On Tue, Sep 22, 2026 at 02:15:32PM +0530, Beleswar Padhi wrote: > The boot and load extensions in the x509 certificate are required for > requesting the secure entity (TIFS) to boot a core. These fields are > defined in the binman node for each core that must be booted by TIFS > and must be included when generating the signed certificate. > > Add support to parse the boot and load extension properties from the > binman node and populate them into the certificate. If any of the > mandatory properties for an extension are missing, that respective > extension section is NOT added to the certificate. > > Add test coverage for the boot and load extension functionality in > ti-secure certificates. The test reads the generated config file and > verifies the sysfw_boot_seq and sysfw_image_load sections contain the > expected values from the DTS. The negative test verifies that partially > specified boot/load extension properties trigger an error. > > Signed-off-by: Beleswar Padhi <[email protected]> > Reviewed-by: Simon Glass <[email protected]> > Reviewed-by: Udit Kumar <[email protected]> > --- > v7: Changelog: > 1. Carried R/B tag from Udit. > > Link to v6: > https://patchwork.ozlabs.org/project/uboot/patch/[email protected]/ > > v6: Changelog: > 1. None > > Link to v5: > https://lore.kernel.org/all/[email protected]/ > > v5: Changelog: > 1. Log missing properties and raise exception rather than returning > silently. > 2. Squash [PATCH v4 07/11] and [PATCH v4 08/11] into [PATCH v5 4/7] > 3. Document properties in function docstring. > 4. Update tests to check the load and boot sections contain the expected > values from test DTS. Add negative tests to check it raises an error > when some of the properties are missing. > 5. Add R/B tags. > > Link to v4: > https://lore.kernel.org/all/[email protected]/ > > v4: Changelog: > 1. None > > Link to v3: > https://lore.kernel.org/all/[email protected]/ > > v3: Changelog: > 1. New patch. Add support to sign HSM firmware here in U-Boot. > > tools/binman/btool/openssl.py | 49 ++++++++++++-- > tools/binman/etype/ti_secure.py | 65 +++++++++++++++++++ > tools/binman/etype/x509_cert.py | 4 +- > tools/binman/ftest.py | 45 +++++++++++++ > .../test/vendor/ti_secure_boot_load_ext.dts | 23 +++++++ > .../ti_secure_boot_load_ext_partial.dts | 20 ++++++ > 6 files changed, 201 insertions(+), 5 deletions(-) > create mode 100644 tools/binman/test/vendor/ti_secure_boot_load_ext.dts > create mode 100644 > tools/binman/test/vendor/ti_secure_boot_load_ext_partial.dts
This leads to CI failures: https://git.u-boot-project.org/u-boot/u-boot/-/jobs/105234 and: tools/binman/etype/x509_cert.py:106:30: E1101: Instance of 'Entry_x509_cert' has no 'boot_ext' member (no-member) tools/binman/etype/x509_cert.py:107:30: E1101: Instance of 'Entry_x509_cert' has no 'load_ext' member (no-member) -- Tom
signature.asc
Description: PGP signature
