<?xml version="1.0" encoding="UTF-8"?>
<!--
===============================================================================

  Copyright (c) 2013-2017 Qualcomm Technologies, Inc.
  All Rights Reserved.
  Confidential and Proprietary - Qualcomm Technologies, Inc.

===============================================================================
-->

<tns:sectools_policy xmlns:tns="http://www.qualcomm.com/sectools_policy"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.qualcomm.com/sectools_policy ../xsd/sectools_policy.xsd">

    <!--
        The sec_image_policy defines the secured image policies,
        such as "sign", "encrypt", or "sign and encrypt". The policy
        is enabled if either:
        1. The feature_flag of the sec_image_policy is defined
           in the environment variable.
        2. The sec_image_policy id is enabled in build_policy
        If no sec_image_policy feature flag is enabled,
        it will default to unsign policy which is an no-op.

        Multiple sec_image_policy can be enabled at any time.
    -->
    <sec_image_policy>
        <policy id="sign" feature_flag="USES_SEC_POLICY_SIGN" cmd_options="-s"/>
        <policy id="encrypt" feature_flag="USES_SEC_POLICY_ENCRYPT" cmd_options="-e"/>
        <policy id="sign_and_encrypt" feature_flag="USES_SEC_POLICY_SIGN_AND_ENCRYPT" cmd_options="-se">
            <exclude>
                <sign_id>mba_ewm</sign_id>
                <sign_id>sbl1_mbn</sign_id>
            </exclude>
        </policy>
        <policy id="integrity_check" feature_flag="USES_SEC_POLICY_INTEGRITY_CHECK" cmd_options="-t">
            <exclude>
                <sign_id>sbl1_mbn</sign_id>
            </exclude>
        </policy>
        <policy id="integrity_check_sign_attr" feature_flag="USES_SEC_POLICY_INTEGRITY_CHECK_SIGN_ATTR" cmd_options="-tr"/>
    </sec_image_policy>

    <!--
        The install_policy defines installation location for the
        corresponding sec_image_policy. The installation policy
        is enabled if the corresponding sec_image_policy is enabled
        and either:
        1. The feature_flag of the install_policy is defined in
           the environment variable
        2. The install_policy id is enabled in build_policy

        ${sectools_install_base_dir} is passed from the command line
        in the sectools_builder to construct the directory name.

        If no install_policy is defined/enabled for a sec_image_policy,
        no installation (i.e. copy of generated image) will be performed.

        Multiple install_policy can be enabled for a sec_image_policy.

        Installation policies do not apply for unsigned images.
    -->
    <install_policy>
        <!--
            Install policy name: subfolder
            1. Install signed image to
                "<sectools_install_base_dir>/signed" folder
            2. Install signed and encrypted image to
                "<sectools_install_base_dir>/signed_encrypted" folder
            3. Install unsigned image with signing attributes in MBN header to
                "<sectools_install_base_dir>/integrity_sign_attr" folder
        -->
        <policy id="subfolder" feature_flag="USES_SEC_POLICY_INSTALL_SUBFOLDER">
            <directory sec_image_policy="sign">
                <value>${sectools_install_base_dir}/signed</value>
            </directory>
            <directory sec_image_policy="sign_and_encrypt">
                <value>${sectools_install_base_dir}/signed_encrypted</value>
            </directory>
            <directory sec_image_policy="integrity_check_sign_attr">
                <value>${sectools_install_base_dir}/integrity_sign_attr</value>
            </directory>
        </policy>

        <!--
            Install policy name: default_sign
            1. Install signed image to
                <sectools_install_base_dir> folder
            2. Install unsigned image (with hash table for integrity check) to
                "<sectools_install_base_dir>/integrity" folder
            3. Install unsigned image with signing attributes in MBN header to
                "<sectools_install_base_dir>/integrity_sign_attr" folder
        -->
        <policy id="default_sign" feature_flag="USES_SEC_POLICY_INSTALL_DEFAULT_SIGN">
            <directory sec_image_policy="sign">
                <value>${sectools_install_base_dir}</value>
            </directory>
            <directory sec_image_policy="integrity_check">
                <value>${sectools_install_base_dir}/integrity</value>
            </directory>
            <directory sec_image_policy="integrity_check_sign_attr">
                <value>${sectools_install_base_dir}/integrity_sign_attr</value>
            </directory>
        </policy>

