mirror of
https://github.com/ARM-software/arm-trusted-firmware.git
synced 2025-04-18 10:34:19 +00:00
1035a70625
- Use the development PROTPK if using the dualroot CoT. Note that unlike the ROTPK, the PROTPK key hash file is not generated from the key file, instead it has to be provided. This might be enhanced in the future. - Define a CoT build flag for the platform code to provide different implementations where needed. Change-Id: Iaaf25183b94e77a99a5d8d875831d90c102a97ea Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
92 lines
3 KiB
Makefile
92 lines
3 KiB
Makefile
#
|
|
# Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
|
|
#
|
|
# SPDX-License-Identifier: BSD-3-Clause
|
|
#
|
|
|
|
PLAT_BL_COMMON_SOURCES += drivers/arm/pl011/${ARCH}/pl011_console.S \
|
|
plat/arm/board/common/${ARCH}/board_arm_helpers.S
|
|
|
|
BL1_SOURCES += drivers/cfi/v2m/v2m_flash.c
|
|
|
|
BL2_SOURCES += drivers/cfi/v2m/v2m_flash.c
|
|
|
|
ifneq (${TRUSTED_BOARD_BOOT},0)
|
|
ifneq (${ARM_CRYPTOCELL_INTEG}, 1)
|
|
# ROTPK hash location
|
|
ifeq (${ARM_ROTPK_LOCATION}, regs)
|
|
ARM_ROTPK_LOCATION_ID = ARM_ROTPK_REGS_ID
|
|
else ifeq (${ARM_ROTPK_LOCATION}, devel_rsa)
|
|
CRYPTO_ALG=rsa
|
|
ARM_ROTPK_LOCATION_ID = ARM_ROTPK_DEVEL_RSA_ID
|
|
ARM_ROTPK_HASH = plat/arm/board/common/rotpk/arm_rotpk_rsa_sha256.bin
|
|
$(eval $(call add_define_val,ARM_ROTPK_HASH,'"$(ARM_ROTPK_HASH)"'))
|
|
$(BUILD_PLAT)/bl2/arm_dev_rotpk.o : $(ARM_ROTPK_HASH)
|
|
$(warning Development keys support for FVP is deprecated. Use `regs` \
|
|
option instead)
|
|
else ifeq (${ARM_ROTPK_LOCATION}, devel_ecdsa)
|
|
CRYPTO_ALG=ec
|
|
ARM_ROTPK_LOCATION_ID = ARM_ROTPK_DEVEL_ECDSA_ID
|
|
ARM_ROTPK_HASH = plat/arm/board/common/rotpk/arm_rotpk_ecdsa_sha256.bin
|
|
$(eval $(call add_define_val,ARM_ROTPK_HASH,'"$(ARM_ROTPK_HASH)"'))
|
|
$(BUILD_PLAT)/bl2/arm_dev_rotpk.o : $(ARM_ROTPK_HASH)
|
|
$(warning Development keys support for FVP is deprecated. Use `regs` \
|
|
option instead)
|
|
else
|
|
$(error "Unsupported ARM_ROTPK_LOCATION value")
|
|
endif
|
|
|
|
$(eval $(call add_define,ARM_ROTPK_LOCATION_ID))
|
|
|
|
# Force generation of the new hash if ROT_KEY is specified
|
|
ifdef ROT_KEY
|
|
HASH_PREREQUISITES = $(ROT_KEY) FORCE
|
|
FORCE:
|
|
else
|
|
HASH_PREREQUISITES = $(ROT_KEY)
|
|
endif
|
|
|
|
$(ARM_ROTPK_HASH) : $(HASH_PREREQUISITES)
|
|
ifndef ROT_KEY
|
|
$(error Cannot generate hash: no ROT_KEY defined)
|
|
endif
|
|
openssl ${CRYPTO_ALG} -in $< -pubout -outform DER | openssl dgst \
|
|
-sha256 -binary > $@
|
|
|
|
# Certificate NV-Counters. Use values corresponding to tied off values in
|
|
# ARM development platforms
|
|
TFW_NVCTR_VAL ?= 31
|
|
NTFW_NVCTR_VAL ?= 223
|
|
else
|
|
# Certificate NV-Counters when CryptoCell is integrated. For development
|
|
# platforms we set the counter to first valid value.
|
|
TFW_NVCTR_VAL ?= 0
|
|
NTFW_NVCTR_VAL ?= 0
|
|
endif
|
|
BL1_SOURCES += plat/arm/board/common/board_arm_trusted_boot.c \
|
|
plat/arm/board/common/rotpk/arm_dev_rotpk.S
|
|
BL2_SOURCES += plat/arm/board/common/board_arm_trusted_boot.c \
|
|
plat/arm/board/common/rotpk/arm_dev_rotpk.S
|
|
|
|
# Allows platform code to provide implementation variants depending on the
|
|
# selected chain of trust.
|
|
$(eval $(call add_define,ARM_COT_${COT}))
|
|
|
|
ifeq (${COT},dualroot)
|
|
# Platform Root of Trust key files.
|
|
ARM_PROT_KEY := plat/arm/board/common/protpk/arm_protprivk_rsa.pem
|
|
ARM_PROTPK_HASH := plat/arm/board/common/protpk/arm_protpk_rsa_sha256.bin
|
|
|
|
# Provide the private key to cert_create tool. It needs it to sign the images.
|
|
PROT_KEY := ${ARM_PROT_KEY}
|
|
|
|
$(eval $(call add_define_val,ARM_PROTPK_HASH,'"$(ARM_PROTPK_HASH)"'))
|
|
|
|
BL1_SOURCES += plat/arm/board/common/protpk/arm_dev_protpk.S
|
|
BL2_SOURCES += plat/arm/board/common/protpk/arm_dev_protpk.S
|
|
|
|
$(BUILD_PLAT)/bl1/arm_dev_protpk.o: $(ARM_PROTPK_HASH)
|
|
$(BUILD_PLAT)/bl2/arm_dev_protpk.o: $(ARM_PROTPK_HASH)
|
|
endif
|
|
|
|
endif
|