[PATCH 0/4] phyCORE-AM62x/AM64x: Sign Images with External Keys

[PATCH 0/4] phyCORE-AM62x/AM64x: Sign Images with External Keys

[Daniel Schultz]

This patch series adds three new Kconfigs for PHYTEC's K3 boards to
pass private keys from an external location. These keys are
required to sign all bootloader images and device-trees to boot on
High-Secure Secure-Enforced (HS-SE) hardware.


Daniel Schultz (2):
  board: phytec: common: k3: Introduce Configs to Sign Images
  board: Phytec: phycore_am6*: Add k3 Kconfig to A53

Nathan Morrisson (2):
  arch: arm: dts: k3-am625-phycore-som-binman: Add custMpk and
    ti-degenerate keys with CONFIG entries
  arch: arm: dts: k3-am642-phycore-som-binman: Add custMpk and
    ti-degenerate keys with CONFIG entries

 arch/arm/dts/k3-am625-phycore-som-binman.dtsi | 72 ++++++++++++++-----
 arch/arm/dts/k3-am642-phycore-som-binman.dtsi | 70 ++++++++++++++----
 board/phytec/common/k3/Kconfig                | 34 +++++++++
 board/phytec/phycore_am62ax/Kconfig           |  1 +
 board/phytec/phycore_am62x/Kconfig            |  1 +
 board/phytec/phycore_am64x/Kconfig            |  2 +
 6 files changed, 149 insertions(+), 31 deletions(-)

-- 
2.25.1

[PATCH 1/4] board: phytec: common: k3: Introduce Configs to Sign Images

[Daniel Schultz]

Private keys to sign bootloader images shouldn't be commit or part
of this repository. Add config entries to use keys located outside
of U-Boot to sign images.

Signed-off-by: Maik Otto <m.otto@phytec.de>
Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
 board/phytec/common/k3/Kconfig | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/board/phytec/common/k3/Kconfig b/board/phytec/common/k3/Kconfig
index 282f4b79742..19fe927b22e 100644
--- a/board/phytec/common/k3/Kconfig
+++ b/board/phytec/common/k3/Kconfig
@@ -3,3 +3,37 @@ config PHYTEC_K3_DDR_PATCH
 	help
 	   Allow to override default DDR timings prior to
 	   DDRSS driver probing.
+
+config PHYTEC_K3_KEY_BLOB_COPY
+	bool "Copy the MPK key and the degenerate TI key to the build path"
+	default y
+	help
+	   Select how to manage the MPK and degenerate TI keys.
+	   If PHYTEC_K3_KEY_BLOB_COPY is enabled, the keys will be copied into
+	   the U-Boot directory for compatibility with the TI dummy keys
+	   stored there.
+	   If PHYTEC_K3_KEY_BLOB_COPY is disabled, the build will use the
+	   original key directly. It is recommended to use the original key to
+	   avoid unnecessary duplication.
+
+config PHYTEC_K3_MPK_KEY
+	string "Path to customer specific MPK key"
+	default "custMpk.pem" if PHYTEC_K3_KEY_BLOB_COPY
+	default "arch/arm/mach-k3/keys/custMpk.pem" if !PHYTEC_K3_KEY_BLOB_COPY
+	help
+	   Specifies the path to the MPK signing key:
+	   If PHYTEC_K3_KEY_BLOB_COPY is enabled, provide the path to the blob
+	   copy of the original key.
+	   If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
+	   original key.
+
+config PHYTEC_K3_DEGENERATE_KEY
+	string "Path to the degenerate TI key"
+	default "ti-degenerate-key.pem" if PHYTEC_K3_KEY_BLOB_COPY
+	default "arch/arm/mach-k3/keys/ti-degenerate-key.pem" if !PHYTEC_K3_KEY_BLOB_COPY
+	help
+	   Specifies the  path to the degenerate key:
+	   If PHYTEC_K3_KEY_BLOB_COPY is enabled, provide the path to the blob
+	   copy of the original key.
+	   If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
+	   original key.
-- 
2.25.1

[PATCH 2/4] board: Phytec: phycore_am6*: Add k3 Kconfig to A53

[Daniel Schultz]

Add board/phytec/common/k3/Kconfig to the A53 builds to make
the PHYTEC_K3_ configs visible for this defconfig.

