signer: Add signing support for nvidia lp0 firmware

BUG=chrome-os-partner:44227
BRANCH=None
TEST=unittests run fine.

Change-Id: I7d623a22d73a1749ebebd323fe09cbbeb8cbd61e
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/296429
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

1 files changed, 17 insertions, 0 deletions

diff --git a/scripts/image_signing/sign_official_build.sh b/scripts/image_signing/sign_official_build.sh
index 7cb89a0a..de155967 100755
--- a/scripts/image_signing/sign_official_build.sh
+++ b/scripts/image_signing/sign_official_build.sh
@@ -35,6 +35,7 @@ where <type> is one of:
              firmware (sign a firmware image)
              usb  (sign an image to boot directly from USB)
              verify (verify an image including rootfs hashes)
+             nv_lp0_firmware (sign nvidia lp0 firmware)
 
 output_image: File name of the signed output image
 version_file: File name of where to read the kernel and firmware versions.
@@ -453,6 +454,17 @@ sign_firmware() {
   echo "Signed firmware image output to ${image}"
 }
 
+# Sign nvidia lp0 firmware with the given keys.
+# Args: NV_LP0_FIRMWARE_IMAGE KEY_DIR
+sign_nv_lp0_firmware() {
+  local nv_lp0_fw_image=$1
+  local key_dir=$2
+
+  "${SCRIPT_DIR}/sign_nv_cbootimage.sh" "lp0_firmware" \
+      "${key_dir%/}/nv_pkc.pem" "${nv_lp0_fw_image}" "tegra210"
+  echo "Signed nvidia lp0 firmware image output to ${nv_lp0_fw_image}"
+}
+
 # Sign a kernel in-place with the given keys.
 # Args: KERNEL_IMAGE KEY_DIR KERNEL_VERSION
 sign_kernel() {
@@ -723,6 +735,11 @@ verify)
   verify_image
   exit 0
   ;;
+nv_lp0_firmware)
+  check_argc $# 3
+  sign_nv_lp0_firmware "${INPUT_IMAGE}" "${KEY_DIR}"
+  exit 0
+  ;;
 *)
   # All other signing commands take 4 to 5 args.
   if [ -z "${OUTPUT_IMAGE}" ]; then