QCS2290 secureboot 流程

1、提前准备

Bp侧代码
Ap侧代码(全编译通过)
HEXAGON_Tools
Snapdragon_SD_LLVM_ARM.LNX.4.0 Installer_40200.1.tar 高通Boot编译工具
8.0版本以下版本的gcc

2、创建新的文件夹存放临时的签名文件OEM-KEYS

将如下文件拷贝到我们创建的OEM-KEYS目录下：

QCM2290.LA.3.0/common/sectools/resources/data_prov_assets/General_Assets/Signing/openssl/opensslroot.cfg
QCM2290.LA.3.0/common/sectools/resources/data_prov_assets/General_Assets/Signing/openssl/v3.ext
QCM2290.LA.3.0/common/sectools/resources/data_prov_assets/General_Assets/Signing/openssl/v3_attest.ext  //Android R 上新增的，高通文档说要这个文件

3、生成对应的公钥和私钥

注意：高通建议使用的是ECDSA方法，这里我们使用2048的方式，接下来的都是有关2048的流程
在OEM-KEY目录下执行以下命令生成签名文件：

openssl genrsa -out qpsa_rootca.key -3 2048
openssl req -new -key qpsa_rootca.key -x509 -out rootca_pem.crt -subj /C=US/ST=California/L="San Diego"/OU="General Use Test Key (for testing 13 only)"/OU="CDMA Technologies"/O=QUALCOMM/CN="QCT Root CA 1" -days 7300 -set_serial 1 -config opensslroot.cfg
openssl x509 -in rootca_pem.crt -inform PEM -out qpsa_rootca.cer -outform DER
openssl x509 -text -inform DER -in qpsa_rootca.ceropenssl genrsa -out qpsa_attestca.key -3 2048
openssl req -new -key qpsa_attestca.key -out attestca.csr -subj /C=US/ST=CA/L="San Diego"/OU="CDMA Technologies"/O=QUALCOMM/CN="QUALCOMM Attestation CA" -days 7300 -config opensslroot.cfg
openssl x509 -req -in attestca.csr -CA rootca_pem.crt -CAkey qpsa_rootca.key -out attestca_pem.crt -set_serial 5 -days 7300 -extfile v3.ext
openssl x509 -inform PEM -in attestca_pem.crt -outform DER -out qpsa_attestca.cer

将生成的qpsa_attestca.key，qpsa_attestca.cer，qpsa_rootca.cer，qpsa_rootca.key拷贝到源码目录里面，目录在QCM2290.LA.3.0/common/sectools/resources/data_prov_assets/Signing/Local/qti_presigned_certs-key2048_exp65537/

所以为啥要拷贝到qti_presigned_certs-key2048_exp65537目录下呢？

因为从文件QCM2290.LA.3.0/common/sectools/config/agatti/agatti_secimage.xml 可以看到:

<general_properties><selected_signer>local_v2</selected_signer><selected_encryptor>unified_encryption_2_0</selected_encryptor><selected_cert_config>qti_presigned_certs</selected_cert_config><cass_capability>secboot_sha2_pss_subca2</cass_capability>
...<key_size>2048</key_size><exponent>65537</exponent>
...

selected_cert_config: 代表的是签名文件名
key_size：表示签名文件的key大小
exponent：表示id，表示差异

所以按照一定规则，使用的签名文件为qti_presigned_certs-key2048_exp65537

当然，也可以自己创建目录存放我们自己的签名文件，只需要在这里配置即可

4、替换rootcert.txt文件

4.1、重新生成sha256rootcert.txt

在QCM2290.LA.3.0/common/sectools/resources/data_prov_assets/Signing/Local/qti_presigned_certs-key2048_exp65537/目录下，执行如下命令替换sha256rootcert.txt

openssl dgst -sha256 qpsa_rootca.cer > sha256rootcert.txt

结果为SHA256(qpsa_rootca.cer)= 781243930c4eaa8ec60a2afcdb1bcfb9b0d2f579b3c504e1ad9def23d0274aca

4.2、重新生成sha384rootcert.txt

在QCM2290.LA.3.0/common/sectools/resources/data_prov_assets/Signing/Local/qti_presigned_certs-key2048_exp65537/目录下，执行如下命令替换sha384rootcert.txt

openssl dgst -sha384 qpsa_rootca.cer >sha384rootcert.txt

结果为SHA384(qpsa_rootca.cer)= 3af2114c7685ff37e515385a8261e03beef85c8a3df9eeb647865a9dbfc30ff60cfe26f99d3737a4a734343fc41cac8a

