[PATCH 00/10] phyCORE-AM62x/AM64x: Add RAUC and Secure Boot

[PATCH 00/10] phyCORE-AM62x/AM64x: Add RAUC and Secure Boot

[Daniel Schultz]

This patch series adds support to boot PHYTEC's reference distros for
RAUC and Secure Boot.

It adds a new Kconfig entry to embed the RAUC boot logic into the K3 MMC
boot logic. The boot flow itself got extended to run the raucinit function.

It also adds Kconfig entries to pass private keys from an external location
to U-Boot to sign bootloader images. An additional config entries allows to
enable FIT image, because our Secure Boot implementation uses fitimages
instead of normal images.

Daniel Schultz (4):
  board: phytec: common: k3: Introduce Configs to Sign Images
  board: phytec: common: k3: Introduce PHYTEC_K3_EMBED_RAUC_ENV
  board: Phytec: phycore_am6*: Add k3 Kconfig to A53
  include: env: phytec: k3_mmc: Use PHYTEC_K3_EMBED_RAUC_ENV to enable
    RAUC

Nathan Morrisson (6):
  board: phytec: common: k3: Introduce PHYTEC_K3_DOFITBOOT_DEFAULT
  arch: arm: dts: k3-am625-phycore-som-binman: Add custMpk and
    ti-degenerate keys with CONFIG entries
  arch: arm: dts: k3-am642-phycore-som-binman: Add custMpk and
    ti-degenerate keys with CONFIG entries
  include: env: phytec: k3_mmc: Add support for FIT boot
  board: phytec: phycore_am62x: Update environment for fitboot
  board: phytec: phycore_am64x: Update environment for fitboot

 arch/arm/dts/k3-am625-phycore-som-binman.dtsi | 72 ++++++++++++++-----
 arch/arm/dts/k3-am642-phycore-som-binman.dtsi | 70 ++++++++++++++----
 board/phytec/common/k3/Kconfig                | 50 +++++++++++++
 board/phytec/phycore_am62ax/Kconfig           |  1 +
 board/phytec/phycore_am62x/Kconfig            |  1 +
 board/phytec/phycore_am62x/phycore_am62x.env  |  1 +
 board/phytec/phycore_am64x/Kconfig            |  2 +
 board/phytec/phycore_am64x/phycore_am64x.env  |  1 +
 include/env/phytec/k3_mmc.env                 | 14 +++-
 9 files changed, 180 insertions(+), 32 deletions(-)

-- 
2.25.1

[PATCH 01/10] board: phytec: common: k3: Introduce Configs to Sign Images

[Daniel Schultz]

Private keys to sign bootloader images shouldn't be commit or part
of this repository. Add config entries to use keys located outside
of U-Boot to sign images.

Signed-off-by: Maik Otto <m.otto@phytec.de>
Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
 board/phytec/common/k3/Kconfig | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/board/phytec/common/k3/Kconfig b/board/phytec/common/k3/Kconfig
index 282f4b79742..19fe927b22e 100644
--- a/board/phytec/common/k3/Kconfig
+++ b/board/phytec/common/k3/Kconfig
@@ -3,3 +3,37 @@ config PHYTEC_K3_DDR_PATCH
 	help
 	   Allow to override default DDR timings prior to
 	   DDRSS driver probing.
+
+config PHYTEC_K3_KEY_BLOB_COPY
+	bool "Copy the MPK key and the degenerate TI key to the build path"
+	default y
+	help
+	   Select how to manage the MPK and degenerate TI keys.
+	   If PHYTEC_K3_KEY_BLOB_COPY is enabled, the keys will be copied into
+	   the U-Boot directory for compatibility with the TI dummy keys
+	   stored there.
+	   If PHYTEC_K3_KEY_BLOB_COPY is disabled, the build will use the
+	   original key directly. It is recommended to use the original key to
+	   avoid unnecessary duplication.
+
+config PHYTEC_K3_MPK_KEY
+	string "Path to customer specific MPK key"
+	default "custMpk.pem" if PHYTEC_K3_KEY_BLOB_COPY
+	default "arch/arm/mach-k3/keys/custMpk.pem" if !PHYTEC_K3_KEY_BLOB_COPY
+	help
+	   Specifies the path to the MPK signing key:
+	   If PHYTEC_K3_KEY_BLOB_COPY is enabled, provide the path to the blob
+	   copy of the original key.
+	   If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
+	   original key.
+
+config PHYTEC_K3_DEGENERATE_KEY
+	string "Path to the degenerate TI key"
+	default "ti-degenerate-key.pem" if PHYTEC_K3_KEY_BLOB_COPY
+	default "arch/arm/mach-k3/keys/ti-degenerate-key.pem" if !PHYTEC_K3_KEY_BLOB_COPY
+	help
+	   Specifies the  path to the degenerate key:
+	   If PHYTEC_K3_KEY_BLOB_COPY is enabled, provide the path to the blob
+	   copy of the original key.
+	   If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
+	   original key.
-- 
2.25.1

