blob: 71be794d200476beaf16e4fd7df6a91efb5198be (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
#!/bin/bash
# Copyright 2015 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
# Wrapper script for signing firmware image using cbootimage.
# Determine script directory.
SCRIPT_DIR=$(dirname "$0")
# Load common constants and variables.
. "${SCRIPT_DIR}/common_minimal.sh"
# Abort on error.
set -e
usage() {
cat<<EOF
Usage: $0 <type> <pkc_key> <firmware_image> <soc>
Signs <firmware_image> of <type> with <pkc_key> using cbootimage for <soc>.
where type is one of
bootloader = sign bootloader image
lp0_firmware = sign lp0 firmware
EOF
exit 1
}
main() {
if [[ $# -ne 4 ]]; then
usage
fi
local type=$1
local pkc_key="$(readlink -f "$2")"
local firmware_image="$(readlink -f "$3")"
local soc=$4
local work_dir=$(make_temp_dir)
local signed_fw=$(make_temp_file)
if [[ "${type}" == "bootloader" ]]; then
pushd "${work_dir}" >/dev/null
cat >update.cfg <<EOF
PkcKey = ${pkc_key}, --save;
ReSignBl;
EOF
# This also generates a file pubkey.sha which contains the hash of public
# key required by factory to burn into PKC fuses. Move pubkey.sha into
# ${firmware_image}.pubkey.sha.
cbootimage -s "${soc}" -u update.cfg "${firmware_image}" \
"${signed_fw}"
popd >/dev/null
# Copy signed firmware image and public key hash to current directory.
mv "${work_dir}/pubkey.sha" "${firmware_image}.pubkey.sha"
mv "${signed_fw}" "${firmware_image}"
elif [[ "${type}" == "lp0_firmware" ]]; then
pushd "${work_dir}" >/dev/null
cat >update.cfg <<EOF
PkcKey = ${pkc_key};
RsaSign = 0x220,, 288, 16, Complete;
EOF
cbootimage --sign update.cfg "${firmware_image}" "${signed_fw}"
popd >/dev/null
mv "${signed_fw}" "${firmware_image}"
else
usage
fi
}
main "$@"
|
