#!/bin/bash -e

# Copyright (c) 2018 Amlogic, Inc. All rights reserved.
#
# This source code is subject to the terms and conditions defined in the
# file 'LICENSE' which is part of this source code package.

#set -x

SCRIPT_PATH=${SCRIPT_PATH:-$(dirname $(readlink -f $0))}

# Path to sign-boot-c1 util
TOOL_PATH=${TOOL_PATH:-$(dirname $(readlink -f $0))}

USE_TOOL_SCRIPT_VERSION=false
if $USE_TOOL_SCRIPT_VERSION; then
    CREATE_HEADER_TOOL=${TOOL_PATH}/create-header.sh
else
    CREATE_HEADER_TOOL=${TOOL_PATH}/sign-boot-c1
fi

# Temporary files directory
if [ -z "$TMP" ]; then
    TMP=${SCRIPT_PATH}/tmp
fi

trace ()
{
    echo ">>> $@" > /dev/null
}

usage() {
    cat << EOF
Usage: $(basename $0) --help

       All-in-one command to create a signed bootloader:

       $(basename $0) --create-signed-bl	\\
                [--soc      (g12a|g12b|sm1|a1|c1)] \\
                --bl2		bl2.bin		\\
                --bl30		bl30.bin	\\
                --bl30-key	bl30key.pem	\\
                [--bl30-aes-key	bl30aeskey	\\
                 --bl30-aes-iv	bl30aesiv]	\\
                --bl31		bl31.img	\\
                --bl31-key	bl31key.pem	\\
                [--bl31-aes-key	bl31aeskey	\\
                 --bl31-aes-iv	bl31aesiv]	\\
                [--bl32		bl32.img	\\
                 --bl32-key	bl32key.pem]	\\
                [--bl32-aes-key	bl32aeskey	\\
                 --bl32-aes-iv	bl32aesiv]	\\
                --bl33		bl33.bin	\\
                --bl33-key	bl33key.pem	\\
                [--bl33-aes-key	bl33aeskey	\\
                 --bl33-aes-iv	bl33aesiv]	\\
                [--kernel-key	kernelkey.pem	\\
                 --kernel-aes-key	kernelaeskey	\\
                 --kernel-aes-iv	kernelaesiv]	\\
                [--fip-key     fipkey.pem]     \\
                [--bl2-arb-cvn <version>]      \\
                [--fip-arb-cvn <version>]      \\
                [--bl30-arb-cvn        <version>]      \\
                [--bl31-arb-cvn        <version>]      \\
                [--bl32-arb-cvn        <version>]      \\
                [--bl33-arb-cvn        <version>]      \\
                [--e            none]          \\
                [--root-key-idx <index>]       \\
                [--marketid     <marketid>]    \\
                -o bl.bin

       Environment Variables:

       TMP:          path to a temporary directory. Defaults to <this script's path>/tmp
EOF
    exit 1
}

## Globals
readonly BL30_SIZE=58368
## /Globals

## Global SoC Config
current_soc=""
bl30_required=true
separate_fip_aes=false
keyhashver_min=2

set_soc() {
    if [ "$current_soc" != "" ]; then
        if [ "$1" != "$current_soc" ]; then
            echo "Internal error setting soc $1"; exit 1
        fi
        return
    fi
    case "$1" in
        g12a|g12b|sm1) ;;
        a1|c1)
            bl30_required=false
            separate_fip_aes=true
            keyhashver_min=3
            ;;
        *)
            echo "Invalid soc $1"; exit 1 ;;
    esac
    readonly bl30_required separate_fip_aes
    readonly current_soc="$1"
}
## /Global SoC Config

check_file() {
    if [ ! -f "$2" ]; then echo Error: Unable to open $1: \""$2"\"; exit 1 ; fi
}

# Check optional file argument exists and is given size
# $1 arg name
# $2 size
# $3 file
check_opt_file() {
    if [ -n "$3" ]; then
        check_file "$1" "$3"
        local filesize=$(wc -c < "$3")
        if [ $filesize -ne $2 ]; then
            echo "Incorrect size $filesize != $2 for $1 $3"
            exit 1
        fi
    fi
}

# Hash root/bl2 RSA keys'.  sha256(n[keylen] + e)
# $1: key hash version
# $2: precomputed binary key file
# $3: keylen
# $4: output hash file
hash_rsa_bin() {
    local keyhashver=$1
    local key=$2
    local keylen=$3
    local output=$4
    if [ -z "$1" ] || [ -z "$2" ] || [ -z "$3" ] || [ -z "$4" ]; then
        echo "Argument error"
        exit 1
    fi
    local insize=$(wc -c < $key)
    if [ $insize -ne 1052 ] && [ $insize -ne 1036 ]; then
        echo "Keyfile wrong size"
        exit 1
    fi
    if [ "$keyhashver" == "3" ] && [ $insize -ne 1052 ]; then
        echo "Keyfile wrong size"
        exit 1
    fi
    if [ "$keyhashver" == "2" ] && [ $insize -ne 1036 ]; then
        echo "Keyfile wrong size"
        exit 1
    fi
    if [ $keylen -ne 1024 ] && [ $keylen -ne 2048 ] && [ $keylen -ne 4096 ]; then
        echo "Invalid keylen"
        exit 1
    fi
    local keylenbytes=$(( $keylen / 8 ))

    if [ "$keyhashver" == "3" ] || [ $keyhashver -eq 2 ]; then
        cp $key $TMP/keydata
    else
        # modulus - rsa_public_key_t.n[key length]
        dd if=$key of=$TMP/keydata bs=$keylenbytes count=1 >& /dev/null
        # exponent - rsa_public_key_t.e
        dd if=$key of=$TMP/keydata bs=1 skip=512 count=4 \
            oflag=append conv=notrunc >& /dev/null
    fi

    openssl dgst -sha256 -out $output -binary $TMP/keydata
}

# Sign bl2 or bl30
sign_bl2() {
    local input=""
    local bl2hdr=""
    local bl2key=""
    local aesiv=""
    local output=""
    local sigver=""
    local keyhashver=""
    local argv=("$@")
    local i=0
    local bl2size=65536

    # Parse args
    i=0
    while [ $i -lt $# ]; do
        arg="${argv[$i]}"
        i=$((i + 1))
        case "$arg" in
            -i)
                input="${argv[$i]}" ;;
            --bl2-hdr)
                bl2hdr="${argv[$i]}" ;;
            --bl2-key)
                bl2key="${argv[$i]}" ;;
            --bl2-size)
                bl2size="${argv[$i]}" ;;
            --iv)
                aesiv="${argv[$i]}" ;;
            -o)
                output="${argv[$i]}" ;;
            --sig-ver)
                sigver="${argv[$i]}" ;;
            --key-hash-ver)
                keyhashver="${argv[$i]}" ;;
            *)
                echo "Unknown option $arg"; exit 1
                ;;
        esac
        i=$((i + 1))
    done

    # Verify args
    check_file bl2  "$input"
    check_file bl2-hdr  "$bl2hdr"
    check_file bl2key "$bl2key"
    if [ -z "$output" ]; then echo Error: Missing output file option -o; exit 1; fi
    if [ ! -z "$aesiv"  ]; then
        check_file "AES IV" "$aesiv"
    fi
    if [ -z "$sigver" ]; then
        sigver=1
    fi
    if [ "$keyhashver" != "2" ] && [ "$keyhashver" != "3" ]; then
        echo Error: bad key hash ver; exit 1
    fi

    local keylenbytes=$(get_pem_key_len "$bl2key")
    local keylen=$(( $keylenbytes * 8 ))

    local insize=$(wc -c < "$bl2hdr")
    if [ $insize -ne 4096 ]; then
        echo "bl2-hdr wrong size ($insize != 4096)"
        exit 1
    fi
    local bl2_payload_size=$(wc -c < ${input})
    trace "BL2 size specified $bl2size"
    trace "Input BL2 payload size $bl2_payload_size"
    if [ $bl2size -ne $(($bl2_payload_size + 4096)) ]; then
        echo Error: invalid bl2 input file size $bl2_payload_size
        exit 1
    fi

    # Add bl2-hdr + bl2
    cat "$bl2hdr" "$input" > "$TMP/bl2.img"

    # Truncate to correct length
    # TODO should check that end of output is all zeroes before truncating
    truncate -s $bl2size $TMP/bl2.img

    # Sign second part with bl2 key
    dd if=$TMP/bl2.img of=$TMP/sigdata bs=1 skip=2264 count=64 >& /dev/null
    chkstart=$(( 2264 + 64 + keylenbytes ))
    chksize=$(( $bl2_payload_size + 1832 - 64 - keylenbytes ))
    # - from nChkStart to end of bl2
    dd if=$TMP/bl2.img of=$TMP/sigdata bs=1 skip=$chkstart count=$chksize \
        oflag=append conv=notrunc >& /dev/null
    openssl dgst -sha256 -sign $bl2key -out $TMP/sigdata.sig $TMP/sigdata

    # Replace signature placeholder
    dd if=$TMP/sigdata.sig of=$TMP/bl2.img bs=1 seek=2328 count=$keylenbytes \
        conv=notrunc >& /dev/null

    # Replace nonce
    if [ ! -z "$aesiv" ]; then
        dd if=$aesiv of=$TMP/bl2.img bs=16 count=1 \
            conv=notrunc >& /dev/null
    else
        dd if=/dev/urandom of=$TMP/bl2.img bs=16 count=1 \
            conv=notrunc >& /dev/null
    fi

    cp $TMP/bl2.img $output
}

# Get key len in bytes of private PEM RSA key
# $1: PEM file
get_pem_key_len() {
    local pem=$1
    local bits=0
    if [ ! -f "$1" ]; then
        echo "Argument error, \"$1\""
        exit 1
    fi
    bits=$(openssl rsa -in $pem -text -noout | \
        grep 'Private-Key: (' | \
        sed -r 's/(RSA )?Private-Key: \(//'| \
        sed -r 's/ bit(,.?[0-9].?primes)?\)//')
    if [ "$bits" == "" ]; then
       echo "Unexpected key size  $bits"
       exit 1
    fi
    if [ "$bits" -ne 1024 ] && [ "$bits" -ne 2048 ] &&
       [ "$bits" -ne 4096 ] && [ "$bits" -ne 8192]; then
       echo "Unexpected key size  $bits"
       exit 1
    fi
    echo $(( $bits / 8 ))
}

# Calculate aligned file size
# $1: file
# $2: alignment requirement in bytes
aligned_size() {
    local file=$1
    local skip=$2
    local alignment=$3
    local alignedsize=0

    local filesize=$(wc -c < ${file})
    #echo "Input $file filesize $filesize"
    if [ $skip -ne 0 ]; then
        filesize=$(( $filesize - $skip ))
    fi
    local rem=$(( $filesize % $alignment ))
    if [ $rem -ne 0 ]; then
        #echo "Input $file not $alignment byte aligned"
        local padsize=$(( $alignment - $rem ))
        alignedsize=$(( $filesize + $padsize ))
    else
        alignedsize=$filesize
    fi
    #echo "Aligned size $alignedsize"
    echo $alignedsize
}

# Pad file to len by adding 0's to end of file
# $1: file
# $2: len
pad_file() {
    local file=$1
    local len=$2
    if [ ! -f "$1" ] || [ -z "$2" ]; then
        echo "Argument error, \"$1\", \"$2\" "
        exit 1
    fi
    local filesize=$(wc -c < ${file})
    local padlen=$(( $len - $filesize ))
    if [ $len -lt $filesize ]; then
        echo "File larger than expected.  $filesize, $len"
        exit 1
    fi
    dd if=/dev/zero of=$file oflag=append conv=notrunc bs=1 \
        count=$padlen >& /dev/null
}

