diff options
| author | Vadim Bendebury <vbendeb@chromium.org> | 2016-08-26 17:40:17 -0700 |
|---|---|---|
| committer | chrome-bot <chrome-bot@chromium.org> | 2016-09-07 00:16:56 -0700 |
| commit | 834207c4854a9f15e4deb9f3a7a03677feed7e68 (patch) | |
| tree | eaf9f6c14e2b32480e04d8dc546e939e51f53e33 /chip | |
| parent | 3392ad70d0d73788f1c24edbb08ddc30a93a0223 (diff) | |
| download | chrome-ec-834207c4854a9f15e4deb9f3a7a03677feed7e68.tar.gz | |
cr50: provide build mode for signing with fob
We don't really have the ability to build the latest signer yet, but
this should not stop us from being able to build a properly signed
image using the ec makefiles.
As a stopgap measure the suggestion is to keep the latest signer
binary in ~/bin/codesigner in chroot, then with this patch applied
invoking make with CR50_DEV=1 will cause the proper sighner used and
proper signing procedure followed.
The signed targets need to be built in series to avoid concurrent use
of the signer fob, an addition dependency is being added to enforce
that.
BRANCH=none
BUG=chrome-os-partner:55557
TEST=ran make as follows:
CR50_DEV=1 make BOARD=cr50
touched the fob when requested, uploaded the generated
build/cr50/ec.bin on a kevin-tpm2 using usb_updater, and observed
it boot properly with the new version.
Change-Id: Ia9494bdc60b4bd3b8e5e09cbcbd8b27409c739d2
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/376885
Tested-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
Diffstat (limited to 'chip')
| -rw-r--r-- | chip/g/build.mk | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/chip/g/build.mk b/chip/g/build.mk index 9cc0edb8a1..ed5c62ccbe 100644 --- a/chip/g/build.mk +++ b/chip/g/build.mk @@ -101,6 +101,18 @@ $(out)/RW/ec.RW_B.flat: $(out)/util/signer endif CR50_RO_KEY ?= rom-testkey-A.pem +ifeq ($(CR50_DEV),) +CR50_RW_KEY = loader-testkey-A.pem +SIGNER = $(out)/util/signer +SIGNER_EXTRAS = +else +SIGNER = $(HOME)/bin/codesigner +CR50_RW_KEY = cr50_rom0-dev-blsign.pem.pub +RW_SIGNER_EXTRAS = -x util/signer/fuses.xml +RW_SIGNER_EXTRAS += -j util/signer/ec_RW-manifest-kevin_evt_1.json +$(out)/RW/ec.RW_B.flat: $(out)/RW/ec.RW.flat +$(out)/RW/ec.RW.flat $(out)/RW/ec.RW_B.flat: SIGNER_EXTRAS = $(RW_SIGNER_EXTRAS) +endif # This file is included twice by the Makefile, once to determine the CHIP info # # and then again after defining all the CONFIG_ and HAS_TASK variables. We use |