Change securerom test to use current hw hash key

Change-Id: Icb596e6c69fadd2f7b8109876a92db04763f206f
RTC: 68883
ForwardPort: yes
Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/23066
Tested-by: Jenkins Server
Tested-by: Jenkins OP Build CI
Tested-by: Jenkins OP HW
Tested-by: FSP CI Jenkins
Reviewed-by: Christian R. Geddes <crgeddes@us.ibm.com>
Reviewed-by: Matthew A. Ploetz <maploetz@us.ibm.com>
Reviewed-by: Daniel M. Crowell <dcrowell@us.ibm.com>
Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/23070

3 files changed, 30 insertions, 9 deletions

diff --git a/src/build/mkrules/hbfw/img/makefile b/src/build/mkrules/hbfw/img/makefile
index c58d05b67..8bd7b4900 100755
--- a/src/build/mkrules/hbfw/img/makefile
+++ b/src/build/mkrules/hbfw/img/makefile
@@ -84,7 +84,11 @@ MVPD_ECC_IMAGE = mvpd.bin.ecc
 MVPD_IMAGE = mvpd.bin
 CVPD_ECC_IMAGE = cvpd.bin.ecc
 PAYLOAD_ECC_IMAGE = payload.bin.ecc
-
+SECUREBOOT_HEADER = secureboot.header
+SECUREBOOT_SIGNED_CONTAINER = secureboot_signed_container
+# DEV_KEY_DIR set by env variable
+SIGN_PREFIX_PARAMS=-flag 0x80000000 -hka ${DEV_KEY_DIR}/hw_key_a -hkb ${DEV_KEY_DIR}/hw_key_b -hkc ${DEV_KEY_DIR}/hw_key_c -skp ${DEV_KEY_DIR}/sw_key_a
+SIGN_BUILD_PARAMS=-skp ${DEV_KEY_DIR}/sw_key_a
 ALL_HB_IMAGES = ${BASE_IMAGES} \
                 ${BASE_W_HEADER_IMAGE} \
                 ${BASE_ECC_IMAGE} ${EXT_ECC_IMAGE} \
@@ -114,12 +118,7 @@ cp_hbfiles: .SPECTARG
 	currentsb -chain
 	ecc --inject ${BASE_IMAGE} --output ${BASE_ECC_IMAGE} --p8
 	ecc --inject ${BASE_W_HEADER_IMAGE} --output ${BASE_W_HEADER_ECC_IMAGE} --p8
-	# dd command will pad image up to the next 4K page
-	dd if=${EXT_IMAGE} of=${EXT_PAD_IMAGE} ibs=4k count=1280 conv=sync
-	ecc --inject ${EXT_PAD_IMAGE} --output ${EXT_ECC_IMAGE} --p8
-        .if(${FAKEPNOR} != "")
-	dd if=${EXT_IMAGE} of=${EXT_FAKE_IMAGE} ibs=5120k conv=sync
-        .endif
+
 	# Add version header w/ HBRT sha hash
 	echo -en VERSION\\0 > ${HBRT_SHA_IMAGE}
 	sha512sum ${HBRT_IMAGE} | awk '{print $$1}' | xxd -pr -r >> ${HBRT_SHA_IMAGE}
@@ -143,6 +142,18 @@ cp_hbfiles: .SPECTARG
 		dd if=${TEMP_IMAGE} of=${EXT_HEADER_IMAGE} ibs=5120k conv=sync
 	.endif
 	ecc --inject ${EXT_HEADER_IMAGE} --output ${EXT_ECC_HEADER_IMAGE} --p8
+	dd if=${EXT_IMAGE} of=${EXT_PAD_IMAGE} ibs=4k count=1280 conv=sync
+	ecc --inject ${EXT_PAD_IMAGE} --output ${EXT_ECC_IMAGE} --p8
+
+	# Test signed container, SIGNING_DIR set by env variable
+	.if(${SECUREBOOT} && ${SIGNING_DIR})
+        # Key prefix used for all partitions
+		${SIGNING_DIR}/prefix -good -of ${SECUREBOOT_HEADER} ${SIGN_PREFIX_PARAMS}
+		dd if=/dev/zero count=1 | tr "\000" "\377" > ${TEMP_IMAGE}
+		${SIGNING_DIR}/build -good -if ${SECUREBOOT_HEADER} -of ${SECUREBOOT_SIGNED_CONTAINER} -bin ${TEMP_IMAGE} ${SIGN_BUILD_PARAMS}
+	.endif
+
+	# Pad and add ECC to other partitions that do not need headers
 	# create data for a test partition in pnor
 	dd if=/dev/urandom of=${TESTDATA} count=1 bs=32K
 	ecc --inject ${TESTDATA} --output ${TESTDATA_ECC} --p8
diff --git a/src/build/tools/hb b/src/build/tools/hb
index 7865c4069..f5d2620fc 100755
--- a/src/build/tools/hb
+++ b/src/build/tools/hb
@@ -241,6 +241,9 @@ hb_helptext()
         echo "      #!/bin/sh"
         echo "      export SANDBOXROOT=~/sandboxes"
         echo "      export SANDBOXNAME=hostboot"
+        echo "      # Dev key signing of images for secureboot"
+        echo "      export SIGNING_DIR=/esw/san2/hostboot/secure-boot/secure-boot-scripts/rom_new_header/sign/obj"
+        echo "      export DEV_KEY_DIR=/esw/san2/hostboot/secure-boot/dev_keys"
         echo
         echo "  See also:"
         echo "      All other sub-commands."
diff --git a/src/build/tools/hbDistribute b/src/build/tools/hbDistribute
index d3c07daed..f0b84a29d 100755
--- a/src/build/tools/hbDistribute
+++ b/src/build/tools/hbDistribute
@@ -6,7 +6,9 @@
 #
 # OpenPOWER HostBoot Project
 #
-# COPYRIGHT International Business Machines Corp. 2012,2014
+# Contributors Listed Below - COPYRIGHT 2012,2016
+# [+] International Business Machines Corp.
+#
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -41,7 +43,7 @@ print_usage()
     echo "    --help: Prints usage information"
     echo
     echo "    --test: Includes test images and content instead of non-test."
-    echo 
+    echo
     echo "    --release: Create a full release distribution (all targets)."
     echo "    --vpo: Generate just 'vpo' content."
     echo "    --simics/--fsp: *default* Generate just 'fsp' content"
@@ -80,6 +82,10 @@ do
             DEBUG="-d"
         ;;
 
+        "--secureboot")
+            SECUREBOOT=1
+        ;;
+
         --*)
             echo "ERROR: Unknown option: $ARG"
             exit
@@ -118,6 +124,7 @@ fi
 mkdir -p $TARGET_DIR
 export TARGET_TEST
 export TARGET_DIR
+export SECUREBOOT
 cd $REPO_ROOT/src/build/mkrules
 make -rR ${DEBUG:=} -f dist.targets.mk $TARGET