# $1: input
# $2: output
# $3: aes key file
# $4: aes iv file
internal_encrypt() {
    local input=$1
    local output=$2
    local keyfile=$3
    local ivfile=$4
    if [ ! -f "$1" ] || [ -z "$2" ] || [ -z "$3" ] || [ -z "$4" ]; then
        echo "Argument error"
        exit 1
    fi
    local key=$(xxd -p -c64 $keyfile)
    local iv=$(xxd -p -c64 $ivfile)
    local imagesize=$(wc -c < ${input})
    local rem=$(( $imagesize % 16 ))
    if [ $rem -ne 0 ]; then
        echo "Input $input not 16 byte aligned?"
        exit 1
    fi
    openssl enc -aes-256-cbc -K $key -iv $iv -e -in $input -out $output -nopad
}

# sign bl3x
sign_bl3x() {
    local input=""
    local key=""
    local output=""
    local arb_cvn=""
    local aeskey=""
    local aesiv=""
    local argv=("$@")
    local encrypt=false
    local stage=""
    local i=0

    # Parse args
    i=0
    while [ $i -lt $# ]; do
        arg="${argv[$i]}"
        i=$((i + 1))
        case "$arg" in
            -i)
                input="${argv[$i]}" ;;
            -k)
                key="${argv[$i]}" ;;
            -o)
                output="${argv[$i]}" ;;
            -a)
                aeskey="${argv[$i]}" ;;
            --iv)
                aesiv="${argv[$i]}" ;;
            --stage)
                stage="${argv[$i]}" ;;
            -v)
                arb_cvn="${argv[$i]}" ;;
            *)
                echo "Unknown option $arg"; exit 1
                ;;
        esac
        i=$((i + 1))
    done
    # Verify args
    check_file "input" "$input"
    if [ -z "$output" ]; then echo Error: Missing output file option -o; exit 1; fi
    if [ -z "$arb_cvn" ]; then
        arb_cvn="0"
    fi
    if [ ! -z "$key" ]; then
        check_file "RSA key" "$key"
    else
        echo Error missing key
        exit 1
    fi
    check_file "RSA key" "$key"
    if [ ! -z "$aeskey" ]; then
        if [ -z "$aesiv"  ]; then echo Error: missing AES IV; exit 1; fi
        check_file "AES key" "$aeskey"
        check_file "AES IV" "$aesiv"
        encrypt=true
    fi
    if [ "$stage" != "bl30" ] &&
            [ "$stage" != "bl31" ] &&
            [ "$stage" != "bl32" ] &&
            [ "$stage" != "bl33" ]; then
        echo Error invalid bl3x stage \"$stage\"
        exit 1
    fi

    # Pad so that hdr + payload is 512 byte aligned
    # because of bl2 driver limitation
    local imagesize=$(wc -c < ${input})
    local rem=$(( (656 + $imagesize) % 512 ))
    if [ $rem -ne 0 ]; then
        #echo "Input $input not 512 byte aligned?"
        local topad=$(( 512 - $rem ))
        imagesize=$(( $imagesize + $topad ))
        cp $input $TMP/blpad.bin
        pad_file $TMP/blpad.bin $imagesize
        input=$TMP/blpad.bin
    fi

    # Hash payload
    openssl dgst -sha256 -binary $input > $TMP/bl-pl.sha

    # Add hash to header
    ${TOOL_PATH}/sign-boot-c1 --create-sbImage-header \
            --hash $TMP/bl-pl.sha \
            --arb-cvn $arb_cvn \
            --stage $stage \
            -o $TMP/bl.hdr

    # Pad header to push signature to end
    # pad to (sizeof(sbImageHeader_t) - signature[keylen] - nonce[16])
    local keylen=$(get_pem_key_len $key)
    pad_file $TMP/bl.hdr $(( 656 - $keylen - 16 ))

    # Sign header
    openssl dgst -sha256 -sign $key -out $TMP/bl.hdr.sig $TMP/bl.hdr

    # Create nonce
    dd if=/dev/urandom of=$TMP/nonce.bin bs=16 count=1 >& /dev/null

    # Combine nonce + hdr + sig + payload
    cat $TMP/nonce.bin $TMP/bl.hdr $TMP/bl.hdr.sig $input > $TMP/bl.bin

    if $encrypt; then
        internal_encrypt $TMP/bl.bin $output $aeskey $aesiv
        #external_encrypt $TMP/bl.bin $output
    else
        cp $TMP/bl.bin $output
    fi
}

append_uint32_le() {
    local input=$1
    local output=$2
    local v=
    local vrev=
    v=$(printf %08x $input)
    # 00010001
    vrev=${v:6:2}${v:4:2}${v:2:2}${v:0:2}

    echo $vrev | xxd -r -p >> $output
}

append_uint64_le() {
    local input=$1
    local output=$2
    local v=
    local vrev=
    v=$(printf %016x $input)

    vrev=${v:14:2}${v:12:2}${v:10:2}${v:8:2}${v:6:2}${v:4:2}${v:2:2}${v:0:2}

    echo $vrev | xxd -r -p >> $output
}

# Encrypt/sign kernel
#typedef struct {
#	uint32_t magic;
#	uint32_t version;
#	uint32_t flags;
#	uint32_t img_version;
#	uint32_t img_size;
#	uint32_t img_offset;
#	uint8_t img_hash[32];
#	uint8_t reserved[200];
#	uint8_t rsa_sig[256];
#} aml_boot_header_t;
#
#CASSERT(sizeof(aml_boot_header_t) == 512, assert_sizeof_aml_boot_header_t);
sign_kernel() {
    local input=""
    local key=""
    local output=""
    local arb_cvn=""
    local aeskey=""
    local aesiv=""
    local argv=("$@")
    local encrypt=false
    local stage="kernel"
    local i=0

    # Parse args
    i=0
    while [ $i -lt $# ]; do
        arg="${argv[$i]}"
        i=$((i + 1))
        case "$arg" in
            -i)
                input="${argv[$i]}" ;;
            -k)
                key="${argv[$i]}" ;;
            -o)
                output="${argv[$i]}" ;;
            -a)
                aeskey="${argv[$i]}" ;;
            --iv)
                aesiv="${argv[$i]}" ;;
            -v)
                arb_cvn="${argv[$i]}" ;;
            *)
                echo "Unknown option $arg"; exit 1
                ;;
        esac
        i=$((i + 1))
    done
    # Verify args
    check_file "input" "$input"
    if [ -z "$output" ]; then echo Error: Missing output file option -o; exit 1; fi
    if [ -z "$arb_cvn" ]; then
        arb_cvn="0"
    fi
    if [ ! -z "$key" ]; then
        check_file "RSA key" "$key"
    else
        echo Error missing key
        exit 1
    fi
    check_file "RSA key" "$key"
    if [ ! -z "$aeskey" ]; then
        if [ -z "$aesiv"  ]; then echo Error: missing AES IV; exit 1; fi
        check_file "AES key" "$aeskey"
        check_file "AES IV" "$aesiv"
        encrypt=true
    fi

    local imagesize=$(wc -c < ${input})
    local rem=$(( $imagesize % 512 ))
    if [ $rem -ne 0 ]; then
        #echo "Input $input not 512 byte aligned?"
        local topad=$(( 512 - $rem ))
        imagesize=$(( $imagesize + $topad ))
        cp $input $TMP/kernpad.bin
        pad_file $TMP/kernpad.bin $imagesize
        input=$TMP/kernpad.bin
    fi

    # Hash payload
    openssl dgst -sha256 -binary $input > $TMP/kern-pl.sha

    # Encrypt payload
    if $encrypt; then
        internal_encrypt $input $TMP/kern-pl.bin $aeskey $aesiv
    else
        cp $input $TMP/kern-pl.bin
    fi

    # Create header
    # magic, version, flags, img_version
    echo -n '@AML' > $TMP/kern.hdr
    append_uint32_le 4 $TMP/kern.hdr
    append_uint32_le 0 $TMP/kern.hdr
    append_uint32_le $arb_cvn $TMP/kern.hdr
    # img_size, img_offset, img_hash, reserved
    append_uint32_le $imagesize $TMP/kern.hdr
    append_uint32_le 512 $TMP/kern.hdr
    cat $TMP/kern-pl.sha >> $TMP/kern.hdr
    pad_file $TMP/kern.hdr 256

    # Sign header
    openssl dgst -sha256 -sign $key -out $TMP/kern.hdr.sig $TMP/kern.hdr

    # Combine header + signature
    cat $TMP/kern.hdr.sig >> $TMP/kern.hdr

    # Pad to 512 in case key/sig is smaller than maximum
    pad_file $TMP/kern.hdr 512

    # Combine hdr + payload
    cat $TMP/kern.hdr $TMP/kern-pl.bin > $output

    echo
    echo Created signed kernel $output successfully
}

# Encrypt/sign rtos/NBG
#define IH_MAGIC      0x56190527  /* Image Magic Number, 0x27051956*/
#define IH_ENC_MAGIC	0x43455341  /* Image encrypt flag*/
#define IH_NMLEN	32			/* Image Name Length		*/
#	typedef struct {
#		uint32_t	ih_magic;	/* Image Header Magic Number	*/
#		uint32_t	ih_hcrc;	/* Image Header CRC Checksum	*/
#		uint32_t	ih_time;	/* Image Creation Timestamp */
#		uint32_t	ih_size;	/* Image Data Size		*/
#		uint32_t	ih_load;	/* Data  Load  Address		*/
#		uint32_t	ih_ep;		/* Entry Point Address		*/
#		uint32_t	ih_dcrc;	/* Image Data CRC Checksum	*/
#		uint8_t 	ih_os;		/* Operating System 	*/
#		uint8_t 	ih_arch;	/* CPU architecture 	*/
#		uint8_t 	ih_type;	/* Image Type			*/
#		uint8_t 	ih_comp;	/* Compression Type 	*/
#		uint8_t 	ih_name[IH_NMLEN-4];	/* Image Name		*/
#		uint32_t    ih_encMagic; /*Image content encrypt flag*/
#	} image_header_chk_t;
#
sign_uimage() {
    local input=""
    local key=""
    local output=""
    local aeskey=""
    local aesiv=""
    local argv=("$@")
    local encrypt=false
    local i=0

    # Parse args
    while [ $i -lt $# ]; do
        arg="${argv[$i]}"
        i=$((i + 1))
        case "$arg" in
            -i)
                input="${argv[$i]}" ;;
            -k)
                key="${argv[$i]}" ;;
            -o)
                output="${argv[$i]}" ;;
            -a)
                aeskey="${argv[$i]}" ;;
            --iv)
                aesiv="${argv[$i]}" ;;
            -v)
                arb_cvn="${argv[$i]}" ;;
            *)
                echo "Unknown option $arg"; exit 1
                ;;
        esac
        i=$((i + 1))
    done
    # Verify args
    check_file "input" "$input"
    if [ -z "$output" ]; then echo Error: Missing output file option -o; exit 1; fi
    if [ -z "$arb_cvn" ]; then
        arb_cvn="0"
    fi

    if [ ! -z "$key" ]; then
        check_file "RSA key" "$key"
    else
        echo Error missing key
        exit 1
    fi
    check_file "RSA key" "$key"
    if [ ! -z "$aeskey" ]; then
        if [ -z "$aesiv"  ]; then echo Error: missing AES IV; exit 1; fi
        check_file "AES key" "$aeskey"
        check_file "AES IV" "$aesiv"
        encrypt=true
    fi

    local ihmagic=$(xxd -p -l 4 $input)
    local ihencmagic=$(xxd -p -seek 60 -l 4 $input)
    if [ "$ihmagic" == "27051956" ]; then
      if [ "$ihencmagic" == "41534543" ]; then
         echo uimage $input was signed, can not sign again!
        return
      fi

    fi

    local imagesize=$(wc -c < ${input})
    local rem=$((( $imagesize + 656 ) % 512 ))
    if [ $rem -ne 0 ]; then
        #echo "Input $input not 512 byte aligned?"
        local topad=$(( 512 - $rem ))
        imagesize=$(( $imagesize + $topad ))
        cp $input $TMP/uimagepad.bin
        pad_file $TMP/uimagepad.bin $imagesize
        input=$TMP/uimagepad.bin
    fi

    dd if="$input" of="$TMP/uimage.hdr" bs=1 count=64 >& /dev/null
    local tempsize=$(( $imagesize - 64 ))
    dd if="$input" of="$TMP/uimage.temp" bs=1 skip=64 count=$tempsize \
        oflag=append conv=notrunc >& /dev/null

    append_uint32_le 0x43455341 "$TMP/ihencmagic"
    dd if="$TMP/ihencmagic" of="$TMP/uimage.hdr" bs=1 seek=60 count=4 \
        conv=notrunc >& /dev/null

    local totalsize=$(( $imagesize + 656 - 64 ))
    printf %08x $totalsize | xxd -r -p > "$TMP/totalsize"
    dd if="$TMP/totalsize" of="$TMP/uimage.hdr" bs=1 seek=12 count=4 \
        conv=notrunc >& /dev/null

