Currently, the ti-secure and ti-secure-rom types hardcode the contents of the Distinguished Name section. Those values are not necessarily appropriate for all boards that just happen to include a SOC produced by TI.
Allow placing a distinguished-name subnode inside the binman node representing the Entry_x509_cert (or derived classes), and if present, use that information. Ensure an Entry_x509_cert instance always has some non-empty req_dist_name dict by adding a dummy default (because for the certificate generation there must be a non-empty req_dist_name section), and let derived classes provide their own default. Reviewed-by: Simon Glass <[email protected]> Signed-off-by: Rasmus Villemoes <[email protected]> --- tools/binman/etype/ti_secure.py | 16 +++++++++------- tools/binman/etype/ti_secure_rom.py | 16 +++++++++------- tools/binman/etype/x509_cert.py | 20 +++++++++++++++++++- 3 files changed, 37 insertions(+), 15 deletions(-) diff --git a/tools/binman/etype/ti_secure.py b/tools/binman/etype/ti_secure.py index f6caa0286d9..b4e120917b1 100644 --- a/tools/binman/etype/ti_secure.py +++ b/tools/binman/etype/ti_secure.py @@ -58,6 +58,7 @@ class Entry_ti_secure(Entry_x509_cert): - Lower Byte - Remains 0x02 as per our use case ( 0x02: Move the authenticated binary back to the header ) - Upper Byte - The Host ID of the core owning the firewall + - distinguished-name: See :ref:`etype_x509_cert` Output files: - input.<unique_name> - input file passed to openssl @@ -99,6 +100,14 @@ class Entry_ti_secure(Entry_x509_cert): writes the signature in this entry. This allows verification that the data is genuine. """ + default_dist_name = {'C': 'US', + 'ST': 'TX', + 'L': 'Dallas', + 'O': 'Texas Instruments Incorporated', + 'OU': 'Processors', + 'CN': 'TI Support', + 'emailAddress': '[email protected]'} + def __init__(self, section, etype, node): super().__init__(section, etype, node) self.openssl = None @@ -117,13 +126,6 @@ class Entry_ti_secure(Entry_x509_cert): self.firewall_cert_data['auth_in_place'] = auth_in_place self.ReadFirewallNode() self.sha = fdt_util.GetInt(self._node, 'sha', 512) - self.req_dist_name = {'C': 'US', - 'ST': 'TX', - 'L': 'Dallas', - 'O': 'Texas Instruments Incorporated', - 'OU': 'Processors', - 'CN': 'TI Support', - 'emailAddress': '[email protected]'} self.debug = fdt_util.GetBool(self._node, 'debug', False) def ReadFirewallNode(self): diff --git a/tools/binman/etype/ti_secure_rom.py b/tools/binman/etype/ti_secure_rom.py index 7e90c655940..6c4e767c741 100644 --- a/tools/binman/etype/ti_secure_rom.py +++ b/tools/binman/etype/ti_secure_rom.py @@ -33,6 +33,7 @@ class Entry_ti_secure_rom(Entry_x509_cert): - content: phandle of SPL in case of legacy bootflow or phandles of component binaries in case of combined bootflow - core-opts (optional): lockstep (0) or split (2) mode set to 0 by default + - distinguished-name: See :ref:`etype_x509_cert` The following properties are only for generating a combined bootflow binary: - sysfw-inner-cert: boolean if binary contains sysfw inner certificate @@ -58,6 +59,14 @@ class Entry_ti_secure_rom(Entry_x509_cert): writes the signature in this entry. This allows verification that the data is genuine. """ + default_dist_name = {'C': 'US', + 'ST': 'TX', + 'L': 'Dallas', + 'O': 'Texas Instruments Incorporated', + 'OU': 'Processors', + 'CN': 'TI Support', + 'emailAddress': '[email protected]'} + def __init__(self, section, etype, node): super().__init__(section, etype, node) self.openssl = None @@ -80,13 +89,6 @@ class Entry_ti_secure_rom(Entry_x509_cert): self.dm_data = fdt_util.GetBool(self._node, 'dm-data', False) if self.dm_data: self.load_addr_dm_data = fdt_util.GetInt(self._node, 'load-dm-data', 0x00000000) - self.req_dist_name = {'C': 'US', - 'ST': 'TX', - 'L': 'Dallas', - 'O': 'Texas Instruments Incorporated', - 'OU': 'Processors', - 'CN': 'TI Support', - 'emailAddress': '[email protected]'} self.debug = fdt_util.GetBool(self._node, 'debug', False) def NonCombinedGetCertificate(self, required): diff --git a/tools/binman/etype/x509_cert.py b/tools/binman/etype/x509_cert.py index b6e8b0b4fb0..2d017b81456 100644 --- a/tools/binman/etype/x509_cert.py +++ b/tools/binman/etype/x509_cert.py @@ -19,6 +19,11 @@ class Entry_x509_cert(Entry_collection): Properties / Entry arguments: - content: List of phandles to entries to sign + - distinguished-name: Optional subnode containing key-value + pairs used for the Distinguished Name in the generated + certificate. Property names must be valid fields (e.g. 'CN', + 'L', 'OU'), and their values must either be strings or + string lists. Output files: - input.<unique_name> - input file passed to openssl @@ -28,10 +33,13 @@ class Entry_x509_cert(Entry_collection): openssl signs the provided data, writing the signature in this entry. This allows verification that the data is genuine """ + + default_dist_name = {'CN': 'Firmware Signature'} + def __init__(self, section, etype, node): super().__init__(section, etype, node) self.openssl = None - self.req_dist_name = None + self.req_dist_name = self.default_dist_name self.cert_type = None self.bootcore = None self.bootcore_opts = None @@ -61,6 +69,16 @@ class Entry_x509_cert(Entry_collection): self.key_fname = self.GetEntryArgsOrProps([ EntryArg('keyfile', str)], required=True)[0] self.sw_rev = fdt_util.GetInt(self._node, 'sw-rev', 1) + dist_name_node = self._node.FindNode('distinguished-name') + if dist_name_node: + self.req_dist_name = dict() + for pname, prop in dist_name_node.props.items(): + val = prop.value + if not (isinstance(val, str) or + (isinstance(val, list) and all(isinstance(x, str) for x in val))): + self.Raise(f"Invalid value for property {pname} in distinguished-name node, " + "must be string or string list") + self.req_dist_name[pname] = val def GetCertificate(self, required, type='generic'): """Get the contents of this entry -- 2.55.0
