Add meta layer for ASPEED SDK

AspeedTech-BMC · May 14, 2021 · 8e1881c · 8e1881c
1 parent ad6ea67
commit 8e1881c
Show file tree

Hide file tree

Showing 165 changed files with 5,717 additions and 16 deletions.
diff --git a/meta-aspeed-sdk/meta-ast2600-sdk/conf/machine/ast2600-emmc-secure-rsa4096-sha512-ncot.conf b/meta-aspeed-sdk/meta-ast2600-sdk/conf/machine/ast2600-emmc-secure-rsa4096-sha512-ncot.conf
@@ -0,0 +1,20 @@
+require conf/machine/ast2600-emmc.conf
+require conf/machine/include/ast2600-secure.inc
+
+# Secure Boot Settings
+ASPEED_SECURE_BOOT_CONFIG = "ast2600-emmc_secure_RSA4096_SHA512_ncot.cfg"
+
+# OpenBMC Settings
+FLASH_UBOOT_IMAGE = "u-boot"
+FLASH_KERNEL_IMAGE = "fitImage-${INITRAMFS_IMAGE}-${MACHINE}-${MACHINE}"
+FLASH_KERNEL_IMAGE_df-obmc-ubi-fs = "fitImage-${MACHINE}.bin"
+# OpenBMC EMMC settings
+IMAGE_BOOT_FILES = "fitImage-${INITRAMFS_IMAGE}-${MACHINE}-${MACHINE};fitImage"
+
+# ASPEED Initramfs Settings
+ASPEED_IMAGE_UBOOT_IMAGE = "u-boot"
+ASPEED_IMAGE_KERNEL_IMAGE = "fitImage-${INITRAMFS_IMAGE}-${MACHINE}-${MACHINE}"
+
+# ASPEED EMMC Settings
+ASPEED_EMMC_IMAGE_UBOOT_IMAGE = "u-boot"
+
diff --git a/meta-aspeed-sdk/recipes-aspeed/aspeed-app/aspeed-app_git.bb b/meta-aspeed-sdk/recipes-aspeed/aspeed-app/aspeed-app_git.bb
@@ -12,14 +12,9 @@
 LICENSE = "CLOSED"
 LIC_FILES_CHKSUM = ""
 
-# S = "${WORKDIR}"
-
-# No information for SRC_URI yet (only an external source tree was specified)
-# http://192.168.10.30:7990/scm/bmc/ast_app.git
-
 S = "${WORKDIR}/git"
 
-SRC_URI = " git://192.168.10.13:29418/aspeed_app.git;protocol=ssh;branch=${BRANCH} \
+SRC_URI = " git://github.com/AspeedTech-BMC/aspeed_app.git;protocol=https;branch=${BRANCH} \
             file://meson.build \
             file://video_ioctl.h \
 "

diff --git a/meta-aspeed-sdk/recipes-aspeed/python/socsec_git.bb b/meta-aspeed-sdk/recipes-aspeed/python/socsec_git.bb
@@ -4,7 +4,7 @@ HOMEPAGE = "https://github.com/AspeedTech-BMC/socsec/"
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=d50b901333b4eedfee074ebcd6a6d611"
 
-SRC_URI = "git://github.com/AspeedTech-BMC/socsec/;protocol=https;branch=develop"
+SRC_URI = "git://github.com/AspeedTech-BMC/socsec.git/;protocol=https;branch=develop"
 
