boot: arm-trusted-firmware-microchipsw: use fixed development keys

Use the published P-256 example key from RFC 6979 for all seven
default development signing roles instead of generating new keys.
Keep role-specific filenames so TFA_KEY_DIR can supply distinct keys.

Pass all supplied keys to both regular and FWU cert_create runs.
Certificate times, serials, and ECDSA signatures still vary.

The public demo key must not be provisioned as a production trust root.

Signed-off-by: Robert Marko <robert.marko@sartura.hr>

10 files changed, 127 insertions, 1 deletions

diff --git a/package/boot/arm-trusted-firmware-microchipsw/Makefile b/package/boot/arm-trusted-firmware-microchipsw/Makefile
index 69630df807..992d796a11 100644
--- a/package/boot/arm-trusted-firmware-microchipsw/Makefile
+++ b/package/boot/arm-trusted-firmware-microchipsw/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=arm-trusted-firmware-microchipsw
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=https://github.com/microchip-ung/arm-trusted-firmware.git
@@ -62,10 +62,22 @@ define Build/Prepare
 	$(TAR) -C $(PKG_BUILD_DIR) -xf $(DL_DIR)/$(MBEDTLS_SOURCE)
 endef
 
+# Public development keys. Override with a private key directory for devices
+# whose root key hash has been provisioned in OTP.
+TFA_KEY_DIR ?= $(PKG_BUILD_DIR)/keys
+
 TFA_MAKE_FLAGS += \
 	MBEDTLS_DIR=$(PKG_BUILD_DIR)/$(MBEDTLS_NAME) \
 	BL33=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-u-boot.bin \
 	KEY_ALG=ecdsa GENERATE_COT=1 TRUSTED_BOARD_BOOT=1 \
+	CREATE_KEYS=0 \
+	ROT_KEY=$(TFA_KEY_DIR)/rot.pem \
+	TRUSTED_WORLD_KEY=$(TFA_KEY_DIR)/trusted-world.pem \
+	NON_TRUSTED_WORLD_KEY=$(TFA_KEY_DIR)/non-trusted-world.pem \
+	SCP_BL2_KEY=$(TFA_KEY_DIR)/scp-fw.pem \
+	BL31_KEY=$(TFA_KEY_DIR)/soc-fw.pem \
+	BL32_KEY=$(TFA_KEY_DIR)/tos-fw.pem \
+	BL33_KEY=$(TFA_KEY_DIR)/nt-fw.pem \
 	all fip fwu_fip
 
 define Package/trusted-firmware-a/install
diff --git a/package/boot/arm-trusted-firmware-microchipsw/patches/0005-tbbr-pass-supplied-keys-to-cert-create.patch b/package/boot/arm-trusted-firmware-microchipsw/patches/0005-tbbr-pass-supplied-keys-to-cert-create.patch
new file mode 100644
index 0000000000..61f16556a5
--- /dev/null
+++ b/package/boot/arm-trusted-firmware-microchipsw/patches/0005-tbbr-pass-supplied-keys-to-cert-create.patch
@@ -0,0 +1,65 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Mon, 12 Oct 2026 19:04:12 +0200
+Subject: [PATCH] tbbr: pass all supplied keys to cert_create
+
+cert_create loads all TBBR keys even if a key is not used by the requested
+certificate. Forward each supplied key unconditionally to both the normal
+and FWU invocations, so CREATE_KEYS=0 works with a complete key set.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ make_helpers/tbbr/tbbr_tools.mk | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/make_helpers/tbbr/tbbr_tools.mk
++++ b/make_helpers/tbbr/tbbr_tools.mk
+@@ -78,7 +78,17 @@ $(if ${PLAT_KEY},$(eval $(call CERT_ADD_
+ $(if ${SWD_ROT_KEY},$(eval $(call CERT_ADD_CMD_OPT,${SWD_ROT_KEY},--swd-rot-key)))
+ $(if ${CORE_SWD_KEY},$(eval $(call CERT_ADD_CMD_OPT,${CORE_SWD_KEY},--core-swd-key)))
+ $(if ${TRUSTED_WORLD_KEY},$(eval $(call CERT_ADD_CMD_OPT,${TRUSTED_WORLD_KEY},--trusted-world-key)))
++$(if ${TRUSTED_WORLD_KEY},$(eval $(call CERT_ADD_CMD_OPT,${TRUSTED_WORLD_KEY},--trusted-world-key,FWU_)))
+ $(if ${NON_TRUSTED_WORLD_KEY},$(eval $(call CERT_ADD_CMD_OPT,${NON_TRUSTED_WORLD_KEY},--non-trusted-world-key)))
++$(if ${NON_TRUSTED_WORLD_KEY},$(eval $(call CERT_ADD_CMD_OPT,${NON_TRUSTED_WORLD_KEY},--non-trusted-world-key,FWU_)))
++$(if ${SCP_BL2_KEY},$(eval $(call CERT_ADD_CMD_OPT,${SCP_BL2_KEY},--scp-fw-key)))
++$(if ${SCP_BL2_KEY},$(eval $(call CERT_ADD_CMD_OPT,${SCP_BL2_KEY},--scp-fw-key,FWU_)))
++$(if ${BL31_KEY},$(eval $(call CERT_ADD_CMD_OPT,${BL31_KEY},--soc-fw-key)))
++$(if ${BL31_KEY},$(eval $(call CERT_ADD_CMD_OPT,${BL31_KEY},--soc-fw-key,FWU_)))
++$(if ${BL32_KEY},$(eval $(call CERT_ADD_CMD_OPT,${BL32_KEY},--tos-fw-key)))
++$(if ${BL32_KEY},$(eval $(call CERT_ADD_CMD_OPT,${BL32_KEY},--tos-fw-key,FWU_)))
++$(if ${BL33_KEY},$(eval $(call CERT_ADD_CMD_OPT,${BL33_KEY},--nt-fw-key)))
++$(if ${BL33_KEY},$(eval $(call CERT_ADD_CMD_OPT,${BL33_KEY},--nt-fw-key,FWU_)))
+ 
+ 
+ # Add the BL2 CoT (image cert)
+@@ -93,7 +103,6 @@ endif
+ # Add the SCP_BL2 CoT (key cert + img cert)
+ ifneq (${SCP_BL2},)
+ ifneq (${COT},cca)
+-    $(if ${SCP_BL2_KEY},$(eval $(call CERT_ADD_CMD_OPT,${SCP_BL2_KEY},--scp-fw-key)))
+     $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/scp_fw_content.crt,--scp-fw-cert))
+     $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/scp_fw_key.crt,--scp-fw-key-cert))
+ endif
+@@ -102,7 +111,6 @@ endif
+ ifeq (${ARCH},aarch64)
+ ifeq (${NEED_BL31},yes)
+ # Add the BL31 CoT (key cert + img cert)
+-$(if ${BL31_KEY},$(eval $(call CERT_ADD_CMD_OPT,${BL31_KEY},--soc-fw-key)))
+ ifneq (${COT},cca)
+ $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/soc_fw_content.crt,--soc-fw-cert))
+ $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/soc_fw_key.crt,--soc-fw-key-cert))
+@@ -112,14 +120,12 @@ endif
+ 
+ # Add the BL32 CoT (key cert + img cert)
+ ifeq (${NEED_BL32},yes)
+-    $(if ${BL32_KEY},$(eval $(call CERT_ADD_CMD_OPT,${BL32_KEY},--tos-fw-key)))
+     $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/tos_fw_content.crt,--tos-fw-cert))
+     $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/tos_fw_key.crt,--tos-fw-key-cert))
+ endif
+ 
+ # Add the BL33 CoT (key cert + img cert)
+ ifneq (${BL33},)
+-    $(if ${BL33_KEY},$(eval $(call CERT_ADD_CMD_OPT,${BL33_KEY},--nt-fw-key)))
+     $(eval $(call TOOL_ADD_PAYLOAD,${BUILD_PLAT}/nt_fw_content.crt,--nt-fw-cert))
+ ifneq (${COT},dualroot)
+     ifneq (${COT},cca)
diff --git a/package/boot/arm-trusted-firmware-microchipsw/src/keys/README b/package/boot/arm-trusted-firmware-microchipsw/src/keys/README
new file mode 100644
index 0000000000..7d9607f646
--- /dev/null
+++ b/package/boot/arm-trusted-firmware-microchipsw/src/keys/README
@@ -0,0 +1,14 @@
+These are public development signing keys for Microchip LAN969x TF-A builds.
+They provide stable inputs for reproducible builds; they do not provide
+authenticity against an attacker. Never provision their root-key hash into
