Document how one can use the keyfile_template to specify one's own key in a single place, and similarly document the use of the distinguished_name_template.
Also mention the ability to use a pkcs#11 uri as "keyfile", and that it requires one to provide a suitable openssl configuration file (via the OPENSSL_CONF environment variable). Details on how to write such a file for one's specific provider is out of scope for this document. Reviewed-by: Simon Glass <[email protected]> Signed-off-by: Rasmus Villemoes <[email protected]> --- doc/board/ti/k3.rst | 48 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/doc/board/ti/k3.rst b/doc/board/ti/k3.rst index d3ecaf59909..9f87101217a 100644 --- a/doc/board/ti/k3.rst +++ b/doc/board/ti/k3.rst @@ -127,6 +127,54 @@ function as in HS-SE, but as there are no customer keys to verify the signatures against, the authentication will pass for certificates signed with any key. +In order to direct the build to use your own signing infrastructure +instead of the custMpk.pem dummy key shipped with the U-Boot sources, +add something like + +.. code-block:: dts + + &keyfile_template { + keyfile = "/path/to/your/key.pem"; + }; + +to your board's ``-u-boot.dtsi`` file. You can also customize the +Distinguished Name in the generated certificates by including +something like + +.. code-block:: dts + + &distinguished_name_template { + distinguished-name { + C = "DE"; + L = "Berlin"; + O = "Acme Corporation"; + OU = "Cartoon props"; + }; + }; + +Ensure that any ``ti-secure`` or ``ti-secure-rom`` nodes defined in +your own ``.dts`` files contain + +.. code-block:: dts + + insert-template = <&keyfile_template>, <&distinguished_name_template>; + +as that will ensure that all certificates use the key and +Distinguished Name defined in the templates. + +If you do not have the private key in a file, but instead use a HSM of +some sort, it is also possible to set ``keyfile`` to a PKCS#11 URI, e.g. + +.. code-block:: dts + + &keyfile_template { + keyfile = "pkcs11:object=your-key-identifier"; + }; + +For that to work, you must set the ``OPENSSL_CONF`` environment +variable appropriately when building, pointing it at a configuration +file matching your pkcs#11 provider. + Chain of trust ^^^^^^^^^^^^^^ -- 2.55.0
