diff --git a/configs/AM62AX/AM62AX_linux_toc.txt b/configs/AM62AX/AM62AX_linux_toc.txt index 0591fbe6d..04eb01176 100644 --- a/configs/AM62AX/AM62AX_linux_toc.txt +++ b/configs/AM62AX/AM62AX_linux_toc.txt @@ -44,6 +44,7 @@ linux/Foundational_Components/U-Boot/UG-DDRSS linux/Foundational_Components/U-Boot/UG-Network-K3 linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-Falcon-Mode +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD diff --git a/configs/AM62DX/AM62DX_linux_toc.txt b/configs/AM62DX/AM62DX_linux_toc.txt index 49de07843..69076435b 100644 --- a/configs/AM62DX/AM62DX_linux_toc.txt +++ b/configs/AM62DX/AM62DX_linux_toc.txt @@ -39,6 +39,7 @@ linux/Foundational_Components/U-Boot/UG-QSPI linux/Foundational_Components/U-Boot/UG-UART linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-Falcon-Mode +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD diff --git a/configs/AM62LX/AM62LX_linux_toc.txt b/configs/AM62LX/AM62LX_linux_toc.txt index 336f87921..238f6863a 100644 --- a/configs/AM62LX/AM62LX_linux_toc.txt +++ b/configs/AM62LX/AM62LX_linux_toc.txt @@ -42,6 +42,7 @@ linux/Foundational_Components/U-Boot/UG-Keywriter-Lite linux/Foundational_Components/U-Boot/UG-Keywriter linux/Foundational_Components/U-Boot/UG-Programming-OTPs linux/Foundational_Components/U-Boot/UG-Splash-Screen +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD diff --git a/configs/AM62PX/AM62PX_linux_toc.txt b/configs/AM62PX/AM62PX_linux_toc.txt index ea88d28b6..aad87aeff 100644 --- a/configs/AM62PX/AM62PX_linux_toc.txt +++ b/configs/AM62PX/AM62PX_linux_toc.txt @@ -44,6 +44,7 @@ linux/Foundational_Components/U-Boot/UG-Network-K3 linux/Foundational_Components/U-Boot/UG-Splash-Screen linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-Falcon-Mode +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD diff --git a/configs/AM62X/AM62X_linux_toc.txt b/configs/AM62X/AM62X_linux_toc.txt index 07b01f227..f4fa3ec8f 100644 --- a/configs/AM62X/AM62X_linux_toc.txt +++ b/configs/AM62X/AM62X_linux_toc.txt @@ -43,6 +43,7 @@ linux/Foundational_Components/U-Boot/UG-Network-K3 linux/Foundational_Components/U-Boot/UG-Splash-Screen linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-Falcon-Mode +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD diff --git a/configs/AM64X/AM64X_linux_toc.txt b/configs/AM64X/AM64X_linux_toc.txt index c8ed786b6..172e8a43e 100644 --- a/configs/AM64X/AM64X_linux_toc.txt +++ b/configs/AM64X/AM64X_linux_toc.txt @@ -41,6 +41,7 @@ linux/Foundational_Components/U-Boot/UG-NAND linux/Foundational_Components/U-Boot/UG-Network-K3 linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-PCIeBoot +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-TroubleShooting diff --git a/configs/AM65X/AM65X_linux_toc.txt b/configs/AM65X/AM65X_linux_toc.txt index 59112de7a..49003c573 100644 --- a/configs/AM65X/AM65X_linux_toc.txt +++ b/configs/AM65X/AM65X_linux_toc.txt @@ -40,6 +40,7 @@ linux/Foundational_Components/U-Boot/UG-UFS linux/Foundational_Components/U-Boot/UG-HyperBus linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-AVS +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/configs/AM67/AM67_linux_toc.txt b/configs/AM67/AM67_linux_toc.txt index be8507d39..ffeacbc5e 100644 --- a/configs/AM67/AM67_linux_toc.txt +++ b/configs/AM67/AM67_linux_toc.txt @@ -37,6 +37,7 @@ linux/Foundational_Components/U-Boot/UG-SATA linux/Foundational_Components/U-Boot/UG-DDR3 linux/Foundational_Components/U-Boot/UG-HyperBus linux/Foundational_Components/U-Boot/UG-RemoteProc +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/configs/AM67A/AM67A_linux_toc.txt b/configs/AM67A/AM67A_linux_toc.txt index 33b1db8f6..96d4097cb 100644 --- a/configs/AM67A/AM67A_linux_toc.txt +++ b/configs/AM67A/AM67A_linux_toc.txt @@ -38,6 +38,7 @@ linux/Foundational_Components/U-Boot/UG-SATA linux/Foundational_Components/U-Boot/UG-DDR3 linux/Foundational_Components/U-Boot/UG-HyperBus linux/Foundational_Components/U-Boot/UG-RemoteProc +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/configs/AM68/AM68_linux_toc.txt b/configs/AM68/AM68_linux_toc.txt index ee53444e6..e8cb0d486 100644 --- a/configs/AM68/AM68_linux_toc.txt +++ b/configs/AM68/AM68_linux_toc.txt @@ -40,6 +40,7 @@ linux/Foundational_Components/U-Boot/UG-Network-K3 linux/Foundational_Components/U-Boot/UG-HyperBus linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-HSM +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/configs/AM68A/AM68A_linux_toc.txt b/configs/AM68A/AM68A_linux_toc.txt index f275352a9..9a11bb038 100644 --- a/configs/AM68A/AM68A_linux_toc.txt +++ b/configs/AM68A/AM68A_linux_toc.txt @@ -40,6 +40,7 @@ linux/Foundational_Components/U-Boot/UG-DDRSS-J7 linux/Foundational_Components/U-Boot/UG-HyperBus linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-HSM +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/configs/AM69/AM69_linux_toc.txt b/configs/AM69/AM69_linux_toc.txt index 404c58488..62fe91389 100644 --- a/configs/AM69/AM69_linux_toc.txt +++ b/configs/AM69/AM69_linux_toc.txt @@ -40,6 +40,7 @@ linux/Foundational_Components/U-Boot/UG-Network-K3 linux/Foundational_Components/U-Boot/UG-HyperBus linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-HSM +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/configs/AM69A/AM69A_linux_toc.txt b/configs/AM69A/AM69A_linux_toc.txt index 1fb0f5df3..bb32de862 100644 --- a/configs/AM69A/AM69A_linux_toc.txt +++ b/configs/AM69A/AM69A_linux_toc.txt @@ -40,6 +40,7 @@ linux/Foundational_Components/U-Boot/UG-DDRSS-J7 linux/Foundational_Components/U-Boot/UG-HyperBus linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-HSM +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/configs/DRA821A/DRA821A_linux_toc.txt b/configs/DRA821A/DRA821A_linux_toc.txt index 18a0fd6c3..a68c777c4 100644 --- a/configs/DRA821A/DRA821A_linux_toc.txt +++ b/configs/DRA821A/DRA821A_linux_toc.txt @@ -36,6 +36,7 @@ linux/Foundational_Components/U-Boot/UG-SATA linux/Foundational_Components/U-Boot/UG-UFS linux/Foundational_Components/U-Boot/UG-DDR3 linux/Foundational_Components/U-Boot/UG-HyperBus +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/configs/J7200/J7200_linux_toc.txt b/configs/J7200/J7200_linux_toc.txt index 559609ad6..cc5b74cb7 100644 --- a/configs/J7200/J7200_linux_toc.txt +++ b/configs/J7200/J7200_linux_toc.txt @@ -42,6 +42,7 @@ linux/Foundational_Components/U-Boot/UG-HyperBus linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-AVS linux/Foundational_Components/U-Boot/UG-Thermal +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/configs/J721E/J721E_linux_toc.txt b/configs/J721E/J721E_linux_toc.txt index 9e6d06c17..a180b7880 100644 --- a/configs/J721E/J721E_linux_toc.txt +++ b/configs/J721E/J721E_linux_toc.txt @@ -42,6 +42,7 @@ linux/Foundational_Components/U-Boot/UG-HyperBus linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-AVS linux/Foundational_Components/U-Boot/UG-Thermal +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/configs/J721S2/J721S2_linux_toc.txt b/configs/J721S2/J721S2_linux_toc.txt index ac3a08b5b..e809c191d 100644 --- a/configs/J721S2/J721S2_linux_toc.txt +++ b/configs/J721S2/J721S2_linux_toc.txt @@ -42,6 +42,7 @@ linux/Foundational_Components/U-Boot/UG-HyperBus linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-HSM linux/Foundational_Components/U-Boot/UG-AVS +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/configs/J722S/J722S_linux_toc.txt b/configs/J722S/J722S_linux_toc.txt index 1db71c708..1426cef89 100644 --- a/configs/J722S/J722S_linux_toc.txt +++ b/configs/J722S/J722S_linux_toc.txt @@ -41,6 +41,7 @@ linux/Foundational_Components/U-Boot/UG-Network-K3 linux/Foundational_Components/U-Boot/UG-HyperBus linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-Splash-Screen +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/configs/J742S2/J742S2_linux_toc.txt b/configs/J742S2/J742S2_linux_toc.txt index 6b71787c3..464b53ddf 100644 --- a/configs/J742S2/J742S2_linux_toc.txt +++ b/configs/J742S2/J742S2_linux_toc.txt @@ -40,6 +40,7 @@ linux/Foundational_Components/U-Boot/UG-UFS linux/Foundational_Components/U-Boot/UG-DDRSS-J7 linux/Foundational_Components/U-Boot/UG-HyperBus linux/Foundational_Components/U-Boot/UG-RemoteProc +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/configs/J784S4/J784S4_linux_toc.txt b/configs/J784S4/J784S4_linux_toc.txt index 98a2252b4..971ac26cf 100644 --- a/configs/J784S4/J784S4_linux_toc.txt +++ b/configs/J784S4/J784S4_linux_toc.txt @@ -41,6 +41,7 @@ linux/Foundational_Components/U-Boot/UG-DDRSS-J7 linux/Foundational_Components/U-Boot/UG-HyperBus linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-HSM +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/configs/TDA4VM/TDA4VM_linux_toc.txt b/configs/TDA4VM/TDA4VM_linux_toc.txt index 41ff0cee8..a630a2af2 100644 --- a/configs/TDA4VM/TDA4VM_linux_toc.txt +++ b/configs/TDA4VM/TDA4VM_linux_toc.txt @@ -41,6 +41,7 @@ linux/Foundational_Components/U-Boot/UG-DDR3 linux/Foundational_Components/U-Boot/UG-HyperBus linux/Foundational_Components/U-Boot/UG-RemoteProc linux/Foundational_Components/U-Boot/UG-AVS +linux/Foundational_Components/U-Boot/UG-ECDSA-Signing linux/Foundational_Components/U-Boot/Applications linux/Foundational_Components/U-Boot/Apps-SPL-Debug-OpenOCD linux/Foundational_Components/U-Boot/Apps-Load-in-CCS diff --git a/source/linux/Foundational_Components/U-Boot/UG-ECDSA-Signing.rst b/source/linux/Foundational_Components/U-Boot/UG-ECDSA-Signing.rst new file mode 100644 index 000000000..36253801d --- /dev/null +++ b/source/linux/Foundational_Components/U-Boot/UG-ECDSA-Signing.rst @@ -0,0 +1,91 @@ +.. _u-boot-ecdsa-signing: + +############################################# +ECDSA signing for K3 devices +############################################# + +The SDK signs boot images with an RSA key by default. This page only lists what changes to use an ECDSA key instead on K3 devices (AM62, AM64, AM65, J721E, J722S, J784S4, etc.). For the full signing procedure, follow