This patch also adds .../k3/Kconfig to the AM64x R5 build for the
same reason.

Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
 board/phytec/phycore_am62ax/Kconfig | 1 +
 board/phytec/phycore_am62x/Kconfig  | 1 +
 board/phytec/phycore_am64x/Kconfig  | 2 ++
 3 files changed, 4 insertions(+)

diff --git a/board/phytec/phycore_am62ax/Kconfig b/board/phytec/phycore_am62ax/Kconfig
index 516dc8e2020..81f2311ec97 100644
--- a/board/phytec/phycore_am62ax/Kconfig
+++ b/board/phytec/phycore_am62ax/Kconfig
@@ -15,6 +15,7 @@ config SYS_CONFIG_NAME
        default "phycore_am62ax"
 
 source "board/phytec/common/Kconfig"
+source "board/phytec/common/k3/Kconfig"
 
 endif
 
diff --git a/board/phytec/phycore_am62x/Kconfig b/board/phytec/phycore_am62x/Kconfig
index ecee5873c0c..6c2eb82787e 100644
--- a/board/phytec/phycore_am62x/Kconfig
+++ b/board/phytec/phycore_am62x/Kconfig
@@ -15,6 +15,7 @@ config SYS_CONFIG_NAME
        default "phycore_am62x"
 
 source "board/phytec/common/Kconfig"
+source "board/phytec/common/k3/Kconfig"
 
 endif
 
diff --git a/board/phytec/phycore_am64x/Kconfig b/board/phytec/phycore_am64x/Kconfig
index 829526c3295..ddfb4a39989 100644
--- a/board/phytec/phycore_am64x/Kconfig
+++ b/board/phytec/phycore_am64x/Kconfig
@@ -18,6 +18,7 @@ config SYS_CONFIG_NAME
        default "phycore_am64x"
 
 source "board/phytec/common/Kconfig"
+source "board/phytec/common/k3/Kconfig"
 
 endif
 
@@ -33,5 +34,6 @@ config SYS_CONFIG_NAME
        default "phycore_am64x"
 
 source "board/phytec/common/Kconfig"
+source "board/phytec/common/k3/Kconfig"
 
 endif
-- 
2.25.1

[PATCH 3/4] arch: arm: dts: k3-am625-phycore-som-binman: Add custMpk and ti-degenerate keys with CONFIG entries

[Daniel Schultz]

From: Nathan Morrisson <nmorrisson@phytec.com>

Add the SMPK and ti-degenerate keys using CONFIG entries. These keys
are set by the build system and are stored outside of u-boot.

Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
 arch/arm/dts/k3-am625-phycore-som-binman.dtsi | 72 ++++++++++++++-----
 1 file changed, 56 insertions(+), 16 deletions(-)

diff --git a/arch/arm/dts/k3-am625-phycore-som-binman.dtsi b/arch/arm/dts/k3-am625-phycore-som-binman.dtsi
index 31456d23167..9682ab532ed 100644
--- a/arch/arm/dts/k3-am625-phycore-som-binman.dtsi
+++ b/arch/arm/dts/k3-am625-phycore-som-binman.dtsi
@@ -8,6 +8,13 @@
 
 #include "k3-binman.dtsi"
 
