lk: add signing tools and import X5 keys

Signed-off-by: svoboda18 <dev.svoboda18@gmail.com>

certs/IMG_AUTH_CFG.ini

@@ -0,0 +1,18 @@
+; ################################
+;
+; Parameter 'IMAGE_VERSION'
+;    - Flash Tool will compare download image version with existing one in Flash.
+;
+; Parameter 'VERIFY_LENGTH'
+;    - It can be configured to any length. SignTool will do the error check while signing image
+;    - If VERIFY_LENGTH is configured as 0, the whole image will be signed.
+;
+; ################################
+
+CUSTOM_NAME = NULL
+IMAGE_VERSION = 1
+VERIFY_COUNT = 1
+VERIFY_OFFSET[0] = 0
+VERIFY_LENGTH[0] = 10240
+CHUNK_SIZE = 1048576
+CFG_VERSION = 4

certs/IMG_AUTH_KEY.ini

@@ -0,0 +1,3 @@
+CUSTOM_RSA_N = 0x5FFF0B70D5DE3FC5BF41CB824B4BFD14820571CE57EDD3E7C668CC570E718DB07DCC7A6CACD0E80DADC38AA33DB37816839D97980DF3E577A6E0B1169D708071E17DD259CFE538DBDA804A2FC07D795841F2F59DEE023A9919360D0A3F4647FDF5657D9FC5944C8BFA2802336BA23AFDCDE8D546E8806EB532AA7F95A01D8DD1
+CUSTOM_RSA_D = 0x4BD992E9A2230CD2ABEF49E4F6A7E11D7E2ADD24847787B320239829C560D5EAB94B8304317C938E9358E94758AE60D9B13F2913DD1A749A9941FACAFAB574D70EBBFBCC0133A4BE2134CBA3CE7EE18A6D3CC98D33DAB06AEEE512F405A3248EA316ABC31A2758D4C5A7B9DFCC02C2508A492EF3760A0D4CDA827CFFCADD11ED
+CUSTOM_RSA_E = 0x10001

certs/VERIFIED_BOOT_IMG_AUTH_KEY.ini

@@ -0,0 +1,22 @@
+#
+# MTEE Image Protection Parameter File
+# Note
+#    1. Value is HEX Notation and starts with 0x
+#    2. Comment line starts with #
+#
+
+# Image version, <= 0xFFFF
+IMG_VER      = 0x3001
+
+# Protection Option, 0x00 or 0x01
+PROT_OPTION  = 0x02
+
+# Encrypt Parameter (IV/KEY) for AES128 Encryption, HEX Notation
+#ENC_PARAM    = 0x00112233445566778899aabbccddeeffffeeddccbbaa99887766554433221100
+
+# Decrypt Parameter (IV/KEY) for AES128 Decryption, Encrypted by MTK Platform, HEX Notation
+#DEC_PARAM    = 0x03a39c05524d9d7b4f373293e550d6fd25d4235fae67a79d7447a7b5d05cd4fe
+
+# Authentication Parameter (N, D) for RSA2048 (E=65537, 0x10001)
+AUTH_PARAM_N = 0xDACD8B5FDA8A766FB7BCAA43F0B16915CE7B47714F1395FDEBCF12A2D41155B0FB587A51FECCCB4DDA1C8E5EB9EB69B86DAF2C620F6C2735215A5F22C0B6CE377AA0D07EB38ED340B5629FC2890494B078A63D6D07FDEACDBE3E7F27FDE4B143F49DB4971437E6D00D9E18B56F02DABEB0000B6E79516D0C8074B5A42569FD0D9196655D2A4030D42DFE05E9F64883E6D5F79A5BFA3E7014C9A62853DC1F21D5D626F4D0846DB16452187DD776E8886B48C210C9E208059E7CAFC997FD2CA210775C1A5D9AA261252FB975268D970C62733871D57814098A453DF92BC6CA19025CD9D430F02EE46F80DE6C63EA802BEF90673AAC4C6667F2883FB4501FA77455
+AUTH_PARAM_D = 0x8BC9B1F7A559BCDD1717F3F7BFF8B858743892A6338D21D0BE2CE78D1BCB8F61A8D31822F694C476929897E4B10753DDBE45A2276C0EFEE594CF75E47016DA9CDB3D8EB6C3E4C5D69B8BCCE1AE443CF299C22B905300C85875E8DBB8231F4E9949D8CF9D8E0F40E93F29F843420F22CD9D080A45A4407F58F3609D03A7DB950D3D847B8B4E7D50DB6359D37A2DD730D3CE77F8FB2A33C095B0A6CF3E08593E4F70254DCDF671790F530EC07C3CD1E80199CB42F24ACA92DB5996F2119003F502E16D88EB4E4A8DEAE4036558D2A52F5C9960B0FBBC6F6FA75EFF6F5A173CE1A82539A35973D568B8918ED12F7610748BEB0239A5006257E19574C77F4133A269