+production OTP.
+
+The default package build uses the same published P-256 example key from
+RFC 6979, Appendix A.2.5, for all seven roles with CREATE_KEYS=0.
+The separate filenames let a private key directory provide distinct keys.
+For a device provisioned with a private root key, supply a private directory
+containing the same filenames via TFA_KEY_DIR. The root key's public X and Y
+coordinates must have no leading zero byte because of ERR-LAN969X-001.
+
+Fixed keys alone do not make the FIP reproducible: cert_create still generates
+random certificate serials and ECDSA signatures and uses the current time.
diff --git a/package/boot/arm-trusted-firmware-microchipsw/src/keys/non-trusted-world.pem b/package/boot/arm-trusted-firmware-microchipsw/src/keys/non-trusted-world.pem
new file mode 100644
index 0000000000..bfb1f0b60b
--- /dev/null
+++ b/package/boot/arm-trusted-firmware-microchipsw/src/keys/non-trusted-world.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIMmvqdhFunUWa1whV2ex1pNOUMPbNuibEnuKYisSD2choAoGCCqGSM49
+AwEHoUQDQgAEYP7UuiVanTHJYet0xjVtaMBJuJI7Yfps5mliLmDyn7Z5A/4QCLi8
+maQa6elWKLxk8vGyDC1+n1F3o8KU1EYimQ==
+-----END EC PRIVATE KEY-----
diff --git a/package/boot/arm-trusted-firmware-microchipsw/src/keys/nt-fw.pem b/package/boot/arm-trusted-firmware-microchipsw/src/keys/nt-fw.pem
new file mode 100644
index 0000000000..bfb1f0b60b
--- /dev/null
+++ b/package/boot/arm-trusted-firmware-microchipsw/src/keys/nt-fw.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIMmvqdhFunUWa1whV2ex1pNOUMPbNuibEnuKYisSD2choAoGCCqGSM49
+AwEHoUQDQgAEYP7UuiVanTHJYet0xjVtaMBJuJI7Yfps5mliLmDyn7Z5A/4QCLi8
+maQa6elWKLxk8vGyDC1+n1F3o8KU1EYimQ==
+-----END EC PRIVATE KEY-----
diff --git a/package/boot/arm-trusted-firmware-microchipsw/src/keys/rot.pem b/package/boot/arm-trusted-firmware-microchipsw/src/keys/rot.pem
new file mode 100644
index 0000000000..bfb1f0b60b
--- /dev/null
+++ b/package/boot/arm-trusted-firmware-microchipsw/src/keys/rot.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIMmvqdhFunUWa1whV2ex1pNOUMPbNuibEnuKYisSD2choAoGCCqGSM49
+AwEHoUQDQgAEYP7UuiVanTHJYet0xjVtaMBJuJI7Yfps5mliLmDyn7Z5A/4QCLi8
+maQa6elWKLxk8vGyDC1+n1F3o8KU1EYimQ==
+-----END EC PRIVATE KEY-----
diff --git a/package/boot/arm-trusted-firmware-microchipsw/src/keys/scp-fw.pem b/package/boot/arm-trusted-firmware-microchipsw/src/keys/scp-fw.pem
new file mode 100644
index 0000000000..bfb1f0b60b
--- /dev/null
+++ b/package/boot/arm-trusted-firmware-microchipsw/src/keys/scp-fw.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIMmvqdhFunUWa1whV2ex1pNOUMPbNuibEnuKYisSD2choAoGCCqGSM49
+AwEHoUQDQgAEYP7UuiVanTHJYet0xjVtaMBJuJI7Yfps5mliLmDyn7Z5A/4QCLi8
+maQa6elWKLxk8vGyDC1+n1F3o8KU1EYimQ==
+-----END EC PRIVATE KEY-----
diff --git a/package/boot/arm-trusted-firmware-microchipsw/src/keys/soc-fw.pem b/package/boot/arm-trusted-firmware-microchipsw/src/keys/soc-fw.pem
new file mode 100644
index 0000000000..bfb1f0b60b
--- /dev/null
+++ b/package/boot/arm-trusted-firmware-microchipsw/src/keys/soc-fw.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIMmvqdhFunUWa1whV2ex1pNOUMPbNuibEnuKYisSD2choAoGCCqGSM49
+AwEHoUQDQgAEYP7UuiVanTHJYet0xjVtaMBJuJI7Yfps5mliLmDyn7Z5A/4QCLi8
+maQa6elWKLxk8vGyDC1+n1F3o8KU1EYimQ==
+-----END EC PRIVATE KEY-----
diff --git a/package/boot/arm-trusted-firmware-microchipsw/src/keys/tos-fw.pem b/package/boot/arm-trusted-firmware-microchipsw/src/keys/tos-fw.pem
new file mode 100644
index 0000000000..bfb1f0b60b
--- /dev/null
+++ b/package/boot/arm-trusted-firmware-microchipsw/src/keys/tos-fw.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIMmvqdhFunUWa1whV2ex1pNOUMPbNuibEnuKYisSD2choAoGCCqGSM49
+AwEHoUQDQgAEYP7UuiVanTHJYet0xjVtaMBJuJI7Yfps5mliLmDyn7Z5A/4QCLi8
+maQa6elWKLxk8vGyDC1+n1F3o8KU1EYimQ==
+-----END EC PRIVATE KEY-----
diff --git a/package/boot/arm-trusted-firmware-microchipsw/src/keys/trusted-world.pem b/package/boot/arm-trusted-firmware-microchipsw/src/keys/trusted-world.pem
new file mode 100644
index 0000000000..bfb1f0b60b
--- /dev/null
+++ b/package/boot/arm-trusted-firmware-microchipsw/src/keys/trusted-world.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIMmvqdhFunUWa1whV2ex1pNOUMPbNuibEnuKYisSD2choAoGCCqGSM49
+AwEHoUQDQgAEYP7UuiVanTHJYet0xjVtaMBJuJI7Yfps5mliLmDyn7Z5A/4QCLi8
+maQa6elWKLxk8vGyDC1+n1F3o8KU1EYimQ==
+-----END EC PRIVATE KEY-----