+#ifndef CONFIG_PHYTEC_K3_KEY_BLOB_COPY
+&binman {
+		/delete-node/ custMpk;
+		/delete-node/ ti-degenerate-key;
+	};
+#endif
+
 #ifdef CONFIG_TARGET_PHYCORE_AM62X_R5
 &binman {
 	tiboot3-am62x-hs-phycore-som.bin {
@@ -18,7 +25,7 @@
 			combined;
 			dm-data;
 			sysfw-inner-cert;
-			keyfile = "custMpk.pem";
+			keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 			sw-rev = <1>;
 			content-sbl = <&u_boot_spl>;
 			content-sysfw = <&ti_fs_enc>;
@@ -64,7 +71,7 @@
 			combined;
 			dm-data;
 			sysfw-inner-cert;
-			keyfile = "custMpk.pem";
+			keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 			sw-rev = <1>;
 			content-sbl = <&u_boot_spl_fs>;
 			content-sysfw = <&ti_fs_enc_fs>;
@@ -117,7 +124,7 @@
 			content-dm-data = <&combined_dm_cfg_gp>;
 			load-dm-data = <0x43c3a800>;
 			sw-rev = <1>;
-			keyfile = "ti-degenerate-key.pem";
+			keyfile = CONFIG_PHYTEC_K3_DEGENERATE_KEY;
 		};
 		u_boot_spl_unsigned: u-boot-spl {
 			no-expanded;
@@ -172,7 +179,7 @@
 			core = "secure";
 			load = <0x40000>;
 			sw-rev = <CONFIG_K3_X509_SWRV>;
-			keyfile = "custMpk.pem";
+			keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 			countersign;
 			tifsstub;
 		};
@@ -210,7 +217,7 @@
 			core = "secure";
 			load = <0x60000>;
 			sw-rev = <CONFIG_K3_X509_SWRV>;
-			keyfile = "ti-degenerate-key.pem";
+			keyfile = CONFIG_PHYTEC_K3_DEGENERATE_KEY;
 			tifsstub;
 		};
 		tifsstub_gp: tifsstub-gp.bin {
@@ -227,6 +234,24 @@
 		fit {
 
 			images {
+				atf {
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+				};
+
+				tee {
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+				};
+
+				spl {
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+				};
+
 				tifsstub-hs {
 					description = "TIFSSTUB";
 					type = "firmware";
@@ -268,7 +293,7 @@
 				dm {
 					ti-secure {
 						content = <&dm>;
-						keyfile = "custMpk.pem";
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 					};
 					dm: blob-ext {
 						filename = "ti-dm.bin";
@@ -282,7 +307,7 @@
 					compression = "none";
 					ti-secure {
 						content = <&spl_am625_phyboard_lyra_dtb>;
-						keyfile = "custMpk.pem";
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 					};
 					spl_am625_phyboard_lyra_dtb: blob-ext {
 						filename = SPL_AM625_PHYBOARD_LYRA_DTB;
@@ -313,6 +338,9 @@
 			images {
 				uboot {
 					description = "U-Boot for phyCORE-AM62x";
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
 				};
 
 				som-no-rtc {
@@ -321,8 +349,11 @@
 					compression = "none";
 					load = <0x8F000000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_rtc_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_rtc_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-rtc.dtbo";
 					};
 				};
@@ -333,8 +364,11 @@
 					compression = "none";
 					load = <0x8F001000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_spi_not_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_spi_not_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-spi-nor.dtbo";
 					};
 				};
@@ -345,8 +379,11 @@
 					compression = "none";
 					load = <0x8F002000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_eth_phy_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_eth_phy_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-eth-phy.dtbo";
 					};
 				};
@@ -357,8 +394,11 @@
 					compression = "none";
 					load = <0x8F003000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_qspi_nor_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_qspi_nor_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-qspi-nor.dtbo";
 					};
 				};
@@ -370,7 +410,7 @@
 					compression = "none";
 					ti-secure {
 						content = <&am625_phyboard_lyra_dtb>;
-						keyfile = "custMpk.pem";
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 					};
 					am625_phyboard_lyra_dtb: blob-ext {
 						filename = AM625_PHYBOARD_LYRA_DTB;
-- 
2.25.1

[PATCH 4/4] arch: arm: dts: k3-am642-phycore-som-binman: Add custMpk and ti-degenerate keys with CONFIG entries

[Daniel Schultz]

From: Nathan Morrisson <nmorrisson@phytec.com>

Add the SMPK and ti-degenerate keys using CONFIG entries. These keys
are set by the build system and are stored outside of u-boot.

Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
 arch/arm/dts/k3-am642-phycore-som-binman.dtsi | 70 +++++++++++++++----
 1 file changed, 55 insertions(+), 15 deletions(-)

diff --git a/arch/arm/dts/k3-am642-phycore-som-binman.dtsi b/arch/arm/dts/k3-am642-phycore-som-binman.dtsi
index 3710564cd4a..5d86da7754e 100644
--- a/arch/arm/dts/k3-am642-phycore-som-binman.dtsi
+++ b/arch/arm/dts/k3-am642-phycore-som-binman.dtsi
@@ -8,6 +8,13 @@
 
 #include "k3-binman.dtsi"
 
+#ifndef CONFIG_PHYTEC_K3_KEY_BLOB_COPY
+&binman {
+		/delete-node/ custMpk;
+		/delete-node/ ti-degenerate-key;
+};
+#endif
+
 #ifdef CONFIG_TARGET_PHYCORE_AM64X_R5
 &binman {
 	tiboot3-am64x_sr2-hs-phycore-som.bin {
@@ -17,7 +24,7 @@
 				<&combined_sysfw_cfg>, <&sysfw_inner_cert>;
 			combined;
 			sysfw-inner-cert;
-			keyfile = "custMpk.pem";
+			keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 			sw-rev = <1>;
 			content-sbl = <&u_boot_spl>;
 			content-sysfw = <&ti_sci_enc>;
@@ -57,7 +64,7 @@
 				<&combined_sysfw_cfg_fs>, <&sysfw_inner_cert_fs>;
 			combined;
 			sysfw-inner-cert;
-			keyfile = "custMpk.pem";
+			keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 			sw-rev = <1>;
 			content-sbl = <&u_boot_spl_fs>;
 			content-sysfw = <&ti_sci_enc_fs>;
@@ -101,7 +108,7 @@
 			content-sysfw-data = <&combined_sysfw_cfg_gp>;
 			load-sysfw-data = <0x7b000>;
 			sw-rev = <1>;
-			keyfile = "ti-degenerate-key.pem";
+			keyfile = CONFIG_PHYTEC_K3_DEGENERATE_KEY;
 		};
 		u_boot_spl_unsigned: u-boot-spl {
 			no-expanded;
@@ -146,6 +153,24 @@
 			#address-cells = <1>;
 
 			images {
+				atf {
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+				};
+
+				tee {
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+				};
+
+				spl {
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+				};
+
 				dm {
 					blob-ext {
 						filename = "/dev/null";
@@ -159,7 +184,7 @@
 					compression = "none";
 					ti-secure {
 						content = <&spl_am642_phyboard_electra_dtb>;
-						keyfile = "custMpk.pem";
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 					};
 					spl_am642_phyboard_electra_dtb: blob-ext {
 						filename = SPL_AM642_PHYBOARD_ELECTRA_DTB;
@@ -190,6 +215,9 @@
 			images {
 				uboot {
 					description = "U-Boot for AM64 board";
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
 				};
 