[PATCH 02/10] board: phytec: common: k3: Introduce PHYTEC_K3_EMBED_RAUC_ENV

[Daniel Schultz]

This configuration enables external activation of RAUC boot.
When enabled, the boot process incorporates the PHYTEC rauc.env file.

Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
 board/phytec/common/k3/Kconfig | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/board/phytec/common/k3/Kconfig b/board/phytec/common/k3/Kconfig
index 19fe927b22e..3404864c39b 100644
--- a/board/phytec/common/k3/Kconfig
+++ b/board/phytec/common/k3/Kconfig
@@ -37,3 +37,12 @@ config PHYTEC_K3_DEGENERATE_KEY
 	   copy of the original key.
 	   If PHYTEC_K3_KEY_BLOB_COPY is disabled, provide the path to the
 	   original key.
+
+config PHYTEC_K3_EMBED_RAUC_ENV
+	bool "Embed environment to handle RAUC A/B systems"
+	default n
+	help
+	   Embed RAUC environment variables into u-boot's default environment.
+	   Provides logic to select a boot partition based on environment variables
+	   and switch to the other if the boot fails.
+	   Includes include/env/phytec/rauc.env.
-- 
2.25.1

[PATCH 03/10] board: phytec: common: k3: Introduce PHYTEC_K3_DOFITBOOT_DEFAULT

[Daniel Schultz]

From: Nathan Morrisson <nmorrisson@phytec.com>

Provide a Kconfig entry to set the dofitboot variable during
compile time.

Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
 board/phytec/common/k3/Kconfig | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/board/phytec/common/k3/Kconfig b/board/phytec/common/k3/Kconfig
index 3404864c39b..c2996016395 100644
--- a/board/phytec/common/k3/Kconfig
+++ b/board/phytec/common/k3/Kconfig
@@ -46,3 +46,10 @@ config PHYTEC_K3_EMBED_RAUC_ENV
 	   Provides logic to select a boot partition based on environment variables
 	   and switch to the other if the boot fails.
 	   Includes include/env/phytec/rauc.env.
+
+config PHYTEC_K3_DOFITBOOT_DEFAULT
+	bool "Boot from a fit image"
+	default n
+	help
+	   When set to 0, the system follows the standard K3 MMC boot flow.
+	   When set to 1, it attempts to boot from a FIT image.
-- 
2.25.1

[PATCH 04/10] board: Phytec: phycore_am6*: Add k3 Kconfig to A53

[Daniel Schultz]

Add board/phytec/common/k3/Kconfig to the A53 builds to make
the PHYTEC_K3_EMBED_RAUC configuration visible for this defconfig.

Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
 board/phytec/phycore_am62ax/Kconfig | 1 +
 board/phytec/phycore_am62x/Kconfig  | 1 +
 board/phytec/phycore_am64x/Kconfig  | 2 ++
 3 files changed, 4 insertions(+)

diff --git a/board/phytec/phycore_am62ax/Kconfig b/board/phytec/phycore_am62ax/Kconfig
index 516dc8e2020..81f2311ec97 100644
--- a/board/phytec/phycore_am62ax/Kconfig
+++ b/board/phytec/phycore_am62ax/Kconfig
@@ -15,6 +15,7 @@ config SYS_CONFIG_NAME
        default "phycore_am62ax"
 
 source "board/phytec/common/Kconfig"
+source "board/phytec/common/k3/Kconfig"
 
 endif
 
diff --git a/board/phytec/phycore_am62x/Kconfig b/board/phytec/phycore_am62x/Kconfig
index ecee5873c0c..6c2eb82787e 100644
--- a/board/phytec/phycore_am62x/Kconfig
+++ b/board/phytec/phycore_am62x/Kconfig
@@ -15,6 +15,7 @@ config SYS_CONFIG_NAME
        default "phycore_am62x"
 