the original guides linked in each section. + +Any ECDSA curve supported by OpenSSL can be used (for example secp256r1, secp384r1, secp521r1). P-384 (secp384r1) is recommended. The FIT signature algorithm is ``sha512,ecdsa`` regardless of the curve. + +.. _ecdsa-key-gen: + +************************** +Generate ECDSA keys +************************** + +Generate the key and certificate with the same names the RSA setup already uses, so nothing else needs renaming: + +.. code-block:: console + + openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out custMpk.key + openssl req -new -x509 -key custMpk.key -out custMpk.crt -days 3650 -subj "/CN=Custom ECDSA Key" + +Use ``openssl ecparam -list_curves`` to see the other curves available. + +.. _ecdsa-boot-images: + +*************************** +Sign boot images +*************************** + +For tiboot3.bin, tispl.bin and u-boot.img, binman picks the key from ``arch/arm/mach-k3/keys/``. Replace the existing RSA files with your ECDSA ones: + +.. code-block:: console + + cp custMpk.key arch/arm/mach-k3/keys/custMpk.pem + cp custMpk.crt arch/arm/mach-k3/keys/custMpk.crt + +No devicetree or config changes are needed. Build as described in :ref:`top-level-makefile`. + +.. _ecdsa-kernel-fitimage: + +*************************** +Sign kernel fitImage +*************************** + +Follow the `U-Boot K3 FIT signature signing guide `__, with these differences: + +#. Change the algorithm in the ``signature-1`` node of your ``fitImage.its``. Keep ``key-name-hint = "custMpk"``: + + .. code-block:: dts + + signature-1 { + algo = "sha512,ecdsa"; + key-name-hint = "custMpk"; + sign-images = "kernel", "fdt"; + }; + +#. Put your ECDSA ``custMpk.key`` and ``custMpk.crt`` in the keys directory you pass to ``mkimage -k``. + +#. Rebuild U-Boot after generating the fitImage, so the updated ``dt.dtb`` with the public key is packed into u-boot.img. + +Check the result with ``mkimage -l fitImage``; the signature section should show ``sha512,ecdsa``. + +.. ifconfig:: CONFIG_part_family in ('AM62LX_family') + + .. _ecdsa-uboot-fit: + + .. rubric:: Sign U-Boot FIT + + On AM62Lx, u-boot.img is a signed FIT image. Change the algorithm on the FIT configuration node in the board ``*-binman.dtsi``. Keep ``key-name-hint = "custMpk"``: + + .. code-block:: dts + + signature { + algo = "sha512,ecdsa"; + key-name-hint = "custMpk"; + sign-images = "firmware", "loadables", "fdt"; + }; + + Replace ``custMpk.key``, ``custMpk.pem`` and ``custMpk.crt`` in ``arch/arm/mach-k3/keys/`` with your ECDSA key and certificate, then rebuild U-Boot. Check the result with ``mkimage -l u-boot.img``. + +.. _ecdsa-see-also: + +******** +See also +******** + +- :ref:`foundational-secure-boot` - complete secure boot documentation +- :ref:`top-level-makefile` - top-level build instructions +- `FIT signature signing - U-Boot K3 documentation `__ diff --git a/source/linux/Foundational_Components/U-Boot/Users-Guide.rst b/source/linux/Foundational_Components/U-Boot/Users-Guide.rst index 7f073245a..3f465fb83 100644 --- a/source/linux/Foundational_Components/U-Boot/Users-Guide.rst +++ b/source/linux/Foundational_Components/U-Boot/Users-Guide.rst @@ -32,6 +32,7 @@ User's Guide UG-Thermal UG-Splash-Screen UG-Secure-Boot + UG-ECDSA-Signing UG-Keywriter-Lite UG-Keywriter UG-Programming-OTPs