1# 2# Copyright 2021 NXP 3# 4# SPDX-License-Identifier: BSD-3-Clause 5# 6 7# This file defines the keys and certificates that must be created to establish 8# a Chain of Trust for the DDR FW. These definitions include the 9# command line options passed to the cert_create and fiptool commands for DDR FW. 10# A DDR FW key is used for signing the DDR Firmware. The DDR key is authenticated 11# by the Trusted World Key. Two content certificates are created: 12# For DDR RDIMM Images [ signed by DDR FW Key] 13# For DDR UDIMM Images [ signed by DDR FW Key] 14# 15# Expected environment: 16# 17# BUILD_PLAT: output directory 18# 19# Build options added by this file: 20# 21# KEY_ALG 22# KEY_SIZE 23# TRUSTED_WORLD_KEY 24# NON_TRUSTED_WORLD_KEY 25# 26 27# Certificate generation tool default parameters 28DDR_FW_CERT := ${BUILD_PLAT}/ddr_fw_key_cert.crt 29 30# Default non-volatile counter values (overridable by the platform) 31TFW_NVCTR_VAL ?= 0 32NTFW_NVCTR_VAL ?= 0 33 34# Pass the non-volatile counters to the cert_create tool 35$(eval $(call CERT_ADD_CMD_OPT,${TFW_NVCTR_VAL},--tfw-nvctr,DDR_)) 36 37ifeq (${DDR_KEY},) 38DDR_KEY=${BUILD_PLAT}/ddr.pem 39endif 40 41ifeq (${TRUSTED_KEY_CERT},) 42$(info Generating: Trusted key certificate as part of DDR cert creation) 43TRUSTED_KEY_CERT := ${BUILD_PLAT}/trusted_key.crt 44$(eval $(call TOOL_ADD_PAYLOAD,${TRUSTED_KEY_CERT},--trusted-key-cert,)) 45$(eval $(call TOOL_ADD_PAYLOAD,${TRUSTED_KEY_CERT},--trusted-key-cert,,DDR_)) 46else 47$(info Using: Trusted key certificate as part of DDR cert creation) 48DDR_FIP_ARGS += --trusted-key-cert ${TRUSTED_KEY_CERT} 49endif 50 51# Add the keys to the cert_create command line options (private keys are NOT 52# packed in the FIP). Developers can use their own keys by specifying the proper 53# build option in the command line when building the Trusted Firmware 54$(if ${KEY_ALG},$(eval $(call CERT_ADD_CMD_OPT,${KEY_ALG},--key-alg,DDR_))) 55$(if ${KEY_SIZE},$(eval $(call CERT_ADD_CMD_OPT,${KEY_SIZE},--key-size,DDR_))) 56$(if ${HASH_ALG},$(eval $(call CERT_ADD_CMD_OPT,${HASH_ALG},--hash-alg,DDR_))) 57$(if ${ROT_KEY},$(eval $(call CERT_ADD_CMD_OPT,${ROT_KEY},--rot-key,DDR_))) 58$(if ${TRUSTED_WORLD_KEY},$(eval $(call CERT_ADD_CMD_OPT,${TRUSTED_WORLD_KEY},--trusted-world-key,DDR_))) 59$(if ${NON_TRUSTED_WORLD_KEY},$(eval $(call CERT_ADD_CMD_OPT,${NON_TRUSTED_WORLD_KEY},--non-trusted-world-key, DDR_))) 60 61# Add the DDR CoT (key cert + img cert) 62$(if ${DDR_KEY},$(eval $(call CERT_ADD_CMD_OPT,${DDR_KEY},--ddr-fw-key,DDR_))) 63$(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/ddr_fw_key.crt,--ddr-fw-key-cert,,DDR_)) 64$(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/ddr_udimm_fw_content.crt,--ddr-udimm-fw-cert,,DDR_)) 65$(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/ddr_rdimm_fw_content.crt,--ddr-rdimm-fw-cert,,DDR_)) 66 67$(eval $(call TOOL_ADD_IMG,DDR_IMEM_UDIMM_1D,--ddr-immem-udimm-1d,DDR_)) 68$(eval $(call TOOL_ADD_IMG,DDR_IMEM_UDIMM_2D,--ddr-immem-udimm-2d,DDR_)) 69$(eval $(call TOOL_ADD_IMG,DDR_DMEM_UDIMM_1D,--ddr-dmmem-udimm-1d,DDR_)) 70$(eval $(call TOOL_ADD_IMG,DDR_DMEM_UDIMM_2D,--ddr-dmmem-udimm-2d,DDR_)) 71 72$(eval $(call TOOL_ADD_IMG,DDR_IMEM_RDIMM_1D,--ddr-immem-rdimm-1d,DDR_)) 73$(eval $(call TOOL_ADD_IMG,DDR_IMEM_RDIMM_2D,--ddr-immem-rdimm-2d,DDR_)) 74$(eval $(call TOOL_ADD_IMG,DDR_DMEM_RDIMM_1D,--ddr-dmmem-rdimm-1d,DDR_)) 75$(eval $(call TOOL_ADD_IMG,DDR_DMEM_RDIMM_2D,--ddr-dmmem-rdimm-2d,DDR_)) 76 77DDR_FIP_DEPS += ddr_certificates 78 79# Process TBB related flags 80ifneq (${GENERATE_COT},0) 81 # Common cert_create options 82 ifneq (${CREATE_KEYS},0) 83 $(eval DDR_CRT_ARGS += -n) 84 ifneq (${SAVE_KEYS},0) 85 $(eval DDR_CRT_ARGS += -k) 86 endif 87 endif 88endif 89