Add an optional 'tee' entry to the x509 certificate template to include optee during the second (tispl) boot phase for the AM62L.
Signed-off-by: Bryan Brattlof <[email protected]> --- tools/binman/btool/openssl.py | 11 +++++++---- tools/binman/etype/ti_secure_rom.py | 32 +++++++++++++++++++++++++++++++- tools/binman/etype/x509_cert.py | 4 ++++ 3 files changed, 42 insertions(+), 5 deletions(-) diff --git a/tools/binman/btool/openssl.py b/tools/binman/btool/openssl.py index b26f087c4470..c4762f6ccee6 100644 --- a/tools/binman/btool/openssl.py +++ b/tools/binman/btool/openssl.py @@ -239,10 +239,10 @@ emailAddress = {req_dist_name_dict['emailAddress']} def x509_cert_rom_combined(self, cert_fname, input_fname, key_fname, sw_rev, config_fname, req_dist_name_dict, load_addr, sha, total_size, num_comps, sysfw_inner_cert_ext_boot_sequence_string, dm_data_ext_boot_sequence_string, - imagesize_sbl, hashval_sbl, load_addr_sysfw, imagesize_sysfw, - hashval_sysfw, load_addr_sysfw_data, imagesize_sysfw_data, - hashval_sysfw_data, sysfw_inner_cert_ext_boot_block, - dm_data_ext_boot_block, bootcore_opts, debug): + tee_ext_boot_sequence_string, imagesize_sbl, hashval_sbl, load_addr_sysfw, + imagesize_sysfw, hashval_sysfw, load_addr_sysfw_data, imagesize_sysfw_data, + hashval_sysfw_data, sysfw_inner_cert_ext_boot_block, dm_data_ext_boot_block, + tee_ext_boot_block, bootcore_opts, debug): """Create a certificate Args: @@ -299,6 +299,7 @@ sbl=SEQUENCE:sbl sysfw=SEQUENCE:sysfw sysfw_data=SEQUENCE:sysfw_data {sysfw_inner_cert_ext_boot_sequence_string} +{tee_ext_boot_sequence_string} {dm_data_ext_boot_sequence_string} [sbl] @@ -340,6 +341,8 @@ coreDbgSecEn = INTEGER:0 {sysfw_inner_cert_ext_boot_block} +{tee_ext_boot_block} + {dm_data_ext_boot_block} ''', file=outf) args = ['req', '-new', '-x509', '-key', key_fname, '-nodes', diff --git a/tools/binman/etype/ti_secure_rom.py b/tools/binman/etype/ti_secure_rom.py index 7e90c6559409..4e0c9d54bbc4 100644 --- a/tools/binman/etype/ti_secure_rom.py +++ b/tools/binman/etype/ti_secure_rom.py @@ -80,6 +80,11 @@ class Entry_ti_secure_rom(Entry_x509_cert): self.dm_data = fdt_util.GetBool(self._node, 'dm-data', False) if self.dm_data: self.load_addr_dm_data = fdt_util.GetInt(self._node, 'load-dm-data', 0x00000000) + + self.tee = fdt_util.GetBool(self._node, 'content-tee', False) + if self.tee: + self.load_addr_tee = fdt_util.GetInt(self._node, 'load-tee', 0x00000000) + self.req_dist_name = {'C': 'US', 'ST': 'TX', 'L': 'Dallas', @@ -219,7 +224,32 @@ compSize = INTEGER:{imagesize_dm_data} shaType = OID:{self.sha_type} shaValue = FORMAT:HEX,OCT:{hashval_dm_data}""" - self.total_size = self.imagesize_sbl + self.imagesize_sysfw + self.imagesize_sysfw_data + imagesize_sysfw_inner_cert + imagesize_dm_data + # tee + self.tee_ext_boot_sequence_string = "" + self.tee_ext_boot_block = "" + imagesize_tee = 0 + if self.tee: + self.content = fdt_util.GetPhandleList(self._node, 'content-tee') + input_data_tee = self.GetContents(required) + + input_fname_tee = tools.get_output_filename('input.%s' % uniq) + tools.write_file(input_fname_tee, input_data_tee) + + indata_tee = tools.read_file(input_fname_tee) + hashval_tee = hashlib.sha512(indata_tee).hexdigest() + imagesize_tee = len(indata_tee) + self.num_comps += 1 + self.tee_ext_boot_sequence_string = "tee=SEQUENCE:tee" + self.tee_ext_boot_block = f"""[tee] +compType = INTEGER:17 +bootCore = INTEGER:16 +compOpts = INTEGER:0 +destAddr = FORMAT:HEX,OCT:{self.load_addr_tee:08x} +compSize = INTEGER:{imagesize_tee} +shaType = OID:{self.sha_type} +shaValue = FORMAT:HEX,OCT:{hashval_tee}""" + + self.total_size = self.imagesize_sbl + self.imagesize_sysfw + self.imagesize_sysfw_data + imagesize_sysfw_inner_cert + imagesize_dm_data + imagesize_tee return super().GetCertificate(required=required, type='rom-combined') def GetCertificate(self, required): diff --git a/tools/binman/etype/x509_cert.py b/tools/binman/etype/x509_cert.py index b6e8b0b4fb09..79b7b37baee7 100644 --- a/tools/binman/etype/x509_cert.py +++ b/tools/binman/etype/x509_cert.py @@ -41,6 +41,7 @@ class Entry_x509_cert(Entry_collection): self.num_comps = None self.sysfw_inner_cert_ext_boot_sequence_string = None self.dm_data_ext_boot_sequence_string = None + self.tee_ext_boot_sequence_string = None self.imagesize_sbl = None self.hashval_sbl = None self.load_addr_sysfw = None @@ -51,6 +52,7 @@ class Entry_x509_cert(Entry_collection): self.hashval_sysfw_data = None self.sysfw_inner_cert_ext_boot_block = None self.dm_data_ext_boot_block = None + self.tee_ext_boot_block = None self.firewall_cert_data = None self.debug = False @@ -132,6 +134,7 @@ class Entry_x509_cert(Entry_collection): num_comps=self.num_comps, sysfw_inner_cert_ext_boot_sequence_string=self.sysfw_inner_cert_ext_boot_sequence_string, dm_data_ext_boot_sequence_string=self.dm_data_ext_boot_sequence_string, + tee_ext_boot_sequence_string=self.tee_ext_boot_sequence_string, imagesize_sbl=self.imagesize_sbl, hashval_sbl=self.hashval_sbl, load_addr_sysfw=self.load_addr_sysfw, @@ -142,6 +145,7 @@ class Entry_x509_cert(Entry_collection): hashval_sysfw_data=self.hashval_sysfw_data, sysfw_inner_cert_ext_boot_block=self.sysfw_inner_cert_ext_boot_block, dm_data_ext_boot_block=self.dm_data_ext_boot_block, + tee_ext_boot_block=self.tee_ext_boot_block, bootcore_opts=self.bootcore_opts, debug=self.debug ) -- 2.54.0
