optee_os/scripts/sign_rproc_fw.py

2 # SPDX-License-Identifier: BSD-2-Clause
42 #                   -----+-------------+
43 #                  /     |    Magic    |  32-bit word, magic value equal to
44 #                 /      +-------------+  0x3543A468
45 #                /       +-------------+
46 #               /        |   version   |  32-bit word, version of the format
47 #              /         +-------------+
48 # +-----------+          +-------------+
49 # |   Header  |          |  TLV size   |  32-bit word, size of the TLV
50 # +-----------+          +-------------+  (aligned on 64-bit), in bytes.
51 #              \         +-------------+
52 #               \        |  sign size  |  32-bit word, size of the signature
53 #                \       +-------------+  (aligned on 64-bit), in bytes.
54 #                 \      +-------------+
55 #                  \     | images size |  32-bit word, size of the images to
56 #                   -----+-------------+  load (aligned on 64-bit), in bytes.
58 #                        +-------------+  Information used to authenticate the
60 #                        |             |  stored in Type-Length-Value format.
61 #                        +-------------+  'Type' and 'Length' are 32-bit words.
63 #                        +-------------+
65 #                        +-------------+
67 #                        +-------------+
70 #                        +-------------+
72 #                        +-------------+
75 #                        +-------------+
122     def add(self, kind, payload):  member in TLV
124         Add a TLV record. Argument type is either the type scalar ID or a
132         # Ensure that each TLV is 64-bit aligned
137             self.buf += bytearray(8 - align_64b)
140         # Get list of custom protected TLVs from the command-line
152                 self.tlvs[type_id] = value.encode('utf-8')
156                 self.add(type_id, value)
160         Get a byte-array that concatenates all the TLV added.
184         self.signer = DSS.new(key, 'fips-186-3')
217                 - the segments header
218                 - a hash of the segment
299         description='Sign a remote processor firmware loadable by OP-TEE.',
302         '   Takes arguments --in, --out --key\n' +
303         '   %(prog)s --help  show available arguments\n\n')
304     parser.add_argument('--in', required=True, dest='in_file',
307     parser.add_argument('--out', required=True, dest='out_file',
309     parser.add_argument('--key', required=True,
312     parser.add_argument('--key_info', required=False,
315     parser.add_argument('--key_type', required=False,
319     parser.add_argument('--key_pwd', required=False,
322     parser.add_argument('--plat-tlv', required=False, nargs=2,
325                              'plat_tlv area. Add "0x" prefix to interpret '
328                              'multiple times to add multiple TLVs.',
397     tlv.add('SIGNTYPE', sign_type.to_bytes(1, 'little'))
419             size += 8 - align_64b
429         # Compute the hash table and add it to TLV blob
433     # Add image information
435     # The 'IMGSIZE' contains a byte array of the size (32-bit) of each image.
436     tlv.add('NUM_IMG', len(args.in_file).to_bytes(1, 'little'))
437     tlv.add('IMGTYPE', bytearray(images_type))
438     tlv.add('IMGSIZE', bytearray(images_size))
440     # Add hash type information in TLV blob
443     tlv.add('HASHTYPE', hash_type.to_bytes(1, 'little'))
445     # Add hash table information in TLV blob
448     tlv.add('HASHTABLE', hash_tlv)
450     # Add optional key information to TLV
454         tlv.add('PKEYINFO', key_info)
457     # Get list of custom protected TLVs from the command-line
465     align_64b = 8 - (s_header.tlv_length % 8)
467         s_header.tlv_length += 8 - align_64b
468         tlvs_buff += bytearray(8 - align_64b)
499             f.write(bytearray(8 - align_64b))
507                 f.write(bytearray(8 - align_64b))