update makefile

1. use new sign script
2. use new UUID format
3. compile 32 or 64 bit by parameters

Change-Id: I323493ce498d91d9eecf46b9692754c484114a73

17 files changed, 203 insertions, 19 deletions

diff --git a/Android.mk b/Android.mk
index db7b9a3..8f319e9 100644
--- a/Android.mk
+++ b/Android.mk
@@ -1,6 +1,10 @@
 TDK_TOP_DIR := $(call my-dir)
 TA_SIGN_TOOL := $(TDK_TOP_DIR)/ta_export/scripts/sign_ta.py
-TA_ROOT_KEY ?= $(TDK_TOP_DIR)/ta_export/keys/root_rsa_prv_key.pem
-TA_USER_KEY ?= $(TDK_TOP_DIR)/ta_export/keys/ta_rsa_prv_key.pem
+TA_GEN_CERT_TOOL := $(TDK_TOP_DIR)/ta_export/scripts/gen_cert_key.py
+TA_ROOT_PRIV_KEY ?= $(TDK_TOP_DIR)/ta_export/keys/root_rsa_prv_key.pem
+TA_USER_PUB_KEY ?= $(TDK_TOP_DIR)/ta_export/keys/ta_rsa_pub_key.pem
+TA_USER_PRIV_KEY ?= $(TDK_TOP_DIR)/ta_export/keys/ta_rsa_prv_key.pem
+TA_ROOT_AES_KEY ?= $(TDK_TOP_DIR)/ta_export/keys/ta_aes_key.bin
+TA_USER_AES_KEY ?= $(TDK_TOP_DIR)/ta_export/keys/ta_aes_key.bin
 
 include $(call all-subdir-makefiles)
diff --git a/demos/hello_world/ta/Android.mk b/demos/hello_world/ta/Android.mk
index 66cae70..a1b7149 100644
--- a/demos/hello_world/ta/Android.mk
+++ b/demos/hello_world/ta/Android.mk
@@ -1,6 +1,6 @@
 LOCAL_PATH:= $(call my-dir)
 TDK_PATH:=../../../
-TA_BINARY=8aaaf200-2450-11e4-abe20002a5d5c51b
+TA_BINARY=8aaaf200-2450-11e4-abe2-0002a5d5c51b
 TA_CROSS_COMPILE=arm-linux-gnueabihf-
 TA_EXPORT_DIR := out/target/product/$(TARGET_BOOTLOADER_BOARD_NAME)/system/lib/teetz
 OUTPUT_DIR = ../out/ta
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))
diff --git a/demos/hello_world/ta/Makefile b/demos/hello_world/ta/Makefile
index 1085a5f..98cec61 100644
--- a/demos/hello_world/ta/Makefile
+++ b/demos/hello_world/ta/Makefile
@@ -1,6 +1,6 @@
 CFG_TEE_TA_LOG_LEVEL ?= 2
 CPPFLAGS += -DCFG_TEE_TA_LOG_LEVEL=$(CFG_TEE_TA_LOG_LEVEL)
-BINARY=8aaaf200-2450-11e4-abe20002a5d5c51b
+BINARY=8aaaf200-2450-11e4-abe2-0002a5d5c51b
 TA_DEV_KIT_DIR=$(TDK_DIR)/ta_export
 
