Add support for using separate developer firmware keyblock while signing.

scripts/image_signing/resign_firmwarefd.sh

 #!/bin/sh
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Script to resign a firmware image using a different set of keys
 # for use on signing servers.
 #
 # arguments: src_fd, dst_fd, firmware_datakey, and firmware_keyblock
@@ skipping 36 matching lines @@
 # which can then replace old vblock for Firmware A ("Firmware A Key" region at
 # offset 0x00008000 and size 0x00002000).
 
 # Load common constants and variables.
 . "$(dirname "$0")/common_minimal.sh"
 
 # Abort on error
 set -e
 
 # Check arguments
-if [ $# -lt 5 ] || [ $# -gt 6 ]; then
+if [ $# -lt 7 ] || [ $# -gt 8 ]; then
   echo "Usage: $PROG src_fd dst_fd firmware_datakey firmware_keyblock"\
-   "kernel_subkey [version]"
+   "dev_firmware_datakey dev_firmware_keyblock kernel_subkey [version]"
   exit 1
 fi
 
 # Make sure the tools we need are available.
 for prog in mosys vbutil_firmware; do
   type "${prog}" &>/dev/null || \
     { echo "${prog} tool not found."; exit 1; }
 done
 
 SRC_FD=$1
 DST_FD=$2
 FIRMWARE_DATAKEY=$3
 FIRMWARE_KEYBLOCK=$4
-KERNEL_SUBKEY=$5
-VERSION=$6
+DEV_FIRMWARE_DATAKEY=$5
+DEV_FIRMWARE_KEYBLOCK=$6
+KERNEL_SUBKEY=$7
+VERSION=$8
 
 if [ -z $VERSION ]; then
   VERSION=1
 fi
 echo "Using firmware version: $VERSION"
 
 # Parse offsets and size of firmware data and vblocks
 for i in "A" "B"
 do
   line=$(mosys -f -k eeprom map $1 | grep "$i Key") ||
@@ skipping 13 matching lines @@
 
   offset="$(echo $line | sed -e 's/.*area_offset=\"\([a-f0-9x]*\)\".*/\1/')"
   eval fw${i}_offset=$((offset))
   size="$(echo $line | sed -e 's/.*area_size=\"\([a-f0-9x]*\)\".*/\1/')"
   eval fw${i}_size=$((size))
 done
 
 temp_fwimage=$(make_temp_file)
 temp_out_vb=$(make_temp_file)
 
-# Extract out Firmware A data and generate signature using the right keys
+# Extract out Firmware A data and generate signature using the right keys.
+# Firmware A is the dev firmware.
 dd if="${SRC_FD}" of="${temp_fwimage}" skip="${fwA_offset}" bs=1 \
   count="${fwA_size}"
 
 echo "Re-calculating Firmware A vblock"
 vbutil_firmware \
   --vblock "${temp_out_vb}" \
-  --keyblock "${FIRMWARE_KEYBLOCK}" \
-  --signprivate "${FIRMWARE_DATAKEY}" \
+  --keyblock "${DEV_FIRMWARE_KEYBLOCK}" \
+  --signprivate "${DEV_FIRMWARE_DATAKEY}" \
   --version "${VERSION}" \
   --fv "${temp_fwimage}" \
   --kernelkey "${KERNEL_SUBKEY}"
 
 # Create a copy of the input image and put in the new vblock for firmware A
 cp "${SRC_FD}" "${DST_FD}"
 dd if="${temp_out_vb}" of="${DST_FD}" seek="${fwA_vblock_offset}" bs=1 \
   count="${fwA_vblock_size}" conv=notrunc
 
-# Repeat for firmware B
+# Firmware B is the normal firmware.
 dd if="${SRC_FD}" of="${temp_fwimage}" skip="${fwB_offset}" bs=1 \
   count="${fwB_size}"
 echo "Re-calculating Firmware B vblock"
 vbutil_firmware \
   --vblock "${temp_out_vb}" \
   --keyblock "${FIRMWARE_KEYBLOCK}" \
   --signprivate "${FIRMWARE_DATAKEY}" \
   --version "${VERSION}" \
   --fv "${temp_fwimage}" \
   --kernelkey "${KERNEL_SUBKEY}"
 
 # Destination image has already been created.
 dd if="${temp_out_vb}" of="${DST_FD}" seek="${fwB_vblock_offset}" bs=1 \
   count="${fwB_vblock_size}" conv=notrunc
 
 echo "New signed image was output to ${DST_FD}"