optee: add gen_ekb.py script

The gen_ekb.py script from the nv-optee source is a useful utility for generating EKB images.
anduril · Feb 7, 2024 · cd3093e · cd3093e
1 parent 6ae4ce1
commit cd3093e
Show file tree

Hide file tree

Showing 4 changed files with 34 additions and 7 deletions.
diff --git a/default.nix b/default.nix
@@ -64,6 +64,7 @@ let
     stdenv = pkgsAarch64.gcc9Stdenv;
     inherit bspSrc l4tVersion;
   }) buildTOS buildOpteeTaDevKit opteeClient;
+  genEkb = callPackage ./pkgs/optee/gen-ekb.nix { inherit l4tVersion; };
 
   flash-tools = callPackage ./pkgs/flash-tools {
     inherit bspSrc l4tVersion;
@@ -160,7 +161,7 @@ rec {
   inherit edk2-jetson uefi-firmware;
   inherit otaUtils;
 
-  inherit opteeClient;
+  inherit opteeClient genEkb;
 
   # TODO: Source packages. source_sync.sh from bspSrc
   # GST plugins

diff --git a/pkgs/optee/default.nix b/pkgs/optee/default.nix
@@ -9,6 +9,9 @@
 , dtc
 , nukeReferences
 , fetchpatch
+, writeShellScriptBin
+, python3
+, callPackage
 }:
 
 let
@@ -18,11 +21,7 @@ let
     sha256 = "sha256-9ml28qXN0B04ZocBr04x4tBzJ3iLgqGoVBveSkSCrgk=";
   };
 
-  nvopteeSrc = fetchgit {
-    url = "https://nv-tegra.nvidia.com/r/tegra/optee-src/nv-optee";
-    rev = "jetson_${l4tVersion}";
-    sha256 = "sha256-44RBXFNUlqZoq3OY/OFwhiU4Qxi4xQNmetFmlrr6jzY=";
-  };
+  nvopteeSrc = callPackage ./nvoptee-src.nix { inherit l4tVersion; };
 
   opteeClient = stdenv.mkDerivation {
     pname = "optee_client";
@@ -233,5 +232,5 @@ let
     image;
 in
 {
-  inherit buildTOS buildOpteeTaDevKit opteeClient;
+  inherit buildTOS buildOpteeTaDevKit opteeClient genEkb;
 }
diff --git a/pkgs/optee/gen-ekb.nix b/pkgs/optee/gen-ekb.nix
@@ -0,0 +1,21 @@
+{ callPackage, l4tVersion, stdenv, python3 }:
+
+stdenv.mkDerivation {
+  pname = "gen_ekb.py";
+  src = callPackage ./nvoptee-src.nix { inherit l4tVersion; };
+  version = l4tVersion;
+  dontBuild = true;
+  buildInputs = [
+    (python3.withPackages (p: with p; [
+      cryptography
+      pycryptodome
+    ]))
+  ];
+  installPhase = ''
+    runHook preInstall
+    install -D optee/samples/hwkey-agent/host/tool/gen_ekb/gen_ekb.py \
+      $out/bin/gen_ekb.py
+    patchShebangs --host $out/bin/gen_ekb.py
+    runHook postInstall
+  '';
+}
diff --git a/pkgs/optee/nvoptee-src.nix b/pkgs/optee/nvoptee-src.nix
@@ -0,0 +1,6 @@
+{ fetchgit, l4tVersion }:
+fetchgit {
+  url = "https://nv-tegra.nvidia.com/r/tegra/optee-src/nv-optee";
+  rev = "jetson_${l4tVersion}";
+  sha256 = "sha256-44RBXFNUlqZoq3OY/OFwhiU4Qxi4xQNmetFmlrr6jzY=";
+}