Hi Bryan,
On 7/18/26 1:23 AM, Bryan Brattlof wrote:
Add an optional 'tee' entry to the x509 certificate template to include
optee during the second (tispl) boot phase for the AM62L.
Signed-off-by: Bryan Brattlof <[email protected]>
---
tools/binman/btool/openssl.py | 11 +++++++----
tools/binman/etype/ti_secure_rom.py | 32 +++++++++++++++++++++++++++++++-
tools/binman/etype/x509_cert.py | 4 ++++
3 files changed, 42 insertions(+), 5 deletions(-)
We need tests.
diff --git a/tools/binman/btool/openssl.py b/tools/binman/btool/openssl.py
index b26f087c4470..c4762f6ccee6 100644
--- a/tools/binman/btool/openssl.py
+++ b/tools/binman/btool/openssl.py
@@ -239,10 +239,10 @@ emailAddress =
{req_dist_name_dict['emailAddress']}
def x509_cert_rom_combined(self, cert_fname, input_fname, key_fname,
sw_rev,
config_fname, req_dist_name_dict, load_addr, sha,
total_size, num_comps,
sysfw_inner_cert_ext_boot_sequence_string,
dm_data_ext_boot_sequence_string,
- imagesize_sbl, hashval_sbl, load_addr_sysfw, imagesize_sysfw,
- hashval_sysfw, load_addr_sysfw_data, imagesize_sysfw_data,
- hashval_sysfw_data, sysfw_inner_cert_ext_boot_block,
- dm_data_ext_boot_block, bootcore_opts, debug):
+ tee_ext_boot_sequence_string, imagesize_sbl, hashval_sbl,
load_addr_sysfw,
+ imagesize_sysfw, hashval_sysfw, load_addr_sysfw_data,
imagesize_sysfw_data,
+ hashval_sysfw_data, sysfw_inner_cert_ext_boot_block,
dm_data_ext_boot_block,
+ tee_ext_boot_block, bootcore_opts, debug):
"""Create a certificate
Args:
@@ -299,6 +299,7 @@ sbl=SEQUENCE:sbl
sysfw=SEQUENCE:sysfw
sysfw_data=SEQUENCE:sysfw_data
{sysfw_inner_cert_ext_boot_sequence_string}
+{tee_ext_boot_sequence_string}
{dm_data_ext_boot_sequence_string}
[sbl]
@@ -340,6 +341,8 @@ coreDbgSecEn = INTEGER:0
{sysfw_inner_cert_ext_boot_block}
+{tee_ext_boot_block}
+
{dm_data_ext_boot_block}
''', file=outf)
args = ['req', '-new', '-x509', '-key', key_fname, '-nodes',
diff --git a/tools/binman/etype/ti_secure_rom.py
b/tools/binman/etype/ti_secure_rom.py
index 7e90c6559409..4e0c9d54bbc4 100644
--- a/tools/binman/etype/ti_secure_rom.py
+++ b/tools/binman/etype/ti_secure_rom.py
@@ -80,6 +80,11 @@ class Entry_ti_secure_rom(Entry_x509_cert):
self.dm_data = fdt_util.GetBool(self._node, 'dm-data', False)
if self.dm_data:
self.load_addr_dm_data = fdt_util.GetInt(self._node,
'load-dm-data', 0x00000000)
+
+ self.tee = fdt_util.GetBool(self._node, 'content-tee', False)
+ if self.tee:
+ self.load_addr_tee = fdt_util.GetInt(self._node, 'load-tee',
0x00000000)
+
We need documentation for these new properties.
