config.mk 3.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103
  1. # SPDX-License-Identifier: GPL-2.0+
  2. #
  3. # Copyright (C) 2017-2018 Texas Instruments Incorporated - http://www.ti.com/
  4. # Lokesh Vutla <lokeshvutla@ti.com>
  5. ifdef CONFIG_SPL_BUILD
  6. # Openssl is required to generate x509 certificate.
  7. # Error out if openssl is not available.
  8. ifeq ($(shell which openssl),)
  9. $(error "No openssl in $(PATH), consider installing openssl")
  10. endif
  11. SHA_VALUE= $(shell openssl dgst -sha512 -hex $(obj)/u-boot-spl.bin | sed -e "s/^.*= //g")
  12. IMAGE_SIZE= $(shell cat $(obj)/u-boot-spl.bin | wc -c)
  13. LOADADDR= $(shell echo $(CONFIG_SPL_TEXT_BASE) | sed -e "s/^0x//g")
  14. MAX_SIZE= $(shell printf "%d" $(CONFIG_SYS_K3_MAX_DOWNLODABLE_IMAGE_SIZE))
  15. # Parameters to get populated into the x509 template
  16. SED_OPTS= -e s/TEST_IMAGE_LENGTH/$(IMAGE_SIZE)/
  17. SED_OPTS+= -e s/TEST_IMAGE_SHA_VAL/$(SHA_VALUE)/
  18. SED_OPTS+= -e s/TEST_CERT_TYPE/1/ # CERT_TYPE_PRIMARY_IMAGE_BIN
  19. SED_OPTS+= -e s/TEST_BOOT_CORE/$(CONFIG_SYS_K3_BOOT_CORE_ID)/
  20. SED_OPTS+= -e s/TEST_BOOT_ARCH_WIDTH/32/
  21. SED_OPTS+= -e s/TEST_BOOT_ADDR/$(LOADADDR)/
  22. # Command to generate ecparam key
  23. quiet_cmd_genkey = OPENSSL $@
  24. cmd_genkey = openssl ecparam -out $@ -name prime256v1 -genkey
  25. # Command to generate x509 certificate
  26. quiet_cmd_gencert = OPENSSL $@
  27. cmd_gencert = cat $(srctree)/tools/k3_x509template.txt | sed $(SED_OPTS) > u-boot-spl-x509.txt; \
  28. openssl req -new -x509 -key $(KEY) -nodes -outform DER -out $@ -config u-boot-spl-x509.txt -sha512
  29. # If external key is not provided, generate key using openssl.
  30. ifeq ($(CONFIG_SYS_K3_KEY), "")
  31. KEY=u-boot-spl-eckey.pem
  32. # On HS use real key or warn if not available
  33. ifeq ($(CONFIG_TI_SECURE_DEVICE),y)
  34. ifneq ($(wildcard $(TI_SECURE_DEV_PKG)/keys/custMpk.pem),)
  35. KEY=$(TI_SECURE_DEV_PKG)/keys/custMpk.pem
  36. else
  37. $(warning "WARNING: signing key not found. Random key will NOT work on HS hardware!")
  38. endif
  39. endif
  40. else
  41. KEY=$(patsubst "%",$(srctree)/%,$(CONFIG_SYS_K3_KEY))
  42. endif
  43. u-boot-spl-eckey.pem: FORCE
  44. $(call if_changed,genkey)
  45. # tiboot3.bin is mandated by ROM and ROM only supports R5 boot.
  46. # So restrict tiboot3.bin creation for CPU_V7R.
  47. ifdef CONFIG_CPU_V7R
  48. u-boot-spl-cert.bin: $(KEY) $(obj)/u-boot-spl.bin image_check FORCE
  49. $(call if_changed,gencert)
  50. image_check: $(obj)/u-boot-spl.bin FORCE
  51. @if [ $(IMAGE_SIZE) -gt $(MAX_SIZE) ]; then \
  52. echo "===============================================" >&2; \
  53. echo "ERROR: Final Image too big. " >&2; \
  54. echo "$< size = $(IMAGE_SIZE), max size = $(MAX_SIZE)" >&2; \
  55. echo "===============================================" >&2; \
  56. exit 1; \
  57. fi
  58. tiboot3.bin: u-boot-spl-cert.bin $(obj)/u-boot-spl.bin FORCE
  59. $(call if_changed,cat)
  60. ALL-y += tiboot3.bin
  61. endif
  62. ifdef CONFIG_ARM64
  63. ifeq ($(CONFIG_TI_SECURE_DEVICE),y)
  64. SPL_ITS := u-boot-spl-k3_HS.its
  65. $(SPL_ITS): FORCE
  66. IS_HS=1 \
  67. $(srctree)/tools/k3_fit_atf.sh \
  68. $(patsubst %,$(obj)/dts/%.dtb,$(subst ",,$(CONFIG_SPL_OF_LIST))) > $@
  69. ALL-y += tispl.bin_HS
  70. else
  71. SPL_ITS := u-boot-spl-k3.its
  72. $(SPL_ITS): FORCE
  73. $(srctree)/tools/k3_fit_atf.sh \
  74. $(patsubst %,$(obj)/dts/%.dtb,$(subst ",,$(CONFIG_SPL_OF_LIST))) > $@
  75. ALL-y += tispl.bin
  76. endif
  77. endif
  78. else
  79. ifeq ($(CONFIG_TI_SECURE_DEVICE),y)
  80. ALL-y += u-boot.img_HS
  81. else
  82. ALL-y += u-boot.img
  83. endif
  84. endif
  85. include $(srctree)/arch/arm/mach-k3/config_secure.mk