<?xml version="1.0" encoding="UTF-8"?>
<!--
===============================================================================

  Copyright (c) 2013-2017 Qualcomm Technologies, Inc.
  All Rights Reserved.
  Confidential and Proprietary - Qualcomm Technologies, Inc.

===============================================================================
-->

<tns:secimage xmlns:tns="http://www.qualcomm.com/secimage"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.qualcomm.com/secimage ../xsd/secimage.xsd">

    <metadata>
        <chipset>sdx24</chipset>
        <version>2.0</version>
    </metadata>

    <!--
       See documentation on general_properties below.
    -->
    <general_properties>
        <selected_signer>local_v2</selected_signer>
        <selected_encryptor></selected_encryptor>
        <selected_cert_config>qti_presigned_certs</selected_cert_config>
        <cass_capability>secboot_sha2_pss_subca2</cass_capability>

        <key_size>2048</key_size>
        <exponent>65537</exponent>

        <mrc_index>0</mrc_index>
        <num_root_certs>1</num_root_certs>
        <max_num_root_certs>4</max_num_root_certs>
        <root_revoke_activate_enable>disable</root_revoke_activate_enable>

        <!-- JTAG IDs:
         0x000960E1 - SDX24
         0x000970E1 - SDX24M
         0x0011d0E1 - SDX24_AUTO
         -->

        <msm_part>0x000960E1</msm_part>
        <soc_hw_version>0x60020100</soc_hw_version>
        <soc_vers>0x6002</soc_vers>
        <in_use_soc_hw_version>enable</in_use_soc_hw_version>
        <use_serial_number_in_signing>disable</use_serial_number_in_signing>
        <oem_id_independent>disable</oem_id_independent>
        <oem_id>0x0000</oem_id>
        <model_id>0x0000</model_id>
        <debug>nop</debug>
        <multi_serial_numbers>
            <!--<serial>0x12345678</serial>-->
        </multi_serial_numbers>
        <serial_number></serial_number> <!-- This is used when use_serial_number_in_signing is set to 1, populate with chip serial number: ex: 0x12345678 -->

        <secboot_version>3.0</secboot_version>
        <qti_sign>false</qti_sign>
        <oem_sign>true</oem_sign>

        <max_cert_size>2048</max_cert_size>
        <num_certs_in_certchain>3</num_certs_in_certchain>

        <hmac>false</hmac>
        <dsa_type>ecdsa</dsa_type>
        <ecdsa_curve>secp384r1</ecdsa_curve>
        <!-- sdx24 also supports RSA. To configure this use:
        <dsa_type>rsa</dsa_type>
        <rsa_padding>pss</rsa_padding>
        <hash_algorithm>sha256</hash_algorithm>
        -->
        <hash_algorithm>sha384</hash_algorithm>
        <segment_hash_algorithm>sha384</segment_hash_algorithm>
    </general_properties>

    <!--
        ***general_properties***

        The default properties for all images. These properties may be overridden
        per image in the 'images' section below as needed.

        Supported signer are:
        local_v2: use local signer with test keys
        cass: use cass signer with production key

        Supported encryptor are:
        unified_encryption_2_0: supports ELF images. Image must be signed to encrypt

        Capability selected the signing key used. Currently, the following capabilities are supported.
        OEM may obtain additional capabilities from CASS support.

        secboot_sha2_pss_subca2: use SHA256, RSAPSS signed root cert

        If "secboot_sha2_pss_subca2" is selected,the PK_HASH_IN_FUSE needs to be blown,
        and the ROOT CERT HASH below needs to be blown in OEM PK HASH:
        d40eee56f3194665574109a39267724ae7944134cd53cb767e293d3c40497955bc8a4519ff992b031fadc6355015ac87

        key_size: Size (in bits) of the key used for signing.
        exponent: exponent value used in attestation key generation.