 PV = "2.0+git${SRCPV}"
 # Tag for v00.02.00

diff --git a/meta-aspeed-sdk/recipes-aspeed/security/ast-secure-config.bb b/meta-aspeed-sdk/recipes-aspeed/security/ast-secure-config.bb
@@ -0,0 +1,40 @@
+SUMMARY = "ASPEED insecure keys for testing and development."
+DESCRIPTION = "Do not use these keys to sign images."
+PR = "r0"
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/Apache-2.0;md5=89aea4e17d99a7cacdbeed46a0096b10"
+
+inherit allarch
+
+SRC_URI = " \
+    file://configs;subdir=${S} \
+    "
+
+do_patch[noexec] = "1"
+do_configure[noexec] = "1"
+do_compile[noexec] = "1"
+
+do_install() {
+    install -d ${D}${datadir}
+    install -d ${D}${datadir}/ast-secure-config
+    install -d ${D}${datadir}/ast-secure-config/ast2600
+    install -d ${D}${datadir}/ast-secure-config/ast2600/security
+    install -d ${D}${datadir}/ast-secure-config/ast2600/security/otp
+    install -d ${D}${datadir}/ast-secure-config/ast2600/security/key
+    install -d ${D}${datadir}/ast-secure-config/ast2600/security/data
+
+    install -m 0755 ${S}/configs/*.sh \
+        ${D}${datadir}/ast-secure-config
+    install -m 0644 ${S}/configs/ast2600/*.cfg \
+        ${D}${datadir}/ast-secure-config/ast2600
+    install -m 0644 ${S}/configs/ast2600/security/*.json \
+        ${D}${datadir}/ast-secure-config/ast2600/security
+    install -m 0644 ${S}/configs/ast2600/security/otp/* \
+        ${D}${datadir}/ast-secure-config/ast2600/security/otp
+    install -m 0644 ${S}/configs/ast2600/security/key/* \
+        ${D}${datadir}/ast-secure-config/ast2600/security/key
+    install -m 0644 ${S}/configs/ast2600/security/data/* \
+        ${D}${datadir}/ast-secure-config/ast2600/security/data
+}
+
+BBCLASSEXTEND = "native"
diff --git a/...es-aspeed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA2048_SHA256.cfg b/...es-aspeed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA2048_SHA256.cfg
@@ -0,0 +1,18 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA1_RSA2048_SHA256.json"
+
+# ROT secure image
+ROT_ALGORITHM="RSA2048_SHA256"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_2048_1.pem"
+COT_FIRST_VERIFY_KEY="${KEY_DIR}/test_bl2_public_2048.pem"
+
+# COT secure image
+COT_ALGORITHM="RSA2048_SHA256"
+COT_PARTITION=" \
+    ${UBOOT_IMAGE}:${SUBOOT_IMAGE}:${KEY_DIR}/test_bl2_private_2048.pem:${KEY_DIR}/test_bl2_public_2048.pem \
+    ${FIT_IMAGE}:${SFIT_IMAGE}:${KEY_DIR}/test_bl3_private_2048.pem:${KEY_DIR}/test_bl3_public_2048.pem \
+    "
diff --git a/...peed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA2048_SHA256_ncot.cfg b/...peed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA2048_SHA256_ncot.cfg
@@ -0,0 +1,10 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA1_RSA2048_SHA256.json"
+
+# ROT secure image
+ROT_ALGORITHM="RSA2048_SHA256"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_2048_1.pem"
diff --git a/...aspeed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA2048_SHA256_o1.cfg b/...aspeed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA2048_SHA256_o1.cfg
@@ -0,0 +1,20 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA1_RSA2048_SHA256_o1.json"
+
+# ROT secure image
+ROT_ALGORITHM="AES_RSA2048_SHA256"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_2048_1.pem"
+AES_KEY="${KEY_DIR}/test_aes_key.bin"
+AES_KEY_IN_OTP="1"
+COT_FIRST_VERIFY_KEY="${KEY_DIR}/test_bl2_public_2048.pem"
+
+# COT secure image
+COT_ALGORITHM="RSA2048_SHA256"
+COT_PARTITION=" \
+    ${UBOOT_IMAGE}:${SUBOOT_IMAGE}:${KEY_DIR}/test_bl2_private_2048.pem:${KEY_DIR}/test_bl2_public_2048.pem \
