def update_image_serial_bound_notes(cls, image_signing_attributes, serial_binding_notes):
if image_signing_attributes.multi_serial_numbers:
serial_numbers = remove_duplicates_ordered(
*image_signing_attributes.multi_serial_numbers)
serial_binding_notes.setdefault(MULTI_SERIAL_NUMBERS_TAG, []).extend(serial_numbers)
super(SingleMultiSerialBound, cls).update_image_serial_bound_notes(
image_signing_attributes, serial_binding_notes)
def is_matched(self, config):
if config.platform_independent:
# Cannot use soc_hw_version/soc_vers/msm_part to determine feature set since image is not bound to any
# hardware values
return False
else:
if config.in_use_soc_hw_version:
soc_vers = []
if config.soc_vers:
soc_vers.extend(config.soc_vers)
soc_hw_version = config.soc_hw_version
if soc_hw_version:
soc_vers.append(soc_hw_version[:-4])
soc_vers = remove_duplicates_ordered(*soc_vers)
if soc_vers:
return (set([x.lower() for x in soc_vers]) -
set(self.chipset_soc_vers)) == set()
else:
msm_part = config.msm_part
if any([
x.upper() in msm_part.upper()[3:-3]
for x in self.msm_parts
]):
return True
return False
def decorated(cls, image_signing_attributes, serial_binding_notes):
if (image_signing_attributes.use_serial_number_in_signing and
image_signing_attributes.hw_id):
serial_numbers = remove_duplicates_ordered(
"0x" + image_signing_attributes.hw_id[-8:])
serial_binding_notes.setdefault(
defines.USE_SERIAL_NUMBER_IN_SIGNING_TAG, []).extend(serial_numbers)
func(cls, image_signing_attributes, serial_binding_notes)
def decorated(cls, image_signing_attributes, serial_binding_notes):
enablement_value = enumerated_values[
defines.ENUMERATED_TAG_MAPPING[attr_name]][binding_value]
attr_value = getattr(image_signing_attributes, attr_name)
if attr_value:
if (int(attr_value, 16) & 0x00000000FFFFFFFF) == enablement_value:
serial_numbers = remove_duplicates_ordered(attr_value[:-8])
serial_binding_notes.setdefault(attr_name, []).extend(serial_numbers)
func(cls, image_signing_attributes, serial_binding_notes)
def decorated(cls, image_signing_attributes, serial_binding_notes):
if image_signing_attributes.debug:
debug = int(image_signing_attributes.debug, 16)
if debug & 0x00000000FFFFFFFF == cls.debug_enablement_value:
if image_signing_attributes.multi_serial_numbers:
multi_serial_numbers = image_signing_attributes.multi_serial_numbers
else:
multi_serial_numbers = []
serial_numbers = remove_duplicates_ordered(*multi_serial_numbers)
serial_binding_notes.setdefault(defines.DEBUG_TAG, []).extend(serial_numbers)
func(cls, image_signing_attributes, serial_binding_notes)
def sanitize_soc_vers(self, sign_id, attributes, add_error):
if attributes.secboot_version == SECBOOT_VERSION_3_0:
if attributes.hmac:
add_error(sign_id, "Secure Boot 3.0 does not support hmac.")
if attributes.mask_soc_hw_version is not None:
add_error(
sign_id,
"Secure Boot 3.0 does not support mask_soc_hw_version")
else:
if (attributes.mask_soc_hw_version is not None
and attributes.in_use_soc_hw_version == 1
and self.mask_warning is True):
logger.warning(
"The mask_soc_hw_version field is set and will mask the soc_hw_version during signing. "
"Please ensure this is the desired result.")
self.mask_warning = False
if self.verbatim_config:
if attributes.secboot_version == SECBOOT_VERSION_3_0:
if not attributes.soc_vers and attributes.in_use_soc_hw_version == 1:
add_error(
sign_id,
"in_use_soc_hw_version is enabled, but no soc_vers is provided."
)
else:
# Make sure in_use_soc_hw_version's specification exists
if int(attributes.soc_hw_version[:6],
16) == 0 and attributes.in_use_soc_hw_version == 1:
add_error(
sign_id,
"in_use_soc_hw_version is enabled, but no soc_hw_version is provided"
)
# mask_soc_hw_version may only exist if soc_hw_version exists
if attributes.soc_hw_version[:
6] == "0x0000" and attributes.mask_soc_hw_version is not None:
add_error(
sign_id,
"mask_soc_hw_version can not exist without soc_hw_version."
