cert_create: add Platform owned secure partitions support
Add support to generate a certificate named "plat-sp-cert" for Secure Partitions(SP) owned by Platform. Earlier a single certificate file "sip-sp-cert" was generated which contained hash of all 8 SPs, with this change SPs are divided into two categories viz "SiP owned" and "Plat owned" containing 4 SPs each. Platform RoT key pair is used for signing. Signed-off-by: Manish Pandey <manish.pandey2@arm.com> Change-Id: I5bd493cfce4cf3fc14b87c8ed1045f633d0c92b6
This commit is contained in:
parent
8f09da46e2
commit
23d5f03ad0
|
@ -66,6 +66,8 @@
|
||||||
{{0x8e, 0xc4, 0xc1, 0xf3}, {0x5d, 0x63}, {0xe4, 0x11}, 0xa7, 0xa9, {0x87, 0xee, 0x40, 0xb2, 0x3f, 0xa7} }
|
{{0x8e, 0xc4, 0xc1, 0xf3}, {0x5d, 0x63}, {0xe4, 0x11}, 0xa7, 0xa9, {0x87, 0xee, 0x40, 0xb2, 0x3f, 0xa7} }
|
||||||
#define UUID_SIP_SECURE_PARTITION_CONTENT_CERT \
|
#define UUID_SIP_SECURE_PARTITION_CONTENT_CERT \
|
||||||
{{0x77, 0x6d, 0xfd, 0x44}, {0x86, 0x97}, {0x4c, 0x3b}, 0x91, 0xeb, {0xc1, 0x3e, 0x02, 0x5a, 0x2a, 0x6f} }
|
{{0x77, 0x6d, 0xfd, 0x44}, {0x86, 0x97}, {0x4c, 0x3b}, 0x91, 0xeb, {0xc1, 0x3e, 0x02, 0x5a, 0x2a, 0x6f} }
|
||||||
|
#define UUID_PLAT_SECURE_PARTITION_CONTENT_CERT \
|
||||||
|
{{0xdd, 0xcb, 0xbf, 0x4a}, {0xca, 0xd6}, {0x11, 0xea}, 0x87, 0xd0, {0x02, 0x42, 0xac, 0x13, 0x00, 0x03} }
|
||||||
/* Dynamic configs */
|
/* Dynamic configs */
|
||||||
#define UUID_HW_CONFIG \
|
#define UUID_HW_CONFIG \
|
||||||
{{0x08, 0xb8, 0xf1, 0xd9}, {0xc9, 0xcf}, {0x93, 0x49}, 0xa9, 0x62, {0x6f, 0xbc, 0x6b, 0x72, 0x65, 0xcc} }
|
{{0x08, 0xb8, 0xf1, 0xd9}, {0xc9, 0xcf}, {0x93, 0x49}, 0xa9, 0x62, {0x6f, 0xbc, 0x6b, 0x72, 0x65, 0xcc} }
|
||||||
|
|
|
@ -76,7 +76,8 @@ static const struct uuidnames uuidnames[] = {
|
||||||
{"fw.cfg", UUID_FW_CONFIG},
|
{"fw.cfg", UUID_FW_CONFIG},
|
||||||
{"rot-k.crt", UUID_ROT_KEY_CERT},
|
{"rot-k.crt", UUID_ROT_KEY_CERT},
|
||||||
{"nt-k.crt", UUID_NON_TRUSTED_WORLD_KEY_CERT},
|
{"nt-k.crt", UUID_NON_TRUSTED_WORLD_KEY_CERT},
|
||||||
{"sip-sp.crt", UUID_SIP_SECURE_PARTITION_CONTENT_CERT}
|
{"sip-sp.crt", UUID_SIP_SECURE_PARTITION_CONTENT_CERT},
|
||||||
|
{"plat-sp.crt", UUID_PLAT_SECURE_PARTITION_CONTENT_CERT}
|
||||||
};
|
};
|
||||||
|
|
||||||
/*******************************************************************************
|
/*******************************************************************************
|
||||||
|
|
|
@ -103,4 +103,7 @@ endif
|
||||||
# Add SiP owned Secure Partitions CoT (image cert)
|
# Add SiP owned Secure Partitions CoT (image cert)
|
