# AArch64 UEFI application - wolfBoot as a UEFI app (the AArch64 sibling of the
# x86_64_efi target). Validated on the NVIDIA Jetson Orin Nano (Tegra234).
#
# wolfBoot builds as an AArch64 UEFI application (wolfboot.efi) launched by the
# platform UEFI firmware. It reads kernel.img/update.img from the EFI Simple
# File System, verifies them, and boots via UEFI LoadImage/StartImage.
# Modeled on config/examples/x86_64_efi.config.
#
# Prerequisite: build gnu-efi for AArch64 first (one-time):
#   ./tools/scripts/build-gnu-efi-aarch64.sh
# then:  cp config/examples/aarch64_efi.config .config && make
#
# Crypto starts on ED25519/SHA256 (matches the proven x86 EFI target) to
# de-risk the first build. Switch to ECC384/SHA384 once the port builds and
# runs: set SIGN?=ECC384, HASH?=SHA384, SPMATH=1 (pulls in SP math objects).
ARCH=AARCH64
TARGET=aarch64_efi
WOLFBOOT_SMALL_STACK=1
SIGN?=ED25519
HASH?=SHA256
DEBUG=1
SPMATH=0
# required for keytools
WOLFBOOT_SECTOR_SIZE?=0x1000
WOLFBOOT_NO_PARTITIONS=1
# Measured boot: extend the verified kernel into the platform firmware TPM via
# EFI_TCG2_PROTOCOL (PCR MEASURED_PCR_A) before handoff, using the firmware's
# own TPM stack -- no wolfTPM transport. Best-effort: skips cleanly if the
# firmware exposes no TCG2/TPM. Validated on the NVIDIA Orin Nano fTPM
# (TPM present, SHA-256 + SHA-384 PCR banks).
MEASURED_BOOT_TCG2=1
MEASURED_PCR_A?=9