* [PATCH 1/4] board: phytec: common: k3: Introduce Configs to Sign Images
2025-02-07 6:51 [PATCH 0/4] phyCORE-AM62x/AM64x: Sign Images with External Keys Daniel Schultz
@ 2025-02-07 6:51 ` Daniel Schultz
2025-02-07 17:07 ` Andrew Davis
2025-02-07 6:51 ` [PATCH 2/4] board: Phytec: phycore_am6*: Add k3 Kconfig to A53 Daniel Schultz
` (2 subsequent siblings)
3 siblings, 1 reply; 7+ messages in thread
From: Daniel Schultz @ 2025-02-07 6:51 UTC (permalink / raw)
To: w.egorov, trini, ggiordano, u-boot
Cc: nm, n-francis, nmorrisson, d-gole, m.otto, bb, upstream,
Daniel Schultz
Private keys to sign bootloader images shouldn't be commit or part
of this repository. Add config entries to use keys located outside
of U-Boot to sign images.
Signed-off-by: Maik Otto <m.otto@phytec.de>
Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
board/phytec/common/k3/Kconfig | 34 ++++++++++++++++++++++++++++++++++
1 file changed, 34 insertions(+)
diff --git a/board/phytec/common/k3/Kconfig b/board/phytec/common/k3/Kconfig
index 282f4b79742..19fe927b22e 100644
--- a/board/phytec/common/k3/Kconfig
+++ b/board/phytec/common/k3/Kconfig
@@ -3,3 +3,37 @@ config PHYTEC_K3_DDR_PATCH
help
Allow to override default DDR timings prior to
DDRSS driver probing.
+
+config PHYTEC_K3_KEY_BLOB_COPY
+ bool "Copy the MPK key and the degenerate TI key to the build path"
+ default y
+ help
+ Select how to manage the MPK and degenerate TI keys.
+ If PHYTEC_K3_KEY_BLOB_COPY is enabled, the keys will be copied into
+ the U-Boot directory for compatibility with the TI dummy keys
+ stored there.
+ If PHYTEC_K3_KEY_BLOB_COPY is disabled, the build will use the
+ original key directly. It is recommended to use the original key to
+ avoid unnecessary duplication.
+
+config PHYTEC_K3_MPK_KEY
+ string "Path to customer specific MPK key"
+ default "custMpk.pem" if PHYTEC_K3_KEY_BLOB_COPY
+ default "arch/arm/mach-k3/keys/custMpk.pem" if !PHYTEC_K3_KEY_BLOB_COPY
+ help
+ Specifies the path to the MPK signing key:
+ If PHYTEC_K3_KEY_BLOB_COPY is enabled, provide the path to the blob
+ copy of the original key.
+ If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
+ original key.
+
+config PHYTEC_K3_DEGENERATE_KEY
+ string "Path to the degenerate TI key"
+ default "ti-degenerate-key.pem" if PHYTEC_K3_KEY_BLOB_COPY
+ default "arch/arm/mach-k3/keys/ti-degenerate-key.pem" if !PHYTEC_K3_KEY_BLOB_COPY
+ help
+ Specifies the path to the degenerate key:
+ If PHYTEC_K3_KEY_BLOB_COPY is enabled, provide the path to the blob
+ copy of the original key.
+ If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
+ original key.
--
2.25.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH 1/4] board: phytec: common: k3: Introduce Configs to Sign Images
2025-02-07 6:51 ` [PATCH 1/4] board: phytec: common: k3: Introduce Configs to Sign Images Daniel Schultz
@ 2025-02-07 17:07 ` Andrew Davis
2025-02-10 7:40 ` Daniel Schultz
0 siblings, 1 reply; 7+ messages in thread
From: Andrew Davis @ 2025-02-07 17:07 UTC (permalink / raw)
To: Daniel Schultz, w.egorov, trini, ggiordano, u-boot
Cc: nm, n-francis, nmorrisson, d-gole, m.otto, bb, upstream
On 2/7/25 12:51 AM, Daniel Schultz wrote:
> Private keys to sign bootloader images shouldn't be commit or part
> of this repository. Add config entries to use keys located outside
> of U-Boot to sign images.