 				fdt-0 {
@@ -199,7 +227,7 @@
 					compression = "none";
 					ti-secure {
 						content = <&am642_phyboard_electra_dtb>;
-						keyfile = "custMpk.pem";
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 					};
 					am642_phyboard_electra_dtb: blob-ext {
 						filename = AM642_PHYBOARD_ELECTRA_DTB;
@@ -324,7 +352,7 @@
 					compression = "none";
 					ti-secure {
 						content = <&spl_am642_phyboard_electra_dtb>;
-						keyfile = "custMpk.pem";
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 					};
 					spl_am642_phyboard_electra_dtb: blob-ext {
 						filename = SPL_AM642_PHYBOARD_ELECTRA_DTB;
@@ -363,8 +391,11 @@
 					compression = "none";
 					load = <0x8F000000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_rtc_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_rtc_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-rtc.dtbo";
 					};
 				};
@@ -375,8 +406,11 @@
 					compression = "none";
 					load = <0x8F001000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_spi_not_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_spi_not_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-spi-nor.dtbo";
 					};
 				};
@@ -387,8 +421,11 @@
 					compression = "none";
 					load = <0x8F002000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_eth_phy_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_eth_phy_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-eth-phy.dtbo";
 					};
 				};
@@ -399,8 +436,11 @@
 					compression = "none";
 					load = <0x8F003000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_qspi_nor_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_qspi_nor_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-qspi-nor.dtbo";
 					};
 				};
@@ -412,7 +452,7 @@
 					compression = "none";
 					ti-secure {
 						content = <&am642_phyboard_electra_dtb>;
-						keyfile = "custMpk.pem";
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 					};
 					am642_phyboard_electra_dtb: blob-ext {
 						filename = AM642_PHYBOARD_ELECTRA_DTB;
-- 
2.25.1

Re: [PATCH 1/4] board: phytec: common: k3: Introduce Configs to Sign Images

[Andrew Davis]

On 2/7/25 12:51 AM, Daniel Schultz wrote:
> Private keys to sign bootloader images shouldn't be commit or part
> of this repository. Add config entries to use keys located outside
> of U-Boot to sign images.
> 

The custMpk.pem was always a placeholder, we fill it with the TI Dummy
key as an example. The idea was you replace it with your key using
something like a symlink. So custMpk.pem is replaced with a pointing
to your real key when building on the production HSM. Why do you
need to have a Kconfig to point to your real key?

If you really want a full path to be settable from Kconfig for some
reason that I am not seeing, then others will want to too. So you
should make this option generic for all K3, nothing specific to this
one board family.

Andrew

> Signed-off-by: Maik Otto <m.otto@phytec.de>
> Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
> Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
> ---
>   board/phytec/common/k3/Kconfig | 34 ++++++++++++++++++++++++++++++++++
>   1 file changed, 34 insertions(+)
> 
> diff --git a/board/phytec/common/k3/Kconfig b/board/phytec/common/k3/Kconfig
> index 282f4b79742..19fe927b22e 100644
> --- a/board/phytec/common/k3/Kconfig
> +++ b/board/phytec/common/k3/Kconfig
> @@ -3,3 +3,37 @@ config PHYTEC_K3_DDR_PATCH
>   	help
>   	   Allow to override default DDR timings prior to
>   	   DDRSS driver probing.
> +
> +config PHYTEC_K3_KEY_BLOB_COPY
> +	bool "Copy the MPK key and the degenerate TI key to the build path"
> +	default y
> +	help
> +	   Select how to manage the MPK and degenerate TI keys.
> +	   If PHYTEC_K3_KEY_BLOB_COPY is enabled, the keys will be copied into
> +	   the U-Boot directory for compatibility with the TI dummy keys
> +	   stored there.
> +	   If PHYTEC_K3_KEY_BLOB_COPY is disabled, the build will use the
> +	   original key directly. It is recommended to use the original key to
> +	   avoid unnecessary duplication.
> +
> +config PHYTEC_K3_MPK_KEY
> +	string "Path to customer specific MPK key"
> +	default "custMpk.pem" if PHYTEC_K3_KEY_BLOB_COPY
> +	default "arch/arm/mach-k3/keys/custMpk.pem" if !PHYTEC_K3_KEY_BLOB_COPY
> +	help
> +	   Specifies the path to the MPK signing key:
> +	   If PHYTEC_K3_KEY_BLOB_COPY is enabled, provide the path to the blob
> +	   copy of the original key.
> +	   If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
> +	   original key.
> +
> +config PHYTEC_K3_DEGENERATE_KEY
> +	string "Path to the degenerate TI key"
> +	default "ti-degenerate-key.pem" if PHYTEC_K3_KEY_BLOB_COPY
> +	default "arch/arm/mach-k3/keys/ti-degenerate-key.pem" if !PHYTEC_K3_KEY_BLOB_COPY
> +	help
> +	   Specifies the  path to the degenerate key:
> +	   If PHYTEC_K3_KEY_BLOB_COPY is enabled, provide the path to the blob
> +	   copy of the original key.
> +	   If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
> +	   original key.