make/build.mk

@@ -17,6 +17,16 @@ $(OUTBIN): $(OUTELF)
 	$(MKIMAGE) $@ img_hdr_lk.cfg > $(BUILDDIR)/lk_header.bin
 	$(NOECHO)mv $(BUILDDIR)/lk_header.bin $@
 
+$(OUTELF)-dtb.img: $(OUTBIN)
+	@echo adding dtb: $@
+	$(NOECHO)cat $< $(LK_TOP_DIR)/main_dtb_header.bin > $@
+
+$(OUTELF)-sign.img: $(OUTELF)-dtb.img
+	@mv $(OUTBIN) $(OUTELF)-bin.img
+	@cp $< $(OUTBIN)
+	@echo signing image: $@
+	$(NOECHO)perl $(LK_TOP_DIR)/scripts/sign/SignTool.pl "$(PROJECT)" "$(PROJECT)" "$(LK_TOP_DIR)/certs" "yes" "2048" "true" "$(BUILDDIR)" "lk.img" "no"
+
 ifeq ($(ENABLE_TRUSTZONE), 1)
 $(OUTELF): $(ALLOBJS) $(LINKER_SCRIPT) $(OUTPUT_TZ_BIN)
 ifeq ($(BUILD_SEC_LIB),yes)

makefile

@@ -86,7 +86,7 @@ CFLAGS += -ffunction-sections -fdata-sections
 LDFLAGS += -gc-sections
 
 # top level rule
-all:: $(OUTBIN) $(OUTELF).lst $(OUTELF).debug.lst $(OUTELF).sym $(OUTELF).size
+all:: $(OUTBIN) $(OUTELF)-sign.img $(OUTELF).lst $(OUTELF).debug.lst $(OUTELF).sym $(OUTELF).size
 