    # Hash payload
    openssl dgst -sha256 -binary $TMP/uimage.temp > $TMP/uimage.temp.sha

    # Encrypt payload
    dd if=/dev/urandom of=$TMP/uimage.aeskey bs=1 count=32 >& /dev/null
    dd if=/dev/urandom of=$TMP/uimage.aesiv bs=1 count=16 >& /dev/null
    if $encrypt; then
        internal_encrypt $TMP/uimage.temp $TMP/uimage.temp.bin $TMP/uimage.aeskey $TMP/uimage.aesiv
    else
        cp $TMP/uimage.temp $TMP/uimage.temp.bin
    fi

    # Create sbImageHeader
    # typedef struct{
    #	unsigned char  nonce[16];
    #	unsigned int   magic;
    #	unsigned int   version;
    #	unsigned int   flags;
    #	unsigned int   arb_cvn;
    #	uint64_t       img_size;
    #	uint64_t       img_offset;
    #	unsigned char  img_hash[32];
    #	unsigned char  aes_nonce[16];
    #	unsigned char  aes_key[32];
    #	unsigned char  aes_iv[16];
    #	unsigned char  signature[512];
    # } v3_aml_sbImageHeader_t; //16+16+16+96+512=656

    # Create nonce
    dd if=/dev/urandom of=$TMP/nonce.bin bs=16 count=1 >& /dev/null

    echo -n '@AML' > $TMP/uimage.sb.hdr
    append_uint32_le 1 $TMP/uimage.sb.hdr
    append_uint32_le 0 $TMP/uimage.sb.hdr
    append_uint32_le $arb_cvn $TMP/uimage.sb.hdr
    # img_size, img_offset, img_hash, reserved
    append_uint64_le $tempsize $TMP/uimage.sb.hdr
    append_uint64_le 656 $TMP/uimage.sb.hdr
    cat $TMP/uimage.temp.sha >> $TMP/uimage.sb.hdr
    dd if=/dev/urandom of=$TMP/uimage.sb.hdr oflag=append conv=notrunc bs=1 \
        count=16 >& /dev/null
    cat $TMP/uimage.aeskey >> $TMP/uimage.sb.hdr
    cat $TMP/uimage.aesiv >> $TMP/uimage.sb.hdr

    # Pad header to push signature to end
    # pad to (sizeof(sbImageHeader_t) - signature[keylen] - nonce[16])
    local keylen=$(get_pem_key_len $key)
    pad_file $TMP/uimage.sb.hdr $(( 656 - $keylen - 16 ))

    # Sign header
    openssl dgst -sha256 -sign $key -out $TMP/uimage.sb.hdr.sig $TMP/uimage.sb.hdr

    # Combine header + signature
    cat $TMP/uimage.sb.hdr.sig >> $TMP/uimage.sb.hdr

    dd if="$TMP/uimage.temp.bin" of="$TMP/uimage.temp.bin.first" bs=1 count=656 >& /dev/null
    local separatesize=$(( $tempsize - 656 ))
    dd if="$TMP/uimage.temp.bin" of="$TMP/uimage.temp.bin.second" bs=1 skip=656 count=$separatesize \
        oflag=append conv=notrunc >& /dev/null

    # Combine nonce + sb.hdr
    cat $TMP/nonce.bin $TMP/uimage.sb.hdr > $TMP/uimage.sb.hdr.temp

    if $encrypt; then
        internal_encrypt $TMP/uimage.sb.hdr.temp $TMP/uimage.sb.hdr.bin $aeskey $aesiv
    else
        cp $TMP/uimage.sb.hdr.temp $TMP/uimage.sb.hdr.bin
    fi

    # Combine image.hdr + sb.hdr + payload
    cat $TMP/uimage.hdr $TMP/uimage.sb.hdr.bin $TMP/uimage.temp.bin.second $TMP/uimage.temp.bin.first > $output
    echo
    echo Created signed uimage $output successfully
}

# Convert RSA private PEM key to public key
# $1: input RSA private .PEM
# $2: output public key file
pem_to_pub() {
    local input=$1
    local output=$2
    if [ ! -f "$1" ] || [ -z "$2" ]; then
        echo "Argument error, \"$1\", \"$2\" "
        exit 1
    fi

    openssl 2>/dev/null rsa -in $input -pubout -RSAPublicKey_out -out $output

    if [ $? -ne 0 ]; then
        echo "Error converting key"
        exit 1
    fi
}

# Convert RSA PEM key to precomputed binary key file
# If input is already the precomputed binary key file, then it is simply copied
# to the output
# $1: input RSA private .PEM
# $2: output precomputed binary key file
# $3: enable N0INV128 if True
pem_to_bin() {
    local input=$1
    local output=$2
    local n0inv128_enable=$3
    if [ ! -f "$1" ] || [ -z "$2" ]; then
        echo "Argument error, \"$1\", \"$2\" "
        exit 1
    fi
    if [ -z "$n0inv128_enable" ]; then
      n0inv128_enable=False
    fi

    local insize=$(wc -c < $input)
    if [ $insize -eq 1052 ] || [ $insize -eq 1036 ]; then
        # input is already precomputed binary key file
        cp $input $output
    fi

    local pycmd="import sys; \
                 sys.path.append(\"${TOOL_PATH}\"); \
                 import pem_extract_pubkey; \
                 sys.stdout.write(pem_extract_pubkey.extract_pubkey( \
                    \"$input\", headerMode=False, n0inv128Enable=$n0inv128_enable));"
    /usr/bin/env python -c "$pycmd" > $output
}

# Create and sign FIP
#./sign-boot-c1.sh --create-fip \
# ... \
#    -o fip.bin
create_fip() {
    local bl30=""
    local bl31=""
    local bl32=""
    local bl31_info=""
    local bl32_info=""
    local bl33=""
    local bl30key=""
    local bl31key=""
    local bl32key=""
    local bl33key=""
    local bl30aeskey=""
    local bl31aeskey=""
    local bl32aeskey=""
    local bl33aeskey=""
    local bl30aesiv=""
    local bl31aesiv=""
    local bl32aesiv=""
    local bl33aesiv=""
    local kernelkey=""
    local kernelaeskey=""
    local kernelaesiv=""
    local fipkey=""
    local fip_arb_cvn="0"
    local output=""
    local argv=("$@")
    local i=0
    local ddrfw1=""
    local ddrfw1_sha=""
    local ddrfw2=""
    local ddrfw2_sha=""
    local ddrfw3=""
    local ddrfw3_sha=""
    local ddrfw4=""
    local ddrfw4_sha=""
    local ddrfw5=""
    local ddrfw5_sha=""
    local ddrfw6=""
    local ddrfw6_sha=""
    local ddrfw7=""
    local ddrfw7_sha=""
    local ddrfw8=""
    local ddrfw8_sha=""
    local ddrfw9=""
    local ddrfw9_sha=""
    local ddrfw10=""
    local ddrfw10_sha=""

