Cherry-pick to earlgrey_1.0.0: [manuf,otp] provision secure boot keys during individualization #24940
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
These partitions must be hashed for locking purposes. Signed-off-by: Tim Trippel <[email protected]> (cherry picked from commit 72eafb3)
This updates the FT individualization provisioning stage to provision the first stage secure boot keys into the ROT_CREATOR_AUTH* partitions. Doing so required updating the OTP C file constants generation to allow generating a C file that contains the secure boot key constants that are to be provisioned into OTP during individualization. Additionally, this fixes a bug in the generation of the perso firmware that was always using the sival SKU OTP SW_CFG constants for the fields that cannot be provisioned during individualization. Now, a separate personalization binary is generated for each SKU. This fixes #21554. Signed-off-by: Tim Trippel <[email protected]> (cherry picked from commit cece1e2)
Different individualization and personalization binaries are generated based on a SKU. A SKU can be defined as a combination of the following: 1. OTP constants 2. DICE certificate format used 2. personalization extension This wraps these configuration settings in a dict that consolidates all SKU configuration data in one place, and generates one perso binary per SKU. Before, perso binaries that may not have been used by a SKU were being generated. Signed-off-by: Tim Trippel <[email protected]> (cherry picked from commit 597bf98)
github-actions
bot
requested review from
moidx
and removed request for
a team
timothytrippel
requested review from
timothytrippel
and removed request for
a team
timothytrippel
approved these changes
Oct 30, 2024
|
Test failure is due to a dest that was disabled in #24935. Merging. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is an automatic cherry-pick of #24900 to branch
earlgrey_1.0.0.