile}"
262else
263  tar -czvf $outfile $files_to_sign $additional_files
264  echo "Static layout tarball at $outfile"
265fi
266
267