+    ${FIT_IMAGE}:${SFIT_IMAGE}:${KEY_DIR}/test_bl3_private_2048.pem:${KEY_DIR}/test_bl3_public_2048.pem \
+    "
diff --git a/...d/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA2048_SHA256_o2_priv.cfg b/...d/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA2048_SHA256_o2_priv.cfg
@@ -0,0 +1,21 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA1_RSA2048_SHA256_o2_priv.json"
+
+# ROT secure image
+ROT_ALGORITHM="AES_RSA2048_SHA256"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_2048_1.pem"
+AES_KEY="${KEY_DIR}/test_aes_key.bin"
+AES_KEY_IN_OTP="0"
+RSA_AES_KEY="${KEY_DIR}/test_soc_public_key_2048.pem"
+COT_FIRST_VERIFY_KEY="${KEY_DIR}/test_bl2_public_2048.pem"
+
+# COT secure image
+COT_ALGORITHM="RSA2048_SHA256"
+COT_PARTITION=" \
+    ${UBOOT_IMAGE}:${SUBOOT_IMAGE}:${KEY_DIR}/test_bl2_private_2048.pem:${KEY_DIR}/test_bl2_public_2048.pem \
+    ${FIT_IMAGE}:${SFIT_IMAGE}:${KEY_DIR}/test_bl3_private_2048.pem:${KEY_DIR}/test_bl3_public_2048.pem \
+    "
diff --git a/...ed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA2048_SHA256_o2_pub.cfg b/...ed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA2048_SHA256_o2_pub.cfg
@@ -0,0 +1,21 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA1_RSA2048_SHA256_o2_pub.json"
+
+# ROT secure image
+ROT_ALGORITHM="AES_RSA2048_SHA256"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_2048_1.pem"
+AES_KEY="${KEY_DIR}/test_aes_key.bin"
+AES_KEY_IN_OTP="0"
+RSA_AES_KEY="${KEY_DIR}/test_soc_private_key_2048.pem"
+COT_FIRST_VERIFY_KEY="${KEY_DIR}/test_bl2_public_2048.pem"
+
+# COT secure image
+COT_ALGORITHM="RSA2048_SHA256"
+COT_PARTITION=" \
+    ${UBOOT_IMAGE}:${SUBOOT_IMAGE}:${KEY_DIR}/test_bl2_private_2048.pem:${KEY_DIR}/test_bl2_public_2048.pem \
+    ${FIT_IMAGE}:${SFIT_IMAGE}:${KEY_DIR}/test_bl3_private_2048.pem:${KEY_DIR}/test_bl3_public_2048.pem \
+    "
diff --git a/...es-aspeed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA3072_SHA384.cfg b/...es-aspeed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA3072_SHA384.cfg
@@ -0,0 +1,18 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA1_RSA3072_SHA384.json"
+
+# ROT secure image
+ROT_ALGORITHM="RSA3072_SHA384"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_3072_1.pem"
+COT_FIRST_VERIFY_KEY="${KEY_DIR}/test_bl2_public_3072.pem"
+
+# COT secure image
+COT_ALGORITHM="RSA3072_SHA384"
+COT_PARTITION=" \
+    ${UBOOT_IMAGE}:${SUBOOT_IMAGE}:${KEY_DIR}/test_bl2_private_3072.pem:${KEY_DIR}/test_bl2_public_3072.pem \
+    ${FIT_IMAGE}:${SFIT_IMAGE}:${KEY_DIR}/test_bl3_private_3072.pem:${KEY_DIR}/test_bl3_public_3072.pem \
+    "
diff --git a/...aspeed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA3072_SHA384_o1.cfg b/...aspeed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA3072_SHA384_o1.cfg
@@ -0,0 +1,20 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA1_RSA3072_SHA384_o1.json"
+
+# ROT secure image
+ROT_ALGORITHM="AES_RSA3072_SHA384"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_3072_1.pem"
+AES_KEY="${KEY_DIR}/test_aes_key.bin"
+AES_KEY_IN_OTP="1"
+COT_FIRST_VERIFY_KEY="${KEY_DIR}/test_bl2_public_3072.pem"
+
+# COT secure image
+COT_ALGORITHM="RSA3072_SHA384"
+COT_PARTITION=" \
+    ${UBOOT_IMAGE}:${SUBOOT_IMAGE}:${KEY_DIR}/test_bl2_private_3072.pem:${KEY_DIR}/test_bl2_public_3072.pem \
+    ${FIT_IMAGE}:${SFIT_IMAGE}:${KEY_DIR}/test_bl3_private_3072.pem:${KEY_DIR}/test_bl3_public_3072.pem \
+    "
diff --git a/...d/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA3072_SHA384_o2_priv.cfg b/...d/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA3072_SHA384_o2_priv.cfg