        <!--
            Install policy name: default_sign_update_unsign
            1. Install signed image to
                <sectools_install_base_dir> folder
            2. Install unsigned image (with hash table for integrity check) to
                "<sectools_install_base_dir>/unsigned" folder
            3. Install unsigned image with signing attributes in MBN header to
                "<sectools_install_base_dir>/integrity_sign_attr" folder
        -->
        <policy id="default_sign_update_unsign" feature_flag="USES_SEC_POLICY_INSTALL_DEFAULT_SIGN_UPDATE_UNSIGN">
            <directory sec_image_policy="sign">
                <value>${sectools_install_base_dir}</value>
            </directory>
            <directory sec_image_policy="integrity_check">
                <value>${sectools_install_base_dir}/unsigned</value>
            </directory>
            <directory sec_image_policy="integrity_check_sign_attr">
                <value>${sectools_install_base_dir}/integrity_sign_attr</value>
            </directory>
        </policy>

        <!--
            Install policy name: default_sign_encrypt
            1. Install signed and encrypted image to
                <sectools_install_base_dir> folder
            2. Install unsigned image (with hash table for integrity check) to
                "<sectools_install_base_dir>/integrity" folder
        -->
        <policy id="default_sign_encrypt" feature_flag="USES_SEC_POLICY_INSTALL_DEFAULT_SIGN_ENCRYPT">
            <directory sec_image_policy="sign_and_encrypt">
                <value>${sectools_install_base_dir}</value>
            </directory>
            <directory sec_image_policy="integrity_check">
                <value>${sectools_install_base_dir}/integrity</value>
            </directory>
        </policy>

        <!--
            Install policy name: default_unsign
            1. Install unsigned image (with hash table for integrity check) to
                <sectools_install_base_dir> folder
        -->
        <policy id="default_unsign" feature_flag="USES_SEC_POLICY_INSTALL_DEFAULT_UNSIGN">
            <directory sec_image_policy="integrity_check">
                <value>${sectools_install_base_dir}</value>
            </directory>
        </policy>

        <!--
            Install policy name: default_integrity_check_sign_attr
            1. Install unsigned image with signing attributes in MBN header to
                "<sectools_install_base_dir>/integrity_sign_attr" folder
        -->
        <policy id="default_integrity_check_sign_attr" feature_flag="USES_SEC_POLICY_INSTALL_DEFAULT_INTEGRITY_CHECK_SIGN_ATTR">
            <directory sec_image_policy="integrity_check_sign_attr">
                <value>${sectools_install_base_dir}</value>
            </directory>
        </policy>

    </install_policy>

    <!--
        The build_policy enables a set of sec_image_policy
        and install_policy. The build_policy is enabled
        if the feature_flag is defined in the environment.

        Only one build_policy can be enabled at any time.
        However, additional sec_image_policy or install_policy
        can be supported with enabling of feature_flag.
    -->
    <build_policy>

        <!--
            Build policy name: default_sign
            Generate:
            1. Signed image
               - default installation
        -->
        <policy_enable id="default_sign"
                feature_flag="USES_SEC_POLICY_DEFAULT_SIGN">
            <sec_image_policy>sign</sec_image_policy>
            <install_policy>default_sign</install_policy>
        </policy_enable>

        <!--
            Build policy name: default_integrity_sign_attr
            Generate:
            1. Integrity image with signing attributes in MBN header (if Secboot 3.0 signing)
               - default installation
        -->
        <policy_enable id="default_integrity_sign_attr"
                feature_flag="USES_SEC_POLICY_DEFAULT_INTEGRITY_SIGN_ATTR">
            <sec_image_policy>integrity_check_sign_attr</sec_image_policy>
            <install_policy>default_integrity_check_sign_attr</install_policy>
        </policy_enable>

