Add transitional flag for enabling arm kernel signing

build_image

 #!/bin/bash
 
 # Copyright (c) 2009 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Script to build a bootable keyfob-based chromeos system image from within
 # a chromiumos setup. This assumes that all needed packages have been built into
 # the given target's root with binary packages turned on. This script will
 # build the Chrome OS image using only pre-built binary packages.
@@ skipping 74 matching lines @@
   "Attempt to preserve the previous build image if one can be found (unstable, \
 kernel/firmware not updated)"
 DEFINE_boolean fast ${DEFAULT_FAST} \
   "Call many emerges in parallel"
 DEFINE_string boot_args "noinitrd" \
   "Additional boot arguments to pass to the commandline"
 
 DEFINE_string usb_disk /dev/sdb3 \
   "Path syslinux should use to do a usb boot. Default: /dev/sdb3"
 
+# TODO(clchiou): Change default to FLAGS_TRUE once ARM verify boot is stable?
+DEFINE_boolean enable_kernel_signing ${FLAGS_FALSE} \

[Will Drewry, 2011/02/17 16:54:09]

This flag is way too broad.  It is meant as a transitionary crutch for arm, but
it wouldn't be obvious to the script user.

[Che-Liang Chiou, 2011/02/21 11:08:39]

Done.

+  "Sign kernel partition for ARM images."
+
 DEFINE_boolean enable_rootfs_verification ${FLAGS_TRUE} \
   "Default all bootloaders to use kernel-based root fs integrity checking."
 DEFINE_integer verity_error_behavior 3 \
   "Kernel verified boot error behavior (0: I/O errors, 1: panic, 2: nothing, \
 3: cros) Default: 3"
 DEFINE_integer verity_depth 1 \
   "Kernel verified boot hash tree depth. Default: 1"
 DEFINE_integer verity_max_ios -1 \
   "Number of outstanding I/O operations dm-verity caps at. Default: -1"
 DEFINE_string verity_algorithm "sha1" \
@@ skipping 170 matching lines @@
     ARCH="arm"
     ;;
   *86)
     ARCH="x86"
     ;;
   *)
     error "Unable to determine ARCH from toolchain: ${CHOST}"
     exit 1
 esac
 
+if [[ ${FLAGS_enable_kernel_signing} -eq ${FLAGS_TRUE} ]]; then
+  enable_kernel_signing_flag="--enable_kernel_signing"
+else
+  enable_kernel_signing_flag="--noenable_kernel_signing"
+fi
 if [[ ${FLAGS_enable_rootfs_verification} -eq ${FLAGS_TRUE} ]]; then
   enable_rootfs_verification_flag="--enable_rootfs_verification"
 fi
 
 # Hack to fix bug where x86_64 CHOST line gets incorrectly added.
 # ToDo(msb): remove this hack.
 PACKAGES_FILE="${BOARD_ROOT}/packages/Packages"
 sudo sed -e "s/CHOST: x86_64-pc-linux-gnu//" -i "${PACKAGES_FILE}"
 
 # Handle existing directory.
@@ skipping 103 matching lines @@
   --rootfs_mountpoint="${ROOT_FS_DIR}"
   --statefulfs_mountpoint="${STATEFUL_FS_DIR}"
   --espfs_mountpoint="${ESP_FS_DIR}"
   --verity_error_behavior="${FLAGS_verity_error_behavior}"
   --verity_depth="${FLAGS_verity_depth}"
   --verity_max_ios="${FLAGS_verity_max_ios}"
   --verity_algorithm="${FLAGS_verity_algorithm}"
   --keys_dir="${DEVKEYSDIR}"
   --usb_disk="${FLAGS_usb_disk}"
   --nocleanup_dirs
+  ${enable_kernel_signing_flag}
   ${enable_rootfs_verification_flag}
 EOF
 }
 
 # Modifies an existing image to add development packages
 update_dev_packages() {
   local image_name=$1
 
   echo "Adding developer packages to ${image_name}"
 