 include $(TA_DEV_KIT_DIR)/mk/ta_dev_kit.mk
diff --git a/demos/optee_test/ta/aes_perf/Android.mk b/demos/optee_test/ta/aes_perf/Android.mk
index c59c884..15e4873 100644
--- a/demos/optee_test/ta/aes_perf/Android.mk
+++ b/demos/optee_test/ta/aes_perf/Android.mk
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))
diff --git a/demos/optee_test/ta/concurrent/Android.mk b/demos/optee_test/ta/concurrent/Android.mk
index ccae656..2ad8d06 100644
--- a/demos/optee_test/ta/concurrent/Android.mk
+++ b/demos/optee_test/ta/concurrent/Android.mk
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))
diff --git a/demos/optee_test/ta/concurrent_large/Android.mk b/demos/optee_test/ta/concurrent_large/Android.mk
index 69b9e92..5f80a03 100644
--- a/demos/optee_test/ta/concurrent_large/Android.mk
+++ b/demos/optee_test/ta/concurrent_large/Android.mk
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))
diff --git a/demos/optee_test/ta/create_fail_test/Android.mk b/demos/optee_test/ta/create_fail_test/Android.mk
index d5a11f2..7e6a1c5 100644
--- a/demos/optee_test/ta/create_fail_test/Android.mk
+++ b/demos/optee_test/ta/create_fail_test/Android.mk
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))
diff --git a/demos/optee_test/ta/crypt/Android.mk b/demos/optee_test/ta/crypt/Android.mk
index 69a62cc..d465240 100644
--- a/demos/optee_test/ta/crypt/Android.mk
+++ b/demos/optee_test/ta/crypt/Android.mk
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))
diff --git a/demos/optee_test/ta/os_test/Android.mk b/demos/optee_test/ta/os_test/Android.mk
index e3e83b8..0e50aa5 100644
--- a/demos/optee_test/ta/os_test/Android.mk
+++ b/demos/optee_test/ta/os_test/Android.mk
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))
diff --git a/demos/optee_test/ta/rpc_test/Android.mk b/demos/optee_test/ta/rpc_test/Android.mk
index 0e6333c..fad66cd 100644
--- a/demos/optee_test/ta/rpc_test/Android.mk
+++ b/demos/optee_test/ta/rpc_test/Android.mk
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))
diff --git a/demos/optee_test/ta/sdp_basic/Android.mk b/demos/optee_test/ta/sdp_basic/Android.mk
index f52eedc..a2f351f 100644
--- a/demos/optee_test/ta/sdp_basic/Android.mk
+++ b/demos/optee_test/ta/sdp_basic/Android.mk
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))
diff --git a/demos/optee_test/ta/sha_perf/Android.mk b/demos/optee_test/ta/sha_perf/Android.mk
index 69ae414..2ffd46e 100644
--- a/demos/optee_test/ta/sha_perf/Android.mk
+++ b/demos/optee_test/ta/sha_perf/Android.mk
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))
diff --git a/demos/optee_test/ta/sims/Android.mk b/demos/optee_test/ta/sims/Android.mk
index 19c06ae..1572200 100644
--- a/demos/optee_test/ta/sims/Android.mk
+++ b/demos/optee_test/ta/sims/Android.mk
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))
diff --git a/demos/optee_test/ta/socket/Android.mk b/demos/optee_test/ta/socket/Android.mk
index 6d46c3c..ec87e5f 100644
--- a/demos/optee_test/ta/socket/Android.mk
+++ b/demos/optee_test/ta/socket/Android.mk
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))
diff --git a/demos/optee_test/ta/storage/Android.mk b/demos/optee_test/ta/storage/Android.mk
index e652634..7cf4670 100644
--- a/demos/optee_test/ta/storage/Android.mk
+++ b/demos/optee_test/ta/storage/Android.mk
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))
diff --git a/demos/optee_test/ta/storage2/Android.mk b/demos/optee_test/ta/storage2/Android.mk
index bebc7d3..523599d 100644
--- a/demos/optee_test/ta/storage2/Android.mk
+++ b/demos/optee_test/ta/storage2/Android.mk
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))
diff --git a/demos/optee_test/ta/storage_benchmark/Android.mk b/demos/optee_test/ta/storage_benchmark/Android.mk
index 9a672c4..0a12580 100644
--- a/demos/optee_test/ta/storage_benchmark/Android.mk
+++ b/demos/optee_test/ta/storage_benchmark/Android.mk
@@ -15,9 +15,21 @@ ta_file := $(wildcard $(OUTPUT_DIR)/*.ta)
 ta_file := $(patsubst $(OUTPUT_DIR)/%,%,$(ta_file))
 
 ifeq ($(PRODUCT_BUILD_SECURE_BOOT_IMAGE_DIRECTLY), true)
-$(info $(shell $(TA_SIGN_TOOL) --rootkey=$(TA_ROOT_KEY) --takey=$(TA_USER_KEY) \
+$(info $(shell $(TA_GEN_CERT_TOOL) --root_rsa_key=$(TA_ROOT_PRIV_KEY) \
+		--ta_rsa_key=$(TA_USER_PUB_KEY) \
+		--uuid=$(TA_BINARY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--root_aes_key=$(TA_ROOT_AES_KEY) \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
+$(info $(shell $(TA_SIGN_TOOL) --ta_rsa_key=$(TA_USER_PRIV_KEY) \
+		--ta_rsa_key_sig=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig \
+		--ta_aes_key=$(TA_USER_AES_KEY) \
+		--ta_aes_key_enc=$(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin \
 		--in=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta \
 		--out=$(LOCAL_PATH)/$(OUTPUT_DIR)/$(TA_BINARY).ta ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_rsa_key.sig ))
+$(info $(shell rm -f $(LOCAL_PATH)/$(OUTPUT_DIR)/ta_aes_key_enc.bin ))
 endif
 
 $(info $(shell mkdir -p $(PRODUCT_OUT)/obj/lib))