5、修改XML配置文件

所需修改的xml文件位于QCM2290.LA.3.0/common/sectools/config/agatti/agatti_fuseblower_USER.xml 目录下，所以我们需要进入这个目录。

5.1 修改agatti_fuseblower_USER.xml文件

5.1.1 配置hash值，替换其中的value值为第三步最后生成的hash值

<entry ignore="false"><description>contains the OEM public key hash as set by OEM</description><name>root_cert_hash0</name><value>781243930c4eaa8ec60a2afcdb1bcfb9b0d2f579b3c504e1ad9def23d0274aca</value>
</entry>

5.1.2 配置PK Hash,修改value值为true

        <entry ignore="false"><description>PK Hash is in Fuse for SEC_BOOT1 : Apps</description><name>SEC_BOOT1_PK_Hash_in_Fuse</name><value>true</value></entry>
...<entry ignore="false"><description>PK Hash is in Fuse for SEC_BOOT2 : MBA</description><name>SEC_BOOT2_PK_Hash_in_Fuse</name><value>true</value></entry>
...<entry ignore="false"><description>PK Hash is in Fuse for SEC_BOOT3 : MPSS</description><name>SEC_BOOT3_PK_Hash_in_Fuse</name><value>true</value></entry>

5.1.3 配置oem id

<entry ignore="false"><description>The OEM hardware ID</description><name>oem_hw_id</name><value>0x0000</value>
</entry>

5.1.4 配置module id

<entry ignore="false"><description>The OEM product ID</description><name>oem_product_id</name><value>0x0000</value>
</entry>

6、生成sec.elf文件

# 生成sec.elf
cd QCM2290.LA.3.0/common/sectools
python sectools.py fuseblower -p agatti -g -d -a --sign

sec.elf 路径为：QCM2290.LA.3.0/common/sectools/fuseblower_output/v2/sec.elf
检查生成的sec.dat是否和XML配置匹配，（如下为一条命令）

python sectools.py fuseblower --oem_config_path=config/agatti/agatti_fuseblower_OEM.xml --qti_config_path=config/agatti/agatti_fuseblower_QTI.xml --user_config_path=config/agatti/agatti_fuseblower_USER.xml --secdat=common_output/v2/sec.elf --validate

7、编译BP的代码

分别有以下三个需要编译

MPSS
ADSP
BOOT (Android R上新增的需要编译)

7.1 编译MPSS

无

7.2 编译ADSP

无

7.3 编译BOOT

android R上生成NON-HLOS.bin需要使用到BOOT.XF.4.1下的文件，所以我们需要编译这里面的代码

7.3.1 首先需要配置环境，需要安装llvm-4.0.2，在高通上下载Snapdragon_SD_LLVM_ARM.LNX.4.0 Installer_40200.1工具

解压工具包（我放在了/opt/Qualcomm/llvm/4.0.2目录里），并在BOOT.XF.4.1/boot_images/QcomPkg/toolchainconfig.json 文件中修改llvm 的路径, 如下：

{"ToolChain" : {"CLANG40" : {# search path should already contain the path where app exists after edksetup.bat/.sh"Windows" :{"Path" : "C:\\Apps\\LLVM\\4.0.2\\bin\\",  # put in the search path"Tool_path" : "C:\\Apps\\LLVM\\4.0.2\\tools\\bin\\",                                                     "Params" : [# append to the build command"-t", "CLANG40WIN"]} ,"Linux" : {"Path" :  "/opt/Qualcomm/llvm/4.0.2/bin/" ,  # 修改这里"Tool_path" : "/opt/Qualcomm/llvm/4.0.2/tools/bin/" , # 修改这里"Params" : [# append to the build command"-t" , "CLANG40LINUX"]}
..."Elf_to_Bin" : {"Windows" :{"Path" : "C:\\Apps\\LLVM\\4.0.2\\tools\\bin\\arm-elfcopy.exe"},"Linux" : {"Path" : "/opt/Qualcomm/llvm/4.0.2/tools/bin/arm-elfcopy" # 修改这里}},

7.3.2 执行命令编译

cd BOOT.XF.4.1/boot_images/QcomPkg/SocPkg/AgattiPkg
make -C OOT.XF.4.1/boot_images/BaseTools/Source/C   // 请使用gcc 8.0以下版本，否则会报错
python ../../buildex.py --variant LAA -r RELEASE -t AgattiPkg,QcomToolsPkg