        mrc_index: the root index for multiple root certificates (MRC) use case (0-3)
        num_root_certs: Number of root certificates in the certificate chain (1-4)
        root_revoke_activate_enable: enable revocation and activation (in hex)

        msm_part: jtag_id for signing. (in hex)
        soc_hw_version: MSM identifier used for latest family of chips (in hex)
        in_use_soc_hw_version: flag to use JTAG_ID or SOC_HW_VERSION (0 or 1)
        use_serial_number_in_signing: flag to use serial number in HW_ID (0 or 1)
        oem_id_independent: flag to set oem_id=0x0001 and model_id=0x0000 (0 or 1)
        oem_id: oem_id for signing. (in hex)
        model_id: model_id for signing. (in hex)
        debug: debug_id for signing. (in hex)
        multi_serial_numbers: serial number list that enable serial binding (in hex)
        serial_number: serial number to set in HW_ID (in hex)

        max_cert_size: Maximum size (in bytes) of one certificate.
        num_certs_in_certchain: Number of certificates in the certificate chain (2,3)

        UIE_key: Specifies which local key assets to use for encryption.
        uie_key_switch_enable: enable UIE key switch (in hex)
        hmac: use HMAC or SHA256 (in boolean)
        rsa_padding: PKCS1.5 or RSAPSS for signature and certificate chain (pkcs or pss)

        QTI internal: (shall not be modified by customer)
        max_num_root_certs: Maximum number of root certificates allowed (1-4)
        UIE_capability: Specifies which encrypted key assets to retrieve from QTI UIE server and use for encryption.
        UIE_root_key_type: Defaults to 1. Can be set to either 0, 1 or 2 depending on whether RTL QTI, OTP OEM, or OTP QTI root key will be used for encryption
        secboot_version: define ELF image header format (1.0, 2.0, or 3.0)
        oem_sign: enable OEM sig segment (in boolean)
        qti_sign: enable QTI sig segment (in boolean)
    -->

    <parsegen>
        <!--
        Parsegen information by default will be read from parsegen_config.xml.
        Additional image_id's can be included here or existing image_id's may be overwritten
        to be generated with the default image_ids.
        -->
    </parsegen>

    <!-- Signing configurations used by secimage. -->
    <signing>
        <signer_attributes>
            <!--
                Use of CASS signer will require additional license agreement
                and contract. Hardware token is required for access.
            -->
            <cass_signer_attributes>
                <!--
                    keystore_type: PKCS11 (hardware token)
                    token_password: User will be prompted if password
                                    is an empty string
                    token_driver_home: Safenet driver location
                -->
                <user_identity>
                    <keystore_type>PKCS11</keystore_type>
                    <token_password></token_password>
                    <token_driver_home>
                        <windows>C:/WINDOWS/SYSTEM32/eTpkcs11.dll</windows>
                        <linux>/usr/lib/libeTPkcs11.so</linux>
                    </token_driver_home>
                </user_identity>
            </cass_signer_attributes>
        </signer_attributes>
    </signing>

    <data_provisioning>
        <base_path>./../../resources/data_prov_assets/</base_path>
    </data_provisioning>

    <post_process>
        <pil_splitter>$(META_BUILD)/common/tools/misc/pil-splitter.py</pil_splitter>
    </post_process>

    <images_list>
        <!--This is for FLASHLESS build-->
        <image sign_id="sbl1" name="sbl1.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x00000000</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
        </image>

        <!--This is for NAND build-->
        <image sign_id="sbl1_nand" name="sbl1.mbn" image_type="elf_preamble">
            <general_properties_overrides>
                <sw_id>0x00000000</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
            <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:BOOT_BINARY)</meta_build_location>
        </image>

        <!--to generate signed NAND image with hash segment 128byte aligned-->
        <image sign_id="sbl1_nand_hash_128b_align" name="sbl1.mbn" image_type="elf_preamble_end_128b_aligned">
            <general_properties_overrides>
                <sw_id>0x00000000</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
            <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:BOOT_BINARY)</meta_build_location>
        </image>

        <!--to generate signed image with hash segment 64byte aligned-->
        <image sign_id="sbl1_hash_64b_align" name="sbl1.mbn" image_type="elf_end_64b_aligned">
            <general_properties_overrides>
                <sw_id>0x00000000</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
        </image>

