Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 1 | # |
Masahiro Yamada | 1dc0714 | 2018-01-26 11:42:01 +0900 | [diff] [blame] | 2 | # Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved. |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 3 | # |
dp-arm | 82cb2c1 | 2017-05-03 09:38:09 +0100 | [diff] [blame] | 4 | # SPDX-License-Identifier: BSD-3-Clause |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 5 | # |
| 6 | |
| 7 | # This file defines the keys and certificates that must be created to establish |
| 8 | # a Chain of Trust following the TBBR document. These definitions include the |
dp-arm | 819281e | 2016-05-25 16:20:20 +0100 | [diff] [blame] | 9 | # command line options passed to the cert_create and fiptool commands. |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 10 | # |
| 11 | # Expected environment: |
| 12 | # |
| 13 | # BUILD_PLAT: output directory |
Juan Castillo | d178637 | 2015-12-14 09:35:25 +0000 | [diff] [blame] | 14 | # NEED_BL32: indicates whether BL32 is needed by the platform |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 15 | # BL2: image filename (optional). Default is IMG_BIN(2) (see macro IMG_BIN) |
Juan Castillo | f59821d | 2015-12-10 15:49:17 +0000 | [diff] [blame] | 16 | # SCP_BL2: image filename (optional). Default is IMG_BIN(30) |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 17 | # BL31: image filename (optional). Default is IMG_BIN(31) |
| 18 | # BL32: image filename (optional). Default is IMG_BIN(32) |
| 19 | # BL33: image filename (optional). Default is IMG_BIN(33) |
| 20 | # |
| 21 | # Build options added by this file: |
| 22 | # |
| 23 | # KEY_ALG |
| 24 | # ROT_KEY |
| 25 | # TRUSTED_WORLD_KEY |
| 26 | # NON_TRUSTED_WORLD_KEY |
Juan Castillo | f59821d | 2015-12-10 15:49:17 +0000 | [diff] [blame] | 27 | # SCP_BL2_KEY |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 28 | # BL31_KEY |
| 29 | # BL32_KEY |
| 30 | # BL33_KEY |
| 31 | # |
| 32 | |
| 33 | # Certificate generation tool default parameters |
| 34 | TRUSTED_KEY_CERT := ${BUILD_PLAT}/trusted_key.crt |
Yatharth Kochar | 0191262 | 2015-10-12 12:33:47 +0100 | [diff] [blame] | 35 | FWU_CERT := ${BUILD_PLAT}/fwu_cert.crt |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 36 | |
Juan Castillo | 96103d5 | 2016-01-22 11:05:24 +0000 | [diff] [blame] | 37 | # Default non-volatile counter values (overridable by the platform) |
| 38 | TFW_NVCTR_VAL ?= 0 |
| 39 | NTFW_NVCTR_VAL ?= 0 |
| 40 | |
| 41 | # Pass the non-volatile counters to the cert_create tool |
| 42 | $(eval $(call CERT_ADD_CMD_OPT,${TFW_NVCTR_VAL},--tfw-nvctr)) |
| 43 | $(eval $(call CERT_ADD_CMD_OPT,${NTFW_NVCTR_VAL},--ntfw-nvctr)) |
| 44 | |
dp-arm | 819281e | 2016-05-25 16:20:20 +0100 | [diff] [blame] | 45 | # Add Trusted Key certificate to the fiptool and cert_create command line options |
Masahiro Yamada | 10cea93 | 2018-01-26 11:42:01 +0900 | [diff] [blame] | 46 | $(eval $(call TOOL_ADD_PAYLOAD,${TRUSTED_KEY_CERT},--trusted-key-cert)) |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 47 | |
dp-arm | 819281e | 2016-05-25 16:20:20 +0100 | [diff] [blame] | 48 | # Add fwu certificate to the fiptool and cert_create command line options |
Masahiro Yamada | 10cea93 | 2018-01-26 11:42:01 +0900 | [diff] [blame] | 49 | $(eval $(call TOOL_ADD_PAYLOAD,${FWU_CERT},--fwu-cert,,FWU_)) |
Yatharth Kochar | 0191262 | 2015-10-12 12:33:47 +0100 | [diff] [blame] | 50 | |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 51 | # Add the keys to the cert_create command line options (private keys are NOT |
| 52 | # packed in the FIP). Developers can use their own keys by specifying the proper |
| 53 | # build option in the command line when building the Trusted Firmware |
| 54 | $(if ${KEY_ALG},$(eval $(call CERT_ADD_CMD_OPT,${KEY_ALG},--key-alg))) |
Qixiang Xu | 9a3088a | 2017-11-09 13:56:29 +0800 | [diff] [blame] | 55 | $(if ${HASH_ALG},$(eval $(call CERT_ADD_CMD_OPT,${HASH_ALG},--hash-alg))) |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 56 | $(if ${ROT_KEY},$(eval $(call CERT_ADD_CMD_OPT,${ROT_KEY},--rot-key))) |