 # the following three object lists are identical except for the ordering
 # which is bootobjs, kobjs, objs

scripts/sign/SignTool.pl

@@ -0,0 +1,237 @@
+#!usr/bin/perl
+# Copyright Statement:
+#
+# This software/firmware and related documentation ("MediaTek Software") are
+# protected under relevant copyright laws. The information contained herein
+# is confidential and proprietary to MediaTek Inc. and/or its licensors.
+# Without the prior written permission of MediaTek inc. and/or its licensors,
+# any reproduction, modification, use or disclosure of MediaTek Software,
+# and information contained herein, in whole or in part, shall be strictly prohibited.
+#
+# MediaTek Inc. (C) 2010. All rights reserved.
+#
+# BY OPENING THIS FILE, RECEIVER HEREBY UNEQUIVOCALLY ACKNOWLEDGES AND AGREES
+# THAT THE SOFTWARE/FIRMWARE AND ITS DOCUMENTATIONS ("MEDIATEK SOFTWARE")
+# RECEIVED FROM MEDIATEK AND/OR ITS REPRESENTATIVES ARE PROVIDED TO RECEIVER ON
+# AN "AS-IS" BASIS ONLY. MEDIATEK EXPRESSLY DISCLAIMS ANY AND ALL WARRANTIES,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT.
+# NEITHER DOES MEDIATEK PROVIDE ANY WARRANTY WHATSOEVER WITH RESPECT TO THE
+# SOFTWARE OF ANY THIRD PARTY WHICH MAY BE USED BY, INCORPORATED IN, OR
+# SUPPLIED WITH THE MEDIATEK SOFTWARE, AND RECEIVER AGREES TO LOOK ONLY TO SUCH
+# THIRD PARTY FOR ANY WARRANTY CLAIM RELATING THERETO. RECEIVER EXPRESSLY ACKNOWLEDGES
+# THAT IT IS RECEIVER'S SOLE RESPONSIBILITY TO OBTAIN FROM ANY THIRD PARTY ALL PROPER LICENSES
+# CONTAINED IN MEDIATEK SOFTWARE. MEDIATEK SHALL ALSO NOT BE RESPONSIBLE FOR ANY MEDIATEK
+# SOFTWARE RELEASES MADE TO RECEIVER'S SPECIFICATION OR TO CONFORM TO A PARTICULAR
+# STANDARD OR OPEN FORUM. RECEIVER'S SOLE AND EXCLUSIVE REMEDY AND MEDIATEK'S ENTIRE AND
+# CUMULATIVE LIABILITY WITH RESPECT TO THE MEDIATEK SOFTWARE RELEASED HEREUNDER WILL BE,
+# AT MEDIATEK'S OPTION, TO REVISE OR REPLACE THE MEDIATEK SOFTWARE AT ISSUE,
+# OR REFUND ANY SOFTWARE LICENSE FEES OR SERVICE CHARGE PAID BY RECEIVER TO
+# MEDIATEK FOR SUCH MEDIATEK SOFTWARE AT ISSUE.
+#
+# The following software/firmware and/or related documentation ("MediaTek Software")
+# have been modified by MediaTek Inc. All revisions are subject to any receiver's
+# applicable license agreements with MediaTek Inc.
+
+
+my $base_prj = $ARGV[0];
+my $prj = $ARGV[1];
+my $custom_dir = $ARGV[2];
+my $secro_ac = $ARGV[3];
+my $nand_page_size = $ARGV[4];
+my $board_avb_enable = $ARGV[5];
+my $dir = $ARGV[6];
+my $tgt = $ARGV[7];
+my $sdl_only = $ARGV[8];
+my $cfg_dir = "$custom_dir";
+my $cfg_def = "IMG_AUTH_CFG.ini";
+my $cfg = "$cfg_dir/$cfg_def";
+my $key = "$cfg_dir/IMG_AUTH_KEY.ini";
+my $oemkey = "$cfg_dir/VERIFIED_BOOT_IMG_AUTH_KEY.ini";
+$ENV{PROJECT}=$prj;
+my $secro_type = "GMP";
+
+##########################################################
+# Dump Parameter
+##########################################################
+print "\n\n";
