<marex>
I need to generate CST input text files for encryption of the blob itself and for signing the result
<marex>
but how and where this should be added, this is completely unclear to me
lucascastro has quit [Remote host closed the connection]
<sjg1>
marex: look at vblock
<sjg1>
rfs613: which patch set?
<marex>
sjg1: tools/binman/etype/vblock.py helps me ... not at all
<marex>
sjg1: have you ever used the imx image signing and encryption ?
ndesaulniers_ is now known as ndesaulniers
<marex>
sjg1: again, this undocumented thing ... seems to take an entry ? and generate signature at random uncontrolled offset in ... what ?
<rfs613>
sjg1: it's to add support for RZ/N1. I haven't posted it yet.. been working on it, off and on, for some time now.
<sjg1>
marex: No I have not used it. It seems that vblock should be similar. Generate the text file in your etype implementation, add cst as a bintool, call the tool from you impl. I can help if you get stuck
<sjg1>
marex: "again, this undocumented thing ... seems to take an entry ? and generate signature at random uncontrolled offset in ... what ?" - I don't understand any of that. Can you rephrase it?
<sjg1>
rfs613: Ah OK
<marex>
sjg1: it seems I am unable to express myself
<marex>
sjg1: I am stuck
<marex>
sjg1: there are two parts of the signing process on the imx8m
<marex>
sjg1: one is signing of the SPL, the other is signing of u-boot.itb components and tree
<marex>
in case of SPL, binman assembles u-boot-spl-ddr.bin from u-boot spl and ddr blobs, then runs mkimage on that, and then I need to generate this CST text input which is used fed to CST to generate CSF, the CSF must then be pasted at the end of SPL at offset which is in the IVT on top
<marex>
in case of u-boot.itb, it is even more convoluted, since the tooling has to generate both IVT and CSF and then stick it between the fitImage tree and external data
<marex>
and the inputs into the CST tool are offsets within the fitImage tree
<marex>
encryption is even more convoluted, but let's start with signing
<sjg1>
Well how about starting with SPL with no signing. Can you get that far? Then I can help to add the signing code?
<sjg1>
Luckily binman is designed to handle pretty complex things