diff options
| -rw-r--r-- | tools/binman/etype/nxp_imx8mcst.py | 19 | ||||
| -rw-r--r-- | tools/binman/ftest.py | 18 |
2 files changed, 35 insertions, 2 deletions
diff --git a/tools/binman/etype/nxp_imx8mcst.py b/tools/binman/etype/nxp_imx8mcst.py index a10f61aa01f..29a7451678d 100644 --- a/tools/binman/etype/nxp_imx8mcst.py +++ b/tools/binman/etype/nxp_imx8mcst.py @@ -20,8 +20,9 @@ from binman import elf from dtoc import fdt_util from u_boot_pylib import tools -MAGIC_NXP_IMX_IVT = 0x412000d1 -MAGIC_FITIMAGE = 0xedfe0dd0 +MAGIC_NXP_IMX_IVT = 0x412000d1 +MAGIC_NXP_IMX_FCFB = 0x42464346 +MAGIC_FITIMAGE = 0xedfe0dd0 KEY_NAME = 'sha256_4096_65537_v3_usr_crt' @@ -112,6 +113,9 @@ class Entry_nxp_imx8mcst(Entry_mkimage): # - If it is mkimage'd imx8mimage, then extract to be signed data size # from imx8mimage header, and calculate CSF blob offset right past # the SPL from this information. + # - If it is mkimage'd imx8mimage wrapped in FCFB, then extract to be + # signed data size from imx8mimage header past the FCFB header, and + # calculate CSF blob offset right past the SPL from this information. # - If it is fitImage, then pad the image to 4k, add generated IVT and # sign the whole payload, then append CSF blob at the end right past # the IVT. @@ -125,6 +129,17 @@ class Entry_nxp_imx8mcst(Entry_mkimage): signsize = struct.unpack('<I', data[24:28])[0] - signbase # Remove mkimage generated padding from the end of data data = data[:signsize] + elif signtype == MAGIC_NXP_IMX_FCFB: # SPL/imx8mimage with FCFB + # Sign the payload including FCFB and imx8mimage headers + # (extra 0x1000 and 0x40 bytes before the payload) + signbase -= 0x1040 + # Pull the end address from IVT offset 24 Bytes and subtract + # the start address to get amount of data to sign. The IVT + # itself is at offset 4096 Bytes, so the total end address + # offset in the image is 4120 Bytes. + signsize = struct.unpack('<I', data[4120:4124])[0] - signbase + # Remove mkimage generated padding from the end of data + data = data[:signsize] elif signtype == MAGIC_FITIMAGE: # fitImage # Align fitImage to 4k signsize = tools.align(len(data), 0x1000) diff --git a/tools/binman/ftest.py b/tools/binman/ftest.py index 04f9a66f007..a0e8bde7901 100644 --- a/tools/binman/ftest.py +++ b/tools/binman/ftest.py @@ -8044,6 +8044,24 @@ fdt fdtmap Extract the devicetree blob from the fdtmap err = stderr.getvalue() self.assertRegex(err, "Image 'image'.*missing bintools.*: cst") + def testNxpImx8mCSTFCFB(self): + """Test CST signing with FCFB-format input (normal auth, no unlock)""" + # Create fake FCFB blob: magic(4) + padding(4116) + ivt_data = struct.pack('<I', 0x42464346) + ivt_data += b'\x00' * 4116 + # Create fake IVT blob: magic(4) + padding(20) + signsize_addr(4) + # + padding(36) = 64 bytes + ivt_data += struct.pack('<I', 0x412000d1) + ivt_data += b'\x00' * 20 + ivt_data += struct.pack('<I', 0) + ivt_data += b'\x00' * 36 + self._MakeInputFile('imx8m-ivt.bin', ivt_data) + with terminal.capture() as (_, stderr): + self._DoTestFile('vendor/nxp_imx8_csf.dts', + force_missing_bintools='cst') + err = stderr.getvalue() + self.assertRegex(err, "Image 'image'.*missing bintools.*: cst") + def testNxpImx8mCSTFastAuth(self): """Test CST signing with fast-auth mode, unlock, and FIT format""" # FIT magic covers the FIT-signing path; fast-auth/unlock cover the |