+print "********************************************\n";
+print " Dump Paramter \n";
+print "********************************************\n";
+print " Base Project     : $base_prj\n";
+print " Project          : $prj\n";
+print " Custom Directory : $custom_dir\n";
+print " SECRO AC         : $secro_ac\n";
+print " NAND Page Size   : $nand_page_size\n";
+print " BOARD_AVB_ENABLE : $board_avb_enable\n";
+print " PRODUCT_OUT      : $dir\n";
+print " SDL_ONLY         : $sdl_only\n";
+print " TGT              : $tgt\n";
+
+##########################################################
+# Create Folder
+##########################################################
+print "\n\n";
+print "********************************************\n";
+print " Create Folder \n";
+print "********************************************\n";
+`mkdir $dir/sig` if ( ! -d "$dir/sig" );
+print "Image Dir '$dir'\n";
+my $command = "scripts/sign/SignTool.sh";
+#tool for signing image with SHA256 + RSA2048 for verified boot
+my $command_2048 = "scripts/sign/SignTool_2048";
+
+##########################################################
+# File Check
+##########################################################
+my @imgs_need_sign_raw = ("lk.img", "logo.bin", "secro.img", "odmdtbo.img", "dtbo.img");
+my @imgs_need_sign = ("system.img", "system_other.img", "userdata.img", "efuse.img", "vendor.img", "odm.img", "vbmeta.img", "vbmeta_system.img", "vbmeta_vendor.img", "super.img");
+
+if ($board_avb_enable ne "true") {
+	push (@imgs_need_sign_raw, "boot.img");
+	push (@imgs_need_sign_raw, "recovery.img");
+} else {
+	push (@imgs_need_sign, "boot.img");
+	push (@imgs_need_sign, "recovery.img");
+}
+
+# ProjectConfig.mk settings is not imported here, and try all the possible names
+push (@imgs_need_sign, "trustzone.bin");
+push (@imgs_need_sign, "mobicore.bin");
+push (@imgs_need_sign, "tz.img");
+push (@imgs_need_sign, "tee.img");
+
+# Does not check whether all images in the list exist. Sign all the images which can be found.
+
+
+##########################################################
+# Process Common Files
+##########################################################
+print "\n\n";
+print "********************************************\n";
+print " Sign Common Images \n";
+print "********************************************\n";
+
+# for these images, two layers of signature is applied, one for verified boot, one for secure download.
+foreach my $img (@imgs_need_sign_raw) {
+	if ("$tgt" ne "all") {
+		if ("$tgt" ne $img) {
+			warn "$img not selected target($tgt), bypass\n";
+			next;
+		}
+	}
+
+	if ( ! -e "$dir/$img") {
+		warn "the $img does NOT exist, please check\n";
+		next;
+	}
+
+	my $signed_verified_img = $img;
+	$signed_verified_img =~ s/\./-verified\./;
+	if ($sdl_only eq "yes") {
+		print "secure boot signature generation bypassed for '$dir/$img'"
+	} else {
+		my $sig_img = $img;
+		$sig_img =~ s/\.bin/\.sig/;
