1set(srcs
2    "src/bootloader_common.c"
3    "src/bootloader_common_loader.c"
4    "src/bootloader_clock_init.c"
5    "src/bootloader_mem.c"
6    "src/bootloader_random.c"
7    "src/bootloader_random_${IDF_TARGET}.c"
8    "src/bootloader_efuse.c"
9    "src/flash_encrypt.c"
10    "src/secure_boot.c"
11    )
12
13if(NOT CONFIG_APP_BUILD_TYPE_PURE_RAM_APP)
14    list(APPEND srcs
15        "bootloader_flash/src/bootloader_flash.c"
16        "bootloader_flash/src/flash_qio_mode.c"
17        "bootloader_flash/src/bootloader_flash_config_${IDF_TARGET}.c"
18        )
19endif()
20
21if(CONFIG_APP_BUILD_TYPE_APP_2NDBOOT)
22    list(APPEND srcs
23        "src/bootloader_utility.c"
24        "src/flash_partitions.c"
25        "src/esp_image_format.c"
26        )
27endif()
28
29if(BOOTLOADER_BUILD OR CONFIG_APP_BUILD_TYPE_RAM)
30    set(include_dirs "include" "bootloader_flash/include"
31        "private_include")
32    set(priv_requires micro-ecc spi_flash efuse esp_app_format)
33    list(APPEND srcs
34    "src/bootloader_init.c"
35    "src/bootloader_clock_loader.c"
36    "src/bootloader_console.c"
37    "src/bootloader_console_loader.c"
38    "src/${IDF_TARGET}/bootloader_sha.c"
39    "src/${IDF_TARGET}/bootloader_soc.c"
40    "src/${IDF_TARGET}/bootloader_${IDF_TARGET}.c"
41    )
42    list(APPEND priv_requires hal)
43    if(CONFIG_ESP_ROM_REV0_HAS_NO_ECDSA_INTERFACE)
44        list(APPEND srcs
45            "src/${IDF_TARGET}/bootloader_ecdsa.c")
46    endif()
47else()
48    list(APPEND srcs
49        "src/idf/bootloader_sha.c")
50    set(include_dirs "include" "bootloader_flash/include")
51    set(priv_include_dirs "private_include")
52    # heap is required for `heap_memory_layout.h` header
53    set(priv_requires spi_flash mbedtls efuse heap esp_app_format)
54endif()
55
56if(BOOTLOADER_BUILD)
57    list(APPEND srcs "src/bootloader_panic.c")
58    if(CONFIG_SECURE_FLASH_ENC_ENABLED)
59        list(APPEND srcs "src/flash_encryption/flash_encrypt.c"
60                         "src/${IDF_TARGET}/flash_encryption_secure_features.c")
61    endif()
62
63    if(CONFIG_SECURE_SIGNED_ON_BOOT)
64        if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
65            list(APPEND srcs "src/secure_boot_v1/secure_boot_signatures_bootloader.c")
66        endif()
67        if(CONFIG_SECURE_BOOT_V1_ENABLED)
68            list(APPEND srcs "src/secure_boot_v1/secure_boot.c"
69                             "src/${IDF_TARGET}/secure_boot_secure_features.c")
70        endif()
71
72        if(CONFIG_SECURE_BOOT_V2_ENABLED)
73            list(APPEND srcs "src/secure_boot_v2/secure_boot_signatures_bootloader.c"
74                             "src/secure_boot_v2/secure_boot.c"
75                             "src/${IDF_TARGET}/secure_boot_secure_features.c")
76        endif()
77    endif()
78else()
79    if(CONFIG_SECURE_SIGNED_ON_UPDATE)
80        if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME)
81            list(APPEND srcs "src/secure_boot_v1/secure_boot_signatures_app.c")
82        endif()
83
84        if(CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME)
85            list(APPEND srcs "src/secure_boot_v2/secure_boot_signatures_app.c")
86            list(APPEND srcs "src/secure_boot_v2/secure_boot_rsa_signature.c")
87        endif()
88        if(CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME)
89            list(APPEND srcs "src/secure_boot_v2/secure_boot_signatures_app.c")
90            list(APPEND srcs "src/secure_boot_v2/secure_boot_ecdsa_signature.c")
91        endif()
92    endif()
93endif()
94
95set(requires soc) #unfortunately the header directly uses SOC registers
96
97idf_component_register(SRCS "${srcs}"
98                    INCLUDE_DIRS "${include_dirs}"
99                    PRIV_INCLUDE_DIRS "${priv_include_dirs}"
100                    REQUIRES "${requires}"
101                    PRIV_REQUIRES "${priv_requires}")
102
103if(NOT BOOTLOADER_BUILD)
104    if(CONFIG_SECURE_SIGNED_ON_UPDATE)
105        if(CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME OR CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME OR
106           CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME)
107            target_link_libraries(${COMPONENT_LIB} PRIVATE idf::app_update)
108        endif()
109    endif()
110endif()
111
112if(CONFIG_SECURE_SIGNED_APPS AND (CONFIG_SECURE_BOOT_V1_ENABLED OR CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME))
113    if(BOOTLOADER_BUILD)
114        # Whether CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES or not, we need verification key to embed
115        # in the library.
