diff options
| author | Masahiro Yamada <yamada.masahiro@socionext.com> | 2017-06-14 20:38:12 +0900 |
|---|---|---|
| committer | Masahiro Yamada <yamada.masahiro@socionext.com> | 2017-06-20 23:54:28 +0900 |
| commit | 63634800fcd82c3395959bcc88328427f6c06308 (patch) | |
| tree | e334cb88c8b3a1292d712ad38b774701f5cf29bd /plat/socionext/uniphier/platform.mk | |
| parent | 0dc3c353054896722b7cbfbd04a4d845619485e7 (diff) | |
uniphier: embed ROTPK hash into BL1/BL2
Currently, ROTPK_NOT_DEPLOYED flag is set in plat_get_rotpk_info().
It is up to users how to retrieve ROTPK if the ROT verification is
desired. This is not nice.
This commit improves plat_get_rotpk_info() implementation and automates
the ROTPK deployment. UniPhier platform has no ROTPK storage, so it
should be embedded in BL1/BL2, like ARM_ROTPK_LOCATION=devel_rsa case.
This makes sense because UniPhier platform implements its internal ROM
i.e. BL1 is used as updatable pseudo ROM.
Things work like this:
- ROT_KEY (default: $(BUILD_PLAT)/rot_key.pem) is created if missing.
Users can override ROT_KEY from the command line if they want to
use a specific ROT key.
- ROTPK_HASH is generated based on ROT_KEY.
- ROTPK_HASH is included by uniphier_rotpk.S and compiled into BL1/BL2.
- ROT_KEY is input to cert_create tool.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Diffstat (limited to 'plat/socionext/uniphier/platform.mk')
| -rw-r--r-- | plat/socionext/uniphier/platform.mk | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/plat/socionext/uniphier/platform.mk b/plat/socionext/uniphier/platform.mk index af8e3ace..7ea0f108 100644 --- a/plat/socionext/uniphier/platform.mk +++ b/plat/socionext/uniphier/platform.mk @@ -86,11 +86,29 @@ TBB_SOURCES := drivers/auth/auth_mod.c \ drivers/auth/img_parser_mod.c \ drivers/auth/tbbr/tbbr_cot.c \ plat/common/tbbr/plat_tbbr.c \ + $(PLAT_PATH)/uniphier_rotpk.S \ $(PLAT_PATH)/uniphier_tbbr.c BL1_SOURCES += $(TBB_SOURCES) BL2_SOURCES += $(TBB_SOURCES) +ROT_KEY = $(BUILD_PLAT)/rot_key.pem +ROTPK_HASH = $(BUILD_PLAT)/rotpk_sha256.bin + +$(eval $(call add_define_val,ROTPK_HASH,'"$(ROTPK_HASH)"')) +$(BUILD_PLAT)/bl1/uniphier_rotpk.o: $(ROTPK_HASH) +$(BUILD_PLAT)/bl2/uniphier_rotpk.o: $(ROTPK_HASH) + +certificates: $(ROT_KEY) +$(ROT_KEY): + @echo " OPENSSL $@" + $(Q)openssl genrsa 2048 > $@ 2>/dev/null + +$(ROTPK_HASH): $(ROT_KEY) + @echo " OPENSSL $@" + $(Q)openssl rsa -in $< -pubout -outform DER 2>/dev/null |\ + openssl dgst -sha256 -binary > $@ 2>/dev/null + endif .PHONY: bl1_gzip |