1#
2# Copyright 2021 NXP
3#
4# SPDX-License-Identifier: BSD-3-Clause
5#
6
7# This file defines the keys and certificates that must be created to establish
8# a Chain of Trust for the DDR FW. These definitions include the
9# command line options passed to the cert_create and fiptool commands for DDR FW.
10# A DDR FW key is used for signing the DDR Firmware. The DDR key is authenticated
11# by the Trusted World Key. Two content certificates are created:
12# For DDR RDIMM Images [ signed by DDR FW Key]
13# For DDR UDIMM Images [ signed by DDR FW Key]
14#
15# Expected environment:
16#
17#   BUILD_PLAT: output directory
18#
19# Build options added by this file:
20#
21#   KEY_ALG
22#   KEY_SIZE
23#   TRUSTED_WORLD_KEY
24#   NON_TRUSTED_WORLD_KEY
25#
26
27# Copy the tbbr.mk from PLAT_TOOL_PATH/cert_create_helper
28# to the ${PLAT_DIR}. So that cert_create is enabled
29# to create certificates for DDR
30$(shell cp ${PLAT_TOOL_PATH}/cert_create_helper/cert_create_tbbr.mk ${PLAT_DIR})
31
32# Certificate generation tool default parameters
33DDR_FW_CERT		:=	${BUILD_PLAT}/ddr_fw_key_cert.crt
34
35# Default non-volatile counter values (overridable by the platform)
36TFW_NVCTR_VAL		?=	0
37NTFW_NVCTR_VAL		?=	0
38
39# Pass the non-volatile counters to the cert_create tool
40$(eval $(call CERT_ADD_CMD_OPT,${TFW_NVCTR_VAL},--tfw-nvctr,DDR_))
41
42$(shell mkdir -p '${BUILD_PLAT}')
43
44ifeq (${DDR_KEY},)
45DDR_KEY=${BUILD_PLAT}/ddr.pem
46endif
47
48ifeq (${TRUSTED_KEY_CERT},)
49$(info Generating: Trusted key certificate as part of DDR cert creation)
50TRUSTED_KEY_CERT	:=	${BUILD_PLAT}/trusted_key.crt
51$(eval $(call TOOL_ADD_PAYLOAD,${TRUSTED_KEY_CERT},--trusted-key-cert,))
52$(eval $(call TOOL_ADD_PAYLOAD,${TRUSTED_KEY_CERT},--trusted-key-cert,,DDR_))
53else
54$(info Using: Trusted key certificate as part of DDR cert creation)
55DDR_FIP_ARGS += --trusted-key-cert ${TRUSTED_KEY_CERT}
56endif
57
58# Add the keys to the cert_create command line options (private keys are NOT
59# packed in the FIP). Developers can use their own keys by specifying the proper
60# build option in the command line when building the Trusted Firmware
61$(if ${KEY_ALG},$(eval $(call CERT_ADD_CMD_OPT,${KEY_ALG},--key-alg,DDR_)))
62$(if ${KEY_SIZE},$(eval $(call CERT_ADD_CMD_OPT,${KEY_SIZE},--key-size,DDR_)))
63$(if ${HASH_ALG},$(eval $(call CERT_ADD_CMD_OPT,${HASH_ALG},--hash-alg,DDR_)))
64$(if ${ROT_KEY},$(eval $(call CERT_ADD_CMD_OPT,${ROT_KEY},--rot-key,DDR_)))
65$(if ${TRUSTED_WORLD_KEY},$(eval $(call CERT_ADD_CMD_OPT,${TRUSTED_WORLD_KEY},--trusted-world-key,DDR_)))
66$(if ${NON_TRUSTED_WORLD_KEY},$(eval $(call CERT_ADD_CMD_OPT,${NON_TRUSTED_WORLD_KEY},--non-trusted-world-key, DDR_)))
67
68# Add the DDR CoT (key cert + img cert)
69$(if ${DDR_KEY},$(eval $(call CERT_ADD_CMD_OPT,${DDR_KEY},--ddr-fw-key,DDR_)))
70$(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/ddr_fw_key.crt,--ddr-fw-key-cert,,DDR_))
71$(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/ddr_udimm_fw_content.crt,--ddr-udimm-fw-cert,,DDR_))
72$(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/ddr_rdimm_fw_content.crt,--ddr-rdimm-fw-cert,,DDR_))
73
74$(eval $(call TOOL_ADD_IMG,DDR_IMEM_UDIMM_1D,--ddr-immem-udimm-1d,DDR_))
75$(eval $(call TOOL_ADD_IMG,DDR_IMEM_UDIMM_2D,--ddr-immem-udimm-2d,DDR_))
76$(eval $(call TOOL_ADD_IMG,DDR_DMEM_UDIMM_1D,--ddr-dmmem-udimm-1d,DDR_))
77$(eval $(call TOOL_ADD_IMG,DDR_DMEM_UDIMM_2D,--ddr-dmmem-udimm-2d,DDR_))
78
79$(eval $(call TOOL_ADD_IMG,DDR_IMEM_RDIMM_1D,--ddr-immem-rdimm-1d,DDR_))
80$(eval $(call TOOL_ADD_IMG,DDR_IMEM_RDIMM_2D,--ddr-immem-rdimm-2d,DDR_))
81$(eval $(call TOOL_ADD_IMG,DDR_DMEM_RDIMM_1D,--ddr-dmmem-rdimm-1d,DDR_))
82$(eval $(call TOOL_ADD_IMG,DDR_DMEM_RDIMM_2D,--ddr-dmmem-rdimm-2d,DDR_))
83
84DDR_FIP_DEPS += ddr_certificates
85
86# Process TBB related flags
87ifneq (${GENERATE_COT},0)
88        # Common cert_create options
89        ifneq (${CREATE_KEYS},0)
90                $(eval DDR_CRT_ARGS += -n)
91                ifneq (${SAVE_KEYS},0)
92                       $(eval DDR_CRT_ARGS += -k)
93                endif
94        endif
95endif
96