cert_create: add Platform owned secure partitions support

Add support to generate a certificate named "plat-sp-cert" for Secure
Partitions(SP) owned by Platform.
Earlier a single certificate file "sip-sp-cert" was generated which
contained hash of all 8 SPs, with this change SPs are divided into
two categories viz "SiP owned" and "Plat owned" containing 4 SPs each.

Platform RoT key pair is used for signing.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I5bd493cfce4cf3fc14b87c8ed1045f633d0c92b6

6 files changed, 29 insertions, 2 deletions

diff --git a/include/tools_share/firmware_image_package.h b/include/tools_share/firmware_image_package.h
index 7342c0ced..bcde04fd1 100644
--- a/include/tools_share/firmware_image_package.h
+++ b/include/tools_share/firmware_image_package.h
@@ -66,6 +66,8 @@
 	{{0x8e,  0xc4, 0xc1, 0xf3}, {0x5d, 0x63}, {0xe4, 0x11}, 0xa7, 0xa9, {0x87, 0xee, 0x40, 0xb2, 0x3f, 0xa7} }
 #define UUID_SIP_SECURE_PARTITION_CONTENT_CERT \
 	{{0x77,  0x6d, 0xfd, 0x44}, {0x86, 0x97}, {0x4c, 0x3b}, 0x91, 0xeb, {0xc1, 0x3e, 0x02, 0x5a, 0x2a, 0x6f} }
+#define UUID_PLAT_SECURE_PARTITION_CONTENT_CERT \
+	{{0xdd,  0xcb, 0xbf, 0x4a}, {0xca, 0xd6}, {0x11, 0xea}, 0x87, 0xd0, {0x02, 0x42, 0xac, 0x13, 0x00, 0x03} }
 /* Dynamic configs */
 #define UUID_HW_CONFIG \
 	{{0x08,  0xb8, 0xf1, 0xd9}, {0xc9, 0xcf}, {0x93, 0x49}, 0xa9, 0x62, {0x6f, 0xbc, 0x6b, 0x72, 0x65, 0xcc} }
diff --git a/lib/debugfs/devfip.c b/lib/debugfs/devfip.c
index b0ee39a11..d8b83b7a4 100644
--- a/lib/debugfs/devfip.c
+++ b/lib/debugfs/devfip.c
@@ -76,7 +76,8 @@ static const struct uuidnames uuidnames[] = {
 	{"fw.cfg",		UUID_FW_CONFIG},
 	{"rot-k.crt",		UUID_ROT_KEY_CERT},
 	{"nt-k.crt",		UUID_NON_TRUSTED_WORLD_KEY_CERT},
-	{"sip-sp.crt",		UUID_SIP_SECURE_PARTITION_CONTENT_CERT}
+	{"sip-sp.crt",		UUID_SIP_SECURE_PARTITION_CONTENT_CERT},
+	{"plat-sp.crt",		UUID_PLAT_SECURE_PARTITION_CONTENT_CERT}
 };
 
 /*******************************************************************************
diff --git a/make_helpers/tbbr/tbbr_tools.mk b/make_helpers/tbbr/tbbr_tools.mk
index 952093443..9c92d3ffb 100644
--- a/make_helpers/tbbr/tbbr_tools.mk
+++ b/make_helpers/tbbr/tbbr_tools.mk
@@ -103,4 +103,7 @@ endif
 # Add SiP owned Secure Partitions CoT (image cert)
 ifneq (${SP_LAYOUT_FILE},)
     $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/sip_sp_content.crt,--sip-sp-cert))
+ifeq (${COT},dualroot)
+    $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/plat_sp_content.crt,--plat-sp-cert))
+endif
 endif
diff --git a/tools/cert_create/include/dualroot/cot.h b/tools/cert_create/include/dualroot/cot.h
index 1d959d465..3e50c8986 100644
--- a/tools/cert_create/include/dualroot/cot.h
+++ b/tools/cert_create/include/dualroot/cot.h
@@ -23,6 +23,7 @@ enum {
 
 	/* Certificates owned by the platform owner. */
 	NON_TRUSTED_FW_CONTENT_CERT,
+	PLAT_SECURE_PARTITION_CONTENT_CERT,
 };
 
 /* Certificate extensions. */
diff --git a/tools/cert_create/src/dualroot/cot.c b/tools/cert_create/src/dualroot/cot.c
index a12ea21ff..4dd4cf033 100644
--- a/tools/cert_create/src/dualroot/cot.c
+++ b/tools/cert_create/src/dualroot/cot.c
@@ -152,12 +152,27 @@ static cert_t cot_certs[] = {
 			SP_PKG2_HASH_EXT,
 			SP_PKG3_HASH_EXT,
 			SP_PKG4_HASH_EXT,
+		},
+		.num_ext = 5
+	},
+
+	[PLAT_SECURE_PARTITION_CONTENT_CERT] = {
+		.id = PLAT_SECURE_PARTITION_CONTENT_CERT,
+		.opt = "plat-sp-cert",
+		.help_msg = "Platform owned Secure Partition Content Certificate (output file)",
+		.fn = NULL,
+		.cn = "Platform owned Secure Partition Content Certificate",
+		.key = PROT_KEY,
+		.issuer = PLAT_SECURE_PARTITION_CONTENT_CERT,
+		.ext = {
+			NON_TRUSTED_FW_NVCOUNTER_EXT,
 			SP_PKG5_HASH_EXT,
 			SP_PKG6_HASH_EXT,
 			SP_PKG7_HASH_EXT,
 			SP_PKG8_HASH_EXT,
+			PROT_PK_EXT,
 		},
-		.num_ext = 9
+		.num_ext = 6
 	},
 
 	[FWU_CERT] = {
diff --git a/tools/fiptool/tbbr_config.c b/tools/fiptool/tbbr_config.c
index bf721c1fa..c1e5217f0 100644
--- a/tools/fiptool/tbbr_config.c
+++ b/tools/fiptool/tbbr_config.c
@@ -162,6 +162,11 @@ toc_entry_t toc_entries[] = {
 		.cmdline_name = "sip-sp-cert"
 	},
 	{
+		.name = "Platform owned Secure Partition content certificate",
+		.uuid = UUID_PLAT_SECURE_PARTITION_CONTENT_CERT,
+		.cmdline_name = "plat-sp-cert"
+	},
+	{
 		.name = NULL,
 		.uuid = { {0} },
 		.cmdline_name = NULL,