From patchwork Thu Apr 25 23:07:01 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marek Vasut X-Patchwork-Id: 1927974 X-Patchwork-Delegate: festevam@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=denx.de header.i=@denx.de header.a=rsa-sha256 header.s=phobos-20191101 header.b=mLVfeuyd; dkim=pass (2048-bit key) header.d=denx.de header.i=@denx.de header.a=rsa-sha256 header.s=phobos-20191101 header.b=iLdELUFS; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4VQWj90typz1yP2 for ; Fri, 26 Apr 2024 09:07:41 +1000 (AEST) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id CE3A38907D; Fri, 26 Apr 2024 01:07:37 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=fail (p=none dis=none) header.from=denx.de Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=denx.de; s=phobos-20191101; t=1714086457; bh=T/gmZHfqW+V+5gR5r39n3E+RkfAW7V15eU1WPEYrLmY=; h=From:To:Cc:Subject:Date:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:From; b=mLVfeuyd68Kfd07Rz7yn4YNGN3vv4uAzs+a4M4SP8BE5s6cDZ2366yqcwBrNaMOlV RMF/gzT/JRhMh9dnXCWApNlAVn91cNP0Go7rTDNZoAmtDeUa1MuZhN8HGRiNgAOEV3 nHbpGMZXEaAaqOm145twjtd9QznbAUhaTl83CCSSsqUWnTrbO3Ut6YShjtyA7awwqu OZL5iLhqlT6Qe3SxD50aW+L7DPlEwAF3E2KLsDPfLh7amKGqmojvnz8M8TzJ04nkNh T1FEkrsgFlXBEyNhqPq34ek2CGTy3/wngjLccia5tf2Qnp5QOTJjLpw23RPYCXKgP0 PpolNu9qjgwQg== Received: from tr.lan (ip-86-49-120-218.bb.vodafone.cz [86.49.120.218]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: marex@denx.de) by phobos.denx.de (Postfix) with ESMTPSA id BE0F188189; Fri, 26 Apr 2024 01:07:35 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=denx.de; s=phobos-20191101; t=1714086456; bh=T/gmZHfqW+V+5gR5r39n3E+RkfAW7V15eU1WPEYrLmY=; h=From:To:Cc:Subject:Date:From; b=iLdELUFSY5H/ZP3Fh0zhoxW0U+QkegMWNmCV20jxPMq04q1m9krLcBLMVSppZ+/ZI Y8VInb4qqPDISD8EfKbJXTVXqW5u4h9e5o/HAB2UdZjVT0tDUgYlUpZE8/+HNIzzrS IzITsrCsDZr+o+nRI4baM2dxdOz6/Z22vfOYxzvD1QUccNxKAwDxB/8Xe0tC2+FUNW 7YLTPyG8MXoiH1bufHX207ZwuhwTtof8dGH/zN7sQCnKz7ldiVxpaIaHB1chbIeF3E 87BOuA9xG9HQw052uYxIIyeInOK1YHWyEuzc8sK5fSiczJJ2MifgJc87qh8jyu0T9b t7eT6K4ruLjcg== From: Marek Vasut To: u-boot@lists.denx.de Cc: Marek Vasut , "NXP i.MX U-Boot Team" , Adam Ford , Alper Nebi Yasak , Andrejs Cainikovs , Angus Ainslie , Emanuele Ghidoli , Fabio Estevam , Francesco Dolcini , Marcel Ziswiler , Rasmus Villemoes , Simon Glass , Stefan Eichenberger , Stefano Babic , Tim Harvey , Tom Rini , kernel@puri.sm, u-boot@dh-electronics.com Subject: [PATCH 1/2] binman: Add nxp_imx8mcst etype for i.MX8M flash.bin signing Date: Fri, 26 Apr 2024 01:07:01 +0200 Message-ID: <20240425230721.497441-1-marex@denx.de> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean Add new binman etype which allows signing both the SPL and fitImage sections of i.MX8M flash.bin using CST. There are multiple DT properties which govern the signing process, nxp,loader-address is the only mandatory one which sets the SPL signature start address without the imx8mimage header, this should be SPL text base. The key material can be configured using optional DT properties nxp,srk-table, nxp,csf-key, nxp,img-key, all of which default the key material names generated by CST tool scripts. The nxp,unlock property can be used to unlock CAAM access in SPL section. Minimal signing description example: diff --git a/arch/arm/dts/imx8mp-u-boot.dtsi b/arch/arm/dts/imx8mp-u-boot.dtsi index c4c1a177102..ccd44bf9d0b 100644 --- a/arch/arm/dts/imx8mp-u-boot.dtsi +++ b/arch/arm/dts/imx8mp-u-boot.dtsi @@ -86,6 +86,12 @@ section { pad-byte = <0x00>; + nxp-imx8mcst@0 { + filename = "u-boot-spl-mkimage.signed.bin"; + nxp,loader-address = ; + nxp,unlock; + args; /* Needed by mkimage etype superclass */ + nxp-imx8mimage { filename = "u-boot-spl-mkimage.bin"; nxp,boot-from = "sd"; @@ -129,6 +135,14 @@ }; }; + }; + + nxp-imx8mcst@1 { + filename = "u-boot-fit.signed.bin"; + nxp,loader-address = ; + offset = <0x58000>; + args; /* Needed by mkimage etype superclass */ + fit { description = "Configuration to load ATF before U-Boot"; #ifndef CONFIG_IMX_HAB @@ -191,5 +205,6 @@ }; }; }; + }; }; }; Signed-off-by: Marek Vasut --- Cc: "NXP i.MX U-Boot Team" Cc: Adam Ford Cc: Alper Nebi Yasak Cc: Andrejs Cainikovs Cc: Angus Ainslie Cc: Emanuele Ghidoli Cc: Fabio Estevam Cc: Francesco Dolcini Cc: Marcel Ziswiler Cc: Rasmus Villemoes Cc: Simon Glass Cc: Stefan Eichenberger Cc: Stefano Babic Cc: Tim Harvey Cc: Tom Rini Cc: kernel@puri.sm Cc: u-boot@dh-electronics.com Cc: u-boot@lists.denx.de --- tools/binman/btool/cst.py | 48 +++++++++++ tools/binman/etype/nxp_imx8mcst.py | 133 +++++++++++++++++++++++++++++ 2 files changed, 181 insertions(+) create mode 100644 tools/binman/btool/cst.py create mode 100644 tools/binman/etype/nxp_imx8mcst.py diff --git a/tools/binman/btool/cst.py b/tools/binman/btool/cst.py new file mode 100644 index 00000000000..30e78bdbbd9 --- /dev/null +++ b/tools/binman/btool/cst.py @@ -0,0 +1,48 @@ +# SPDX-License-Identifier: GPL-2.0+ +# Copyright 2024 Marek Vasut +# +"""Bintool implementation for cst""" + +import re + +from binman import bintool + +class Bintoolcst(bintool.Bintool): + """Image generation for U-Boot + + This bintool supports running `cst` with some basic parameters as + needed by binman. + """ + def __init__(self, name): + super().__init__(name, 'Sign NXP i.MX image') + + # pylint: disable=R0913 + def run(self, output_fname=None): + """Run cst + + Args: + output_fname: Output filename to write to + """ + args = [] + if output_fname: + args += ['-o', output_fname] + return self.run_cmd(*args) + + def fetch(self, method): + """Fetch handler for cst + + This installs cst using the apt utility. + + Args: + method (FETCH_...): Method to use + + Returns: + True if the file was fetched and now installed, None if a method + other than FETCH_BIN was requested + + Raises: + Valuerror: Fetching could not be completed + """ + if method != bintool.FETCH_BIN: + return None + return self.apt_install('imx-code-signing-tool') diff --git a/tools/binman/etype/nxp_imx8mcst.py b/tools/binman/etype/nxp_imx8mcst.py new file mode 100644 index 00000000000..fb1c3415ca1 --- /dev/null +++ b/tools/binman/etype/nxp_imx8mcst.py @@ -0,0 +1,133 @@ +# SPDX-License-Identifier: GPL-2.0+ +# Copyright 2023-2024 Marek Vasut +# Written with much help from Simon Glass +# +# Entry-type module for generating the i.MX8M code signing tool +# input configuration file and invocation of cst on generated +# input configuration file and input data to be signed. +# + +import struct + +from collections import OrderedDict + +from binman.entry import Entry +from binman.etype.mkimage import Entry_mkimage +from binman.etype.section import Entry_section +from binman import elf +from dtoc import fdt_util +from u_boot_pylib import tools + +class Entry_nxp_imx8mcst(Entry_mkimage): + """NXP i.MX8M CST .cfg file generator and cst invoker + + Properties / Entry arguments: + - nxp,loader-address - loader address (SPL text base) + """ + + def __init__(self, section, etype, node): + super().__init__(section, etype, node) + self.required_props = ['nxp,loader-address'] + + def ReadNode(self): + super().ReadNode() + self.loader_address = fdt_util.GetInt(self._node, 'nxp,loader-address') + self.srk_table = fdt_util.GetString(self._node, 'nxp,srk-table', 'SRK_1_2_3_4_table.bin') + self.csf_key = fdt_util.GetString(self._node, 'nxp,csf-key', 'CSF1_1_sha256_4096_65537_v3_usr_crt.pem') + self.img_key = fdt_util.GetString(self._node, 'nxp,img-key', 'IMG1_1_sha256_4096_65537_v3_usr_crt.pem') + self.unlock = fdt_util.GetBool(self._node, 'nxp,unlock') + self.ReadEntries() + + def BuildSectionData(self, required): + data, input_fname, uniq = self.collect_contents_to_file( + self._entries.values(), 'input') + # Parse the input data and figure out what it is that is being signed. + # - If it is mkimage'd imx8mimage, then extract to be signed data size + # from imx8mimage header, and calculate CSF blob offset right past + # the SPL from this information. + # - If it is fitImage, then pad the image to 4k, add generated IVT and + # sign the whole payload, then append CSF blob at the end right past + # the IVT. + signtype = struct.unpack('