 source "board/phytec/common/Kconfig"
+source "board/phytec/common/k3/Kconfig"
 
 endif
 
diff --git a/board/phytec/phycore_am64x/Kconfig b/board/phytec/phycore_am64x/Kconfig
index 829526c3295..ddfb4a39989 100644
--- a/board/phytec/phycore_am64x/Kconfig
+++ b/board/phytec/phycore_am64x/Kconfig
@@ -18,6 +18,7 @@ config SYS_CONFIG_NAME
        default "phycore_am64x"
 
 source "board/phytec/common/Kconfig"
+source "board/phytec/common/k3/Kconfig"
 
 endif
 
@@ -33,5 +34,6 @@ config SYS_CONFIG_NAME
        default "phycore_am64x"
 
 source "board/phytec/common/Kconfig"
+source "board/phytec/common/k3/Kconfig"
 
 endif
-- 
2.25.1

[PATCH 05/10] arch: arm: dts: k3-am625-phycore-som-binman: Add custMpk and ti-degenerate keys with CONFIG entries

[Daniel Schultz]

From: Nathan Morrisson <nmorrisson@phytec.com>

Add the SMPK and ti-degenerate keys using CONFIG entries. These keys
are set by the build system and are stored outside of u-boot.

Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
 arch/arm/dts/k3-am625-phycore-som-binman.dtsi | 72 ++++++++++++++-----
 1 file changed, 56 insertions(+), 16 deletions(-)

diff --git a/arch/arm/dts/k3-am625-phycore-som-binman.dtsi b/arch/arm/dts/k3-am625-phycore-som-binman.dtsi
index 31456d23167..9682ab532ed 100644
--- a/arch/arm/dts/k3-am625-phycore-som-binman.dtsi
+++ b/arch/arm/dts/k3-am625-phycore-som-binman.dtsi
@@ -8,6 +8,13 @@
 
 #include "k3-binman.dtsi"
 
+#ifndef CONFIG_PHYTEC_K3_KEY_BLOB_COPY
+&binman {
+		/delete-node/ custMpk;
+		/delete-node/ ti-degenerate-key;
+	};
+#endif
+
 #ifdef CONFIG_TARGET_PHYCORE_AM62X_R5
 &binman {
 	tiboot3-am62x-hs-phycore-som.bin {
@@ -18,7 +25,7 @@
 			combined;
 			dm-data;
 			sysfw-inner-cert;
-			keyfile = "custMpk.pem";
+			keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 			sw-rev = <1>;
 			content-sbl = <&u_boot_spl>;
 			content-sysfw = <&ti_fs_enc>;
@@ -64,7 +71,7 @@
 			combined;
 			dm-data;
 			sysfw-inner-cert;
-			keyfile = "custMpk.pem";
+			keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 			sw-rev = <1>;
 			content-sbl = <&u_boot_spl_fs>;
 			content-sysfw = <&ti_fs_enc_fs>;
@@ -117,7 +124,7 @@
 			content-dm-data = <&combined_dm_cfg_gp>;
 			load-dm-data = <0x43c3a800>;
 			sw-rev = <1>;
-			keyfile = "ti-degenerate-key.pem";
+			keyfile = CONFIG_PHYTEC_K3_DEGENERATE_KEY;
 		};
 		u_boot_spl_unsigned: u-boot-spl {
 			no-expanded;
@@ -172,7 +179,7 @@
 			core = "secure";
 			load = <0x40000>;
 			sw-rev = <CONFIG_K3_X509_SWRV>;
-			keyfile = "custMpk.pem";
+			keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 			countersign;
 			tifsstub;
 		};
@@ -210,7 +217,7 @@
 			core = "secure";
 			load = <0x60000>;
 			sw-rev = <CONFIG_K3_X509_SWRV>;
-			keyfile = "ti-degenerate-key.pem";
+			keyfile = CONFIG_PHYTEC_K3_DEGENERATE_KEY;
 			tifsstub;
 		};
 		tifsstub_gp: tifsstub-gp.bin {
@@ -227,6 +234,24 @@
 		fit {
 