Masahiro Yamada | 91704d9 | 2018-01-26 11:42:01 +0900 | [diff] [blame] | 57 | $(if ${ROT_KEY},$(eval $(call CERT_ADD_CMD_OPT,${ROT_KEY},--rot-key,FWU_))) |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 58 | $(if ${TRUSTED_WORLD_KEY},$(eval $(call CERT_ADD_CMD_OPT,${TRUSTED_WORLD_KEY},--trusted-world-key))) |
| 59 | $(if ${NON_TRUSTED_WORLD_KEY},$(eval $(call CERT_ADD_CMD_OPT,${NON_TRUSTED_WORLD_KEY},--non-trusted-world-key))) |
| 60 | |
Masahiro Yamada | f30ee0b | 2018-01-26 11:42:01 +0900 | [diff] [blame] | 61 | |
| 62 | # Add the BL2 CoT (image cert) |
Roberto Vargas | c9b31ae | 2018-01-02 11:23:41 +0000 | [diff] [blame] | 63 | ifeq (${BL2_AT_EL3}, 0) |
Masahiro Yamada | 10cea93 | 2018-01-26 11:42:01 +0900 | [diff] [blame] | 64 | $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/tb_fw.crt,--tb-fw-cert)) |
Roberto Vargas | c9b31ae | 2018-01-02 11:23:41 +0000 | [diff] [blame] | 65 | endif |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 66 | |
Masahiro Yamada | f30ee0b | 2018-01-26 11:42:01 +0900 | [diff] [blame] | 67 | # Add the SCP_BL2 CoT (key cert + img cert) |
Juan Castillo | f59821d | 2015-12-10 15:49:17 +0000 | [diff] [blame] | 68 | ifneq (${SCP_BL2},) |
Juan Castillo | f59821d | 2015-12-10 15:49:17 +0000 | [diff] [blame] | 69 | $(if ${SCP_BL2_KEY},$(eval $(call CERT_ADD_CMD_OPT,${SCP_BL2_KEY},--scp-fw-key))) |
Masahiro Yamada | 10cea93 | 2018-01-26 11:42:01 +0900 | [diff] [blame] | 70 | $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/scp_fw_content.crt,--scp-fw-cert)) |
| 71 | $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/scp_fw_key.crt,--scp-fw-key-cert)) |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 72 | endif |
| 73 | |
dp-arm | a440900 | 2017-02-15 11:07:55 +0000 | [diff] [blame] | 74 | ifeq (${ARCH},aarch64) |
Soby Mathew | 5744e87 | 2017-11-14 14:10:10 +0000 | [diff] [blame] | 75 | ifeq (${NEED_BL31},yes) |
Masahiro Yamada | f30ee0b | 2018-01-26 11:42:01 +0900 | [diff] [blame] | 76 | # Add the BL31 CoT (key cert + img cert) |
Juan Castillo | 516beb5 | 2015-12-03 10:19:21 +0000 | [diff] [blame] | 77 | $(if ${BL31_KEY},$(eval $(call CERT_ADD_CMD_OPT,${BL31_KEY},--soc-fw-key))) |
Masahiro Yamada | 10cea93 | 2018-01-26 11:42:01 +0900 | [diff] [blame] | 78 | $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/soc_fw_content.crt,--soc-fw-cert)) |
| 79 | $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/soc_fw_key.crt,--soc-fw-key-cert)) |
dp-arm | a440900 | 2017-02-15 11:07:55 +0000 | [diff] [blame] | 80 | endif |
Soby Mathew | 5744e87 | 2017-11-14 14:10:10 +0000 | [diff] [blame] | 81 | endif |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 82 | |
Masahiro Yamada | f30ee0b | 2018-01-26 11:42:01 +0900 | [diff] [blame] | 83 | # Add the BL32 CoT (key cert + img cert) |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 84 | ifeq (${NEED_BL32},yes) |
Juan Castillo | 516beb5 | 2015-12-03 10:19:21 +0000 | [diff] [blame] | 85 | $(if ${BL32_KEY},$(eval $(call CERT_ADD_CMD_OPT,${BL32_KEY},--tos-fw-key))) |
Masahiro Yamada | 10cea93 | 2018-01-26 11:42:01 +0900 | [diff] [blame] | 86 | $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/tos_fw_content.crt,--tos-fw-cert)) |
| 87 | $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/tos_fw_key.crt,--tos-fw-key-cert)) |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 88 | endif |
| 89 | |
Masahiro Yamada | f30ee0b | 2018-01-26 11:42:01 +0900 | [diff] [blame] | 90 | # Add the BL33 CoT (key cert + img cert) |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 91 | ifneq (${BL33},) |
Juan Castillo | 516beb5 | 2015-12-03 10:19:21 +0000 | [diff] [blame] | 92 | $(if ${BL33_KEY},$(eval $(call CERT_ADD_CMD_OPT,${BL33_KEY},--nt-fw-key))) |
Masahiro Yamada | 10cea93 | 2018-01-26 11:42:01 +0900 | [diff] [blame] | 93 | $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/nt_fw_content.crt,--nt-fw-cert)) |
| 94 | $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/nt_fw_key.crt,--nt-fw-key-cert)) |
Juan Castillo | 73c99d4 | 2015-08-18 14:23:04 +0100 | [diff] [blame] | 95 | endif |