Re: [PATCH 1/4] board: phytec: common: k3: Introduce Configs to Sign Images

[Daniel Schultz]

On 07.02.25 18:07, Andrew Davis wrote:
> On 2/7/25 12:51 AM, Daniel Schultz wrote:
>> Private keys to sign bootloader images shouldn't be commit or part
>> of this repository. Add config entries to use keys located outside
>> of U-Boot to sign images.
>>
>
> The custMpk.pem was always a placeholder, we fill it with the TI Dummy
> key as an example. The idea was you replace it with your key using
> something like a symlink. So custMpk.pem is replaced with a pointing
> to your real key when building on the production HSM. Why do you
> need to have a Kconfig to point to your real key?

Thanks for pointing that out! We were not aware of that process and 
added these Kconfigs. I just sent new patches to add the missing keyfile 
entries in our binman to use symlinks.

- Daniel

>
> If you really want a full path to be settable from Kconfig for some
> reason that I am not seeing, then others will want to too. So you
> should make this option generic for all K3, nothing specific to this
> one board family.
>
> Andrew
>
>> Signed-off-by: Maik Otto <m.otto@phytec.de>
>> Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
>> Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
>> ---
>>   board/phytec/common/k3/Kconfig | 34 ++++++++++++++++++++++++++++++++++
>>   1 file changed, 34 insertions(+)
>>
>> diff --git a/board/phytec/common/k3/Kconfig 
>> b/board/phytec/common/k3/Kconfig
>> index 282f4b79742..19fe927b22e 100644
>> --- a/board/phytec/common/k3/Kconfig
>> +++ b/board/phytec/common/k3/Kconfig
>> @@ -3,3 +3,37 @@ config PHYTEC_K3_DDR_PATCH
>>       help
>>          Allow to override default DDR timings prior to
>>          DDRSS driver probing.
>> +
>> +config PHYTEC_K3_KEY_BLOB_COPY
>> +    bool "Copy the MPK key and the degenerate TI key to the build path"
>> +    default y
>> +    help
>> +       Select how to manage the MPK and degenerate TI keys.
>> +       If PHYTEC_K3_KEY_BLOB_COPY is enabled, the keys will be 
>> copied into
>> +       the U-Boot directory for compatibility with the TI dummy keys
>> +       stored there.
>> +       If PHYTEC_K3_KEY_BLOB_COPY is disabled, the build will use the
>> +       original key directly. It is recommended to use the original 
>> key to
>> +       avoid unnecessary duplication.
>> +
>> +config PHYTEC_K3_MPK_KEY
>> +    string "Path to customer specific MPK key"
>> +    default "custMpk.pem" if PHYTEC_K3_KEY_BLOB_COPY
>> +    default "arch/arm/mach-k3/keys/custMpk.pem" if 
>> !PHYTEC_K3_KEY_BLOB_COPY
>> +    help
>> +       Specifies the path to the MPK signing key:
>> +       If PHYTEC_K3_KEY_BLOB_COPY is enabled, provide the path to 
>> the blob
>> +       copy of the original key.
>> +       If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
>> +       original key.
>> +
>> +config PHYTEC_K3_DEGENERATE_KEY
>> +    string "Path to the degenerate TI key"
>> +    default "ti-degenerate-key.pem" if PHYTEC_K3_KEY_BLOB_COPY
>> +    default "arch/arm/mach-k3/keys/ti-degenerate-key.pem" if 
>> !PHYTEC_K3_KEY_BLOB_COPY
>> +    help
>> +       Specifies the  path to the degenerate key:
>> +       If PHYTEC_K3_KEY_BLOB_COPY is enabled, provide the path to 
>> the blob
>> +       copy of the original key.
>> +       If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
>> +       original key.