On Mon, Jan 05, 2026 at 03:32:30PM +0100, Michael Tretter wrote: > Add support to enable secure boot on rk3588 SoCs via the Rockchip Secure > Boot PTA [0]. > > The OTP fuses for the secure boot configuration are only accessible from > the secure world. Therefore, the actual hardware access is implemented > in the aforementioned PTA. Thus, barebox is only able to enable secure > boot, if this PTA is available. > > Patch 1 adds a helper script to calculate the Public Root Key hash, that > needs to be burned into the OTP fuses. The script accepts a PEM file > containing an RSA (public) key or an already signed rkimage, from which > the key is extracted. > > Patch 2 adds a driver that interacts with the Rockchip Secure Boot PTA. > The API header between the PTA and the driver has been copied from > OP-TEE. > > Patch 3 adds a shell command that a user may use to actually interact > with the PTA. The command options are inspired by the options for the > i.MX hab command. > > This series is an RFC, because the Rockchip Secure Boot PTA is not > merged into OP-TEE, yet.
Looks all good to me, so let's wait until it's merged into OP-TEE. Sascha -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
