diff mbox series

[meta-ti,master,RFC,1/9] u-boot: Add ECDSA Signing keys as a build time parameter for k3 devices

Message ID 20260907081021.3876876-1-a-dubey@ti.com
State New
Headers show
Series [meta-ti,master,RFC,1/9] u-boot: Add ECDSA Signing keys as a build time parameter for k3 devices | expand

Commit Message

Atharv Dubey Sept. 7, 2026, 8:10 a.m. UTC 
To make sure that the signing key is passed on as a
build time parameter we use the make SIGNING_KEY=
<path to key> in our current SDK, but this method is not
been accepted in upstream[1], hence we are using BINMAN_INDIRS
to pick the key path.

The other method suggested was to make a
BINMAN_EXTRA_ARGS variable in the Makefile, but this is also
rejected in upstream[2].

In this patch, we have used the multiconf option for multiple
images of the target device, so when we build the image we get
both RSA and ECDSA signed images. The RSA and ECDSA keys would
live in separate directories, each with a custMpk.pem, and
BINMAN_INDIRS just picks them respectively at build time.

[1]: https://lore.kernel.org/all/20260206110439.1236201-1-t-pratham@ti.com/
[2]: https://lore.kernel.org/all/CAPnjgZ0Oj=iT4K0Yj_ii=uL0rQnoPmQ6vs4E2xun5X1RLn9qOQ@mail.gmail.com/t/#ma8f80bad7481122d41f12b85b0ce80eae3d99f51

Signed-off-by: Atharv Dubey <a-dubey@ti.com>
---
 .../recipes-bsp/u-boot/files/custMpk_ecdsa.key    |  6 ------
 meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc      | 15 ++++++++++++---
 2 files changed, 12 insertions(+), 9 deletions(-)
 delete mode 100644 meta-ti-bsp/recipes-bsp/u-boot/files/custMpk_ecdsa.key
diff mbox series

Patch

diff --git a/meta-ti-bsp/recipes-bsp/u-boot/files/custMpk_ecdsa.key b/meta-ti-bsp/recipes-bsp/u-boot/files/custMpk_ecdsa.key
deleted file mode 100644
index 83dffcda..00000000
--- a/meta-ti-bsp/recipes-bsp/u-boot/files/custMpk_ecdsa.key
+++ /dev/null
@@ -1,6 +0,0 @@ 
------BEGIN EC PRIVATE KEY-----
-MIGkAgEBBDBDO9fzBU2LoKaYgji4m3ZCHKUBF9CTVnU6ClfNPJsTo0SKZpCsmyr0
-TKUNkk16vwGgBwYFK4EEACKhZANiAATCv6ftwnJW91fP5wpLpLAxt3u732oNnKr8
-pLbZUzi/s8/e7QiISJ8QKYGaWMnjORW82cM3UJKlCw8GOrb3ZrEXYWRKxkPWql0+
-BOhDQA5b21GtL9HQPvuCPz471ZaxGYA=
------END EC PRIVATE KEY-----
diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
index c1959d11..89f87d4a 100644
--- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
+++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
@@ -93,7 +93,17 @@  PACKAGECONFIG:append:am62pxx = " dm"
 
 COMPATIBLE_MACHINE = "(ti-soc)"
 
-BINMAN_INDIRS = "${STAGING_DIR_HOST}${nonarch_base_libdir}/firmware"
+BINMAN_INDIRS_DIR = "${WORKDIR}/binman-indirs"
+
+do_configure:prepend() {
+	for key in rsa ecdsa; do
+		mkdir -p ${BINMAN_INDIRS_DIR}-${key}
+		ln -sf ${STAGING_DIR_HOST}${nonarch_base_libdir}/firmware/* ${BINMAN_INDIRS_DIR}-${key}/ 2>/dev/null || true
+		ln -sf ${S}/arch/arm/mach-k3/keys/${key}/* ${BINMAN_INDIRS_DIR}-${key}/ 2>/dev/null || true
+	done
+}
+
+BINMAN_INDIRS = "${BINMAN_INDIRS_DIR}-rsa"
 
 EXTRA_OEMAKE += "${PACKAGECONFIG_CONFARGS} BINMAN_INDIRS=${BINMAN_INDIRS}"
 
@@ -417,5 +427,4 @@  PACKAGES:prepend:am62xx-lp-evm = "${FALCON_PKG} "
 
 TOOLCHAIN = "gcc"
 
-TI_SIGN_WITH_ECDSA_KEY ?= "SIGNING_KEY=${THISDIR}/files/custMpk_ecdsa.key"
-TI_SIGN_WITH_ECDSA_KEY:bsp-ti-6_12 = "KEY_PATH=${THISDIR}/files/custMpk_ecdsa.key"
+TI_SIGN_WITH_ECDSA_KEY ?= "BINMAN_INDIRS=${BINMAN_INDIRS_DIR}-ecdsa"