From c9848791fbbba9a1f31e6ed5c0ca512b9fbaa1ba Mon Sep 17 00:00:00 2001
From: Andrew Davis <afd@ti.com>
Date: Wed, 15 Feb 2023 13:33:43 -0600
Subject: optee-os: Use new ti-secdev class to sign the images

Use the new ti-k3-secdev package to pull in the signing tools if they are
not provided by the environment. This allows us to use these tools
unconditionally. Remove the checks for the script and do the signing
for all K3 machines. The signature is automatically stripped from
the binaries on non-HS devices at boot time as needed so this change
is harmless for GP devices.

Signed-off-by: Andrew Davis <afd@ti.com>
Signed-off-by: Ryan Eatmon <reatmon@ti.com>
---
 .../recipes-security/optee/optee-os_%.bbappend     | 43 ++++------------------
 1 file changed, 7 insertions(+), 36 deletions(-)

(limited to 'meta-ti-bsp/recipes-security')

diff --git a/meta-ti-bsp/recipes-security/optee/optee-os_%.bbappend b/meta-ti-bsp/recipes-security/optee/optee-os_%.bbappend
index 6f711101..c1adf6de 100644
--- a/meta-ti-bsp/recipes-security/optee/optee-os_%.bbappend
+++ b/meta-ti-bsp/recipes-security/optee/optee-os_%.bbappend
@@ -1,11 +1,10 @@
+# Use TI SECDEV for signing
+inherit ti-secdev
+
 EXTRA_OEMAKE:append:k3 = "${@ ' CFG_CONSOLE_UART='+ d.getVar('OPTEE_K3_USART') if d.getVar('OPTEE_K3_USART') else ''}"
 
 EXTRA_OEMAKE:append:am62xx = " CFG_WITH_SOFTWARE_PRNG=y CFG_TEE_CORE_LOG_LEVEL=1"
 
-do_compile:prepend:ti-soc() {
-    export TI_SECURE_DEV_PKG=${TI_SECURE_DEV_PKG}
-}
-
 do_compile:append:k3() {
     ( cd ${B}/core/; \
         cp tee-pager_v2.bin ${B}/bl32.bin; \
@@ -32,20 +31,6 @@ optee_sign_legacyhs() {
     fi
 }
 
-# Signing procedure for K3 HS devices
-optee_sign_k3hs() {
-    ( cd ${B}/core/; \
-        if [ -f ${TI_SECURE_DEV_PKG}/scripts/secure-binary-image.sh ]; then \
-            ${TI_SECURE_DEV_PKG}/scripts/secure-binary-image.sh tee-pager_v2.bin tee-pager.bin.signed; \
-        else \
-            echo "Warning: TI_SECURE_DEV_PKG not set, OP-TEE not signed."; \
-            cp tee-pager_v2.bin tee-pager.bin.signed; \
-        fi; \
-        mv tee-pager.bin.signed ${B}/bl32.bin; \
-        cp tee.elf ${B}/bl32.elf; \
-    )
-}
-
 do_compile:append:ti43x() {
     optee_sign_legacyhs
 }
@@ -54,24 +39,10 @@ do_compile:append:dra7xx() {
     optee_sign_legacyhs
 }
 
-do_compile:append:am65xx-hs-evm() {
-    optee_sign_k3hs
-}
-
-do_compile:append:am64xx-evm() {
-    optee_sign_k3hs
-}
-
-do_compile:append:j721e-hs-evm() {
-    optee_sign_k3hs
-}
-
-do_compile:append:j7200-hs-evm() {
-    optee_sign_k3hs
-}
-
-do_compile:append:j721s2-hs-evm() {
-    optee_sign_k3hs
+# Signing procedure for K3 devices
+do_compile:append:k3() {
+    ${TI_SECURE_DEV_PKG}/scripts/secure-binary-image.sh ${B}/core/tee-pager_v2.bin ${B}/bl32.bin
+    cp ${B}/core/tee.elf ${B}/bl32.elf
 }
 
 do_install:append:ti-soc() {
-- 
cgit v1.2.3-54-g00ecf