signer: Add signing support for nvidia lp0 firmware

BUG=chrome-os-partner:44227
BRANCH=None
TEST=unittests run fine.

Change-Id: I7d623a22d73a1749ebebd323fe09cbbeb8cbd61e
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/296429
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

2 files changed, 32 insertions, 0 deletions

diff --git a/scripts/image_signing/sign_nv_cbootimage.sh b/scripts/image_signing/sign_nv_cbootimage.sh
index 890ca6a9..71be794d 100755
--- a/scripts/image_signing/sign_nv_cbootimage.sh
+++ b/scripts/image_signing/sign_nv_cbootimage.sh
@@ -21,6 +21,7 @@ Usage: $0 <type> <pkc_key> <firmware_image> <soc>
 Signs <firmware_image> of <type> with <pkc_key> using cbootimage for <soc>.
 where type is one of
       bootloader = sign bootloader image
+      lp0_firmware = sign lp0 firmware
 EOF
   exit 1
 }
@@ -58,6 +59,20 @@ EOF
     mv "${work_dir}/pubkey.sha" "${firmware_image}.pubkey.sha"
     mv "${signed_fw}" "${firmware_image}"
 
+  elif [[ "${type}" == "lp0_firmware" ]]; then
+
+    pushd "${work_dir}" >/dev/null
+
+    cat >update.cfg <<EOF
+PkcKey = ${pkc_key};
+RsaSign = 0x220,, 288, 16, Complete;
+EOF
+
+    cbootimage --sign update.cfg "${firmware_image}" "${signed_fw}"
+
+    popd >/dev/null
+    mv "${signed_fw}" "${firmware_image}"
+
   else
     usage
   fi
diff --git a/scripts/image_signing/sign_official_build.sh b/scripts/image_signing/sign_official_build.sh
index 7cb89a0a..de155967 100755
--- a/scripts/image_signing/sign_official_build.sh
+++ b/scripts/image_signing/sign_official_build.sh
@@ -35,6 +35,7 @@ where <type> is one of:
              firmware (sign a firmware image)
              usb  (sign an image to boot directly from USB)
              verify (verify an image including rootfs hashes)
+             nv_lp0_firmware (sign nvidia lp0 firmware)
 
 output_image: File name of the signed output image
 version_file: File name of where to read the kernel and firmware versions.
@@ -453,6 +454,17 @@ sign_firmware() {
   echo "Signed firmware image output to ${image}"
 }
 
+# Sign nvidia lp0 firmware with the given keys.
+# Args: NV_LP0_FIRMWARE_IMAGE KEY_DIR
+sign_nv_lp0_firmware() {
+  local nv_lp0_fw_image=$1
+  local key_dir=$2
+
+  "${SCRIPT_DIR}/sign_nv_cbootimage.sh" "lp0_firmware" \
+      "${key_dir%/}/nv_pkc.pem" "${nv_lp0_fw_image}" "tegra210"
+  echo "Signed nvidia lp0 firmware image output to ${nv_lp0_fw_image}"
+}
+
 # Sign a kernel in-place with the given keys.
 # Args: KERNEL_IMAGE KEY_DIR KERNEL_VERSION
 sign_kernel() {
@@ -723,6 +735,11 @@ verify)
   verify_image
   exit 0
   ;;
+nv_lp0_firmware)
+  check_argc $# 3
+  sign_nv_lp0_firmware "${INPUT_IMAGE}" "${KEY_DIR}"
+  exit 0
+  ;;
 *)
   # All other signing commands take 4 to 5 args.
   if [ -z "${OUTPUT_IMAGE}" ]; then