When trying to hook up use of a customer's own signing infrastructure
for some am62x devices, I found it was more difficult than it should
be to point at the right key(s). One has to patch in the keyfile=
property in way too many places, and if you miss just one, the build
succeeds using the generic custMpk.pem for the one you missed, but of
course the resulting artifacts are unbootable.
Use the template mechanism that binman already has to allow one to
only set the keyfile= in a single place. I cannot really imagine any
case where one would not want to use the same key for signing all
artifacts across the r5/a53 cores, but that is of course still
possible, just as any downstreams that have explicit
&{/binman/tiboot3-am62x-hs-evm.bin/ti-secure-rom} {
keyfile = "foobar.pem";
};
&{/binman/tiboot3-am62x-hs-fs-evm.bin/ti-secure-rom} {
keyfile = "foobar.pem";
};
will continue to work.
Changes in v3:
- Fix thinko in patch 7 (s/keyname/keyfile/g).
- Add Simon's Reviewed-bys.
Changes in v2:
- Make sure an x509_cert entry (and derived classes) always has _some_
valid reg_dist_name attribute. openssl not only requires existence
of a distinguish name section, it also needs to be non-empty.
- Implement the "allow string list a value" for distinguished-name
properties alluded to in v1, as it might as well be done now and
doesn't take a lot of code.
- Verify that property values in the distinguished-name node are
strings or string lists.
- Add documentation, both to the binman entry definitions and a new
patch with an update of k3.rst's section on Secure Boot.
v2: https://lore.kernel.org/u-boot/[email protected]/
v1: https://lore.kernel.org/u-boot/[email protected]/
Rasmus Villemoes (7):
binman: openssl: refactor creation of Distinguished Name section from
dict
binman: x509_cert: allow and parse distinguished-name subnode
binman: x509: fix CN emitted for basic x509 certificates
k3-binman.dtsi: add keyfile_template node
k3-binman.dtsi: add empty distinguished_name_template
k3-binman.dtsi: insert keyfile and distinguished name templates in all
ti-secure(-rom) nodes
doc: k3.rst: describe use of keyfile and distinguished_name binman
templates
arch/arm/dts/k3-binman.dtsi | 35 ++++++++----
doc/board/ti/k3.rst | 48 +++++++++++++++++
tools/binman/btool/openssl.py | 68 ++++++++++++------------
tools/binman/etype/ti_secure.py | 16 +++---
tools/binman/etype/ti_secure_rom.py | 16 +++---
tools/binman/etype/x509_cert.py | 23 ++++++--
tools/binman/test/security/x509_cert.dts | 5 +-
7 files changed, 147 insertions(+), 64 deletions(-)
--
2.55.0