||||||
ifneq (${SP_LAYOUT_FILE},)
|
ifneq (${SP_LAYOUT_FILE},)
|
||||||
$(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/sip_sp_content.crt,--sip-sp-cert))
|
$(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/sip_sp_content.crt,--sip-sp-cert))
|
||||||
|
ifeq (${COT},dualroot)
|
||||||
|
$(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/plat_sp_content.crt,--plat-sp-cert))
|
||||||
|
endif
|
||||||
endif
|
endif
|
||||||
|
|
|
@ -23,6 +23,7 @@ enum {
|
||||||
|
|
||||||
/* Certificates owned by the platform owner. */
|
/* Certificates owned by the platform owner. */
|
||||||
NON_TRUSTED_FW_CONTENT_CERT,
|
NON_TRUSTED_FW_CONTENT_CERT,
|
||||||
|
PLAT_SECURE_PARTITION_CONTENT_CERT,
|
||||||
};
|
};
|
||||||
|
|
||||||
/* Certificate extensions. */
|
/* Certificate extensions. */
|
||||||
|
|
|
@ -152,12 +152,27 @@ static cert_t cot_certs[] = {
|
||||||
SP_PKG2_HASH_EXT,
|
SP_PKG2_HASH_EXT,
|
||||||
SP_PKG3_HASH_EXT,
|
SP_PKG3_HASH_EXT,
|
||||||
SP_PKG4_HASH_EXT,
|
SP_PKG4_HASH_EXT,
|
||||||
|
},
|
||||||
|
.num_ext = 5
|
||||||
|
},
|
||||||
|
|
||||||
|
[PLAT_SECURE_PARTITION_CONTENT_CERT] = {
|
||||||
|
.id = PLAT_SECURE_PARTITION_CONTENT_CERT,
|
||||||
|
.opt = "plat-sp-cert",
|
||||||
|
.help_msg = "Platform owned Secure Partition Content Certificate (output file)",
|
||||||
|
.fn = NULL,
|
||||||
|
.cn = "Platform owned Secure Partition Content Certificate",
|
||||||
|
.key = PROT_KEY,
|
||||||
|
.issuer = PLAT_SECURE_PARTITION_CONTENT_CERT,
|
||||||
|
.ext = {
|
||||||
|
NON_TRUSTED_FW_NVCOUNTER_EXT,
|
||||||
SP_PKG5_HASH_EXT,
|
SP_PKG5_HASH_EXT,
|
||||||
SP_PKG6_HASH_EXT,
|
SP_PKG6_HASH_EXT,
|
||||||
SP_PKG7_HASH_EXT,
|
SP_PKG7_HASH_EXT,
|
||||||
SP_PKG8_HASH_EXT,
|
SP_PKG8_HASH_EXT,
|
||||||
|
PROT_PK_EXT,
|
||||||
},
|
},
|
||||||
.num_ext = 9
|
.num_ext = 6
|
||||||
},
|
},
|
||||||
|
|
||||||
[FWU_CERT] = {
|
[FWU_CERT] = {
|
||||||
|
|
|
@ -161,6 +161,11 @@ toc_entry_t toc_entries[] = {
|
||||||
.uuid = UUID_SIP_SECURE_PARTITION_CONTENT_CERT,
|
.uuid = UUID_SIP_SECURE_PARTITION_CONTENT_CERT,
|
||||||
.cmdline_name = "sip-sp-cert"
|
.cmdline_name = "sip-sp-cert"
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
.name = "Platform owned Secure Partition content certificate",
|
||||||
|
.uuid = UUID_PLAT_SECURE_PARTITION_CONTENT_CERT,
|
||||||
|
.cmdline_name = "plat-sp-cert"
|
||||||
|
},
|
||||||
{
|
{
|
||||||
.name = NULL,
|
.name = NULL,
|
||||||
.uuid = { {0} },
|
.uuid = { {0} },
|
||||||
|
|
Loading…
Reference in New Issue