>
The custMpk.pem was always a placeholder, we fill it with the TI Dummy
key as an example. The idea was you replace it with your key using
something like a symlink. So custMpk.pem is replaced with a pointing
to your real key when building on the production HSM. Why do you
need to have a Kconfig to point to your real key?
If you really want a full path to be settable from Kconfig for some
reason that I am not seeing, then others will want to too. So you
should make this option generic for all K3, nothing specific to this
one board family.
Andrew
> Signed-off-by: Maik Otto <m.otto@phytec.de>
> Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
> Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
> ---
> board/phytec/common/k3/Kconfig | 34 ++++++++++++++++++++++++++++++++++
> 1 file changed, 34 insertions(+)
>
> diff --git a/board/phytec/common/k3/Kconfig b/board/phytec/common/k3/Kconfig
> index 282f4b79742..19fe927b22e 100644
> --- a/board/phytec/common/k3/Kconfig
> +++ b/board/phytec/common/k3/Kconfig
> @@ -3,3 +3,37 @@ config PHYTEC_K3_DDR_PATCH
> help
> Allow to override default DDR timings prior to
> DDRSS driver probing.
> +
> +config PHYTEC_K3_KEY_BLOB_COPY
> + bool "Copy the MPK key and the degenerate TI key to the build path"
> + default y
> + help
> + Select how to manage the MPK and degenerate TI keys.
> + If PHYTEC_K3_KEY_BLOB_COPY is enabled, the keys will be copied into
> + the U-Boot directory for compatibility with the TI dummy keys
> + stored there.
> + If PHYTEC_K3_KEY_BLOB_COPY is disabled, the build will use the
> + original key directly. It is recommended to use the original key to
> + avoid unnecessary duplication.
> +
> +config PHYTEC_K3_MPK_KEY
> + string "Path to customer specific MPK key"
> + default "custMpk.pem" if PHYTEC_K3_KEY_BLOB_COPY
> + default "arch/arm/mach-k3/keys/custMpk.pem" if !PHYTEC_K3_KEY_BLOB_COPY
> + help
> + Specifies the path to the MPK signing key:
> + If PHYTEC_K3_KEY_BLOB_COPY is enabled, provide the path to the blob
> + copy of the original key.
> + If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
> + original key.
> +
> +config PHYTEC_K3_DEGENERATE_KEY
> + string "Path to the degenerate TI key"
> + default "ti-degenerate-key.pem" if PHYTEC_K3_KEY_BLOB_COPY
> + default "arch/arm/mach-k3/keys/ti-degenerate-key.pem" if !PHYTEC_K3_KEY_BLOB_COPY
> + help
> + Specifies the path to the degenerate key:
> + If PHYTEC_K3_KEY_BLOB_COPY is enabled, provide the path to the blob
> + copy of the original key.
> + If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
> + original key.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/4] board: phytec: common: k3: Introduce Configs to Sign Images
2025-02-07 17:07 ` Andrew Davis
@ 2025-02-10 7:40 ` Daniel Schultz
0 siblings, 0 replies; 7+ messages in thread
From: Daniel Schultz @ 2025-02-10 7:40 UTC (permalink / raw)
To: Andrew Davis, w.egorov, trini, ggiordano, u-boot
Cc: nm, n-francis, nmorrisson, d-gole, m.otto, bb, upstream
On 07.02.25 18:07, Andrew Davis wrote:
> On 2/7/25 12:51 AM, Daniel Schultz wrote:
>> Private keys to sign bootloader images shouldn't be commit or part
>> of this repository. Add config entries to use keys located outside
>> of U-Boot to sign images.