    # Parse args
    i=0
    while [ $i -lt $# ]; do
        arg="${argv[$i]}"
        i=$((i + 1))
        case "$arg" in
            --bl30)
                bl30="${argv[$i]}" ;;
            --bl31)
                bl31="${argv[$i]}" ;;
            --bl32)
                bl32="${argv[$i]}" ;;
            --bl31-info)
                bl31_info="${argv[$i]}" ;;
            --bl32-info)
                bl32_info="${argv[$i]}" ;;
            --bl33)
                bl33="${argv[$i]}" ;;
            --bl30-key)
                bl30key="${argv[$i]}" ;;
            --bl31-key)
                bl31key="${argv[$i]}" ;;
            --bl32-key)
                bl32key="${argv[$i]}" ;;
            --bl33-key)
                bl33key="${argv[$i]}" ;;
            --bl30-aes-key)
                bl30aeskey="${argv[$i]}" ;;
            --bl31-aes-key)
                bl31aeskey="${argv[$i]}" ;;
            --bl32-aes-key)
                bl32aeskey="${argv[$i]}" ;;
            --bl33-aes-key)
                bl33aeskey="${argv[$i]}" ;;
            --bl30-aes-iv)
                bl30aesiv="${argv[$i]}" ;;
            --bl31-aes-iv)
                bl31aesiv="${argv[$i]}" ;;
            --bl32-aes-iv)
                bl32aesiv="${argv[$i]}" ;;
            --bl33-aes-iv)
                bl33aesiv="${argv[$i]}" ;;
            --kernel-key)
                kernelkey="${argv[$i]}" ;;
            --kernel-aes-key)
                kernelaeskey="${argv[$i]}" ;;
            --kernel-aes-iv)
                kernelaesiv="${argv[$i]}" ;;
            --fip-key)
                fipkey="${argv[$i]}" ;;
            --fip-arb-cvn)
                fip_arb_cvn="${argv[$i]}" ;;
            --ddrfw1)
                ddrfw1="${argv[$i]}"
                if [ "$ddrfw1" != "" ]; then
                    ddrfw1_sha=$TMP/ddrfw1.padded.sha
                    check_file ddrfw1 "$ddrfw1"
                    check_file ddrfw1_sha "$ddrfw1_sha"
                    trace "DDR FW1 $ddrfw1 $ddrfw1_sha"
                fi
                ;;
            --ddrfw2)
                ddrfw2="${argv[$i]}"
                if [ "$ddrfw2" != "" ]; then
                    ddrfw2_sha=$TMP/ddrfw2.padded.sha
                    check_file ddrfw2 "$ddrfw2"
                    check_file ddrfw2_sha "$ddrfw2_sha"
                    trace "DDR FW2 $ddrfw2 $ddrfw2_sha"
                fi
                ;;
            --ddrfw3)
                ddrfw3="${argv[$i]}"
                if [ "$ddrfw3" != "" ]; then
                    ddrfw3_sha=$TMP/ddrfw3.padded.sha
                    check_file ddrfw3 "$ddrfw3"
                    check_file ddrfw3_sha "$ddrfw3_sha"
                    trace "DDR FW3 $ddrfw3 $ddrfw3_sha"
                fi
                ;;
            --ddrfw4)
                ddrfw4="${argv[$i]}"
                if [ "$ddrfw4" != "" ]; then
                    ddrfw4_sha=$TMP/ddrfw4.padded.sha
                    check_file ddrfw4 "$ddrfw4"
                    check_file ddrfw4_sha "$ddrfw4_sha"
                    trace "DDR FW4 $ddrfw4 $ddrfw4_sha"
                fi
                ;;
            --ddrfw5)
                ddrfw5="${argv[$i]}"
                if [ "$ddrfw5" != "" ]; then
                    ddrfw5_sha=$TMP/ddrfw5.padded.sha
                    check_file ddrfw5 "$ddrfw5"
                    check_file ddrfw5_sha "$ddrfw5_sha"
                    trace "DDR FW5 $ddrfw5 $ddrfw5_sha"
                fi
                ;;
            --ddrfw6)
                ddrfw6="${argv[$i]}"
                if [ "$ddrfw6" != "" ]; then
                    ddrfw6_sha=$TMP/ddrfw6.padded.sha
                    check_file ddrfw6 "$ddrfw6"
                    check_file ddrfw6_sha "$ddrfw6_sha"
                    trace "DDR FW6 $ddrfw6 $ddrfw6_sha"
                fi
                ;;
            --ddrfw7)
                ddrfw7="${argv[$i]}"
                if [ "$ddrfw7" != "" ]; then
                    ddrfw7_sha=$TMP/ddrfw7.padded.sha
                    check_file ddrfw7 "$ddrfw7"
                    check_file ddrfw7_sha "$ddrfw7_sha"
                    trace "DDR FW7 $ddrfw7 $ddrfw7_sha"
                fi
                ;;
            --ddrfw8)
                ddrfw8="${argv[$i]}"
                if [ "$ddrfw8" != "" ]; then
                    ddrfw8_sha=$TMP/ddrfw8.padded.sha
                    check_file ddrfw8 "$ddrfw8"
                    check_file ddrfw8_sha "$ddrfw8_sha"
                    trace "DDR FW8 $ddrfw8 $ddrfw8_sha"
                fi
                ;;
            --ddrfw9)
                ddrfw9="${argv[$i]}"
                if [ "$ddrfw9" != "" ]; then
                    ddrfw9_sha=$TMP/ddrfw9.padded.sha
                    check_file ddrfw9 "$ddrfw9"
                    check_file ddrfw9_sha "$ddrfw9_sha"
                    trace "DDR FW9 $ddrfw9 $ddrfw9_sha"
                fi
                ;;
            --ddrfw10)
                ddrfw10="${argv[$i]}"
                if [ "$ddrfw10" != "" ]; then
                    ddrfw10_sha=$TMP/ddrfw10.padded.sha
                    check_file ddrfw10 "$ddrfw10"
                    check_file ddrfw10_sha "$ddrfw10_sha"
                    trace "DDR FW10 $ddrfw10 $ddrfw10_sha"
                fi
                ;;
            -o)
                output="${argv[$i]}" ;;
            *)
                echo "Unknown option $arg"; exit 1 ;;
        esac
        i=$((i + 1))
    done
    # Verify args
    check_file bl30 "$bl30"
    check_file bl31 "$bl31"
    check_file bl32 "$bl32"
    check_file bl31_info "$bl31_info"
    check_file bl32_info "$bl32_info"
    check_file bl33 "$bl33"
    if [ -n "$bl30key" ]; then
        check_file bl30key "$bl30key"
    fi
    check_file bl31key "$bl31key"
    check_file bl32key "$bl32key"
    check_file bl33key "$bl33key"
    check_file bl30aeskey "$bl30aeskey"
    check_file bl31aeskey "$bl31aeskey"
    check_file bl32aeskey "$bl32aeskey"
    check_file bl33aeskey "$bl33aeskey"
    check_file bl30aesiv "$bl30aesiv"
    check_file bl31aesiv "$bl31aesiv"
    check_file bl32aesiv "$bl32aesiv"
    check_file bl33aesiv "$bl33aesiv"
    if [ ! -z "$kernelkey" ]; then
        check_file kernelkey "$kernelkey"
    fi
    if [ ! -z "$kernelaeskey" ]; then
        check_file kernelaeskey "$kernelaeskey"
        check_file kernelaesiv "$kernelaesiv"
    fi
    check_file fipkey "$fipkey"

    if [ -z "$output" ]; then echo Error: Missing output file option -o ; exit 1; fi

    if [ -n "$bl30key" ]; then
        pem_to_pub $bl30key $TMP/bl30key.pub
    fi
    pem_to_pub $bl31key $TMP/bl31key.pub
    pem_to_pub $bl32key $TMP/bl32key.pub
    pem_to_pub $bl33key $TMP/bl33key.pub

    # Convert PEM key to rsa_public_key_t (precomputed RSA public key)
    if [ -n "$bl30key" ]; then
        pem_to_bin $TMP/bl30key.pub $TMP/bl30key.bin
    else
        head -c 1036 /dev/zero > "$TMP/bl30key.bin"
    fi
    pem_to_bin $TMP/bl31key.pub $TMP/bl31key.bin
    pem_to_bin $TMP/bl32key.pub $TMP/bl32key.bin
    pem_to_bin $TMP/bl33key.pub $TMP/bl33key.bin

    # dummy key/iv placeholders
    dd if=/dev/zero of="$TMP/zeroaeskey" bs=1 count=32 >& /dev/null
    dd if=/dev/zero of="$TMP/zeroaesiv" bs=1 count=16 >& /dev/null

    if [ ! -z "$kernelkey" ]; then
        pem_to_pub $kernelkey $TMP/kernelkey.pub
        pem_to_bin $TMP/kernelkey.pub $TMP/kernelkey.bin
    else
        # dummy kernelkey placeholder
        dd if=/dev/zero of=$TMP/kernelkey.bin bs=1036 count=1 &> /dev/null
    fi
    if [ -z "$kernelaeskey" ]; then
        # dummy key/iv placeholders
        kernelaeskey=$TMP/zeroaeskey
        kernelaesiv=$TMP/zeroaesiv
    fi

    # Overencrypt bl3x keys

    # Create header (without nonce) and add keys
    local argv=("$@")
    ${TOOL_PATH}/sign-boot-c1 --create-fip-header \
        --bl30 $bl30 --bl30-key $TMP/bl30key.bin \
        --bl30-aes-key $bl30aeskey --bl30-aes-iv $bl30aesiv \
        --bl31 $bl31 --bl31-key $TMP/bl31key.bin \
        --bl31-aes-key $bl31aeskey --bl31-aes-iv $bl31aesiv \
        --bl32 $bl32 --bl32-key $TMP/bl32key.bin \
        --bl32-aes-key $bl32aeskey --bl32-aes-iv $bl32aesiv \
        --bl33 $bl33 --bl33-key $TMP/bl33key.bin \
        --bl33-aes-key $bl33aeskey --bl33-aes-iv $bl33aesiv \
        --bl31-info $bl31_info --bl32-info $bl32_info \
        --kernel-key $TMP/kernelkey.bin \
        --kernel-aes-key $kernelaeskey --kernel-aes-iv $kernelaesiv \
        --arb-cvn $fip_arb_cvn \
        --ddrfw1   "$ddrfw1" \
        --ddrfw1-sha   "$ddrfw1_sha" \
        --ddrfw2   "$ddrfw2" \
        --ddrfw2-sha   "$ddrfw2_sha" \
        --ddrfw3   "$ddrfw3" \
        --ddrfw3-sha   "$ddrfw3_sha" \
        --ddrfw4   "$ddrfw4" \
        --ddrfw4-sha   "$ddrfw4_sha" \
        --ddrfw5   "$ddrfw5" \
        --ddrfw5-sha   "$ddrfw5_sha" \
        --ddrfw6   "$ddrfw6" \
        --ddrfw6-sha   "$ddrfw6_sha" \
        --ddrfw7   "$ddrfw7" \
        --ddrfw7-sha   "$ddrfw7_sha" \
        --ddrfw8   "$ddrfw8" \
        --ddrfw8-sha   "$ddrfw8_sha" \
        --ddrfw9   "$ddrfw9" \
        --ddrfw9-sha   "$ddrfw9_sha" \
        --ddrfw10   "$ddrfw10" \
        --ddrfw10-sha   "$ddrfw10_sha" \
        -o $TMP/fip.hdr

    # Pad header to size
    # pad to (sizeof(fip hdr) - signature[keylen] - nonce[16])
    local keylen=$(get_pem_key_len $fipkey)
    pad_file $TMP/fip.hdr $(( (16*1024) - $keylen - 16 ))

    # Sign header
    openssl dgst -sha256 -sign $fipkey -out $TMP/fip.hdr.sig $TMP/fip.hdr

    # Create nonce
    dd if=/dev/urandom of=$TMP/nonce.bin bs=16 count=1 >& /dev/null

    # Combine nonce + hdr + sig
    cat $TMP/nonce.bin $TMP/fip.hdr $TMP/fip.hdr.sig > $output
}

# Check (bl31/bl32) input is .img
# 1: input
# returns True or False
is_img_format() {
    local input=$1
    if [ ! -f "$1" ]; then
        echo "Argument error, \"$1\""
        exit 1
    fi
    local insize=$(wc -c < $input)
    if [ $insize -le 512 ]; then
        # less than size of img header
        echo False
        return
    fi

    local inmagic=$(xxd -p -l 4 $input)
    if [ "$inmagic" == "65873412" ]; then
        # Input has FIP_TOC_ENTRY_EXT_FLAG, so it is in .img format.
        # Strip off 0x200 byte header.
        echo True
    else
        echo False
    fi
}

# Convert from .img to .bin.  If not .img format, copy to output.
# 1: input
# 2: output
convert_img_to_bin() {
    local input=$1
    local output=$2
    if [ ! -f "$1" ] || [ -z "$2" ]; then
        echo "Argument error, \"$1\", \"$2\" "
        exit 1
    fi
    local insize=$(wc -c < $input)
    if [ $insize -le 512 ]; then
        # less than size of img header
        cp $input $output
        return
    fi

    local inmagic=$(xxd -p -l 4 $input)
    if [ "$inmagic" == "65873412" ]; then
        # Input has FIP_TOC_ENTRY_EXT_FLAG, so it is in .img format.
        # Strip off 0x200 byte header.
        tail -c +513 $input > $output
    else
        cp $input $output
    fi
}

sign_enc_ddrfw() {
    local name="$1"
    local ddrfw="$2"
    local ddrfwalignment=16384
    local encryptFIPbl3x="$3"
    local aeskey="$4"
    local ddrfwsha="$5"
    local ddrfwout="$6"
    local ddrfwcombined="$7"

    check_file $name "$ddrfw"

    # 16K align
    size=$(aligned_size "$ddrfw" 96 $ddrfwalignment)
    trace "sizeof($ddrfw) $(wc -c < ${ddrfw}) --> $size"

    dd if=$ddrfw of=$TMP/ddrfw.hdr bs=1 count=96 >& /dev/null
    dd if=$ddrfw of=$TMP/ddrfw.padded bs=1 skip=96 >& /dev/null
    pad_file $TMP/ddrfw.padded $size

    openssl dgst -sha256 -binary $TMP/ddrfw.padded > $ddrfwsha

    if $encryptFIPbl3x; then
        dd if=/dev/zero of=$TMP/zeroiv bs=16 count=1 >& /dev/null
        internal_encrypt $TMP/ddrfw.padded $TMP/ddrfw.padded.enc $aeskey $TMP/zeroiv
        mv $TMP/ddrfw.padded.enc $TMP/ddrfw.padded
    fi

    dd if=$TMP/ddrfw.padded of=$ddrfwcombined oflag=append conv=notrunc >& /dev/null

    cat $TMP/ddrfw.hdr $TMP/ddrfw.padded > $ddrfwout
}

# Sign bl2 or bl30 header with root key
sign_bl2_hdr() {
    local rootkey=""
    local rootkeyidx="0"
    local rootkey0=""
    local rootkey1=""
    local rootkey2=""
    local rootkey3=""
    local bl2key0=""
    local bl2key1=""
    local bl2key2=""
    local bl2key3=""
    local bl2key=""
    local output=""
    local arb_cvn=""
    local marketid="0"
    local sigver=""
    local keyhashver=""
    local argv=("$@")
    local i=0
    local bl2size=65536
    local soc="g12a"