7.3.3 报错

You may need to run:make -C BOOT.XF.4.1/boot_images/BaseTools/Source/C

解决办法

make -C BOOT.XF.4.1/boot_images/BaseTools/Source/C

make时报错

/usr/include/x86_64-linux-gnu/bits/string_fortified.h:136:10: error: ‘__builtin___strncat_chk’ output may be truncated copying between 0 and 511 bytes from a string of length 511 [-Werror=stringop-truncation]136 |   return __builtin___strncat_chk (__dest, __src, __len, __bos (__dest));|          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors

解决办法

由于是gcc 在8.0后添加了一些检查的东西，导致编译报错，所以切换gcc版本低于8.0

8、删除不支持的镜像文件(QCM2290.LA.3.0/contents.xml)

adsp2.mbn 不支持
wapi 不支持

-      <download_file cmm_file_var="ADSP2_BINARY" pil_split="adsp2" minimized="true">
+      <!-- <download_file cmm_file_var="ADSP2_BINARY" pil_split="adsp2" minimized="true"><file_name>adsp2.mbn</file_name><file_path>adsp_proc/obj/qdsp6v5_ReleaseG/agatti.adsp.prod2/</file_path>
-      </download_file>
+      </download_file> -->...<build_command>build.cmd build.cmd</build_command></build>
-    <build>
+    <!-- <build><name>wapi</name><role>wapi</role><chipset>QCM2290</chipset>
@@ -769,7 +769,7 @@<release_path>HY11_CompileTest</release_path><buildfile_path>cd/</buildfile_path><build_command>cd ./addon/build_wapi; source ./build.sh</build_command>
-    </build>
+    </build> -->

9、镜像签名

对所有镜像签名：

python sectools.py secimage -m ../../ -s -c config/agatti/agatti_secimage.xml -o TMP --cfg_selected_cert_config=qti_presigned_certs

-o 表示镜像签名后需要保存的目录

使用qti_presigned_certs-key2048_exp65537 下的签名文件进行签名，签名后的文件保存到 TMP目录下(自己新建的，可以自己定义路径)

10、将签名后的文件拷贝到原来的目录下并生成NON-HLOS.bin文件

注意，qdsp6sw.mbn签名后名字会被自动修改为modem.mbn，拷贝回去的时候需要将名字改为qdsp6sw.mbn
方便起见，写了一个拷贝的脚本，该脚本保存在"6.镜像签名"步骤的xlf_tmp目录下并执行就可以啦