        <!--to generate signed image with hash segment 128byte aligned-->
        <image sign_id="sbl1_hash_128b_align" name="sbl1.mbn" image_type="elf_end_128b_aligned">
            <general_properties_overrides>
                <sw_id>0x00000000</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
        </image>

        <image sign_id="xbl_config" name="xbl_config.elf" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x00000025</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
            <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:BOOT_CONFIG)</meta_build_location>
        </image>
        <image sign_id="prog_firehose" name="prog_firehose_sdx24.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x00000003</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
             <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:BOOT_BINARY_PROG)</meta_build_location>
        </image>
        <!--ENPRG currently not present in sdx24 boot build. TODO: check and remove is needed -->
        <!--<image sign_id="NPRG" name="NPRGsdx24.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x00000003</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
            <meta_build_location>$(BUILD_PATH:boot)/boot_images/build/ms/bin/sdx24/nand/unsigned/NPRGsdx24.mbn</meta_build_location>
        </image> -->

        <!--ENPRG currently not present in sdx24 boot build. TODO: check and remove is needed -->
        <!--<image sign_id="ENPRG" name="ENPRGsdx24.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x00000003</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
            <meta_build_location>$(BUILD_PATH:boot)/boot_images/build/ms/bin/sdx24/nand/unsigned/ENPRGsdx24.mbn</meta_build_location>
        </image>-->

        <image sign_id="tz" name="tz.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x00000007</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
                <oem_id_independent>enable</oem_id_independent>
                <qti_sign>true</qti_sign>
                <selected_encryptor>unified_encryption_2_0</selected_encryptor>
                <UIE_key>default</UIE_key>
            </general_properties_overrides>
            <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:TZ_BINARY)</meta_build_location>
        </image>
        <image sign_id="devcfg" name="devcfg.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x00000005</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
            <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:DEVCFG_BINARY)</meta_build_location>
        </image>
        <!-- TODO: APPS image shouldn't be signed for SDX.LE but may be needed for other variants -->
        <!--<image sign_id="apps" name="apps.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x0000000E</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
            <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:APSS_BINARY)</meta_build_location>
        </image> -->

        <image sign_id="aop" name="aop.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x00000021</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
            <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:AOP_BINARY)</meta_build_location>
        </image>

        <image sign_id="modem" name="qdsp6sw.mbn" image_type="elf_has_ht" output_file_name="modem.mbn">
            <general_properties_overrides>
                <sw_id>0x00000002</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
            <pil_split>true</pil_split>
            <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:MPSS_BINARY)</meta_build_location>
        </image>

        <image sign_id="mcfg_hw" name="mcfg_hw.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x00000002</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
        </image>

        <image sign_id="efs_tar" name="fs_image.tar.gz.mbn" image_type="mbn_40b">
            <general_properties_overrides>
                <sw_id>0x0000001B</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
        </image>

        <image sign_id="mcfg_sw" name="mcfg_sw.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x00000002</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
        </image>

        <image sign_id="abl" name="abl.elf" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x0000001C</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
            <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:ABL_ELF)</meta_build_location>
        </image>

        <image sign_id="uefi" name="uefi.elf" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x00000009</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
            <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:UEFI_ELF)</meta_build_location>
        </image>

        <image sign_id="xbl_sec" name="xbl_sec.mbn" image_type="elf_post_phdr_load_aligned">
            <general_properties_overrides>
                <sw_id>0x0000000B</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
                <oem_id_independent>enable</oem_id_independent>
                <qti_sign>true</qti_sign>
                <oem_sign>false</oem_sign>
            </general_properties_overrides>
        </image>

        <image sign_id="multi_image" name="multi_image.mbn" image_type="multi_image" output_file_name="multi_image.mbn">
            <general_properties_overrides>
                <sw_id>0x00000022</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
                <multi_image_segment_addr>0x148D7000</multi_image_segment_addr>
            </general_properties_overrides>
        </image>

