andrius
/
arm-trusted-firmware
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge "Mention COT build option in trusted-board-boot-build.rst" into integration

This commit is contained in:
Mark Dykes 2020-03-12 18:04:09 +00:00 committed by TrustedFirmware Code Review
parent bd2ad92902 d935b95161
commit e820759f1c
1 changed files with 13 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
docs/design/trusted-board-boot-build.rst
View File

@ -32,25 +32,28 @@ images with support for these features:
- ``TRUSTED_BOARD_BOOT=1`` - ``TRUSTED_BOARD_BOOT=1``
- ``GENERATE_COT=1`` - ``GENERATE_COT=1``
By default, this will use the Chain of Trust described in the TBBR-client
document. To select a different one, use the ``COT`` build option.
In the case of Arm platforms, the location of the ROTPK hash must also be In the case of Arm platforms, the location of the ROTPK hash must also be
specified at build time. The following locations are currently supported (see specified at build time. The following locations are currently supported (see
``ARM_ROTPK_LOCATION`` build option): ``ARM_ROTPK_LOCATION`` build option):
- ``ARM_ROTPK_LOCATION=regs``: the ROTPK hash is obtained from the Trusted - ``ARM_ROTPK_LOCATION=regs``: the ROTPK hash is obtained from the Trusted
root-key storage registers present in the platform. On Juno, this root-key storage registers present in the platform. On Juno, these
registers are read-only. On FVP Base and Cortex models, the registers registers are read-only. On FVP Base and Cortex models, the registers
are read-only, but the value can be specified using the command line are also read-only, but the value can be specified using the command line
option ``bp.trusted_key_storage.public_key`` when launching the model. option ``bp.trusted_key_storage.public_key`` when launching the model.
On Juno board, the default value corresponds to an ECDSA-SECP256R1 public On Juno board, the default value corresponds to an ECDSA-SECP256R1 public
key hash, whose private part is not currently available. key hash, whose private part is not currently available.
- ``ARM_ROTPK_LOCATION=devel_rsa``: use the default hash located in - ``ARM_ROTPK_LOCATION=devel_rsa``: use the default hash located in
plat/arm/board/common/rotpk/arm_rotpk_rsa_sha256.bin. Enforce generation ``plat/arm/board/common/rotpk/arm_rotpk_rsa_sha256.bin``. Enforce
of the new hash if ROT_KEY is specified. generation of the new hash if ``ROT_KEY`` is specified.
- ``ARM_ROTPK_LOCATION=devel_ecdsa``: use the default hash located in - ``ARM_ROTPK_LOCATION=devel_ecdsa``: use the default hash located in
plat/arm/board/common/rotpk/arm_rotpk_ecdsa_sha256.bin. Enforce generation ``plat/arm/board/common/rotpk/arm_rotpk_ecdsa_sha256.bin``. Enforce
of the new hash if ROT_KEY is specified. generation of the new hash if ``ROT_KEY`` is specified.
Example of command line using RSA development keys: Example of command line using RSA development keys:
@ -64,9 +67,8 @@ images with support for these features:
all fip all fip
The result of this build will be the bl1.bin and the fip.bin binaries. This The result of this build will be the bl1.bin and the fip.bin binaries. This
FIP will include the certificates corresponding to the Chain of Trust FIP will include the certificates corresponding to the selected Chain of
described in the TBBR-client document. These certificates can also be found Trust. These certificates can also be found in the output build directory.
in the output build directory.
#. The optional FWU_FIP contains any additional images to be loaded from #. The optional FWU_FIP contains any additional images to be loaded from
Non-Volatile storage during the :ref:`Firmware Update (FWU)` process. To build the Non-Volatile storage during the :ref:`Firmware Update (FWU)` process. To build the
@ -102,8 +104,8 @@ images with support for these features:
The result of this build will be bl1.bin, fip.bin and fwu_fip.bin binaries. The result of this build will be bl1.bin, fip.bin and fwu_fip.bin binaries.
Both the FIP and FWU_FIP will include the certificates corresponding to the Both the FIP and FWU_FIP will include the certificates corresponding to the
Chain of Trust described in the TBBR-client document. These certificates selected Chain of Trust. These certificates can also be found in the output
can also be found in the output build directory. build directory.
-------------- --------------