@@ -0,0 +1,21 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA1_RSA3072_SHA384_o2_priv.json"
+
+# ROT secure image
+ROT_ALGORITHM="AES_RSA3072_SHA384"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_3072_1.pem"
+AES_KEY="${KEY_DIR}/test_aes_key.bin"
+AES_KEY_IN_OTP="0"
+RSA_AES_KEY="${KEY_DIR}/test_soc_public_key_3072.pem"
+COT_FIRST_VERIFY_KEY="${KEY_DIR}/test_bl2_public_3072.pem"
+
+# COT secure image
+COT_ALGORITHM="RSA3072_SHA384"
+COT_PARTITION=" \
+    ${UBOOT_IMAGE}:${SUBOOT_IMAGE}:${KEY_DIR}/test_bl2_private_3072.pem:${KEY_DIR}/test_bl2_public_3072.pem \
+    ${FIT_IMAGE}:${SFIT_IMAGE}:${KEY_DIR}/test_bl3_private_3072.pem:${KEY_DIR}/test_bl3_public_3072.pem \
+    "
diff --git a/...ed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA3072_SHA384_o2_pub.cfg b/...ed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA3072_SHA384_o2_pub.cfg
@@ -0,0 +1,21 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA1_RSA3072_SHA384_o2_pub.json"
+
+# ROT secure image
+ROT_ALGORITHM="AES_RSA3072_SHA384"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_3072_1.pem"
+AES_KEY="${KEY_DIR}/test_aes_key.bin"
+AES_KEY_IN_OTP="0"
+RSA_AES_KEY="${KEY_DIR}/test_soc_private_key_3072.pem"
+COT_FIRST_VERIFY_KEY="${KEY_DIR}/test_bl2_public_3072.pem"
+
+# COT secure image
+COT_ALGORITHM="RSA3072_SHA384"
+COT_PARTITION=" \
+    ${UBOOT_IMAGE}:${SUBOOT_IMAGE}:${KEY_DIR}/test_bl2_private_3072.pem:${KEY_DIR}/test_bl2_public_3072.pem \
+    ${FIT_IMAGE}:${SFIT_IMAGE}:${KEY_DIR}/test_bl3_private_3072.pem:${KEY_DIR}/test_bl3_public_3072.pem \
+    "
diff --git a/...es-aspeed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA4096_SHA512.cfg b/...es-aspeed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA4096_SHA512.cfg
@@ -0,0 +1,18 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA1_RSA4096_SHA512.json"
+
+# ROT secure image
+ROT_ALGORITHM="RSA4096_SHA512"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_4096_1.pem"
+COT_FIRST_VERIFY_KEY="${KEY_DIR}/test_bl2_public_4096.pem"
+
+# COT secure image
+COT_ALGORITHM="RSA4096_SHA512"
+COT_PARTITION=" \
+    ${UBOOT_IMAGE}:${SUBOOT_IMAGE}:${KEY_DIR}/test_bl2_private_4096.pem:${KEY_DIR}/test_bl2_public_4096.pem \
+    ${FIT_IMAGE}:${SFIT_IMAGE}:${KEY_DIR}/test_bl3_private_4096.pem:${KEY_DIR}/test_bl3_public_4096.pem \
+    "
diff --git a/...aspeed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA4096_SHA512_o1.cfg b/...aspeed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA4096_SHA512_o1.cfg
@@ -0,0 +1,20 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA1_RSA4096_SHA512_o1.json"
+
+# ROT secure image
+ROT_ALGORITHM="AES_RSA4096_SHA512"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_4096_1.pem"
+AES_KEY="${KEY_DIR}/test_aes_key.bin"
+AES_KEY_IN_OTP="1"
+COT_FIRST_VERIFY_KEY="${KEY_DIR}/test_bl2_public_4096.pem"
+
+# COT secure image
+COT_ALGORITHM="RSA4096_SHA512"
+COT_PARTITION=" \
+    ${UBOOT_IMAGE}:${SUBOOT_IMAGE}:${KEY_DIR}/test_bl2_private_4096.pem:${KEY_DIR}/test_bl2_public_4096.pem \
+    ${FIT_IMAGE}:${SFIT_IMAGE}:${KEY_DIR}/test_bl3_private_4096.pem:${KEY_DIR}/test_bl3_public_4096.pem \
+    "
diff --git a/...d/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA4096_SHA512_o2_priv.cfg b/...d/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA4096_SHA512_o2_priv.cfg
@@ -0,0 +1,21 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA1_RSA4096_SHA512_o2_priv.json"
+
+# ROT secure image
+ROT_ALGORITHM="AES_RSA4096_SHA512"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_4096_1.pem"