    # Parse args
    i=0
    while [ $i -lt $# ]; do
        arg="${argv[$i]}"
        i=$((i + 1))
        case "$arg" in
            --soc)
                soc="${argv[$i]}" ;;
            --root-key)
                rootkey="${argv[$i]}" ;;
            --root-key-idx)
                rootkeyidx="${argv[$i]}" ;;
            --root-key-0)
                rootkey0="${argv[$i]}" ;;
            --root-key-1)
                rootkey1="${argv[$i]}" ;;
            --root-key-2)
                rootkey2="${argv[$i]}" ;;
            --root-key-3)
                rootkey3="${argv[$i]}" ;;
            --bl2-key-0)
                bl2key0="${argv[$i]}" ;;
            --bl2-key-1)
                bl2key1="${argv[$i]}" ;;
            --bl2-key-2)
                bl2key2="${argv[$i]}" ;;
            --bl2-key-3)
                bl2key3="${argv[$i]}" ;;
            --bl2-key)
                bl2key="${argv[$i]}" ;;
            -o)
                output="${argv[$i]}" ;;
            --bl2-size)
                bl2size="${argv[$i]}" ;;
            --arb-cvn)
                arb_cvn="${argv[$i]}" ;;
            --marketid)
                marketid="${argv[$i]}" ;;
            --sig-ver)
                sigver="${argv[$i]}" ;;
            --key-hash-ver)
                keyhashver="${argv[$i]}" ;;
            *)
                echo "Unknown option $arg"; exit 1
                ;;
        esac
        i=$((i + 1))
    done
    # Verify args
    set_soc "$soc"

    check_file rootkey "$rootkey"
    check_file rootkey0 "$rootkey0"
    check_file rootkey1 "$rootkey1"
    check_file rootkey2 "$rootkey2"
    check_file rootkey3 "$rootkey3"
    check_file bl2key0 "$bl2key0"
    check_file bl2key1 "$bl2key1"
    check_file bl2key2 "$bl2key2"
    check_file bl2key3 "$bl2key3"
    check_file bl2key "$bl2key"
    if [ -z "$output" ]; then echo Error: Missing output file option -o; exit 1; fi
    if [ -z "$arb_cvn" ]; then
        arb_cvn="0"
    else
        if [ $(( $arb_cvn )) -lt 0 ] || [ $(( $arb_cvn )) -gt 255 ]; then
            echo Error: invalid bl2 arb cvn \"$arb_cvn\"
            exit 1
        fi
    fi
    if [ -z "$sigver" ]; then
        sigver=1
    fi
    if [ -z "$keyhashver" ]; then
        keyhashver=$keyhashver_min
    fi
    if [ "$keyhashver" -lt $keyhashver_min ]; then
        echo Error: bad key hash ver; exit 1
    fi
    if [ "$keyhashver" != "2" ] && [ "$keyhashver" != "3" ]; then
        echo Error: bad key hash ver; exit 1
    fi
    trace "BL2 size specified $bl2size"

    local keylenbytes=$(get_pem_key_len "$rootkey")
    local keylen=$(( $keylenbytes * 8 ))

    # Convert to public PEM using openssl in case of password protected keys
    pem_to_pub "$rootkey"  "$TMP/rootkey.pub"
    cp "$rootkey0" "$TMP/rootkey0.pub"
    cp "$rootkey1" "$TMP/rootkey1.pub"
    cp "$rootkey2" "$TMP/rootkey2.pub"
    cp "$rootkey3" "$TMP/rootkey3.pub"
    cp "$bl2key0" "$TMP/bl2key0.pub"
    cp "$bl2key1" "$TMP/bl2key1.pub"
    cp "$bl2key2" "$TMP/bl2key2.pub"
    cp "$bl2key3" "$TMP/bl2key3.pub"
    pem_to_pub "$bl2key"  "$TMP/bl2key.pub"

    # Convert PEM key to rsa_public_key_t (precomputed RSA public key)
    if [ "$keyhashver" == "3" ]; then
        enable_n0inv128=True
    else
        enable_n0inv128=False
    fi

    pem_to_bin "$TMP/rootkey.pub" "$TMP/rootkey.bin" $enable_n0inv128
    pem_to_bin "$TMP/rootkey0.pub" "$TMP/rootkey0.bin" $enable_n0inv128
    pem_to_bin "$TMP/rootkey1.pub" "$TMP/rootkey1.bin" $enable_n0inv128
    pem_to_bin "$TMP/rootkey2.pub" "$TMP/rootkey2.bin" $enable_n0inv128
    pem_to_bin "$TMP/rootkey3.pub" "$TMP/rootkey3.bin" $enable_n0inv128
    pem_to_bin "$TMP/bl2key0.pub" "$TMP/bl2key0.bin" $enable_n0inv128
    pem_to_bin "$TMP/bl2key1.pub" "$TMP/bl2key1.bin" $enable_n0inv128
    pem_to_bin "$TMP/bl2key2.pub" "$TMP/bl2key2.bin" $enable_n0inv128
    pem_to_bin "$TMP/bl2key3.pub" "$TMP/bl2key3.bin" $enable_n0inv128
    pem_to_bin "$TMP/bl2key.pub" "$TMP/bl2key.bin" $enable_n0inv128

    # hash of keys
    hash_rsa_bin $keyhashver "$TMP/rootkey.bin" $keylen "$TMP/rootkey.sha"
    hash_rsa_bin $keyhashver "$TMP/rootkey0.bin" $keylen "$TMP/rootkey0.sha"
    hash_rsa_bin $keyhashver "$TMP/rootkey1.bin" $keylen "$TMP/rootkey1.sha"
    hash_rsa_bin $keyhashver "$TMP/rootkey2.bin" $keylen "$TMP/rootkey2.sha"
    hash_rsa_bin $keyhashver "$TMP/rootkey3.bin" $keylen "$TMP/rootkey3.sha"
    hash_rsa_bin $keyhashver "$TMP/bl2key0.bin" $keylen "$TMP/bl2key0.sha"
    hash_rsa_bin $keyhashver "$TMP/bl2key1.bin" $keylen "$TMP/bl2key1.sha"
    hash_rsa_bin $keyhashver "$TMP/bl2key2.bin" $keylen "$TMP/bl2key2.sha"
    hash_rsa_bin $keyhashver "$TMP/bl2key3.bin" $keylen "$TMP/bl2key3.sha"
    hash_rsa_bin $keyhashver "$TMP/bl2key.bin" $keylen "$TMP/bl2key.sha"

    # Create bl2 header
    ${CREATE_HEADER_TOOL} --create-bl2-header \
            -r $keylen \
            --root-key "$TMP/rootkey.bin" \
            --root-key-idx $rootkeyidx \
            --root-key-sha-0 "$TMP/rootkey0.sha" \
            --root-key-sha-1 "$TMP/rootkey1.sha" \
            --root-key-sha-2 "$TMP/rootkey2.sha" \
            --root-key-sha-3 "$TMP/rootkey3.sha" \
            --bl2-key-sha-0 "$TMP/bl2key0.sha" \
            --bl2-key-sha-1 "$TMP/bl2key1.sha" \
            --bl2-key-sha-2 "$TMP/bl2key2.sha" \
            --bl2-key-sha-3 "$TMP/bl2key3.sha" \
            --bl2-key-idx 0 \
            --bl2-key "$TMP/bl2key.bin" \
            --marketid $marketid \
            --bl2-size $bl2size \
            -o "$TMP/bl2.hdr"

    # Add arb cvn
    if [ ! -z "$arb_cvn" ]; then
        printf %02x $arb_cvn | xxd -r -p > "$TMP/bl2cvn"
        local filesize=$(wc -c < "${TMP}/bl2cvn")
        if [ $filesize -ne 1 ]; then echo Error: cvn error ; exit 1; fi
        # to byteoffset 16+12 - bl2VerMajor
        dd if="$TMP/bl2cvn" of="$TMP/bl2.hdr" bs=1 seek=28 count=1 \
            conv=notrunc >& /dev/null
        # to 2nd aml block header, 0x8d8 + 12
        dd if="$TMP/bl2cvn" of="$TMP/bl2.hdr" bs=1 seek=2276 count=1 \
            conv=notrunc >& /dev/null
    fi

    # Sign first part with root key
    # aml block header - first 64:
    dd if="$TMP/bl2.hdr" of="$TMP/sigdata" bs=1 skip=16 count=64 >& /dev/null
    local chkstart=$(( 16 + 64 + keylenbytes ))
    local chksize=$(( 2248 - 64 - keylenbytes ))
    # - from nChkStart to end of bl2_key_array
    dd if="$TMP/bl2.hdr" of="$TMP/sigdata" bs=1 skip=$chkstart count=$chksize \
        oflag=append conv=notrunc >& /dev/null
    openssl dgst -sha256 -sign "$rootkey" -out "$TMP/sigdata.sig" "$TMP/sigdata"

    # Replace signature placeholder
    dd if="$TMP/sigdata.sig" of="$TMP/bl2.hdr" bs=1 seek=80 count=$keylenbytes \
        conv=notrunc >& /dev/null

    mv "$TMP/bl2.hdr" "$output"
}

# input bl2, bl30/31/32/33/kernel {.bin, rsa key, aes key, aes iv}
create_signed_bl() {
    local bl2=""
    local bl2hdr=""
    local bl30hdr=""
    local bl30=""
    local bl31=""
    local bl32=""
    local bl33=""
    local ddrfw1=""
    local ddrfw1_sha=""
    local ddrfw2=""
    local ddrfw2_sha=""
    local ddrfw3=""
    local ddrfw3_sha=""
    local ddrfw4=""
    local ddrfw4_sha=""
    local ddrfw5=""
    local ddrfw5_sha=""
    local ddrfw6=""
    local ddrfw6_sha=""
    local ddrfw7=""
    local ddrfw7_sha=""
    local ddrfw8=""
    local ddrfw8_sha=""
    local ddrfw9=""
    local ddrfw9_sha=""
    local ddrfw10=""
    local ddrfw10_sha=""
    local rootkey=""
    local rootkeyidx="0"
    local rootkey0=""
    local rootkey1=""
    local rootkey2=""
    local rootkey3=""
    local bl2key0=""
    local bl2key1=""
    local bl2key2=""
    local bl2key3=""
    local bl2key=""
    local bl30key=""
    local bl31key=""
    local bl32key=""
    local bl33key=""
    local bl2aeskey=""
    local bl30aeskey=""
    local bl31aeskey=""
    local bl32aeskey=""
    local bl33aeskey=""
    local bl2aesiv=""
    local bl30aesiv=""
    local bl31aesiv=""
    local bl32aesiv=""
    local bl33aesiv=""
    local kernel=""
    local kernelkey=""
    local kernelaeskey=""
    local kernelaesiv=""
    local fipkey=""
    local fipaeskey=""
    local fipaesiv=""
    local encryptbl2=true
    local encryptFIPbl3x=false
    local bl2_arb_cvn="0"
    local fip_arb_cvn="0"
    local bl30_arb_cvn="0"
    local bl31_arb_cvn="0"
    local bl32_arb_cvn="0"
    local bl33_arb_cvn="0"
    local output=""
    local sigver=""
    local keyhashver=""
    local marketid="0"
    local argv=("$@")
    local i=0
    local size=0
    local ddrfwalignment=16384
    local soc="g12a"

