The pre-load entry type currently only supports signing via RSA key files on disk. This series extends it to support Hardware Security Modules (HSM) through the PKCS#11 standard.
The implementation builds on the existing pkcs11_tool btool: a sign() method is added that drives pkcs11-tool to perform the actual cryptographic operation. The pre-load entry gains a set of hsm-* device-tree properties: hsm-support - boolean flag to enable HSM path hsm-library - path to the PKCS#11 shared library (.so) hsm-token-label - token label (alternative to serial) hsm-token-serial - token serial number hsm-slot-index - direct slot index (alternative to label/serial) hsm-key-label - private key label (alternative to key-id) hsm-key-id - private key ID hsm-pin - user PIN Yan WANG (5): binman: Add PKCS#11 signing support to pkcs11_tool binman: Add test for pkcs11_tool sign method binman: Add HSM signing support to pre-load entry type binman: test: Add SoftHSM functional test for pre-load HSM signing binman: Add functional test for pre-load HSM signing tools/binman/bintool_test.py | 374 ++++++++++++++++++ tools/binman/btool/pkcs11_tool.py | 275 +++++++++++++ tools/binman/etype/pre_load.py | 285 +++++++++---- tools/binman/ftest.py | 140 +++++++ .../security/pre_load_default_padding.dts | 23 ++ .../security/pre_load_hsm_invalid_padding.dts | 27 ++ .../security/pre_load_hsm_missing_library.dts | 27 ++ .../security/pre_load_hsm_missing_tool.dts | 27 ++ .../test/security/pre_load_hsm_sign.dts | 68 ++++ .../security/pre_load_missing_key_name.dts | 23 ++ 10 files changed, 1198 insertions(+), 71 deletions(-) create mode 100644 tools/binman/test/security/pre_load_default_padding.dts create mode 100644 tools/binman/test/security/pre_load_hsm_invalid_padding.dts create mode 100644 tools/binman/test/security/pre_load_hsm_missing_library.dts create mode 100644 tools/binman/test/security/pre_load_hsm_missing_tool.dts create mode 100644 tools/binman/test/security/pre_load_hsm_sign.dts create mode 100644 tools/binman/test/security/pre_load_missing_key_name.dts -- 2.43.0
