Re: [PATCH RFC 0/3] ARM: rockchip: add rockchip secure boot

[Sascha Hauer <s.hauer@pengutronix.de>]

On Mon, Jan 05, 2026 at 03:32:30PM +0100, Michael Tretter wrote:
> Add support to enable secure boot on rk3588 SoCs via the Rockchip Secure
> Boot PTA [0].
> 
> The OTP fuses for the secure boot configuration are only accessible from
> the secure world. Therefore, the actual hardware access is implemented
> in the aforementioned PTA. Thus, barebox is only able to enable secure
> boot, if this PTA is available.
> 
> Patch 1 adds a helper script to calculate the Public Root Key hash, that
> needs to be burned into the OTP fuses. The script accepts a PEM file
> containing an RSA (public) key or an already signed rkimage, from which
> the key is extracted.
> 
> Patch 2 adds a driver that interacts with the Rockchip Secure Boot PTA.
> The API header between the PTA and the driver has been copied from
> OP-TEE.
> 
> Patch 3 adds a shell command that a user may use to actually interact
> with the PTA. The command options are inspired by the options for the
> i.MX hab command.
> 
> This series is an RFC, because the Rockchip Secure Boot PTA is not
> merged into OP-TEE, yet.

Looks all good to me, so let's wait until it's merged into OP-TEE.

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |