Currently, it is somewhat tedious for downstream/custom boards to
override the keyfile used for signing all the various artifacts
involved in booting on K3 devices to point at their own key. For a key
stored in a file, one could override node which "generates" (copies)
custMpk.pem in the build dir from the one in the source dir and point
that at another filename=. That works, but is a little misleading.
However, when the "keyfile" needs to be, say, a pkcs#11 uri, one has
to have overrides in one's .dtsi for each and every ti-secure /
ti-secure-rom node, and a lot of those do not even have dts labels, so
one has to use their full /binman/... path.
Add a small dedicated template that only contains the keyfile
property. In a subsequent patch, we will change nodes that contain an
explicit 'keyfile = "custMpk.pem"' to instead have this template
inserted. This way, the downstream board's .dtsi file only needs to
contain something like
&keyfile_template {
keyfile = "pkcs11:object=my-key-identifier";
};
and that will then automatically propagate to all the nodes.
Reviewed-by: Simon Glass <[email protected]>
Signed-off-by: Rasmus Villemoes <[email protected]>
---
arch/arm/dts/k3-binman.dtsi | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/arm/dts/k3-binman.dtsi b/arch/arm/dts/k3-binman.dtsi
index ad127663d03..69214bb32fb 100644
--- a/arch/arm/dts/k3-binman.dtsi
+++ b/arch/arm/dts/k3-binman.dtsi
@@ -25,6 +25,10 @@
filename =
"arch/arm/mach-k3/keys/ti-degenerate-key.pem";
};
};
+
+ keyfile_template: template-keyfile {
+ keyfile = "custMpk.pem";
+ };
};
#ifndef CONFIG_ARM64
--
2.55.0
