From 834207c4854a9f15e4deb9f3a7a03677feed7e68 Mon Sep 17 00:00:00 2001 From: Vadim Bendebury Date: Fri, 26 Aug 2016 17:40:17 -0700 Subject: cr50: provide build mode for signing with fob We don't really have the ability to build the latest signer yet, but this should not stop us from being able to build a properly signed image using the ec makefiles. As a stopgap measure the suggestion is to keep the latest signer binary in ~/bin/codesigner in chroot, then with this patch applied invoking make with CR50_DEV=1 will cause the proper sighner used and proper signing procedure followed. The signed targets need to be built in series to avoid concurrent use of the signer fob, an addition dependency is being added to enforce that. BRANCH=none BUG=chrome-os-partner:55557 TEST=ran make as follows: CR50_DEV=1 make BOARD=cr50 touched the fob when requested, uploaded the generated build/cr50/ec.bin on a kevin-tpm2 using usb_updater, and observed it boot properly with the new version. Change-Id: Ia9494bdc60b4bd3b8e5e09cbcbd8b27409c739d2 Signed-off-by: Vadim Bendebury Reviewed-on: https://chromium-review.googlesource.com/376885 Tested-by: Bill Richardson Reviewed-by: Bill Richardson --- Makefile.rules | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'Makefile.rules') diff --git a/Makefile.rules b/Makefile.rules index d2a151205b..565c95c34d 100644 --- a/Makefile.rules +++ b/Makefile.rules @@ -45,8 +45,8 @@ cmd_flat_to_obj = $(CC) -T $(out)/firmware_image.lds -nostdlib $(CPPFLAGS) \ # Allow the .roshared section to overlap other sections (itself) cmd_ec_elf_to_flat ?= $(OBJCOPY) --set-section-flags .roshared=share \ -O binary $< $@ -cmd_elf_to_signed ?= sudo $(out)/util/signer --key=util/signer/$(3) \ - --input=$< --format=bin --output=$@.signed $(SIG_EXTRA) \ +cmd_elf_to_signed ?= sudo $(SIGNER) --key=util/signer/$(3) \ + --input=$< --format=bin --output=$@.signed $(SIGNER_EXTRAS) \ && sudo chown $(shell whoami) $@.signed && mv $@.signed $@ cmd_elf_to_dis = $(OBJDUMP) -D $< > $@ cmd_elf_to_hex = $(OBJCOPY) -O ihex $< $@ @@ -274,7 +274,7 @@ $(out)/RO/%.flat: $(out)/RO/%.elf $(out)/RO/%.smap $(call quiet,elf_to_signed,RO_SIGN,$(CR50_RO_KEY)) $(out)/RW/%.flat: $(out)/RW/%.elf $(out)/RW/%.smap - $(call quiet,elf_to_signed,RW_SIGN,loader-testkey-A.pem) + $(call quiet,elf_to_signed,RW_SIGN,$(CR50_RW_KEY)) $(out)/RO/%.hex: $(out)/RO/%.flat $(call quiet,bin_to_hex,OBJCOPY) -- cgit v1.2.1