    touch $TMP/ddr.fw.bin

    # Parse args
    i=0
    while [ $i -lt $# ]; do
        arg="${argv[$i]}"
        i=$((i + 1))
        case "$arg" in
            --soc)
                soc="${argv[$i]}" ;;
            --bl2)
                bl2="${argv[$i]}" ;;
            --bl30)
                bl30="${argv[$i]}" ;;
            --bl31)
                bl31="${argv[$i]}" ;;
            --bl32)
                bl32="${argv[$i]}" ;;
            --bl33)
                bl33="${argv[$i]}" ;;
            --bl2-hdr)
                bl2hdr="${argv[$i]}" ;;
            --bl30-hdr)
                bl30hdr="${argv[$i]}" ;;
            --ddrfw1)
                ddrfw1="${argv[$i]}" ;;
            --ddrfw2)
                ddrfw2="${argv[$i]}" ;;
            --ddrfw3)
                ddrfw3="${argv[$i]}" ;;
            --ddrfw4)
                ddrfw4="${argv[$i]}" ;;
            --ddrfw5)
                ddrfw5="${argv[$i]}" ;;
            --ddrfw6)
                ddrfw6="${argv[$i]}" ;;
            --ddrfw7)
                ddrfw7="${argv[$i]}" ;;
            --ddrfw8)
                ddrfw8="${argv[$i]}" ;;
            --ddrfw9)
                ddrfw9="${argv[$i]}" ;;
            --ddrfw10)
                ddrfw10="${argv[$i]}" ;;
            --root-key)
                rootkey="${argv[$i]}" ;;
            --root-key-idx)
                rootkeyidx="${argv[$i]}" ;;
            --root-key-0)
                rootkey0="${argv[$i]}" ;;
            --root-key-1)
                rootkey1="${argv[$i]}" ;;
            --root-key-2)
                rootkey2="${argv[$i]}" ;;
            --root-key-3)
                rootkey3="${argv[$i]}" ;;
            --bl2-key-0)
                bl2key0="${argv[$i]}" ;;
            --bl2-key-1)
                bl2key1="${argv[$i]}" ;;
            --bl2-key-2)
                bl2key2="${argv[$i]}" ;;
            --bl2-key-3)
                bl2key3="${argv[$i]}" ;;
            --bl2-key)
                bl2key="${argv[$i]}" ;;
            --bl30-key)
                bl30key="${argv[$i]}" ;;
            --bl31-key)
                bl31key="${argv[$i]}" ;;
            --bl32-key)
                bl32key="${argv[$i]}" ;;
            --bl33-key)
                bl33key="${argv[$i]}" ;;
            --bl2-aes-key)
                bl2aeskey="${argv[$i]}" ;;
            --bl30-aes-key)
                bl30aeskey="${argv[$i]}" ;;
            --bl31-aes-key)
                bl31aeskey="${argv[$i]}" ;;
            --bl32-aes-key)
                bl32aeskey="${argv[$i]}" ;;
            --bl33-aes-key)
                bl33aeskey="${argv[$i]}" ;;
            --bl2-aes-iv)
                bl2aesiv="${argv[$i]}" ;;
            --bl30-aes-iv)
                bl30aesiv="${argv[$i]}" ;;
            --bl31-aes-iv)
                bl31aesiv="${argv[$i]}" ;;
            --bl32-aes-iv)
                bl32aesiv="${argv[$i]}" ;;
            --bl33-aes-iv)
                bl33aesiv="${argv[$i]}" ;;
            --kernel-key)
                kernelkey="${argv[$i]}" ;;
            --kernel-aes-key)
                kernelaeskey="${argv[$i]}" ;;
            --kernel-aes-iv)
                kernelaesiv="${argv[$i]}" ;;
            --fip-key)
                fipkey="${argv[$i]}" ;;
            --fip-aes-key)
                fipaeskey="${argv[$i]}" ;;
            --fip-aes-iv)
                fipaesiv="${argv[$i]}" ;;
            -e)
                if [ "${argv[$i]}" == "FIPbl3x" ]; then
                    # encrypted bl2, FIP, bl3x
                    encryptFIPbl3x=true
                fi
                if [ "${argv[$i]}" == "FIPbl3xonly" ]; then
                    # unencrypted bl2.  encrypted FIP, bl3x
                    encryptFIPbl3x=true
                    encryptbl2=false
                fi
                if [ "${argv[$i]}" == "none" ]; then
                    # unencrypted bl2, FIP, bl3x
                    encryptFIPbl3x=false
                    encryptbl2=false
                fi
                ;;
            --bl2-arb-cvn)
                bl2_arb_cvn="${argv[$i]}" ;;
            --fip-arb-cvn)
                fip_arb_cvn="${argv[$i]}" ;;
            --bl30-arb-cvn)
                bl30_arb_cvn="${argv[$i]}" ;;
            --bl31-arb-cvn)
                bl31_arb_cvn="${argv[$i]}" ;;
            --bl32-arb-cvn)
                bl32_arb_cvn="${argv[$i]}" ;;
            --bl33-arb-cvn)
                bl33_arb_cvn="${argv[$i]}" ;;
            --sig-ver)
                sigver="${argv[$i]}" ;;
            --key-hash-ver)
                keyhashver="${argv[$i]}" ;;
            --marketid)
                marketid="${argv[$i]}" ;;
            -o)
                output="${argv[$i]}" ;;
            *)
                echo "Unknown option $arg"; exit 1 ;;
        esac
        i=$((i + 1))
    done
    # Verify args
    set_soc "$soc"

    if [ -z "$keyhashver" ]; then
        keyhashver=$keyhashver_min
    fi
    if [ "$keyhashver" -lt $keyhashver_min ]; then
        echo Error: bad key hash ver; exit 1
    fi

    check_file bl2 "$bl2"
    if $bl30_required || [ "$bl30" != "" ]; then
        check_file bl30 "$bl30"
    fi
    check_file bl31 "$bl31"
    if [ "$bl32" != "" ]; then
        check_file bl32 "$bl32"
    fi
    check_file bl33 "$bl33"

    if [ "$(is_img_format $bl31)" != "True" ]; then
        echo Error. Expected .img format for \"$bl31\"
        exit 1
    fi
    if [ "$bl32" != "" ]; then
        if [ "$(is_img_format $bl32)" != "True" ]; then
            echo Error. Expected .img format for \"$bl32\"
            exit 1
        fi
    fi
    if [ "$bl2hdr" != "" ]; then
        check_file bl2hdr "$bl2hdr"
        if $bl30_required || [ "$bl30hdr" != "" ]; then
            check_file bl30hdr "$bl30hdr"
        fi

        if [ "$rootkey" != "" ]; then
            echo Presigned bl2 header given. Root-key not necessary
            exit 1;
        fi
    else
        check_file rootkey "$rootkey"
        if [ "$rootkeyidx" -lt 0 ] || [ "$rootkeyidx" -gt 3 ]; then
            echo "Error invalid root-key-idx: $rootkeyidx.";
            exit 1;
        fi
        check_file rootkey0 "$rootkey0"
        check_file rootkey1 "$rootkey1"
        check_file rootkey2 "$rootkey2"
        check_file rootkey3 "$rootkey3"
    fi
    check_file bl2key "$bl2key"
    if [ "$bl2key0" == "" ]; then
        bl2key0=$bl2key
    fi
    if [ "$bl2key1" == "" ]; then
        bl2key1=$bl2key
    fi
    if [ "$bl2key2" == "" ]; then
        bl2key2=$bl2key
    fi
    if [ "$bl2key3" == "" ]; then
        bl2key3=$bl2key
    fi
    check_file bl2key0 "$bl2key0"
    check_file bl2key1 "$bl2key1"
    check_file bl2key2 "$bl2key2"
    check_file bl2key3 "$bl2key3"
    if $bl30_required || [ "$bl30key" != "" ]; then
        check_file bl30key "$bl30key"
    fi
    check_file bl31key "$bl31key"
    check_file bl32key "$bl32key"
    check_file bl33key "$bl33key"

    if $encryptbl2; then
        check_file bl2aeskey "$bl2aeskey"
    fi
    if $encryptFIPbl3x; then
        if ! $separate_fip_aes; then
            if [ -n "$fipaeskey" ] && [ "$fipaeskey" != "$bl2aeskey" ]; then
                echo "Error: Separate fip-aes-key not supported by SoC $soc"
                exit 1
            fi
        fi
        if [ -z "$bl2aeskey" ] && [ -z "$fipaeskey" ]; then
            echo Error: bl2-aes-key or fip-aes-key must be given
            exit 1
        fi
        check_opt_file bl2-aes-key 32 "$bl2aeskey"
    fi
    if $encryptbl2 || $encryptFIPbl3x; then
        if [ -n "$bl2aesiv" ]; then
            check_file bl2aesiv "$bl2aesiv"
        else
            dd if=/dev/urandom of=$TMP/bl2aesiv bs=16 count=1 \
                conv=notrunc >& /dev/null
            bl2aesiv=$TMP/bl2aesiv
        fi
    fi
    if $encryptFIPbl3x; then
        if [ -z "$fipaeskey" ]; then
            if [ -n "$fipaesiv" ]; then
                echo Error: Mix of bl2-aes-key and fip-aes-iv for FIP encryption is not supported by this tool
                exit 1
            fi
            fipaeskey="$bl2aeskey"
            fipaesiv="$bl2aesiv"
        else
            check_file fip-aes-key "$fipaeskey"
            check_file fip-aes-iv "$fipaeskey"
        fi

        if $bl30_required || [ "$bl30aeskey" != "" ]; then
            check_file bl30aeskey "$bl30aeskey"
            check_file bl30aesiv "$bl30aesiv"
        fi
        check_file bl31aeskey "$bl31aeskey"
        check_file bl32aeskey "$bl32aeskey"
        check_file bl33aeskey "$bl33aeskey"
        check_file bl31aesiv "$bl31aesiv"
        check_file bl32aesiv "$bl32aesiv"
        check_file bl33aesiv "$bl33aesiv"
        check_file kernelaeskey "$kernelaeskey"
        check_file kernelaesiv "$kernelaesiv"
    fi
    if [ ! -z "$kernelkey" ]; then
        check_file kernelkey "$kernelkey"
    fi
    if [ ! -z "$kernelaeskey" ]; then
        check_file kernelaeskey "$kernelaeskey"
        check_file kernelaesiv "$kernelaesiv"
    fi

    check_file fipkey "$fipkey"
    if [ -z "$bl2_arb_cvn" ]; then
        bl2_arb_cvn="0"
    fi
    if [ -z "$sigver" ]; then
        sigver=1
    fi
    if [ "$keyhashver" != "2" ] && [ "$keyhashver" != "3" ]; then
        echo Error: bad key hash ver; exit 1
    fi

    if [ -z "$output" ]; then echo Error: Missing output file option -o ; exit 1; fi

    local bl2hdr_i="$bl2hdr"
    if [ "$bl2hdr" == "" ]; then
        bl2hdr_i="$TMP/bl2.hdri"
        # No pre-signed header given. Create one.
        sign_bl2_hdr -o "$bl2hdr_i" \
            --soc "$soc" \
            --root-key "$rootkey" --root-key-idx "$rootkeyidx" \
            --root-key-0 "$rootkey0" --root-key-1 "$rootkey1" \
            --root-key-2 "$rootkey2" --root-key-3 "$rootkey3" \
            --bl2-key-0 "$bl2key0" --bl2-key-1 "$bl2key1" \
            --bl2-key-2 "$bl2key2" --bl2-key-3 "$bl2key3" \
            --bl2-key "$bl2key" \
            --bl2-size 65536 \
            --marketid $marketid \
            --arb-cvn $bl2_arb_cvn \
            --sig-ver $sigver --key-hash-ver $keyhashver
    fi