+AES_KEY="${KEY_DIR}/test_aes_key.bin"
+AES_KEY_IN_OTP="0"
+RSA_AES_KEY="${KEY_DIR}/test_soc_public_key_4096.pem"
+COT_FIRST_VERIFY_KEY="${KEY_DIR}/test_bl2_public_4096.pem"
+
+# COT secure image
+COT_ALGORITHM="RSA4096_SHA512"
+COT_PARTITION=" \
+    ${UBOOT_IMAGE}:${SUBOOT_IMAGE}:${KEY_DIR}/test_bl2_private_4096.pem:${KEY_DIR}/test_bl2_public_4096.pem \
+    ${FIT_IMAGE}:${SFIT_IMAGE}:${KEY_DIR}/test_bl3_private_4096.pem:${KEY_DIR}/test_bl3_public_4096.pem \
+    "
diff --git a/...ed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA4096_SHA512_o2_pub.cfg b/...ed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_RSA4096_SHA512_o2_pub.cfg
@@ -0,0 +1,21 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA1_RSA4096_SHA512_o2_pub.json"
+
+# ROT secure image
+ROT_ALGORITHM="AES_RSA4096_SHA512"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_4096_1.pem"
+AES_KEY="${KEY_DIR}/test_aes_key.bin"
+AES_KEY_IN_OTP="0"
+RSA_AES_KEY="${KEY_DIR}/test_soc_private_key_4096.pem"
+COT_FIRST_VERIFY_KEY="${KEY_DIR}/test_bl2_public_4096.pem"
+
+# COT secure image
+COT_ALGORITHM="RSA4096_SHA512"
+COT_PARTITION="  \
+    ${UBOOT_IMAGE}:${SUBOOT_IMAGE}:${KEY_DIR}/test_bl2_private_4096.pem:${KEY_DIR}/test_bl2_public_4096.pem \
+    ${FIT_IMAGE}:${SFIT_IMAGE}:${KEY_DIR}/test_bl3_private_4096.pem:${KEY_DIR}/test_bl3_public_4096.pem \
+    "
diff --git a/...d-sdk/recipes-aspeed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_gcm.cfg b/...d-sdk/recipes-aspeed/security/ast-secure-config/configs/ast2600/ast2600-a1_secure_gcm.cfg
@@ -0,0 +1,18 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA1_gcm.json"
+
+# ROT secure image
+ROT_ALGORITHM="AES_GCM"
+ROT_SIGN_KEY="${KEY_DIR}/test_gcm_aes_key_1.bin"
+COT_FIRST_VERIFY_KEY="${KEY_DIR}/test_bl2_public_4096.pem"
+
+# COT secure image
+COT_ALGORITHM="RSA4096_SHA512"
+COT_PARTITION=" \
+    ${UBOOT_IMAGE}:${SUBOOT_IMAGE}:${KEY_DIR}/test_bl2_private_4096.pem:${KEY_DIR}/test_bl2_public_4096.pem \
+    ${FIT_IMAGE}:${SFIT_IMAGE}:${KEY_DIR}/test_bl3_private_4096.pem:${KEY_DIR}/test_bl3_public_4096.pem \
+    "
diff --git a/...eed-sdk/recipes-aspeed/security/ast-secure-config/configs/ast2600/ast2600-emmc_secure.cfg b/...eed-sdk/recipes-aspeed/security/ast-secure-config/configs/ast2600/ast2600-emmc_secure.cfg
@@ -0,0 +1,18 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA2_RSA4096_SHA512.json"
+
+# ROT secure image
+ROT_ALGORITHM="RSA4096_SHA512"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_4096_1.pem"
+COT_FIRST_VERIFY_KEY="${KEY_DIR}/test_bl2_public_4096.pem"
+
+# COT secure image
+COT_ALGORITHM="RSA4096_SHA512"
+COT_PARTITION=" \
+    ${UBOOT_IMAGE}:${SUBOOT_IMAGE}:${KEY_DIR}/test_bl2_private_4096.pem:${KEY_DIR}/test_bl2_public_4096.pem \
+    ${FIT_IMAGE}:${SFIT_IMAGE}:${KEY_DIR}/test_bl3_private_4096.pem:${KEY_DIR}/test_bl3_public_4096.pem \
+    "
diff --git a/...ed/security/ast-secure-config/configs/ast2600/ast2600-emmc_secure_RSA4096_SHA512_ncot.cfg b/...ed/security/ast-secure-config/configs/ast2600/ast2600-emmc_secure_RSA4096_SHA512_ncot.cfg
@@ -0,0 +1,10 @@
+KEY_DIR="${ROOT_DIR}/ast-secure-config/ast2600/security/key"
+SIGNING_HELPER="${ROOT_DIR}/ast-secure-config/signing_helper.sh"
+# SIGNING_HELPER_WITH_FILES="${ROOT_DIR}/ast-secure-config/signing_helper_with_files.sh"
+
+# OTP secure image
+OTP_CONFIG="${ROOT_DIR}/ast-secure-config/ast2600/security/otp/evbA2_RSA4096_SHA512.json"
+
+# ROT secure image
+ROT_ALGORITHM="RSA4096_SHA512"
+ROT_SIGN_KEY="${KEY_DIR}/test_oem_dss_private_key_4096_1.pem"