+		$sig_img =~ s/\.img/\.sig/;
+		print "Sign Image '$dir/$img' with key '$oemkey'... output = '$dir/$signed_verified_img'\n";
+		system("$command_2048 $oemkey $dir/$img $dir/$signed_verified_img $dir/sig/$sig_img") == 0 or die "sign image(verified boot) fail";
+	}
+
+	my $signed_img = $img;
+	$signed_img =~ s/\./-sign\./;
+
+	my $signed_cfg = "$cfg_dir/$img.ini";
+	if ( ! -e "$signed_cfg" ) {
+		$signed_cfg = $cfg;
+	}
+	print "Sign Image '$dir/$img' with cfg '$signed_cfg'...\n";
+
+	system("$command $key $signed_cfg $dir/$signed_verified_img $dir/$signed_img $nand_page_size") == 0 or die "sign image fail";
+}
+
+# these images are signed for secure download only and not covered by verified boot.
+foreach my $img (@imgs_need_sign) {
+	if ("$tgt" ne "all") {
+		if ("$tgt" ne $img) {
+			warn "$img not selected target($tgt), bypass\n";
+			next;
+		}
+	}
+
+	if ( ! -e "$dir/$img") {
+		warn "the $img does NOT exist, please check\n";
+		next;
+	}
+
+	my $signed_img = $img;
+	$signed_img =~ s/\./-sign\./;
+	my $signed_cfg = "$cfg_dir/$img.ini";
+	if ( ! -e "$signed_cfg" ) {
+		$signed_cfg = $cfg;
+	}
+	print "Sign Image '$dir/$img' with cfg '$signed_cfg'...\n";
+
+	system("$command $key $signed_cfg $dir/$img $dir/$signed_img $nand_page_size") == 0 or die "sign image fail";
+}
+
+sub print_system {
+	my $command = $_[0];
+	my $rslt = system($command);
+	print "$command: $rslt\n";
+	die "Failed to execute $command" if ($rslt != 0);
+}
+
+##########################################################
+# Process EMMC Files
+##########################################################
+print "\n\n";
+print "********************************************\n";
+print " Sign EMMC Images \n";
+print "********************************************\n";
+
+my @imgs_need_sign = ("MBR", "EBR1", "EBR2");
+
+foreach my $img (@imgs_need_sign) {
+	if ("$tgt" ne "all") {
+		if ("$tgt" ne $img) {
+			warn "$img not selected target($tgt), bypass\n";
+			next;
+		}
+	}
+
+	if (-e "$dir/$img") {
+		my $signed_cfg = "$cfg_dir/$img.ini";
+		if ( ! -e "$signed_cfg" ) {
+			$signed_cfg = $cfg;
+		}
+		print "Sign Image '$dir/$img' with cfg '$signed_cfg'...\n";
+		system("$command $key $signed_cfg $dir/$img $dir/${img}-sign $nand_page_size") == 0 or die "sign EMMC image fail";
+	}
+}
+
+my @imgs_need_sign = ("cache.img", "custom.img");
+
+foreach my $img (@imgs_need_sign) {
+	if ("$tgt" ne "all") {
+		if ("$tgt" ne $img) {
+			warn "$img not selected target($tgt), bypass\n";
+			next;
+		}
+	}
+
+	if (-e "$dir/$img") {
+		my $signed_img = $img;
+		$signed_img =~ s/\./-sign\./;
+		my $signed_cfg = "$cfg_dir/$img.ini";
+		if ( ! -e "$signed_cfg" ) {
+			$signed_cfg = $cfg;
+		}
+		print "Sign Image '$dir/$img' with cfg '$signed_cfg'...\n";
+		system("$command $key $signed_cfg $dir/$img $dir/$signed_img $nand_page_size") == 0 or die "sign EMMC image fail";
+	}
+}
+
+
+print "remove unused *sig files \n";
+system("rm -f $dir/*.sig ");

