Allow signing scripts to (optionally) set the firmware and kernel versions

scripts/image_signing/resign_firmwarefd.sh

 #!/bin/sh
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Script to resign a firmware image using a different set of keys
 # for use on signing servers.
 #
 # arguments: src_fd, dst_fd, firmware_datakey, and firmware_keyblock
@@ skipping 36 matching lines @@
 # which can then replace old vblock for Firmware A ("Firmware A Key" region at
 # offset 0x00008000 and size 0x00002000).
 
 # Load common constants and variables.
 . "$(dirname "$0")/common_minimal.sh"
 
 # Abort on error
 set -e
 
 # Check arguments
-if [ $# -ne 5 ] ; then
-  echo \
-    "Usage: $0 src_fd dst_fd firmware_datakey firmware_keyblock kernel_subkey"
+if [ $# -lt 5 ] || [ $# -gt 6 ]; then
+  echo "Usage: $PROG src_fd dst_fd firmware_datakey firmware_keyblock"\
+   "kernel_subkey [version]"
   exit 1
 fi
 
 # Make sure the tools we need are available.
 for prog in mosys vbutil_firmware; do
   type "${prog}" &>/dev/null || \
     { echo "${prog} tool not found."; exit 1; }
 done
 
-src_fd=$1
-dst_fd=$2
-firmware_datakey=$3
-firmware_keyblock=$4
-kernel_subkey=$5
+SRC_FD=$1
+DST_FD=$2
+FIRMWARE_DATAKEY=$3
+FIRMWARE_KEYBLOCK=$4
+KERNEL_SUBKEY=$5
+VERSION=$6
 
-# TODO(gauravsh): Figure out where the version comes from.
-#                 Do we rev it manually?
-VERSION=1
+if [ -z $VERSION ]; then
+  VERSION=1
+fi
+echo "Using firmware version: $VERSION"
 
 # Parse offsets and size of firmware data and vblocks
 for i in "A" "B"
 do
   match_str="$i Key"
   line=$(mosys -f -k eeprom map $1 | grep "$match_str")
   offset="$(echo $line | sed -e 's/.*area_offset=\"\([a-f0-9x]*\)\".*/\1/')"
   eval fw${i}_vblock_offset=$((offset))
   size="$(echo $line | sed -e 's/.*area_size=\"\([a-f0-9x]*\)\".*/\1/')"
   eval fw${i}_vblock_size=$((size))
 
   match_str="$i Data"
   line=$(mosys -f -k eeprom map $1 | grep "$match_str")
   offset="$(echo $line | sed -e 's/.*area_offset=\"\([a-f0-9x]*\)\".*/\1/')"
   eval fw${i}_offset=$((offset))
   size="$(echo $line | sed -e 's/.*area_size=\"\([a-f0-9x]*\)\".*/\1/')"
   eval fw${i}_size=$((size))
 done
 
 temp_fwimage=$(make_temp_file)
 temp_out_vb=$(make_temp_file)
 
 # Extract out Firmware A data and generate signature using the right keys
-dd if="${src_fd}" of="${temp_fwimage}" skip="${fwA_offset}" bs=1 \
+dd if="${SRC_FD}" of="${temp_fwimage}" skip="${fwA_offset}" bs=1 \
   count="${fwA_size}"
 
 echo "Re-calculating Firmware A vblock"
 vbutil_firmware \
   --vblock "${temp_out_vb}" \
-  --keyblock "${firmware_keyblock}" \
-  --signprivate "${firmware_datakey}" \
+  --keyblock "${FIRMWARE_KEYBLOCK}" \
+  --signprivate "${FIRMWARE_DATAKEY}" \
   --version "${VERSION}" \
   --fv "${temp_fwimage}" \
-  --kernelkey "${kernel_subkey}"
+  --kernelkey "${KERNEL_SUBKEY}"
 
 # Create a copy of the input image and put in the new vblock for firmware A
-cp "${src_fd}" "${dst_fd}"
-dd if="${temp_out_vb}" of="${dst_fd}" seek="${fwA_vblock_offset}" bs=1 \
+cp "${SRC_FD}" "${DST_FD}"
+dd if="${temp_out_vb}" of="${DST_FD}" seek="${fwA_vblock_offset}" bs=1 \
   count="${fwA_vblock_size}" conv=notrunc
 
 # Repeat for firmware B
-dd if="${src_fd}" of="${temp_fwimage}" skip="${fwB_offset}" bs=1 \
+dd if="${SRC_FD}" of="${temp_fwimage}" skip="${fwB_offset}" bs=1 \
   count="${fwB_size}"
 echo "Re-calculating Firmware B vblock"
 vbutil_firmware \
   --vblock "${temp_out_vb}" \
-  --keyblock "${firmware_keyblock}" \
-  --signprivate "${firmware_datakey}" \
+  --keyblock "${FIRMWARE_KEYBLOCK}" \
+  --signprivate "${FIRMWARE_DATAKEY}" \
   --version "${VERSION}" \
   --fv "${temp_fwimage}" \
-  --kernelkey "${kernel_subkey}"
+  --kernelkey "${KERNEL_SUBKEY}"
 
 # Destination image has already been created.
-dd if="${temp_out_vb}" of="${dst_fd}" seek="${fwB_vblock_offset}" bs=1 \
+dd if="${temp_out_vb}" of="${DST_FD}" seek="${fwB_vblock_offset}" bs=1 \
   count="${fwB_vblock_size}" conv=notrunc
 
-echo "New signed image was output to ${dst_fd}"
+echo "New signed image was output to ${DST_FD}"