        <!--
            Build policy name: default_sign_update_unsign
            Generate:
            1. Signed image
               - default installation
            2. Unsigned image
               - subfolder installation
        -->
        <policy_enable id="default_sign_update_unsign"
                feature_flag="USES_SEC_POLICY_DEFAULT_SIGN_UPDATE_UNSIGN">
            <sec_image_policy>sign</sec_image_policy>
            <sec_image_policy>integrity_check</sec_image_policy>
            <install_policy>default_sign_update_unsign</install_policy>
        </policy_enable>

        <!--
            Build policy name: default_unsign
            Generate:
            1. Unsigned image
               - default installation
        -->
        <policy_enable id="default_unsign"
                feature_flag="USES_SEC_POLICY_DEFAULT_UNSIGN">
            <sec_image_policy>integrity_check</sec_image_policy>
            <install_policy>default_unsign</install_policy>
        </policy_enable>

        <!--
            Build policy name: default_subfolder_sign
            Generate:
            1. Signed image
               - default installation
               - subfolder installation
        -->
        <policy_enable id="default_subfolder_sign"
                feature_flag="USES_SEC_POLICY_DEFAULT_SUBFOLDER_SIGN">
            <sec_image_policy>sign</sec_image_policy>
            <install_policy>subfolder</install_policy>
            <install_policy>default_sign</install_policy>
        </policy_enable>

        <!--
            Build policy name: default_subfolder_integrity_sign_attr
            Generate:
            1. Integrity image with signing attributes in MBN header (if Secboot 3.0 signing)
               - default installation
               - subfolder installation
        -->
        <policy_enable id="default_subfolder_integrity_sign_attr"
                feature_flag="USES_SEC_POLICY_DEFAULT_SUBFOLDER_INTEGRITY_SIGN_ATTR">
            <sec_image_policy>integrity_check_sign_attr</sec_image_policy>
            <install_policy>subfolder</install_policy>
            <install_policy>default_integrity_check_sign_attr</install_policy>
        </policy_enable>

        <!--
            Build policy name: subfolder_multiple_sign_and_encrypt
            Generate:
            1. Signed image
               - subfolder installation
            2. Signed and encrypted image
               - subfolder installation
        -->
        <policy_enable id="subfolder_multiple_sign_and_encrypt"
                feature_flag="USES_SEC_POLICY_SUBFOLDER_MULTIPLE_SIGN_AND_ENCRYPT">
            <sec_image_policy>sign</sec_image_policy>
            <sec_image_policy>sign_and_encrypt</sec_image_policy>
            <install_policy>subfolder</install_policy>
            <install_policy>default_unsign</install_policy>
        </policy_enable>

        <!--
            Build policy name: multiple_default_sign
            Generate:
            1. Signed image
               - subfolder installation
               - default installation
            2. Signed and encrypted image
               - subfolder installation
        -->
        <policy_enable id="multiple_default_sign"
                feature_flag="USES_SEC_POLICY_MULTIPLE_DEFAULT_SIGN">
            <sec_image_policy>sign</sec_image_policy>
            <sec_image_policy>sign_and_encrypt</sec_image_policy>
            <install_policy>subfolder</install_policy>
            <install_policy>default_sign</install_policy>
        </policy_enable>

        <!--
            Build policy name: multiple_default_sign_encrypt
            Generate:
            1. Signed image
               - subfolder installation
            2. Signed and encrypted image
               - subfolder installation
               - default installation
        -->
        <policy_enable id="multiple_default_sign_encrypt"
                feature_flag="USES_SEC_POLICY_MULTIPLE_DEFAULT_SIGN_ENCRYPT">
            <sec_image_policy>sign</sec_image_policy>
            <sec_image_policy>sign_and_encrypt</sec_image_policy>
            <install_policy>subfolder</install_policy>
            <install_policy>default_sign_encrypt</install_policy>
        </policy_enable>

    </build_policy>

</tns:sectools_policy>