scripts/sign/SignTool.sh

@@ -0,0 +1,161 @@
+#!/bin/sh
+# Copyright Statement:
+#
+# This software/firmware and related documentation ("MediaTek Software") are
+# protected under relevant copyright laws. The information contained herein
+# is confidential and proprietary to MediaTek Inc. and/or its licensors.
+# Without the prior written permission of MediaTek inc. and/or its licensors,
+# any reproduction, modification, use or disclosure of MediaTek Software,
+# and information contained herein, in whole or in part, shall be strictly prohibited.
+#
+# MediaTek Inc. (C) 2010. All rights reserved.
+#
+# BY OPENING THIS FILE, RECEIVER HEREBY UNEQUIVOCALLY ACKNOWLEDGES AND AGREES
+# THAT THE SOFTWARE/FIRMWARE AND ITS DOCUMENTATIONS ("MEDIATEK SOFTWARE")
+# RECEIVED FROM MEDIATEK AND/OR ITS REPRESENTATIVES ARE PROVIDED TO RECEIVER ON
+# AN "AS-IS" BASIS ONLY. MEDIATEK EXPRESSLY DISCLAIMS ANY AND ALL WARRANTIES,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT.
+# NEITHER DOES MEDIATEK PROVIDE ANY WARRANTY WHATSOEVER WITH RESPECT TO THE
+# SOFTWARE OF ANY THIRD PARTY WHICH MAY BE USED BY, INCORPORATED IN, OR
+# SUPPLIED WITH THE MEDIATEK SOFTWARE, AND RECEIVER AGREES TO LOOK ONLY TO SUCH
+# THIRD PARTY FOR ANY WARRANTY CLAIM RELATING THERETO. RECEIVER EXPRESSLY ACKNOWLEDGES
+# THAT IT IS RECEIVER'S SOLE RESPONSIBILITY TO OBTAIN FROM ANY THIRD PARTY ALL PROPER LICENSES
+# CONTAINED IN MEDIATEK SOFTWARE. MEDIATEK SHALL ALSO NOT BE RESPONSIBLE FOR ANY MEDIATEK
+# SOFTWARE RELEASES MADE TO RECEIVER'S SPECIFICATION OR TO CONFORM TO A PARTICULAR
+# STANDARD OR OPEN FORUM. RECEIVER'S SOLE AND EXCLUSIVE REMEDY AND MEDIATEK'S ENTIRE AND
+# CUMULATIVE LIABILITY WITH RESPECT TO THE MEDIATEK SOFTWARE RELEASED HEREUNDER WILL BE,
+# AT MEDIATEK'S OPTION, TO REVISE OR REPLACE THE MEDIATEK SOFTWARE AT ISSUE,
+# OR REFUND ANY SOFTWARE LICENSE FEES OR SERVICE CHARGE PAID BY RECEIVER TO
+# MEDIATEK FOR SUCH MEDIATEK SOFTWARE AT ISSUE.
+#
+# The following software/firmware and/or related documentation ("MediaTek Software")
+# have been modified by MediaTek Inc. All revisions are subject to any receiver's
+# applicable license agreements with MediaTek Inc.
+
+
+##############################################################
+# Program:
+#	SIGN TOOL
+#
+
+CUR_DIR=`pwd`
+
+if [ "$3" = "" ]; then
+    echo "Usage: Sign Image .."
+    echo "       ./SignTool.sh [KEY] [CONFIG] [INPUT_IMAGE] [OUTPUT_IMAGE]"
+    echo ""
+    echo "Example:"
+    echo "       ./SignTool.sh IMG_KEY.ini IMG_CFG.ini u-boot.bin signed-u-boot.bin"
+    echo ""
+    exit 1;
+fi
+
+##############################################################
+# Setup tool and nand page size
+SignToolDir=${0%/*}
+SignTool=${SignToolDir}/SignTool
+Simg2imgTool=${SignToolDir}/simg2img
+Yaffs2Covert=${SignToolDir}/yimg2img
+if [ "$5" = "2K" ] ; then
+    NAND_PAGE_SIZE=2048
+elif [ "$5" = "4K" ] ; then
+    NAND_PAGE_SIZE=4096
+elif [ "$5" = "1K" ] ; then
+    NAND_PAGE_SIZE=1024
+else
+    echo "[SignTool] NAND page size $5 not supported, set to default 2048!!"
+    NAND_PAGE_SIZE=2048
+fi
+
+##############################################################
+# Check if it is a sparse image or yaffs2 image
+Sparse_Str=`hexdump -n 4 $3 | head -n 1 | awk '{print $2,$3}'`
+Yaffs_Str=`hexdump $3 | head -n 1 | awk '{print $2,$3,$4,$5,$6,$7,$8,$9}'`