#!/usr/bin/shecho "start copy signed img !!!"
BPPath=/opt/codes/QCS2290/  # 这路径需要按照本地BP文件地址配置
cp ./agatti/xbl/xbl.elf $BPPath/BOOT.XF.4.1/boot_images/QcomPkg/SocPkg/AgattiPkg/Bin/LAA/RELEASE/xbl.elf
cp ./agatti/xbl_config/xbl_config.elf $BPPath/BOOT.XF.4.1/boot_images/QcomPkg/SocPkg/AgattiPkg/Bin/LAA/RELEASE/xbl_config.elf
cp ./agatti/abl/abl_ecc.elf $BPPath/LA.UM.9.15.2/LINUX/android/out/target/product/bengal/abl_ecc.elf
cp ./agatti/prog_firehose_ddr/prog_firehose_ddr.elf $BPPath/BOOT.XF.4.1/boot_images/QcomPkg/SocPkg/AgattiPkg/Bin/LAA/RELEASE/prog_firehose_ddr.elf
cp ./agatti/prog_firehouse_lite/prog_firehose_lite.elf $BPPath/BOOT.XF.4.1/boot_images/QcomPkg/SocPkg/AgattiPkg/Bin/LAA/RELEASE/prog_firehose_lite.elf
cp ./agatti/modem/modem.mbn $BPPath/MPSS.HA.1.1/modem_proc/build/ms/bin/kamorta.gen.prod/qdsp6sw.mbn
cp ./agatti/tz/tz.mbn $BPPath/TZ.XF.5.1/trustzone_images/build/ms/bin/FAYAANAA/tz.mbn
cp ./agatti/hyp/hyp.mbn $BPPath/TZ.XF.5.1/trustzone_images/build/ms/bin/FAYAANAA/hyp.mbn
cp ./agatti/devcfg/devcfg.mbn $BPPath/TZ.XF.5.1/trustzone_images/build/ms/bin/FAYAANAA/devcfg.mbn
cp ./agatti/adsp/adsp.mbn $BPPath/ADSP.VT.5.4.1/adsp_proc/obj/qdsp6v5_ReleaseG/agatti.adsp.prod/adsp.mbn
cp ./agatti/wlan/wlanmdsp.mbn $BPPath/WLAN.HL.3.3.7/wlan_proc/build/ms/bin/QCAHLAWPDLIOT/signed/wlanmdsp.mbn
cp ./agatti/venus/venus.mbn $BPPath/VIDEO.VE.6.0/venus_proc/build/bsp/asic/build/PROD/mbn/reloc/eccn/signed/venus.mbn
cp ./agatti/ipa_fw/scuba_ipa_fws.elf $BPPath/LA.UM.9.15.2/LINUX/android/out/target/product/bengal/vendor/firmware/scuba_ipa_fws.elf
cp ./agatti/sampleapp32/smplap32.mbn $BPPath/TZ.XF.5.1/trustzone_images/build/ms/bin/FAYAANAA/smplap32.mbn
cp ./agatti/sampleapp64/smplap64.mbn $BPPath/TZ.XF.5.1/trustzone_images/build/ms/bin/FAYAANAA/smplap64.mbn
cp ./agatti/km41/km41.mbn $BPPath/TZ.APPS.2.0/qtee_tas/build/ms/bin/FAYAANAA/km41.mbn
# cp $BPPath/TZ.APPS.2.0/qtee_tas/build/ms/bin/FAYAANAA/km41.mbn
cp ./agatti/hdcpsrm/hdcpsrm.mbn $BPPath/TZ.APPS.2.0/qtee_tas/build/ms/bin/FAYAANAA/hdcpsrm.mbn
cp ./agatti/gfx_microcode/a702_zap.elf $BPPath/LA.UM.9.15.2/LINUX/android/out/target/product/bengal/vendor/firmware/a702_zap.elf
cp ./agatti/uefisecapp/uefi_sec.mbn $BPPath/TZ.APPS.2.0/qtee_tas/build/ms/bin/FAYAANAA/uefi_sec.mbn
cp ./agatti/storsec/storsec.mbn $BPPath/TZ.APPS.2.0/qtee_tas/build/ms/bin/FAYAANAA/storsec.mbn
cp ./agatti/rtic/rtic.mbn $BPPath/TZ.APPS.2.0/qtee_tas/build/ms/bin/FAYAANAA/rtic.mbn
cp ./agatti/featenabler/featenabler.mbn $BPPath/TZ.APPS.2.0/qtee_tas/build/ms/bin/FAYAANAA/featenabler.mbn
cp ./agatti/qupv3/qupv3fw.elf $BPPath/QCM2290.LA.3.0/common/core_qupv3fw/agatti/qupv3fw.elf
cp ./agatti/rpm/rpm.mbn $BPPath/RPM.BF.1.10/rpm_proc/build/ms/bin/agatti/sdm_ddr4/rpm.mbn
cp ./agatti/imagefv/imagefv.elf $BPPath/BOOT.XF.4.1/boot_images/QcomPkg/SocPkg/AgattiPkg/Bin/LAA/RELEASE/imagefv.elf
# cp $BPPath/QCM2290.LA.3.0/common/build/bin/multi_image/agatti/multi_image/multi_image.mbn
echo "end copy signed img !!!"

11、复制AP侧编译好的img

将AP侧编译生成的image复制到LA.UM.9.15.2/LINUX/android/out/target/product/bengal目录下（建议直接将bengal整个目录直接拷贝到LA.UM.9.15.2/LINUX/android/out/target/product/bengal目录下


./system_ext.img
./dtbo.img
./recovery.img
./vendor.img
./vbmeta_system.img
./prebuilt_dtbo.img
./super.img
./product.img
./ramdisk-debug.img
./persist.img
./dtb.img
./ramdisk.img
./metadata.img
./userdata.img
./super_empty.img
./ramdisk-recovery.img
./boot-debug.img
./system.img
./vbmeta.img
./boot.img
./abl_ecc.elf
./abl.elf

12、生成NON-HLOS.bin文件

cd QCM2290.LA.3.0/common/build
python build.py

生成的NON-HLOS.bin文件路径为QCM2290.LA.3.0/common/build/emmc/bin/asic/NON-HLOS.bin(这个路径可以从contents.xml中查看到)

<download_file storage_type="emmc" backup_partition="modem_b" fastboot="modem_a" minimized="true"><file_name>NON-HLOS.bin</file_name><file_path>common/build/emmc/bin/asic/</file_path>
</download_file>