d3be1ab1fc
This patch adds high assurance boot support (HABv4) image generation to barebox, currently tested on i.MX6 only. In order to build a signed barebox image, add a new image target to images/Makefile.imx as illustrated in the diff below: - - - a/images/Makefile.imx + + + b/images/Makefile.imx @@ -163,10 +163,14 @@ image-$(CONFIG_MACH_SABRELITE) += barebox-freescale-imx6dl-sabrelite.img pblx-$(CONFIG_MACH_SABRESD) += start_imx6q_sabresd CFG_start_imx6q_sabresd.pblx.imximg = $(board)/freescale-mx6-sabresd/flash-header-mx6-sabresd.imxcfg FILE_barebox-freescale-imx6q-sabresd.img = start_imx6q_sabresd.pblx.imximg image-$(CONFIG_MACH_SABRESD) += barebox-freescale-imx6q-sabresd.img +CSF_start_imx6q_sabresd.pblx.imximg = $(havb4_imx6csf) +FILE_barebox-freescale-imx6q-sabresd-signed.img = start_imx6q_sabresd.pblx.imximg.signed +image-$(CONFIG_MACH_SABRESD) += barebox-freescale-imx6q-sabresd-signed.img + Here the default i.MX6 CSF file $(havb4_imx6csf) is used, it's generated during build on from the template "scripts/habv4/habv4-imx6.csf.in". You can configure the paths to the SRK table and certificates via: System Type -> i.MX specific settings -> HABv4 support. The proprietary tool "cst" by Freescale tool is expected in the PATH. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
49 lines
1.8 KiB
Makefile
49 lines
1.8 KiB
Makefile
# -*-makefile-*-
|
|
#
|
|
# barebox image generation Makefile for HABv4 images
|
|
#
|
|
|
|
# default csf templates
|
|
havb4_imx6csf = $(srctree)/scripts/habv4/habv4-imx6.csf.in
|
|
habv4_imx2csf = $(srctree)/scripts/habv4/habv4-imx28.csf.in
|
|
|
|
# %.imximg.prep - Convert in i.MX image, with preparation for signature
|
|
# ----------------------------------------------------------------
|
|
quiet_cmd_imx_prep_image = IMX-PREP-IMG $@
|
|
cmd_imx_prep_image = $(CPP) $(imxcfg_cpp_flags) -o $(imximg-tmp) $(word 2,$^) ; \
|
|
$< -o $@ -b -c $(imximg-tmp) -p -f $(word 3,$^)
|
|
|
|
.SECONDEXPANSION:
|
|
$(obj)/%.imximg.prep: $(objtree)/scripts/imx/imx-image $$(CFG_%.imximg) $(obj)/%
|
|
$(call if_changed,imx_prep_image)
|
|
|
|
# %.habv4.csf - create Command Sequence File from template
|
|
# ----------------------------------------------------------------
|
|
quiet_cmd_csf = CSF $@
|
|
cmd_csf = TABLE_BIN=$(CONFIG_HABV4_TABLE_BIN) \
|
|
CSF_CRT_PEM=$(CONFIG_HABV4_CSF_CRT_PEM) \
|
|
IMG_CRT_PEM=$(CONFIG_HABV4_IMG_CRT_PEM) \
|
|
$< -f $(word 2,$^) -c $(word 3,$^) -i $(word 4,$^) -o $@
|
|
|
|
.SECONDEXPANSION:
|
|
$(obj)/%.habv4.csf: $(srctree)/scripts/habv4/gencsf.sh $(obj)/%.prep $$(CFG_%) $$(CSF_%)
|
|
$(call if_changed,csf)
|
|
|
|
# %.habv4.sig - create signature and pad to 0x2000
|
|
# ----------------------------------------------------------------
|
|
CST = cst
|
|
quiet_cmd_habv4_sig = HAB4SIG $@
|
|
cmd_habv4_sig = $(CST) -o $(imximg-tmp) < $(word 2,$^) > /dev/null; \
|
|
$(OBJCOPY) -I binary -O binary --pad-to 0x2000 --gap-fill=0x5a $(imximg-tmp) $@
|
|
|
|
$(obj)/%.habv4.sig: $(obj)/%.prep $(obj)/%.habv4.csf
|
|
$(call if_changed,habv4_sig)
|
|
|
|
# %.imximg.signed - concatenate bootloader and signature
|
|
# ----------------------------------------------------------------
|
|
quiet_cmd_cat = CAT $@
|
|
cmd_cat = cat $^ > $@
|
|
|
|
$(obj)/%.imximg.signed: $(obj)/%.imximg.prep $(obj)/%.imximg.habv4.sig
|
|
$(call if_changed,cat)
|