)
else:
soc_vers_candidates = [attributes.soc_hw_version[:6]]
if attributes.soc_vers is not None:
soc_vers_candidates.extend(attributes.soc_vers.split())
soc_vers_candidates = remove_duplicates_ordered(
*soc_vers_candidates)
if self.platform_binding:
# Make sure there are soc_ver_candidates when binding to SOC HW Version is requested
if self.platform_binding == PLATFORM_BINDING_SOC_VERS and not soc_vers_candidates:
add_error(
sign_id, "platform_binding is set to {0}, "
"but soc_hw_version and soc_vers were not provided.".
format(PLATFORM_BINDING_SOC_VERS))
else:
# Make sure there are soc_ver_candidates when in_use_soc_hw_version is enabled
if not soc_vers_candidates and attributes.in_use_soc_hw_version == 1:
add_error(
sign_id,
"in_use_soc_hw_version is enabled, but no soc_hw_version or soc_vers is provided."
)
# For secboot versions other than 3.0, mask_soc_hw_version may only exist if soc_hw_version or soc_vers exists
if (attributes.secboot_version != SECBOOT_VERSION_3_0
and not soc_vers_candidates
and attributes.mask_soc_hw_version is not None):
add_error(
sign_id,
"mask_soc_hw_version can not exist without soc_hw_version or soc_vers."
)
def sanitize_serial_numbers(self):
""" Sanitize all general properties related to serial numbers.
Specifically
1. Pool all unique non-zero serial numbers.
2. Assign them to their respective attributes
"""
serial_numbers = []
multi_serial_number_count = 0
if self.general_properties.multi_serial_numbers is not None:
serial_numbers = remove_duplicates_ordered(
*self.general_properties.multi_serial_numbers.serial)
multi_serial_number_count = len(serial_numbers)
if self.general_properties.secboot_version in (SECBOOT_VERSION_1_0,
SECBOOT_VERSION_2_0):
max_serial_number_count = MAX_NUM_SERIALS_MAP[SECBOOT_VERSION_2_0]
else:
max_serial_number_count = MAX_NUM_SERIALS_MAP[SECBOOT_VERSION_3_0]
# This is rudimentary max serial number count check, simply to ensure that
# the certificate OU[SN] field spec is not violated.
if len(serial_numbers) > max_serial_number_count:
verb_be = "is" if max_serial_number_count == 1 else "are"
raise RuntimeError(
"{0} serials were provided. A maximum of {1} {2} allowed.".
format(len(serial_numbers), max_serial_number_count, verb_be))
if self.verbatim_config:
if self.general_properties.use_serial_number_in_signing == 1:
if self.general_properties.secboot_version in (
SECBOOT_VERSION_1_0, SECBOOT_VERSION_2_0):
if self.general_properties.serial_number is None or int(
self.general_properties.serial_number, 16) == 0:
raise RuntimeError(
"serial_number must be set when use_serial_number_in_signing "
"is enabled.".format(
self.general_properties.secboot_version))
elif self.general_properties.secboot_version == SECBOOT_VERSION_3_0:
if multi_serial_number_count == 0:
raise RuntimeError(
"multi_serial_numbers must be set with at least one non-zero "
"serial number when use_serial_number_in_signing is enabled."
)
self.valid_serial_numbers = []
else:
if self.disable_serial_binding:
self.valid_serial_numbers = []
else:
if self.general_properties.serial_number is not None:
serial_numbers.append(
self.general_properties.serial_number)
for attr_name in (cfgdef.DEBUG_TAG, cfgdef.ROT_EN_TAG,
cfgdef.ACTIVATION_ENABLEMENT_TAG,
cfgdef.REVOCATION_ENABLEMENT_TAG,
cfgdef.ROOT_REVOKE_ACTIVATE_ENABLE_TAG,
cfgdef.UIE_KEY_SWITCH_ENABLE_TAG):
# All the signing attributes listed in the for-loop have default values.
attr_value = getattr(self.general_properties, attr_name)
# Save the serial number bound to the signing attribute.
serial_numbers.append(attr_value[:-8])
# Remove any serial numbers already bound to the signing attributes, while
# coalescing all the serial numbers. All serial-binding signing attributes
# will only reflect their state, for example enable or disable. This is
# to pave the way for the downstream logic to complete the serial-binding
# operations.
setattr(self.general_properties, attr_name,
("0x%08x" % 0) + attr_value[-8:])
self.valid_serial_numbers = remove_duplicates_ordered(
*serial_numbers)
if self.valid_serial_numbers:
chipset_profile = ChipsetProfile(
self.general_properties.secboot_version,
self.general_properties.in_use_soc_hw_version,
self.general_properties.msm_part,
getattr(self.general_properties, "soc_vers",
[]), self.general_properties.soc_hw_version,
self.platform_binding == PLATFORM_BINDING_INDEPENDENT)
with SerialBoundFeatureSetContextManager(
chipset_profile,
self.valid_serial_numbers) as feature_set:
feature_set.bind(self)
else:
self.general_properties.use_serial_number_in_signing = 0
self.general_properties.serial_number = "0x%08x" % 0
self.general_properties.multi_serial_numbers = complex_multi_serial_numbers(
[])
def sanitize_soc_vers(self):
def set_soc_hw_version(soc_ver):
self.general_properties.soc_hw_version = soc_ver + "0000"
max_soc_vers_count = MAX_NUM_SOC_VERS_MAP[
self.general_properties.secboot_version]
if self.general_properties.secboot_version in (SECBOOT_VERSION_1_0,
SECBOOT_VERSION_2_0):
max_soc_vers_count += 1 # soc_hw_version + soc_vers combined
soc_ver_candidates = [self.general_properties.soc_hw_version[:-4]]
if self.general_properties.soc_vers is not None:
soc_ver_candidates.extend(self.general_properties.soc_vers.split())
soc_ver_candidates = remove_duplicates_ordered(*soc_ver_candidates)
soc_vers_count = len(soc_ver_candidates)
if soc_vers_count > max_soc_vers_count:
verb_be = "is" if max_soc_vers_count == 1 else "are"
raise RuntimeError(
"{0} soc_vers were provided. A maximum of {1} {2} allowed.".
format(soc_vers_count, max_soc_vers_count, verb_be))
# Sanitize soc_vers values based on platform_binding value
if self.platform_binding:
if self.platform_binding == PLATFORM_BINDING_INDEPENDENT:
if self.general_properties.secboot_version != SECBOOT_VERSION_3_0 or \
not is_TA(self.general_properties.sw_id):
raise RuntimeError(
"platform_binding {0} is only supported for "
"Secure Boot 3.0 Trusted Application".format(
self.platform_binding))
soc_ver_candidates = []
self.general_properties.msm_part = "0x00000000"
elif self.platform_binding == PLATFORM_BINDING_JTAG_ID:
soc_ver_candidates = []
elif self.platform_binding == PLATFORM_BINDING_SOC_VERS:
self.general_properties.in_use_soc_hw_version = 1
if self.verbatim_config is False:
if not soc_ver_candidates:
self.general_properties.in_use_soc_hw_version = 0
self.general_properties.soc_vers = None
self.general_properties.soc_hw_version = "0x00000000"
elif self.general_properties.secboot_version in (
SECBOOT_VERSION_1_0, SECBOOT_VERSION_2_0):
if len(soc_ver_candidates) == 1:
set_soc_hw_version(soc_ver_candidates[0])
self.general_properties.soc_vers = None
else:
self.general_properties.in_use_soc_hw_version = 1
set_soc_hw_version(soc_ver_candidates[0])
self.general_properties.soc_vers = " ".join(
soc_ver_candidates[1:])
elif self.general_properties.secboot_version == SECBOOT_VERSION_3_0:
if len(soc_ver_candidates) > 1:
self.general_properties.in_use_soc_hw_version = 1
self.general_properties.soc_vers = " ".join(soc_ver_candidates)
# If msm_part will be ignored by secboot, wipe the msm_part value to avoid user confusion
if self.general_properties.in_use_soc_hw_version == 1:
self.general_properties.msm_part = "0x00000000"
# Sanitize soc_vers and handle interdependence with in_use_soc_hw_version (for Secboot 1 and 2)
if self.general_properties.soc_vers is not None:
self.general_properties.soc_vers = self.general_properties.soc_vers.split(
)
if (self.general_properties.secboot_version != SECBOOT_VERSION_3_0
and self.general_properties.in_use_soc_hw_version != 1):
self.general_properties.soc_vers = None
# soc_hw_version only uses Family and Device number
self.general_properties.soc_hw_version = self.general_properties.soc_hw_version[:
6] + "0000"
# Disable in_use_soc_hw_version if chipset needs to be signed with JTAG ID
if (self.chipset in JTAGID_SIGN_IDS
and self.sign_id in JTAGID_SIGN_IDS[self.chipset]
and self.general_properties.in_use_soc_hw_version == 1):
raise RuntimeError(
"For chipset {0}, in_use_soc_hw_version must be disabled".
format(self.chipset))
def update_image_serial_bound_notes(cls, image_signing_attributes,
serial_binding_notes):
""" Terminate the super-chain of the method of all feature implementations. """
for attr_name, attr_value in serial_binding_notes.items():
serial_binding_notes[attr_name] = remove_duplicates_ordered(
*attr_value)