    # Sign/encrypt BL2 payload
    sign_bl2 -i "$bl2" -o "$TMP/bl2.bin.out" \
        --bl2-hdr "$bl2hdr_i" \
        --bl2-key "$bl2key" \
        --bl2-size 65536 \
        $( [ -n "$bl2aesiv" ] && echo -n "--iv $bl2aesiv" ) \
        --sig-ver $sigver --key-hash-ver $keyhashver

    if $encryptbl2; then
        dd if=/dev/zero of=$TMP/zeroiv bs=16 count=1 >& /dev/null
        internal_encrypt $TMP/bl2.bin.out $TMP/bl2.bin.sig $bl2aeskey $TMP/zeroiv
    else
        cp $TMP/bl2.bin.out $TMP/bl2.bin.sig
    fi

    # Sign/encrypt BL30 payload using bl2 functions
    if ! $bl30_required && [ "$bl30" == "" ]; then
        touch "$TMP/bl30.bin.sig"
    else
        local bl30hdr_i="$bl30hdr"
        if [ "$bl30hdr" == "" ]; then
            bl30hdr_i="$TMP/bl30.hdri"
            # No pre-signed header given. Create one.
            sign_bl2_hdr -o "$bl30hdr_i" \
                --soc "$soc" \
                --root-key "$rootkey" --root-key-idx "$rootkeyidx" \
                --root-key-0 "$rootkey0" --root-key-1 "$rootkey1" \
                --root-key-2 "$rootkey2" --root-key-3 "$rootkey3" \
                --bl2-key-0 "$bl30key" --bl2-key-1 "$bl30key" \
                --bl2-key-2 "$bl30key" --bl2-key-3 "$bl30key" \
                --bl2-key "$bl30key" \
                --bl2-size 58368 \
                --arb-cvn $bl30_arb_cvn \
                --sig-ver $sigver --key-hash-ver $keyhashver
        fi
        sign_bl2 -i $bl30 -o $TMP/bl30.bin.out \
            --bl2-hdr "$bl30hdr_i" \
            --bl2-key $bl30key \
            --bl2-size 58368 \
            $( [ -n "$bl30aesiv" ] && echo -n "--iv $bl30aesiv" ) \
            --sig-ver $sigver --key-hash-ver $keyhashver

        if $encryptbl2; then
            # bl30 encryption enable is based on a fuse bit, so use the 'encryptbl2' flag
            dd if=/dev/zero of=$TMP/zeroiv bs=16 count=1 >& /dev/null
            #internal_encrypt $TMP/bl30.bin.out $TMP/bl30.bin.sig $bl2aeskey $TMP/zeroiv
            # scp needs to decrypt in 2KB chunks:
            if [ -f $TMP/bl30.bin.sig ]; then rm -f $TMP/bl30.bin.sig ; fi
            for i in $(seq 0 $(( 58368 / 2048 )) ); do
                dd if=$TMP/bl30.bin.out of=$TMP/pt skip=$i bs=2048 count=1 >& /dev/null
                internal_encrypt $TMP/pt $TMP/ct $bl2aeskey $TMP/zeroiv
                cat $TMP/ct >> $TMP/bl30.bin.sig
            done
            if [ $(wc -c < $TMP/bl30.bin.sig) -ne 58368 ]; then
                echo Internal error, bl30.bin.sig size
                exit 1;
            fi
        else
            cp $TMP/bl30.bin.out $TMP/bl30.bin.sig
        fi
    fi

    if [ "$ddrfw1" != "" ]; then
        ddrfw1_sha=$TMP/ddrfw1.padded.sha
        ddrfw1_out=$TMP/ddrfw1.hdr.padded
        sign_enc_ddrfw ddrfw1 "$ddrfw1" "$encryptFIPbl3x" "$fipaeskey" "$ddrfw1_sha" "$ddrfw1_out" "$TMP/ddr.fw.bin"
        ddrfw1=$ddrfw1_out
    fi
    if [ "$ddrfw2" != "" ]; then
        ddrfw2_sha=$TMP/ddrfw2.padded.sha
        ddrfw2_out=$TMP/ddrfw2.hdr.padded
        sign_enc_ddrfw ddrfw2 "$ddrfw2" "$encryptFIPbl3x" "$fipaeskey" "$ddrfw2_sha" "$ddrfw2_out" "$TMP/ddr.fw.bin"
        ddrfw2=$ddrfw2_out
    fi
    if [ "$ddrfw3" != "" ]; then
        ddrfw3_sha=$TMP/ddrfw3.padded.sha
        ddrfw3_out=$TMP/ddrfw3.hdr.padded
        sign_enc_ddrfw ddrfw3 "$ddrfw3" "$encryptFIPbl3x" "$fipaeskey" "$ddrfw3_sha" "$ddrfw3_out" "$TMP/ddr.fw.bin"
        ddrfw3=$ddrfw3_out
    fi
    if [ "$ddrfw4" != "" ]; then
        ddrfw4_sha=$TMP/ddrfw4.padded.sha
        ddrfw4_out=$TMP/ddrfw4.hdr.padded
        sign_enc_ddrfw ddrfw4 "$ddrfw4" "$encryptFIPbl3x" "$fipaeskey" "$ddrfw4_sha" "$ddrfw4_out" "$TMP/ddr.fw.bin"
        ddrfw4=$ddrfw4_out
    fi
    if [ "$ddrfw5" != "" ]; then
        ddrfw5_sha=$TMP/ddrfw5.padded.sha
        ddrfw5_out=$TMP/ddrfw5.hdr.padded
        sign_enc_ddrfw ddrfw5 "$ddrfw5" "$encryptFIPbl3x" "$fipaeskey" "$ddrfw5_sha" "$ddrfw5_out" "$TMP/ddr.fw.bin"
        ddrfw5=$ddrfw5_out
    fi
    if [ "$ddrfw6" != "" ]; then
        ddrfw6_sha=$TMP/ddrfw6.padded.sha
        ddrfw6_out=$TMP/ddrfw6.hdr.padded
        sign_enc_ddrfw ddrfw6 "$ddrfw6" "$encryptFIPbl3x" "$fipaeskey" "$ddrfw6_sha" "$ddrfw6_out" "$TMP/ddr.fw.bin"
        ddrfw6=$ddrfw6_out
    fi
    if [ "$ddrfw7" != "" ]; then
        ddrfw7_sha=$TMP/ddrfw7.padded.sha
        ddrfw7_out=$TMP/ddrfw7.hdr.padded
        sign_enc_ddrfw ddrfw7 "$ddrfw7" "$encryptFIPbl3x" "$fipaeskey" "$ddrfw7_sha" "$ddrfw7_out" "$TMP/ddr.fw.bin"
        ddrfw7=$ddrfw7_out
    fi
    if [ "$ddrfw8" != "" ]; then
        ddrfw8_sha=$TMP/ddrfw8.padded.sha
        ddrfw8_out=$TMP/ddrfw8.hdr.padded
        sign_enc_ddrfw ddrfw8 "$ddrfw8" "$encryptFIPbl3x" "$fipaeskey" "$ddrfw8_sha" "$ddrfw8_out" "$TMP/ddr.fw.bin"
        ddrfw8=$ddrfw8_out
    fi
    if [ "$ddrfw9" != "" ]; then
        ddrfw9_sha=$TMP/ddrfw9.padded.sha
        ddrfw9_out=$TMP/ddrfw9.hdr.padded
        sign_enc_ddrfw ddrfw9 "$ddrfw9" "$encryptFIPbl3x" "$fipaeskey" "$ddrfw9_sha" "$ddrfw9_out" "$TMP/ddr.fw.bin"
        ddrfw9=$ddrfw9_out
    fi
    if [ "$ddrfw10" != "" ]; then
        ddrfw10_sha=$TMP/ddrfw10.padded.sha
        ddrfw10_out=$TMP/ddrfw10.hdr.padded
        sign_enc_ddrfw ddrfw10 "$ddrfw10" "$encryptFIPbl3x" "$fipaeskey" "$ddrfw10_sha" "$ddrfw10_out" "$TMP/ddr.fw.bin"
        ddrfw10=$ddrfw10_out
    fi

    convert_img_to_bin $bl31 $TMP/bl31.bin
    if [ "$bl32" != "" ]; then
        convert_img_to_bin $bl32 $TMP/bl32.bin
    fi

    sign_bl3x -i $TMP/bl31.bin -o $TMP/bl31.bin.sig -k $bl31key --stage bl31 -v $bl31_arb_cvn \
        $( $encryptFIPbl3x && echo -n "-a $bl31aeskey --iv $bl31aesiv" )
    if [ "$bl32" != "" ]; then
        sign_bl3x -i $TMP/bl32.bin -o $TMP/bl32.bin.sig -k $bl32key --stage bl32 -v $bl32_arb_cvn \
            $( $encryptFIPbl3x && echo -n "-a $bl32aeskey --iv $bl32aesiv" )
    fi
    sign_bl3x -i $bl33         -o $TMP/bl33.bin.sig -k $bl33key --stage bl33 -v $bl33_arb_cvn \
        $( $encryptFIPbl3x && echo -n "-a $bl33aeskey --iv $bl33aesiv" )

    if ! $encryptFIPbl3x || (! $bl30_required && [ "$bl30" == "" ]); then
        dd if=/dev/zero of=$TMP/zerokey bs=32 count=1 >& /dev/null
        dd if=/dev/zero of=$TMP/zeroiv bs=16 count=1 >& /dev/null
    fi
    if ! $encryptFIPbl3x; then
        # create_fip currently requires bl3x aes key/iv to be inserted into fip
        # header. Create dummy data for it
        bl30aeskey=$TMP/zerokey
        bl31aeskey=$TMP/zerokey
        bl32aeskey=$TMP/zerokey
        bl33aeskey=$TMP/zerokey
        kernelaeskey=$TMP/zerokey
        bl30aesiv=$TMP/zeroiv
        bl31aesiv=$TMP/zeroiv
        bl32aesiv=$TMP/zeroiv
        bl33aesiv=$TMP/zeroiv
        kernelaesiv=$TMP/zeroiv
    fi

    bl30_key_arg="--bl30-key     $bl30key"
    if ! $bl30_required; then
        if [ "$bl30aeskey" == "" ]; then
            bl30aeskey=$TMP/zerokey
            bl30aesiv=$TMP/zeroiv
        fi
        if [ "$bl30key" == "" ]; then
            bl30_key_arg=
        fi
    fi

    if [ "$bl32" == "" ]; then
        rm -f $TMP/bl32.bin.sig
        touch $TMP/bl32.bin.sig
        # use bl31 as dummy bl32 img info
        cp $bl31 $TMP/bl32.img-info
        bl32info=$TMP/bl32.img-info
    else
        bl32info=$bl32
    fi

    create_fip \
        --bl30     $TMP/bl30.bin.sig \
        $bl30_key_arg \
        --bl30-aes-key $bl30aeskey \
        --bl30-aes-iv  $bl30aesiv \
        --bl31     $TMP/bl31.bin.sig \
        --bl31-info $bl31 \
        --bl31-key     $bl31key \
        --bl31-aes-key $bl31aeskey \
        --bl31-aes-iv  $bl31aesiv \
        --bl32     $TMP/bl32.bin.sig \
        --bl32-info $bl32info \
        --bl32-key     $bl32key \
        --bl32-aes-key $bl32aeskey \
        --bl32-aes-iv  $bl32aesiv \
        --bl33     $TMP/bl33.bin.sig \
        --bl33-key     $bl33key \
        --bl33-aes-key $bl33aeskey \
        --bl33-aes-iv  $bl33aesiv \
        $( [ ! -z "$kernelkey" ] && \
            echo -n "--kernel-key $kernelkey " ) \
        $( [ ! -z "$kernelaeskey" ] && \
            echo -n "--kernel-aes-key $kernelaeskey \
                     --kernel-aes-iv  $kernelaesiv " ) \
        --fip-key $fipkey \
        --fip-arb-cvn $fip_arb_cvn \
        --ddrfw1   "$ddrfw1" \
        --ddrfw2   "$ddrfw2" \
        --ddrfw3   "$ddrfw3" \
        --ddrfw4   "$ddrfw4" \
        --ddrfw5   "$ddrfw5" \
        --ddrfw6   "$ddrfw6" \
        --ddrfw7   "$ddrfw7" \
        --ddrfw8   "$ddrfw8" \
        --ddrfw9   "$ddrfw9" \
        --ddrfw10  "$ddrfw10" \
        -o $TMP/fip.hdr.out

    if $encryptFIPbl3x; then
        internal_encrypt $TMP/fip.hdr.out $TMP/fip.hdr.sig $fipaeskey $fipaesiv
    else
        cp $TMP/fip.hdr.out $TMP/fip.hdr.sig
    fi

