To make sure that the signing key is passed on as a build time parameter we use the make SIGNING_KEY= <path to key> in our current SDK, but this method is not been accepted in upstream[1], hence we are using BINMAN_INDIRS to pick the key path.
The other method suggested was to make a BINMAN_EXTRA_ARGS variable in the Makefile, but this is also rejected in upstream[2]. In this patch, we have used the multiconf option for multiple images of the target device, so when we build the image we get both RSA and ECDSA signed images. The RSA and ECDSA keys would live in separate directories, each with a custMpk.pem, and BINMAN_INDIRS just picks them respectively at build time. [1]: https://lore.kernel.org/all/[email protected]/ [2]: https://lore.kernel.org/all/CAPnjgZ0Oj=iT4K0Yj_ii=ul0rqnopmq6vs4e2xun5x1rln9...@mail.gmail.com/t/#ma8f80bad7481122d41f12b85b0ce80eae3d99f51 Signed-off-by: Atharv Dubey <[email protected]> --- .../recipes-bsp/u-boot/files/custMpk_ecdsa.key | 6 ------ meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc | 15 ++++++++++++--- 2 files changed, 12 insertions(+), 9 deletions(-) delete mode 100644 meta-ti-bsp/recipes-bsp/u-boot/files/custMpk_ecdsa.key diff --git a/meta-ti-bsp/recipes-bsp/u-boot/files/custMpk_ecdsa.key b/meta-ti-bsp/recipes-bsp/u-boot/files/custMpk_ecdsa.key deleted file mode 100644 index 83dffcda..00000000 --- a/meta-ti-bsp/recipes-bsp/u-boot/files/custMpk_ecdsa.key +++ /dev/null @@ -1,6 +0,0 @@ ------BEGIN EC PRIVATE KEY----- -MIGkAgEBBDBDO9fzBU2LoKaYgji4m3ZCHKUBF9CTVnU6ClfNPJsTo0SKZpCsmyr0 -TKUNkk16vwGgBwYFK4EEACKhZANiAATCv6ftwnJW91fP5wpLpLAxt3u732oNnKr8 -pLbZUzi/s8/e7QiISJ8QKYGaWMnjORW82cM3UJKlCw8GOrb3ZrEXYWRKxkPWql0+ -BOhDQA5b21GtL9HQPvuCPz471ZaxGYA= ------END EC PRIVATE KEY----- diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc index c1959d11..89f87d4a 100644 --- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc +++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc @@ -93,7 +93,17 @@ PACKAGECONFIG:append:am62pxx = " dm" COMPATIBLE_MACHINE = "(ti-soc)" -BINMAN_INDIRS = "${STAGING_DIR_HOST}${nonarch_base_libdir}/firmware" +BINMAN_INDIRS_DIR = "${WORKDIR}/binman-indirs" + +do_configure:prepend() { + for key in rsa ecdsa; do + mkdir -p ${BINMAN_INDIRS_DIR}-${key} + ln -sf ${STAGING_DIR_HOST}${nonarch_base_libdir}/firmware/* ${BINMAN_INDIRS_DIR}-${key}/ 2>/dev/null || true + ln -sf ${S}/arch/arm/mach-k3/keys/${key}/* ${BINMAN_INDIRS_DIR}-${key}/ 2>/dev/null || true + done +} + +BINMAN_INDIRS = "${BINMAN_INDIRS_DIR}-rsa" EXTRA_OEMAKE += "${PACKAGECONFIG_CONFARGS} BINMAN_INDIRS=${BINMAN_INDIRS}" @@ -417,5 +427,4 @@ PACKAGES:prepend:am62xx-lp-evm = "${FALCON_PKG} " TOOLCHAIN = "gcc" -TI_SIGN_WITH_ECDSA_KEY ?= "SIGNING_KEY=${THISDIR}/files/custMpk_ecdsa.key" -TI_SIGN_WITH_ECDSA_KEY:bsp-ti-6_12 = "KEY_PATH=${THISDIR}/files/custMpk_ecdsa.key" +TI_SIGN_WITH_ECDSA_KEY ?= "BINMAN_INDIRS=${BINMAN_INDIRS_DIR}-ecdsa" -- 2.34.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#20330): https://lists.yoctoproject.org/g/meta-ti/message/20330 Mute This Topic: https://lists.yoctoproject.org/mt/121125628/21656 Group Owner: [email protected] Unsubscribe: https://lists.yoctoproject.org/g/meta-ti/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
