[PATCH 4/6] k3-binman.dtsi: add keyfile_template node

Rasmus Villemoes ravi at prevas.dk
Fri Jul 10 14:36:16 CEST 2026


Currently, it is somewhat tedious for downstream/custom boards to
override the keyfile used for signing all the various artifacts
involved in booting on K3 devices to point at their own key (or
pkcs#11 uri for that matter). One has to have overrides in one's .dtsi
for each and every ti-secure / ti-secure-rom node, and a lot of those
do not even have dts labels, so one has to use their full
/binman/... path.

Add a small dedicated template that only contains the keyfile
property. In a subsequent patch, we will change nodes that contain an
explicit 'keyfile = "custMpk.pem"' to instead have this template
inserted. This way, the downstream board's .dtsi file only needs to
contain something like

  &keyfile_template {
    keyfile = "/path/to/own/key.pem";
  };

and that will then automatically propagate to all the nodes.

Signed-off-by: Rasmus Villemoes <ravi at prevas.dk>
---
 arch/arm/dts/k3-binman.dtsi | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm/dts/k3-binman.dtsi b/arch/arm/dts/k3-binman.dtsi
index ad127663d03..69214bb32fb 100644
--- a/arch/arm/dts/k3-binman.dtsi
+++ b/arch/arm/dts/k3-binman.dtsi
@@ -25,6 +25,10 @@
 			filename = "arch/arm/mach-k3/keys/ti-degenerate-key.pem";
 		};
 	};
+
+	keyfile_template: template-keyfile {
+		keyfile = "custMpk.pem";
+	};
 };
 
 #ifndef CONFIG_ARM64
-- 
2.55.0



More information about the U-Boot mailing list