1README on how boot images are created for secure TI devices 2 3CONFIG_TI_SECURE_DEVICE: 4Secure TI devices require a boot image that is authenticated by ROM 5code to function. Without this, even JTAG remains locked and the 6device is essentially useless. In order to create a valid boot image for 7a secure device from TI, the initial public software image must be signed 8and combined with various headers, certificates, and other binary images. 9 10Information on the details on the complete boot image format can be obtained 11from Texas Instruments. The tools used to generate boot images for secure 12devices are part of a secure development package (SECDEV) that can be 13downloaded from: 14 15 http://www.ti.com/mysecuresoftware (login required) 16 17The secure development package is access controlled due to NDA and export 18control restrictions. Access must be requested and granted by TI before the 19package is viewable and downloadable. Contact TI, either online or by way 20of a local TI representative, to request access. 21 22When CONFIG_TI_SECURE_DEVICE is set, the U-Boot SPL build process requires 23the presence and use of these tools in order to create a viable boot image. 24The build process will look for the environment variable TI_SECURE_DEV_PKG, 25which should be the path of the installed SECDEV package. If the 26TI_SECURE_DEV_PKG variable is not defined or if it is defined but doesn't 27point to a valid SECDEV package, a warning is issued during the build to 28indicate that a final secure bootable image was not created. 29 30Within the SECDEV package exists an image creation script: 31 32${TI_SECURE_DEV_PKG}/scripts/create-boot-image.sh 33 34This is called as part of the SPL/u-boot build process. As the secure boot 35image formats and requirements differ between secure SOC from TI, the 36purpose of this script is to abstract these details as much as possible. 37 38The script is basically the only required interface to the TI SECDEV package 39for secure TI devices. 40 41Invoking the script for AM43xx Secure Devices 42============================================= 43 44create-boot-image.sh <IMAGE_FLAG> <INPUT_FILE> <OUTPUT_FILE> <SPL_LOAD_ADDR> 45 46<IMAGE_FLAG> is a value that specifies the type of the image to generate OR 47the action the image generation tool will take. Valid values are: 48 SPI_X-LOADER - Generates an image for SPI flash (byte swapped) 49 XIP_X-LOADER - Generates a single stage u-boot for NOR/QSPI XiP 50 ISSW - Generates an image for all other boot modes 51 52<INPUT_FILE> is the full path and filename of the public world boot loader 53binary file (depending on the boot media, this is usually either 54u-boot-spl.bin or u-boot.bin). 55 56<OUTPUT_FILE> is the full path and filename of the final secure image. The 57output binary images should be used in place of the standard non-secure 58binary images (see the platform-specific user's guides and releases notes 59for how the non-secure images are typically used) 60 u-boot-spl_HS_SPI_X-LOADER - byte swapped boot image for SPI flash 61 u-boot_HS_XIP_X-LOADER - boot image for NOR or QSPI flash 62 u-boot-spl_HS_ISSW - boot image for all other boot media 63 64<SPL_LOAD_ADDR> is the address at which SOC ROM should load the <INPUT_FILE> 65 66Invoking the script for DRA7xx/AM57xx Secure Devices 67==================================================== 68 69create-boot-image.sh <IMAGE_TYPE> <INPUT_FILE> <OUTPUT_FILE> 70 71<IMAGE_TYPE> is a value that specifies the type of the image to generate OR 72the action the image generation tool will take. Valid values are: 73 X-LOADER - Generates an image for NOR or QSPI boot modes 74 MLO - Generates an image for SD/MMC/eMMC boot modes 75 ULO - Generates an image for USB/UART peripheral boot modes 76 Note: ULO is not yet used by the u-boot build process 77 78<INPUT_FILE> is the full path and filename of the public world boot loader 79binary file (for this platform, this is always u-boot-spl.bin). 80 81<OUTPUT_FILE> is the full path and filename of the final secure image. The 82output binary images should be used in place of the standard non-secure 83binary images (see the platform-specific user's guides and releases notes 84for how the non-secure images are typically used) 85 u-boot-spl_HS_MLO - boot image for SD/MMC/eMMC. This image is 86 copied to a file named MLO, which is the name that 87 the device ROM bootloader requires for loading from 88 the FAT partition of an SD card (same as on 89 non-secure devices) 90 u-boot-spl_HS_X-LOADER - boot image for all other flash memories 91 including QSPI and NOR flash 92