Repository navigation
feat(linux): Add ECDSA Signing Guide for k3 devices - #802
DoobyDoPap wants to merge 1 commit into
Conversation
github-actions
Bot
assigned
bryanbrattlof,
devarsht,
gehariprasath,
jmenti,
praneethbajjuri,
ti-sebin and
uditkumarti
|
New issues found with check_toc_txt.py: |
|
New warnings found with rstcheck: |
|
New issues found with check_toc_txt.py: |
|
@DoobyDoPap I think we might need to update it for fitImage as well, that also uses custmpk.{pem,crt}, do give instructions to change the rsa key to ecdsa in that and see if that works. |
f2742c2 to
56c0baa
Compare
56c0baa to
a5576f4
Compare
|
Hello @StaticRocket , I have completely refactored the doc for this use case, Can you please review the doc again |
|
Is it prudent to hold the doc updates till the necessary patches are merged in the SDK? I see that Andrew had posted some comments on the U-Boot patches posted by @DoobyDoPap. And it is possible the code might change in the due review process. |
Add a new page in the U-Boot user guide documenting how to switch K3 boot images from RSA to ECDSA signing. This covers the standalone ti-u-boot build flow placing the ECDSA Key in the appropiate folders and lists the steps to enable signing for boot images & fit sigining. Signed-off-by: Atharv Dubey <a-dubey@ti.com>
a5576f4 to
0df464e
Compare
| When u-boot.img is a signed FIT image, change the algorithm on the FIT configuration node in your board's ``*-binman.dtsi``. Keep ``key-name-hint = "custMpk"``: | ||
|
|
||
| .. code-block:: dts | ||
| signature { | ||
| algo = "sha512,ecdsa"; | ||
| key-name-hint = "custMpk"; | ||
| sign-images = "firmware", "loadables", "fdt"; | ||
| }; | ||
| Replace ``custMpk.key``, ``custMpk.pem`` and ``custMpk.crt`` in ``arch/arm/mach-k3/keys/`` with your ECDSA key and certificate, then rebuild U-Boot. Check the result with ``mkimage -l u-boot.img``. |
There was a problem hiding this comment.
(#802 (comment)) I think we already had this discussion of removing it.
Just noticed that only AM62L has this u-boot.img and tispl.bin signing though, If you want to keep it then it's only relevant for them, better to keep that in a ifdef if they are also supporting ecdsa keys, @Pratham-T . @ti-kamlesh ?
I think the doc is independent of whatever code we are discussing. It's a very small change to update the key but the integration is a problem, until we figure that out, the doc atleast allows people to start using the ecdsa key |
11 participants
Add a new page in the U-Boot user guide documenting how to switch K3 boot images from RSA to ECDSA signing using CONFIG_K3_KEYFILE_NAME and the k3_ecdsa.config fragment.
This covers the standalone ti-u-boot build flow placing the ECDSA key, merging the config fragment, and building tiboot3.bin and tispl.bin/u-boot.img with BINMAN_INDIRS.