>>
>
> The custMpk.pem was always a placeholder, we fill it with the TI Dummy
> key as an example. The idea was you replace it with your key using
> something like a symlink. So custMpk.pem is replaced with a pointing
> to your real key when building on the production HSM. Why do you
> need to have a Kconfig to point to your real key?
Thanks for pointing that out! We were not aware of that process and
added these Kconfigs. I just sent new patches to add the missing keyfile
entries in our binman to use symlinks.
- Daniel
>
> If you really want a full path to be settable from Kconfig for some
> reason that I am not seeing, then others will want to too. So you
> should make this option generic for all K3, nothing specific to this
> one board family.
>
> Andrew
>
>> Signed-off-by: Maik Otto <m.otto@phytec.de>
>> Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
>> Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
>> ---
>> board/phytec/common/k3/Kconfig | 34 ++++++++++++++++++++++++++++++++++
>> 1 file changed, 34 insertions(+)
>>
>> diff --git a/board/phytec/common/k3/Kconfig
>> b/board/phytec/common/k3/Kconfig
>> index 282f4b79742..19fe927b22e 100644
>> --- a/board/phytec/common/k3/Kconfig
>> +++ b/board/phytec/common/k3/Kconfig
>> @@ -3,3 +3,37 @@ config PHYTEC_K3_DDR_PATCH
>> help
>> Allow to override default DDR timings prior to
>> DDRSS driver probing.
>> +
>> +config PHYTEC_K3_KEY_BLOB_COPY
>> + bool "Copy the MPK key and the degenerate TI key to the build path"
>> + default y
>> + help
>> + Select how to manage the MPK and degenerate TI keys.
>> + If PHYTEC_K3_KEY_BLOB_COPY is enabled, the keys will be
>> copied into
>> + the U-Boot directory for compatibility with the TI dummy keys
>> + stored there.
>> + If PHYTEC_K3_KEY_BLOB_COPY is disabled, the build will use the
>> + original key directly. It is recommended to use the original
>> key to
>> + avoid unnecessary duplication.
>> +
>> +config PHYTEC_K3_MPK_KEY
>> + string "Path to customer specific MPK key"
>> + default "custMpk.pem" if PHYTEC_K3_KEY_BLOB_COPY
>> + default "arch/arm/mach-k3/keys/custMpk.pem" if
>> !PHYTEC_K3_KEY_BLOB_COPY
>> + help
>> + Specifies the path to the MPK signing key:
>> + If PHYTEC_K3_KEY_BLOB_COPY is enabled, provide the path to
>> the blob
>> + copy of the original key.
>> + If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
>> + original key.
>> +
>> +config PHYTEC_K3_DEGENERATE_KEY
>> + string "Path to the degenerate TI key"
>> + default "ti-degenerate-key.pem" if PHYTEC_K3_KEY_BLOB_COPY
>> + default "arch/arm/mach-k3/keys/ti-degenerate-key.pem" if
>> !PHYTEC_K3_KEY_BLOB_COPY
>> + help
>> + Specifies the path to the degenerate key:
>> + If PHYTEC_K3_KEY_BLOB_COPY is enabled, provide the path to
>> the blob
>> + copy of the original key.
>> + If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
>> + original key.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH 2/4] board: Phytec: phycore_am6*: Add k3 Kconfig to A53
2025-02-07 6:51 [PATCH 0/4] phyCORE-AM62x/AM64x: Sign Images with External Keys Daniel Schultz
2025-02-07 6:51 ` [PATCH 1/4] board: phytec: common: k3: Introduce Configs to Sign Images Daniel Schultz
@ 2025-02-07 6:51 ` Daniel Schultz
2025-02-07 6:51 ` [PATCH 3/4] arch: arm: dts: k3-am625-phycore-som-binman: Add custMpk and ti-degenerate keys with CONFIG entries Daniel Schultz
2025-02-07 6:51 ` [PATCH 4/4] arch: arm: dts: k3-am642-phycore-som-binman: " Daniel Schultz
3 siblings, 0 replies; 7+ messages in thread
From: Daniel Schultz @ 2025-02-07 6:51 UTC (permalink / raw)
To: w.egorov, trini, ggiordano, u-boot
Cc: nm, n-francis, nmorrisson, d-gole, m.otto, bb, upstream,
Daniel Schultz
Add board/phytec/common/k3/Kconfig to the A53 builds to make
the PHYTEC_K3_ configs visible for this defconfig.
This patch also adds .../k3/Kconfig to the AM64x R5 build for the
same reason.
Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
board/phytec/phycore_am62ax/Kconfig | 1 +
board/phytec/phycore_am62x/Kconfig | 1 +
board/phytec/phycore_am64x/Kconfig | 2 ++
3 files changed, 4 insertions(+)
diff --git a/board/phytec/phycore_am62ax/Kconfig b/board/phytec/phycore_am62ax/Kconfig
index 516dc8e2020..81f2311ec97 100644
--- a/board/phytec/phycore_am62ax/Kconfig
+++ b/board/phytec/phycore_am62ax/Kconfig
@@ -15,6 +15,7 @@ config SYS_CONFIG_NAME
default "phycore_am62ax"
source "board/phytec/common/Kconfig"
+source "board/phytec/common/k3/Kconfig"
endif
diff --git a/board/phytec/phycore_am62x/Kconfig b/board/phytec/phycore_am62x/Kconfig
index ecee5873c0c..6c2eb82787e 100644
--- a/board/phytec/phycore_am62x/Kconfig
+++ b/board/phytec/phycore_am62x/Kconfig
@@ -15,6 +15,7 @@ config SYS_CONFIG_NAME
default "phycore_am62x"
source "board/phytec/common/Kconfig"
+source "board/phytec/common/k3/Kconfig"
endif
diff --git a/board/phytec/phycore_am64x/Kconfig b/board/phytec/phycore_am64x/Kconfig
index 829526c3295..ddfb4a39989 100644
--- a/board/phytec/phycore_am64x/Kconfig
+++ b/board/phytec/phycore_am64x/Kconfig
@@ -18,6 +18,7 @@ config SYS_CONFIG_NAME
default "phycore_am64x"
source "board/phytec/common/Kconfig"
+source "board/phytec/common/k3/Kconfig"
endif
@@ -33,5 +34,6 @@ config SYS_CONFIG_NAME
default "phycore_am64x"
source "board/phytec/common/Kconfig"
+source "board/phytec/common/k3/Kconfig"
endif
--
2.25.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH 3/4] arch: arm: dts: k3-am625-phycore-som-binman: Add custMpk and ti-degenerate keys with CONFIG entries
2025-02-07 6:51 [PATCH 0/4] phyCORE-AM62x/AM64x: Sign Images with External Keys Daniel Schultz
2025-02-07 6:51 ` [PATCH 1/4] board: phytec: common: k3: Introduce Configs to Sign Images Daniel Schultz
2025-02-07 6:51 ` [PATCH 2/4] board: Phytec: phycore_am6*: Add k3 Kconfig to A53 Daniel Schultz
@ 2025-02-07 6:51 ` Daniel Schultz
2025-02-07 6:51 ` [PATCH 4/4] arch: arm: dts: k3-am642-phycore-som-binman: " Daniel Schultz
3 siblings, 0 replies; 7+ messages in thread
From: Daniel Schultz @ 2025-02-07 6:51 UTC (permalink / raw)
To: w.egorov, trini, ggiordano, u-boot
Cc: nm, n-francis, nmorrisson, d-gole, m.otto, bb, upstream,
Daniel Schultz
From: Nathan Morrisson <nmorrisson@phytec.com>
Add the SMPK and ti-degenerate keys using CONFIG entries. These keys
are set by the build system and are stored outside of u-boot.
Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
arch/arm/dts/k3-am625-phycore-som-binman.dtsi | 72 ++++++++++++++-----
1 file changed, 56 insertions(+), 16 deletions(-)
diff --git a/arch/arm/dts/k3-am625-phycore-som-binman.dtsi b/arch/arm/dts/k3-am625-phycore-som-binman.dtsi
index 31456d23167..9682ab532ed 100644
--- a/arch/arm/dts/k3-am625-phycore-som-binman.dtsi
+++ b/arch/arm/dts/k3-am625-phycore-som-binman.dtsi
@@ -8,6 +8,13 @@
#include "k3-binman.dtsi"
+#ifndef CONFIG_PHYTEC_K3_KEY_BLOB_COPY
+&binman {
+ /delete-node/ custMpk;
+ /delete-node/ ti-degenerate-key;
+ };
+#endif
+
#ifdef CONFIG_TARGET_PHYCORE_AM62X_R5
&binman {
tiboot3-am62x-hs-phycore-som.bin {
@@ -18,7 +25,7 @@
combined;
dm-data;
sysfw-inner-cert;
- keyfile = "custMpk.pem";
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
sw-rev = <1>;
content-sbl = <&u_boot_spl>;
content-sysfw = <&ti_fs_enc>;
@@ -64,7 +71,7 @@
combined;
dm-data;
sysfw-inner-cert;
- keyfile = "custMpk.pem";
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
sw-rev = <1>;
content-sbl = <&u_boot_spl_fs>;
content-sysfw = <&ti_fs_enc_fs>;
@@ -117,7 +124,7 @@
content-dm-data = <&combined_dm_cfg_gp>;
load-dm-data = <0x43c3a800>;
sw-rev = <1>;
- keyfile = "ti-degenerate-key.pem";
+ keyfile = CONFIG_PHYTEC_K3_DEGENERATE_KEY;
};
u_boot_spl_unsigned: u-boot-spl {
no-expanded;
@@ -172,7 +179,7 @@
core = "secure";
load = <0x40000>;
sw-rev = <CONFIG_K3_X509_SWRV>;
- keyfile = "custMpk.pem";
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
countersign;
tifsstub;
};
@@ -210,7 +217,7 @@
core = "secure";
load = <0x60000>;
sw-rev = <CONFIG_K3_X509_SWRV>;
- keyfile = "ti-degenerate-key.pem";
+ keyfile = CONFIG_PHYTEC_K3_DEGENERATE_KEY;
tifsstub;
};
tifsstub_gp: tifsstub-gp.bin {
@@ -227,6 +234,24 @@
fit {
images {
+ atf {
+ ti-secure {
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
+ };
+
+ tee {
+ ti-secure {
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
+ };
+
+ spl {
+ ti-secure {
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
+ };
+
tifsstub-hs {
description = "TIFSSTUB";
type = "firmware";
@@ -268,7 +293,7 @@
dm {
ti-secure {
content = <&dm>;
- keyfile = "custMpk.pem";
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
};
dm: blob-ext {
filename = "ti-dm.bin";
@@ -282,7 +307,7 @@
compression = "none";
ti-secure {
content = <&spl_am625_phyboard_lyra_dtb>;
- keyfile = "custMpk.pem";
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
};
spl_am625_phyboard_lyra_dtb: blob-ext {
filename = SPL_AM625_PHYBOARD_LYRA_DTB;
@@ -313,6 +338,9 @@
images {
uboot {
description = "U-Boot for phyCORE-AM62x";
+ ti-secure {
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
};
som-no-rtc {
@@ -321,8 +349,11 @@
compression = "none";
load = <0x8F000000>;
arch = "arm";
-
- blob-ext {
+ ti-secure {
+ content = <&am6xx_phycore_disable_rtc_dtbo>;
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
+ am6xx_phycore_disable_rtc_dtbo: blob-ext {
filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-rtc.dtbo";
};
};
@@ -333,8 +364,11 @@
compression = "none";
load = <0x8F001000>;
arch = "arm";
-
- blob-ext {
+ ti-secure {
+ content = <&am6xx_phycore_disable_spi_not_dtbo>;