@@ skipping 369 matching lines @@
 
 USE_DEV_KEYS=
 if [ "${FLAGS_dev_install}" -eq "${FLAGS_TRUE}" ] || \
    [ "${FLAGS_factory_install}" -eq "${FLAGS_TRUE}" ]; then
   USE_DEV_KEYS="--use_dev_keys"
 fi
 
 # Place flags before positional args
 ${SCRIPTS_DIR}/bin/cros_make_image_bootable "${OUTPUT_DIR}" \
                                             "${PRISTINE_IMAGE_NAME}" \
-                                            ${USE_DEV_KEYS}
+                                            ${USE_DEV_KEYS} \
+                                            ${enable_kernel_signing_flag}
 
 # FIXME: only signing things for x86 right now.
-if [[ "${ARCH}" = "x86" ]]; then
+# FIXME: signing things for x86, and for ARM if enabled.
+if [[ "${FLAGS_enable_kernel_signing}" -eq "${FLAGS_TRUE}" || \
+      "${ARCH}" = "x86" ]]; then
   BOOT_FLAG=
   if [ "${FLAGS_dev_install}" -eq "${FLAGS_TRUE}" ] ||
      [ "${FLAGS_factory_install}" -eq "${FLAGS_TRUE}" ]; then
     BOOT_FLAG="-b 1"  # BOOT_FLAG_DEVELOPER value defined in load_kernel_fw.h
     info "--dev_install set, pass BOOT_FLAG_DEVELOPER flag to load_kernel_test"
   fi
 
   # Verify the final image.
   load_kernel_test "${OUTPUT_DIR}/${PRISTINE_IMAGE_NAME}" \
     "${DEVKEYSDIR}/recovery_key.vbpubk" ${BOOT_FLAG}
 fi
 
 # Create a developer image based on the chromium os base image.
 if [ "${FLAGS_withdev}" -eq "${FLAGS_TRUE}" ] ; then
   if [[ ! -f ${DEVELOPER_IMG} ]] ; then
     echo "Creating developer image from base image ${PRISTINE_IMAGE_NAME}"
     cp ${PRISTINE_IMG} ${DEVELOPER_IMG}
   fi
 
   update_dev_packages ${DEVELOPER_IMAGE_NAME}
   ${SCRIPTS_DIR}/bin/cros_make_image_bootable "${OUTPUT_DIR}" \
-                                              "${DEVELOPER_IMAGE_NAME}"
+                                              "${DEVELOPER_IMAGE_NAME}" \
+                                              ${enable_kernel_signing_flag}
 fi
 
 # Clean up temporary files.
 rm -f "${ROOT_FS_IMG}" "${STATEFUL_FS_IMG}" "${OUTPUT_DIR}/vmlinuz.image" \
   "${ESP_FS_IMG}" "${OEM_FS_IMG}" "${OUTPUT_DIR}/vmlinuz_hd.vblock"
 rmdir "${ROOT_FS_DIR}" "${STATEFUL_FS_DIR}" "${OEM_FS_DIR}" "${ESP_FS_DIR}"
 
 # Generating AU generator zip file to run outside chroot
 generate_au_zip || echo "Failed generating AU zip file - ignoring Error..."
 # Create a 'latest' link
 rm -f ${FLAGS_output_root}/${FLAGS_board}/latest
 ln -s $(basename ${OUTPUT_DIR}) ${FLAGS_output_root}/${FLAGS_board}/latest
 
 echo "Done.  Image created in ${OUTPUT_DIR}"
 echo "Chromium OS image created as ${PRISTINE_IMAGE_NAME}"
 if [ "${FLAGS_withdev}" -eq "${FLAGS_TRUE}" ]; then
   echo "Developer image created as ${DEVELOPER_IMAGE_NAME}"
 fi
 
 print_time_elapsed
 
 echo "To copy to USB keyfob, do something like:"
 echo "  ./image_to_usb.sh --from=${OUTSIDE_OUTPUT_DIR} --to=/dev/sdX"
 echo "To convert to VMWare image, INSIDE the chroot, do something like:"
 echo "  ./image_to_vm.sh --from=${OUTSIDE_OUTPUT_DIR} --board=${BOARD}"
 echo "from the scripts directory where you entered the chroot."