+if [ "$Sparse_Str" = "ff3a ed26" ] ; then
+    echo "${Simg2imgTool} $3 $3.UN_SPARSE_TEMP_IMG"
+    ${Simg2imgTool} $3 "$3.UN_SPARSE_TEMP_IMG"
+    echo "${SignTool} $1 $2 $3.UN_SPARSE_TEMP_IMG $3.SIGNATURE $3.HEADER"
+    ${SignTool} $1 $2 "$3.UN_SPARSE_TEMP_IMG" "$3.SIGNATURE" "$3.HEADER"
+    if [ $? -eq 0 ] ; then
+        echo "SIGN PASS !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(Sparse S1 IMG)"
+        cp -f "$3.HEADER" "$3.EXT_HDR_SPARSE"
+        cat "$3.SIGNATURE" >> "$3.EXT_HDR_SPARSE"
+    else
+        echo "SIGN FAIL !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(Sparse S1 IMG)"
+        exit 1;
+    fi
+
+    rm -f "$3.SIGNATURE"
+    rm -f "$3.HEADER"
+
+    echo "${SignTool} $1 $2 $3 $3.SIGNATURE $3.HEADER $3.EXT_HDR_SPARSE"
+    ${SignTool} $1 $2 $3 "$3.SIGNATURE" "$3.HEADER" "$3.EXT_HDR_SPARSE"
+    if [ $? -eq 0 ] ; then
+        echo "SIGN PASS !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(Sparse S2 IMG)"
+        cp -f "$3.HEADER" $4
+        cat $3 >> $4
+        cat "$3.SIGNATURE" >> $4
+        rm -f "$3.SIGNATURE"
+        rm -f "$3.HEADER"
+    else
+        echo "SIGN FAIL !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(Sparse S2 IMG)"
+        exit 1;
+    fi
+
+    rm -rf "$3.UN_SPARSE_TEMP_IMG"
+    rm -rf "$3.EXT_HDR_SPARSE"
+
+elif [ "$Yaffs_Str" = "0003 0000 0001 0000 ffff 0000 0000 0000" ] ; then
+    echo "${Yaffs2Covert} -c $NAND_PAGE_SIZE $3 $3.UN_YAFFS_TEMP_IMG"
+    ${Yaffs2Covert} -c $NAND_PAGE_SIZE $3 "$3.UN_YAFFS_TEMP_IMG"
+    echo "${SignTool} $1 $2 $3.UN_YAFFS_TEMP_IMG $3.SIGNATURE $3.HEADER"
+    ${SignTool} $1 $2 "$3.UN_YAFFS_TEMP_IMG" "$3.SIGNATURE" "$3.HEADER"
+    if [ $? -eq 0 ] ; then
+        echo "SIGN PASS !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(Yaffs S1 IMG)"
+        cp -f "$3.HEADER" "$3.EXT_HDR_SPARSE"
+        cat "$3.SIGNATURE" >> "$3.EXT_HDR_SPARSE"
+    else
+        echo "SIGN FAIL !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(Yaffs S1 IMG)"
+        exit 1;
+    fi
+
+    rm -f "$3.SIGNATURE"
+    rm -f "$3.HEADER"
+
+    echo "${SignTool} $1 $2 $3 $3.SIGNATURE $3.HEADER $3.EXT_HDR_SPARSE"
+    ${SignTool} $1 $2 $3 "$3.SIGNATURE" "$3.HEADER" "$3.EXT_HDR_SPARSE"
+    if [ $? -eq 0 ] ; then
+        echo "SIGN PASS !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(Yaffs S2 IMG)"
+        cp -f "$3.HEADER" $4
+        cat $3 >> $4
+        cat "$3.SIGNATURE" >> $4
+        rm -f "$3.SIGNATURE"
+        rm -f "$3.HEADER"
+    else
+        echo "SIGN FAIL !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(Yaffs S2 IMG)"
+        exit 1;
+    fi
+
+    rm -rf "$3.UN_YAFFS_TEMP_IMG"
+    rm -rf "$3.EXT_HDR_SPARSE"
+
+else
+    echo "${SignTool} $1 $2 $3 $3.SIGNATURE $3.HEADER"
+    ${SignTool} $1 $2 $3 "$3.SIGNATURE" "$3.HEADER"
+    if [ $? -eq 0 ] ; then
+        echo "SIGN PASS !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(Normal IMG)"
+        #cp -f "$3.HEADER" $3.sig
+        #cat "$3.SIGNATURE" >> $3.sig
+        cp -f "$3.HEADER" $4
+        cat $3 >> $4
+        cat "$3.SIGNATURE" >> $4
+    else
+        echo "SIGN FAIL !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!(Normal IMG)"
+        exit 1;
+    fi
+
+    rm -f "$3.SIGNATURE"
+    rm -f "$3.HEADER"
+fi
+