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
+ am6xx_phycore_disable_spi_not_dtbo: blob-ext {
filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-spi-nor.dtbo";
};
};
@@ -345,8 +379,11 @@
compression = "none";
load = <0x8F002000>;
arch = "arm";
-
- blob-ext {
+ ti-secure {
+ content = <&am6xx_phycore_disable_eth_phy_dtbo>;
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
+ am6xx_phycore_disable_eth_phy_dtbo: blob-ext {
filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-eth-phy.dtbo";
};
};
@@ -357,8 +394,11 @@
compression = "none";
load = <0x8F003000>;
arch = "arm";
-
- blob-ext {
+ ti-secure {
+ content = <&am6xx_phycore_disable_qspi_nor_dtbo>;
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
+ am6xx_phycore_disable_qspi_nor_dtbo: blob-ext {
filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-qspi-nor.dtbo";
};
};
@@ -370,7 +410,7 @@
compression = "none";
ti-secure {
content = <&am625_phyboard_lyra_dtb>;
- keyfile = "custMpk.pem";
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
};
am625_phyboard_lyra_dtb: blob-ext {
filename = AM625_PHYBOARD_LYRA_DTB;
--
2.25.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH 4/4] arch: arm: dts: k3-am642-phycore-som-binman: Add custMpk and ti-degenerate keys with CONFIG entries
2025-02-07 6:51 [PATCH 0/4] phyCORE-AM62x/AM64x: Sign Images with External Keys Daniel Schultz
` (2 preceding siblings ...)
2025-02-07 6:51 ` [PATCH 3/4] arch: arm: dts: k3-am625-phycore-som-binman: Add custMpk and ti-degenerate keys with CONFIG entries Daniel Schultz
@ 2025-02-07 6:51 ` Daniel Schultz
3 siblings, 0 replies; 7+ messages in thread
From: Daniel Schultz @ 2025-02-07 6:51 UTC (permalink / raw)
To: w.egorov, trini, ggiordano, u-boot
Cc: nm, n-francis, nmorrisson, d-gole, m.otto, bb, upstream,
Daniel Schultz
From: Nathan Morrisson <nmorrisson@phytec.com>
Add the SMPK and ti-degenerate keys using CONFIG entries. These keys
are set by the build system and are stored outside of u-boot.
Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
arch/arm/dts/k3-am642-phycore-som-binman.dtsi | 70 +++++++++++++++----
1 file changed, 55 insertions(+), 15 deletions(-)
diff --git a/arch/arm/dts/k3-am642-phycore-som-binman.dtsi b/arch/arm/dts/k3-am642-phycore-som-binman.dtsi
index 3710564cd4a..5d86da7754e 100644
--- a/arch/arm/dts/k3-am642-phycore-som-binman.dtsi
+++ b/arch/arm/dts/k3-am642-phycore-som-binman.dtsi
@@ -8,6 +8,13 @@
#include "k3-binman.dtsi"
+#ifndef CONFIG_PHYTEC_K3_KEY_BLOB_COPY
+&binman {
+ /delete-node/ custMpk;
+ /delete-node/ ti-degenerate-key;
+};
+#endif
+
#ifdef CONFIG_TARGET_PHYCORE_AM64X_R5
&binman {
tiboot3-am64x_sr2-hs-phycore-som.bin {
@@ -17,7 +24,7 @@
<&combined_sysfw_cfg>, <&sysfw_inner_cert>;
combined;
sysfw-inner-cert;
- keyfile = "custMpk.pem";
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
sw-rev = <1>;
content-sbl = <&u_boot_spl>;
content-sysfw = <&ti_sci_enc>;
@@ -57,7 +64,7 @@
<&combined_sysfw_cfg_fs>, <&sysfw_inner_cert_fs>;
combined;
sysfw-inner-cert;
- keyfile = "custMpk.pem";
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
sw-rev = <1>;
content-sbl = <&u_boot_spl_fs>;
content-sysfw = <&ti_sci_enc_fs>;
@@ -101,7 +108,7 @@