        <image sign_id="multi_image_qti" name="multi_image_qti.mbn" image_type="multi_image" output_file_name="multi_image_qti.mbn">
            <general_properties_overrides>
                <qti_sign>true</qti_sign>
                <oem_sign>false</oem_sign>
                <oem_id_independent>enable</oem_id_independent>
                <sw_id>0x00000023</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
                <multi_image_segment_addr>0x8FFF8000</multi_image_segment_addr>
            </general_properties_overrides>
        </image>

        <image sign_id="ipa_fw" name="ipa_fws.elf" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x0000001D</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
            <pil_split>true</pil_split>
            <meta_build_location>$(FILE_TYPE:file_ref, ATTR:cmm_file_var, VAR:IPA_FWS_ELF)</meta_build_location>
        </image>

        <image sign_id="hyp" name="hyp.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x00000015</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
            </general_properties_overrides>
            <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:HYP_BINARY)</meta_build_location>
        </image>

        <image sign_id="cmnlib" name="cmnlib.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x0000001F</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
                <app_id>0x00000555</app_id>
                <oem_id_independent>enable</oem_id_independent>
                <qti_sign>true</qti_sign>
                <selected_encryptor>unified_encryption_2_0</selected_encryptor>
                <UIE_key>default</UIE_key>
            </general_properties_overrides>
            <pil_split>true</pil_split>
            <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:CMNLIB_BINARY)</meta_build_location>
        </image>

        <image sign_id="cmnlib64" name="cmnlib64.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x0000001F</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
                <app_id>0x00000556</app_id>
                <oem_id_independent>enable</oem_id_independent>
                <qti_sign>true</qti_sign>
                <selected_encryptor>unified_encryption_2_0</selected_encryptor>
                <UIE_key>default</UIE_key>
            </general_properties_overrides>
            <pil_split>true</pil_split>
            <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:CMNLIB64_BINARY)</meta_build_location>
        </image>

         <image sign_id="sampleapp32" name="smplap32.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x0000000C</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
                <app_id>0x00000111</app_id>
            </general_properties_overrides>
            <pil_split>true</pil_split>
            <meta_build_location>$(FILE_TYPE:file_ref, ATTR:pil_split, VAR:smplap32)</meta_build_location>
        </image>

        <image sign_id="sampleapp64" name="smplap64.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x0000000C</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
                <app_id>0x00000112</app_id>
            </general_properties_overrides>
            <pil_split>true</pil_split>
            <meta_build_location>$(FILE_TYPE:file_ref, ATTR:pil_split, VAR:smplap64)</meta_build_location>
        </image>

        <image sign_id="smpcpyap" name="smpcpyap.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x0000000C</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
                <app_id>0x00000111</app_id>
                <qti_sign>true</qti_sign>
            </general_properties_overrides>
            <pil_split>true</pil_split>
        </image>

        <image sign_id="keymaster" name="km4.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x0000000C</sw_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
                <app_id>0x00000666</app_id>
            </general_properties_overrides>
            <pil_split>true</pil_split>
            <meta_build_location>$(FILE_TYPE:download_file, ATTR:cmm_file_var, VAR:KEYMASTER_BINARY)</meta_build_location>
        </image>

        <image sign_id="haventkn" name="haventkn.mbn" image_type="elf_has_ht">
            <general_properties_overrides>
                <sw_id>0x0000000C</sw_id>
                <app_id>0x00000131</app_id>
                <anti_rollback_version>0x00000000</anti_rollback_version>
                <oem_id_independent>enable</oem_id_independent>
                <qti_sign>true</qti_sign>
                <selected_encryptor>unified_encryption_2_0</selected_encryptor>
                <UIE_key>default</UIE_key>
            </general_properties_overrides>
            <pil_split>true</pil_split>
            <meta_build_location>
                $(FILE_TYPE:file_ref, ATTR:pil_split, VAR:haventkn)
                $(FILE_TYPE:file_ref, ATTR:cmm_file_var, VAR:HAVENTKN_BINARY)
            </meta_build_location>
        </image>
    </images_list>

</tns:secimage>