116        if(CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES)
117            # We generate the key from the signing key. The signing key is passed from the main project.
118            get_filename_component(secure_boot_signing_key
119                "${SECURE_BOOT_SIGNING_KEY}"
120                ABSOLUTE BASE_DIR "${project_dir}")
121            get_filename_component(secure_boot_verification_key
122                "signature_verification_key.bin"
123                ABSOLUTE BASE_DIR "${CMAKE_CURRENT_BINARY_DIR}")
124            add_custom_command(OUTPUT "${secure_boot_verification_key}"
125                COMMAND ${ESPSECUREPY}
126                extract_public_key --keyfile "${secure_boot_signing_key}"
127                "${secure_boot_verification_key}"
128                DEPENDS ${secure_boot_signing_key}
129                VERBATIM)
130        else()
131            # We expect to 'inherit' the verification key passed from main project.
132            get_filename_component(secure_boot_verification_key
133                ${SECURE_BOOT_VERIFICATION_KEY}
134                ABSOLUTE BASE_DIR "${project_dir}")
135        endif()
136    else()  # normal app build
137        idf_build_get_property(project_dir PROJECT_DIR)
138
139        if(CONFIG_SECURE_BOOT_VERIFICATION_KEY)
140            # verification-only build supplies verification key
141            set(secure_boot_verification_key ${CONFIG_SECURE_BOOT_VERIFICATION_KEY})
142            get_filename_component(secure_boot_verification_key
143                ${secure_boot_verification_key}
144                ABSOLUTE BASE_DIR "${project_dir}")
145        else()
146            # sign at build time, extracts key from signing key
147            set(secure_boot_verification_key "${CMAKE_BINARY_DIR}/signature_verification_key.bin")
148            get_filename_component(secure_boot_signing_key
149                ${CONFIG_SECURE_BOOT_SIGNING_KEY}
150                ABSOLUTE BASE_DIR "${project_dir}")
151
152            add_custom_command(OUTPUT "${secure_boot_verification_key}"
153                COMMAND ${ESPSECUREPY}
154                extract_public_key --keyfile "${secure_boot_signing_key}"
155                "${secure_boot_verification_key}"
156                WORKING_DIRECTORY ${project_dir}
157                DEPENDS ${secure_boot_signing_key}
158                VERBATIM)
159        endif()
160    endif()
161
162    # Embed the verification key in the binary (app & bootloader)
163    #
164    target_add_binary_data(${COMPONENT_LIB} "${secure_boot_verification_key}" "BINARY"
165        RENAME_TO signature_verification_key_bin)
166    set_property(DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
167        APPEND PROPERTY ADDITIONAL_CLEAN_FILES
168        "${secure_boot_verification_key}")
169endif()
170
171if(BOOTLOADER_BUILD)
172    target_link_libraries(${COMPONENT_LIB} INTERFACE "-u abort")
173endif()
174