content-sysfw-data = <&combined_sysfw_cfg_gp>;
load-sysfw-data = <0x7b000>;
sw-rev = <1>;
- keyfile = "ti-degenerate-key.pem";
+ keyfile = CONFIG_PHYTEC_K3_DEGENERATE_KEY;
};
u_boot_spl_unsigned: u-boot-spl {
no-expanded;
@@ -146,6 +153,24 @@
#address-cells = <1>;
images {
+ atf {
+ ti-secure {
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
+ };
+
+ tee {
+ ti-secure {
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
+ };
+
+ spl {
+ ti-secure {
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
+ };
+
dm {
blob-ext {
filename = "/dev/null";
@@ -159,7 +184,7 @@
compression = "none";
ti-secure {
content = <&spl_am642_phyboard_electra_dtb>;
- keyfile = "custMpk.pem";
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
};
spl_am642_phyboard_electra_dtb: blob-ext {
filename = SPL_AM642_PHYBOARD_ELECTRA_DTB;
@@ -190,6 +215,9 @@
images {
uboot {
description = "U-Boot for AM64 board";
+ ti-secure {
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
};
fdt-0 {
@@ -199,7 +227,7 @@
compression = "none";
ti-secure {
content = <&am642_phyboard_electra_dtb>;
- keyfile = "custMpk.pem";
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
};
am642_phyboard_electra_dtb: blob-ext {
filename = AM642_PHYBOARD_ELECTRA_DTB;
@@ -324,7 +352,7 @@
compression = "none";
ti-secure {
content = <&spl_am642_phyboard_electra_dtb>;
- keyfile = "custMpk.pem";
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
};
spl_am642_phyboard_electra_dtb: blob-ext {
filename = SPL_AM642_PHYBOARD_ELECTRA_DTB;
@@ -363,8 +391,11 @@
compression = "none";
load = <0x8F000000>;
arch = "arm";
-
- blob-ext {
+ ti-secure {
+ content = <&am6xx_phycore_disable_rtc_dtbo>;
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
+ am6xx_phycore_disable_rtc_dtbo: blob-ext {
filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-rtc.dtbo";
};
};
@@ -375,8 +406,11 @@
compression = "none";
load = <0x8F001000>;
arch = "arm";
-
- blob-ext {
+ ti-secure {
+ content = <&am6xx_phycore_disable_spi_not_dtbo>;
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
+ am6xx_phycore_disable_spi_not_dtbo: blob-ext {
filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-spi-nor.dtbo";
};
};
@@ -387,8 +421,11 @@
compression = "none";
load = <0x8F002000>;
arch = "arm";
-
- blob-ext {
+ ti-secure {
+ content = <&am6xx_phycore_disable_eth_phy_dtbo>;
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
+ am6xx_phycore_disable_eth_phy_dtbo: blob-ext {
filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-eth-phy.dtbo";
};
};
@@ -399,8 +436,11 @@
compression = "none";
load = <0x8F003000>;
arch = "arm";
-
- blob-ext {
+ ti-secure {
+ content = <&am6xx_phycore_disable_qspi_nor_dtbo>;
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+ };
+ am6xx_phycore_disable_qspi_nor_dtbo: blob-ext {
filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-qspi-nor.dtbo";
};
};
@@ -412,7 +452,7 @@
compression = "none";
ti-secure {
content = <&am642_phyboard_electra_dtb>;
- keyfile = "custMpk.pem";
+ keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
};
am642_phyboard_electra_dtb: blob-ext {
filename = AM642_PHYBOARD_ELECTRA_DTB;
--
2.25.1
^ permalink raw reply related [flat|nested] 7+ messages in thread