    # TODO:
    # Call fixup script to create blxx_new.bin
    #package

    cat $TMP/bl2.bin.sig $TMP/fip.hdr.sig $TMP/ddr.fw.bin $TMP/bl30.bin.sig $TMP/bl31.bin.sig \
        $TMP/bl32.bin.sig $TMP/bl33.bin.sig > $output

    echo
    echo Created signed bootloader $output successfully
}

create_signed_bl40() {
    local bl40hdr=""
    local bl40=""
    local rootkey=""
    local rootkeyidx="0"
    local rootkey0=""
    local rootkey1=""
    local bl40key=""
    local bl40aeskey=""
    local bl40aesiv=""
    local encryptFIPbl3x=false
    local bl40_arb_cvn="0"
    local output=""
    local sigver=""
    local keyhashver=""
    local marketid="0"
    local argv=("$@")
    local i=0
    local size=0
    local soc="g12a"

    # Parse args
    i=0
    while [ $i -lt $# ]; do
        arg="${argv[$i]}"
        i=$((i + 1))
        case "$arg" in
            --soc)
                soc="${argv[$i]}" ;;
            --root-key)
                rootkey="${argv[$i]}" ;;
            --root-key-idx)
                rootkeyidx="${argv[$i]}" ;;
            --root-key-0)
                rootkey0="${argv[$i]}" ;;
            --root-key-1)
                rootkey1="${argv[$i]}" ;;
            --bl40)
                bl40="${argv[$i]}" ;;
            --bl40-hdr)
                bl40hdr="${argv[$i]}" ;;
            --bl40-key)
                bl40key="${argv[$i]}" ;;
            --bl40-aes-key)
                bl40aeskey="${argv[$i]}" ;;
            --bl40-aes-iv)
                bl40aesiv="${argv[$i]}" ;;
            -e)
                if [ "${argv[$i]}" == "FIPbl3x" ]; then
                    # encrypted bl2, FIP, bl3x
                    encryptFIPbl3x=true
                fi
                if [ "${argv[$i]}" == "none" ]; then
                    # unencrypted bl2, FIP, bl3x
                    encryptFIPbl3x=false
                fi
                ;;
            --bl40-arb-cvn)
                bl40_arb_cvn="${argv[$i]}" ;;
            --sig-ver)
                sigver="${argv[$i]}" ;;
            --key-hash-ver)
                keyhashver="${argv[$i]}" ;;
            --marketid)
                marketid="${argv[$i]}" ;;
            -o)
                output="${argv[$i]}" ;;
            *)
                echo "Unknown option $arg"; exit 1 ;;
        esac
        i=$((i + 1))
    done
    # Verify args
    set_soc "$soc"

    if [ -z "$keyhashver" ]; then
        keyhashver=$keyhashver_min
    fi
    if [ "$keyhashver" -lt $keyhashver_min ]; then
        echo Error: bad key hash ver; exit 1
    fi

    check_file bl40 "$bl40"

    check_file bl40key "$bl40key"
    if $encryptFIPbl3x; then
        if [ "$bl40aeskey" != "" ]; then
            check_file bl40aeskey "$bl40aeskey"
            check_file bl40aesiv "$bl40aesiv"
        fi
    fi
    if [ -z "$sigver" ]; then
        sigver=1
    fi
    if [ "$keyhashver" != "2" ] && [ "$keyhashver" != "3" ]; then
        echo Error: bad key hash ver; exit 1
    fi

    if [ -z "$output" ]; then echo Error: Missing output file option -o ; exit 1; fi

    bl40_align_size=$(aligned_size "$bl40" 0 16)
    cp $bl40 $TMP/bl40.bin.aligned
    pad_file $TMP/bl40.bin.aligned $bl40_align_size
    bl40_aligned=$TMP/bl40.bin.aligned
    bl40_size=$(($bl40_align_size + 4096))
    # Sign/encrypt BL30 payload using bl2 functions
    local bl40hdr_i="$bl40hdr"
    if [ "$bl40hdr" == "" ]; then
        check_file rootkey "$rootkey"
        if [ "$rootkeyidx" -lt 0 ] || [ "$rootkeyidx" -gt 2 ]; then
            echo "Error invalid root-key-idx: $rootkeyidx.";
            exit 1;
        fi
        check_file rootkey0 "$rootkey0"
        check_file rootkey1 "$rootkey1"

        bl40hdr_i="$TMP/bl40.hdri"
        # No pre-signed header given. Create one.
        sign_bl2_hdr -o "$bl40hdr_i" \
            --soc "$soc" \
            --root-key "$rootkey" --root-key-idx "$rootkeyidx" \
            --root-key-0 "$rootkey0" --root-key-1 "$rootkey1" \
            --root-key-2 "$rootkey0" --root-key-3 "$rootkey1" \
            --bl2-key-0 "$bl40key" --bl2-key-1 "$bl40key" \
            --bl2-key-2 "$bl40key" --bl2-key-3 "$bl40key" \
            --bl2-key "$bl40key" \
            --bl2-size $bl40_size \
            --arb-cvn $bl40_arb_cvn \
            --sig-ver $sigver --key-hash-ver $keyhashver
    fi
    sign_bl2 -i $bl40_aligned -o $TMP/bl40.bin.out \
        --bl2-hdr "$bl40hdr_i" \
        --bl2-key $bl40key \
        --bl2-size $bl40_size \
        $( [ -n "$bl40aesiv" ] && echo -n "--iv $bl40aesiv" ) \
        --sig-ver $sigver --key-hash-ver $keyhashver

    if $encryptFIPbl3x; then
        # bl40 encryption enable is based on a fuse bit, so use the 'encryptFIPbl3x' flag
        dd if=/dev/zero of=$TMP/zeroiv bs=16 count=1 >& /dev/null
        #internal_encrypt $TMP/bl40.bin.out $TMP/bl40.bin.sig $bl2aeskey $TMP/zeroiv
        # scp needs to decrypt in 2KB chunks:
        if [ -f $TMP/bl40.bin.sig ]; then rm -f $TMP/bl40.bin.sig ; fi
        openssl dgst -sha256 -out $TMP/realbl40key -binary $bl40aeskey
        for i in $(seq 0 $(( $bl40_size / 2048 )) ); do
            dd if=$TMP/bl40.bin.out of=$TMP/pt skip=$i bs=2048 count=1 >& /dev/null
            internal_encrypt $TMP/pt $TMP/ct $TMP/realbl40key $TMP/zeroiv
            cat $TMP/ct >> $TMP/bl40.bin.sig
        done
        if [ $(wc -c < $TMP/bl40.bin.sig) -ne $bl40_size ]; then
            echo Internal error, bl40.bin.sig size
            exit 1;
        fi
    else
        cp $TMP/bl40.bin.out $TMP/bl40.bin.sig
    fi

    cat $TMP/bl40.bin.sig > $output
    echo
    echo Created signed bootloader $output successfully
}
parse_main() {
    local i=0
    local argv=()
    for arg in "$@" ; do
        argv[$i]="$arg"
        i=$((i + 1))
    done

    i=0
    while [ $i -lt $# ]; do
        arg="${argv[$i]}"
        case "$arg" in
            -h|--help)
                usage
                break ;;
            --sign-bl2-hdr)
                sign_bl2_hdr "${argv[@]:$((i + 1))}"
                break ;;
            --create-signed-bl)
                create_signed_bl "${argv[@]:$((i + 1))}"
                break ;;
            --create-signed-bl40)
                create_signed_bl40 "${argv[@]:$((i + 1))}"
                break ;;
            --sign-kernel)
                sign_kernel "${argv[@]:$((i + 1))}"
                break ;;
            --sign-uimage)
                sign_uimage "${argv[@]:$((i + 1))}"
                break ;;
            *)
                echo "Unknown first option $1"; exit 1
                ;;
        esac
        i=$((i + 1))
    done
}

cleanup() {
    if [ $? -ne 0 ]; then
        echo
        echo "Failed to sign bootloader!"
    fi
    if [ ! -d "$TMP" ]; then return; fi
    local tmpfiles="bl2.bin.out bl2.bin.sig bl2cvn bl2.hdr bl2.img bl2key0.bin
    bl2key0.sha bl2key1.bin bl2key1.sha bl2key2.bin bl2key2.sha bl2key3.bin
    bl2key3.sha bl2key.bin bl2key.sha bl30.bin.out bl30.bin.img bl30.bin.sig bl30key.bin
    bl31.bin bl31.bin.img bl31.bin.sig bl31key.bin bl32.bin bl32.bin.img
    bl32.bin.sig bl32key.bin bl33.bin.img bl33.bin.sig bl33key.bin
    bl2aesiv
    bl.bin bl.hdr bl.hdr.sig blpad.bin bl-pl.sha bl2.hdri bl30.hdri
    bl32.img-info
    fip.hdr fip.hdr.out fip.hdr.sig kernelkey.bin keydata
    nonce.bin rootkey0.bin rootkey0.sha rootkey1.bin rootkey1.sha
    rootkey2.bin rootkey2.sha rootkey3.bin rootkey3.sha rootkey.bin
    rootkey.sha sigdata sigdata.sig zeroiv
    kernel zeroaesiv zeroaeskey zerokey
    bl2key0.pub bl2key1.pub  bl2key2.pub  bl2key3.pub  bl2key.pub  mod  modhex
    bl30key.pub  bl31key.pub  bl32key.pub  bl33key.pub  kernelkey.pub
    rootkey0.pub  rootkey1.pub  rootkey2.pub  rootkey3.pub  rootkey.pub
    fip.hdr.bin fip.payload.bin bl3x.payload.bin bl3x.bin ddrfw*.padded* ddrfw*.hdr ddr.fw.bin
    kern.hdr  kern.hdr.sig  kern-pl.bin  kern-pl.sha pt ct
    bl40.bin.out  bl40.bin.sig  bl40.hdri  realbl40key bl40.bin.aligned
    ihencmagic  uimage.aesiv  uimage.hdr  uimage.sb.hdr  uimage.temp.bin
    totalsize  uimage.aeskey  uimagepad.bin  uimage.temp  uimage.temp.sha uimage.sb.hdr.temp
    uimage.sb.hdr.bin  uimage.sb.hdr.sig  uimage.temp.bin.first  uimage.temp.bin.second"
    for i in $tmpfiles ; do
        rm -f $TMP/$i
    done
    rm -fr $TMP
}

trap cleanup EXIT

cleanup
if [ ! -d "$TMP" ]; then mkdir "$TMP" ; fi
parse_main "$@"