[PATCH v2 2/7] binman: x509_cert: allow and parse distinguished-name subnode

[Rasmus Villemoes <ravi@prevas.dk>]

Currently, the ti-secure and ti-secure-rom types hardcode the contents
of the Distinguished Name section. Those values are not necessarily
appropriate for all boards that just happen to include a SOC produced
by TI.

Allow placing a distinguished-name subnode inside the binman node
representing the Entry_x509_cert (or derived classes), and if present,
use that information.

Ensure an Entry_x509_cert instance always has some non-empty
req_dist_name dict by adding a dummy default (because for the
certificate generation there must be a non-empty req_dist_name
section), and let derived classes provide their own default.

Signed-off-by: Rasmus Villemoes <ravi@prevas.dk>
---
 tools/binman/etype/ti_secure.py     | 16 +++++++++-------
 tools/binman/etype/ti_secure_rom.py | 16 +++++++++-------
 tools/binman/etype/x509_cert.py     | 20 +++++++++++++++++++-
 3 files changed, 37 insertions(+), 15 deletions(-)

diff --git a/tools/binman/etype/ti_secure.py b/tools/binman/etype/ti_secure.py
index f6caa0286d9..b4e120917b1 100644
--- a/tools/binman/etype/ti_secure.py
+++ b/tools/binman/etype/ti_secure.py
@@ -58,6 +58,7 @@ class Entry_ti_secure(Entry_x509_cert):
             - Lower Byte - Remains 0x02 as per our use case
               ( 0x02: Move the authenticated binary back to the header )
             - Upper Byte - The Host ID of the core owning the firewall
+        - distinguished-name: See :ref:`etype_x509_cert`
 
     Output files:
         - input.<unique_name> - input file passed to openssl
@@ -99,6 +100,14 @@ class Entry_ti_secure(Entry_x509_cert):
     writes the signature in this entry. This allows verification that the
     data is genuine.
     """
+    default_dist_name = {'C': 'US',
+                         'ST': 'TX',
+                         'L': 'Dallas',
+                         'O': 'Texas Instruments Incorporated',
+                         'OU': 'Processors',
+                         'CN': 'TI Support',
+                         'emailAddress': 'support@ti.com'}
+
     def __init__(self, section, etype, node):
         super().__init__(section, etype, node)
         self.openssl = None
@@ -117,13 +126,6 @@ class Entry_ti_secure(Entry_x509_cert):
             self.firewall_cert_data['auth_in_place'] = auth_in_place
             self.ReadFirewallNode()
         self.sha = fdt_util.GetInt(self._node, 'sha', 512)
-        self.req_dist_name = {'C': 'US',
-                'ST': 'TX',
-                'L': 'Dallas',
-                'O': 'Texas Instruments Incorporated',
-                'OU': 'Processors',
-                'CN': 'TI Support',
-                'emailAddress': 'support@ti.com'}
         self.debug = fdt_util.GetBool(self._node, 'debug', False)
 
     def ReadFirewallNode(self):
diff --git a/tools/binman/etype/ti_secure_rom.py b/tools/binman/etype/ti_secure_rom.py
index 7e90c655940..6c4e767c741 100644
--- a/tools/binman/etype/ti_secure_rom.py
+++ b/tools/binman/etype/ti_secure_rom.py
@@ -33,6 +33,7 @@ class Entry_ti_secure_rom(Entry_x509_cert):
         - content: phandle of SPL in case of legacy bootflow or phandles of component binaries
           in case of combined bootflow
         - core-opts (optional): lockstep (0) or split (2) mode set to 0 by default
+        - distinguished-name: See :ref:`etype_x509_cert`
 
     The following properties are only for generating a combined bootflow binary:
         - sysfw-inner-cert: boolean if binary contains sysfw inner certificate
@@ -58,6 +59,14 @@ class Entry_ti_secure_rom(Entry_x509_cert):
     writes the signature in this entry. This allows verification that the
     data is genuine.
     """
+    default_dist_name = {'C': 'US',
+                         'ST': 'TX',
+                         'L': 'Dallas',
+                         'O': 'Texas Instruments Incorporated',
+                         'OU': 'Processors',
+                         'CN': 'TI Support',
+                         'emailAddress': 'support@ti.com'}
+
     def __init__(self, section, etype, node):
         super().__init__(section, etype, node)
         self.openssl = None
@@ -80,13 +89,6 @@ class Entry_ti_secure_rom(Entry_x509_cert):
             self.dm_data = fdt_util.GetBool(self._node, 'dm-data', False)
             if self.dm_data:
                 self.load_addr_dm_data = fdt_util.GetInt(self._node, 'load-dm-data', 0x00000000)
-        self.req_dist_name = {'C': 'US',
-                    'ST': 'TX',
-                    'L': 'Dallas',
-                    'O': 'Texas Instruments Incorporated',
-                    'OU': 'Processors',
-                    'CN': 'TI Support',
-                    'emailAddress': 'support@ti.com'}
         self.debug = fdt_util.GetBool(self._node, 'debug', False)
 
     def NonCombinedGetCertificate(self, required):
diff --git a/tools/binman/etype/x509_cert.py b/tools/binman/etype/x509_cert.py
index b6e8b0b4fb0..2d017b81456 100644
--- a/tools/binman/etype/x509_cert.py
+++ b/tools/binman/etype/x509_cert.py
@@ -19,6 +19,11 @@ class Entry_x509_cert(Entry_collection):
 
     Properties / Entry arguments:
         - content: List of phandles to entries to sign
+        - distinguished-name: Optional subnode containing key-value
+          pairs used for the Distinguished Name in the generated
+          certificate. Property names must be valid fields (e.g. 'CN',
+          'L', 'OU'), and their values must either be strings or
+          string lists.
 
     Output files:
         - input.<unique_name> - input file passed to openssl
@@ -28,10 +33,13 @@ class Entry_x509_cert(Entry_collection):
     openssl signs the provided data, writing the signature in this entry. This
     allows verification that the data is genuine
     """
+
+    default_dist_name = {'CN': 'Firmware Signature'}
+
     def __init__(self, section, etype, node):
         super().__init__(section, etype, node)
         self.openssl = None
-        self.req_dist_name =  None
+        self.req_dist_name = self.default_dist_name
         self.cert_type = None
         self.bootcore = None
         self.bootcore_opts = None
@@ -61,6 +69,16 @@ class Entry_x509_cert(Entry_collection):
         self.key_fname = self.GetEntryArgsOrProps([
             EntryArg('keyfile', str)], required=True)[0]
         self.sw_rev = fdt_util.GetInt(self._node, 'sw-rev', 1)
+        dist_name_node = self._node.FindNode('distinguished-name')
+        if dist_name_node:
+            self.req_dist_name = dict()
+            for pname, prop in dist_name_node.props.items():
+                val = prop.value
+                if not (isinstance(val, str) or
+                        (isinstance(val, list) and all(isinstance(x, str) for x in val))):
+                    self.Raise(f"Invalid value for property {pname} in distinguished-name node, "
+                               "must be string or string list")
+                self.req_dist_name[pname] = val
 
     def GetCertificate(self, required, type='generic'):
         """Get the contents of this entry
-- 
2.55.0