self.req_dist_name = {'C': 'US',
'ST': 'TX',
'L': 'Dallas',
@@ -219,7 +224,32 @@ compSize = INTEGER:{imagesize_dm_data}
shaType = OID:{self.sha_type}
shaValue = FORMAT:HEX,OCT:{hashval_dm_data}"""
- self.total_size = self.imagesize_sbl + self.imagesize_sysfw + self.imagesize_sysfw_data + imagesize_sysfw_inner_cert + imagesize_dm_data
+ # tee
+ self.tee_ext_boot_sequence_string = ""
+ self.tee_ext_boot_block = ""
+ imagesize_tee = 0
+ if self.tee:
+ self.content = fdt_util.GetPhandleList(self._node, 'content-tee')
+ input_data_tee = self.GetContents(required)
+
+ input_fname_tee = tools.get_output_filename('input.%s' % uniq)
+ tools.write_file(input_fname_tee, input_data_tee)
+
+ indata_tee = tools.read_file(input_fname_tee)
+ hashval_tee = hashlib.sha512(indata_tee).hexdigest()
+ imagesize_tee = len(indata_tee)
+ self.num_comps += 1
+ self.tee_ext_boot_sequence_string = "tee=SEQUENCE:tee"
+ self.tee_ext_boot_block = f"""[tee]
+compType = INTEGER:17
+bootCore = INTEGER:16
+compOpts = INTEGER:0
+destAddr = FORMAT:HEX,OCT:{self.load_addr_tee:08x}
+compSize = INTEGER:{imagesize_tee}
+shaType = OID:{self.sha_type}
+shaValue = FORMAT:HEX,OCT:{hashval_tee}"""
+
+ self.total_size = self.imagesize_sbl + self.imagesize_sysfw +
self.imagesize_sysfw_data + imagesize_sysfw_inner_cert + imagesize_dm_data +
imagesize_tee
return super().GetCertificate(required=required, type='rom-combined')
def GetCertificate(self, required):
diff --git a/tools/binman/etype/x509_cert.py b/tools/binman/etype/x509_cert.py
index b6e8b0b4fb09..79b7b37baee7 100644
--- a/tools/binman/etype/x509_cert.py
+++ b/tools/binman/etype/x509_cert.py
@@ -41,6 +41,7 @@ class Entry_x509_cert(Entry_collection):
self.num_comps = None
self.sysfw_inner_cert_ext_boot_sequence_string = None
self.dm_data_ext_boot_sequence_string = None
+ self.tee_ext_boot_sequence_string = None
self.imagesize_sbl = None
self.hashval_sbl = None
self.load_addr_sysfw = None
@@ -51,6 +52,7 @@ class Entry_x509_cert(Entry_collection):
self.hashval_sysfw_data = None
self.sysfw_inner_cert_ext_boot_block = None
self.dm_data_ext_boot_block = None
+ self.tee_ext_boot_block = None
self.firewall_cert_data = None
self.debug = False
@@ -132,6 +134,7 @@ class Entry_x509_cert(Entry_collection):
num_comps=self.num_comps,
sysfw_inner_cert_ext_boot_sequence_string=self.sysfw_inner_cert_ext_boot_sequence_string,
dm_data_ext_boot_sequence_string=self.dm_data_ext_boot_sequence_string,
+ tee_ext_boot_sequence_string=self.tee_ext_boot_sequence_string,
imagesize_sbl=self.imagesize_sbl,
hashval_sbl=self.hashval_sbl,
load_addr_sysfw=self.load_addr_sysfw,
@@ -142,6 +145,7 @@ class Entry_x509_cert(Entry_collection):
hashval_sysfw_data=self.hashval_sysfw_data,
sysfw_inner_cert_ext_boot_block=self.sysfw_inner_cert_ext_boot_block,
dm_data_ext_boot_block=self.dm_data_ext_boot_block,
+ tee_ext_boot_block=self.tee_ext_boot_block,
bootcore_opts=self.bootcore_opts,
debug=self.debug
)
Honestly, I'm not sure what we're doing with the Entry_x509_cert is
correct... I particularly dislike the type argument to GetCertificate().
It's like we somehow tried to make a generic class but we're putting
TI-specific things in there. I think we should move the TI-specific
certificate types to tools/binman/etype/ti_secure.py and
tools/binman/etype/ti_secure_rom.py instead and override
GetCertificate() from x509 class in those files. Then don't call
super().GetCertificate(). Or if the 20 lines we would spare in
GetCertificate() are really important to share, have them in other
functions and make GetCertificate() from x509 class and your TI classes
call them. I don't think this needs to be a blocker for this series, but
I think it'd be nice to implement in follow-up patches.
Cheers,
Quentin