 			images {
+				atf {
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+				};
+
+				tee {
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+				};
+
+				spl {
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+				};
+
 				tifsstub-hs {
 					description = "TIFSSTUB";
 					type = "firmware";
@@ -268,7 +293,7 @@
 				dm {
 					ti-secure {
 						content = <&dm>;
-						keyfile = "custMpk.pem";
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 					};
 					dm: blob-ext {
 						filename = "ti-dm.bin";
@@ -282,7 +307,7 @@
 					compression = "none";
 					ti-secure {
 						content = <&spl_am625_phyboard_lyra_dtb>;
-						keyfile = "custMpk.pem";
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 					};
 					spl_am625_phyboard_lyra_dtb: blob-ext {
 						filename = SPL_AM625_PHYBOARD_LYRA_DTB;
@@ -313,6 +338,9 @@
 			images {
 				uboot {
 					description = "U-Boot for phyCORE-AM62x";
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
 				};
 
 				som-no-rtc {
@@ -321,8 +349,11 @@
 					compression = "none";
 					load = <0x8F000000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_rtc_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_rtc_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-rtc.dtbo";
 					};
 				};
@@ -333,8 +364,11 @@
 					compression = "none";
 					load = <0x8F001000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_spi_not_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_spi_not_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-spi-nor.dtbo";
 					};
 				};
@@ -345,8 +379,11 @@
 					compression = "none";
 					load = <0x8F002000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_eth_phy_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_eth_phy_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-eth-phy.dtbo";
 					};
 				};
@@ -357,8 +394,11 @@
 					compression = "none";
 					load = <0x8F003000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_qspi_nor_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_qspi_nor_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-qspi-nor.dtbo";
 					};
 				};
@@ -370,7 +410,7 @@
 					compression = "none";
 					ti-secure {
 						content = <&am625_phyboard_lyra_dtb>;
-						keyfile = "custMpk.pem";
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 					};
 					am625_phyboard_lyra_dtb: blob-ext {
 						filename = AM625_PHYBOARD_LYRA_DTB;
-- 
2.25.1

[PATCH 06/10] arch: arm: dts: k3-am642-phycore-som-binman: Add custMpk and ti-degenerate keys with CONFIG entries

[Daniel Schultz]

From: Nathan Morrisson <nmorrisson@phytec.com>

Add the SMPK and ti-degenerate keys using CONFIG entries. These keys
are set by the build system and are stored outside of u-boot.

Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
 arch/arm/dts/k3-am642-phycore-som-binman.dtsi | 70 +++++++++++++++----
 1 file changed, 55 insertions(+), 15 deletions(-)

diff --git a/arch/arm/dts/k3-am642-phycore-som-binman.dtsi b/arch/arm/dts/k3-am642-phycore-som-binman.dtsi
index 3710564cd4a..5d86da7754e 100644
--- a/arch/arm/dts/k3-am642-phycore-som-binman.dtsi
+++ b/arch/arm/dts/k3-am642-phycore-som-binman.dtsi
@@ -8,6 +8,13 @@
 
 #include "k3-binman.dtsi"
 
+#ifndef CONFIG_PHYTEC_K3_KEY_BLOB_COPY
+&binman {
+		/delete-node/ custMpk;
+		/delete-node/ ti-degenerate-key;
+};
+#endif
+
 #ifdef CONFIG_TARGET_PHYCORE_AM64X_R5
 &binman {
 	tiboot3-am64x_sr2-hs-phycore-som.bin {
@@ -17,7 +24,7 @@
 				<&combined_sysfw_cfg>, <&sysfw_inner_cert>;
 			combined;
 			sysfw-inner-cert;
-			keyfile = "custMpk.pem";
+			keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 			sw-rev = <1>;
 			content-sbl = <&u_boot_spl>;
 			content-sysfw = <&ti_sci_enc>;
@@ -57,7 +64,7 @@
 				<&combined_sysfw_cfg_fs>, <&sysfw_inner_cert_fs>;
 			combined;
 			sysfw-inner-cert;
-			keyfile = "custMpk.pem";
+			keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 			sw-rev = <1>;
 			content-sbl = <&u_boot_spl_fs>;
 			content-sysfw = <&ti_sci_enc_fs>;
@@ -101,7 +108,7 @@
 			content-sysfw-data = <&combined_sysfw_cfg_gp>;
 			load-sysfw-data = <0x7b000>;
 			sw-rev = <1>;
-			keyfile = "ti-degenerate-key.pem";
+			keyfile = CONFIG_PHYTEC_K3_DEGENERATE_KEY;
 		};
 		u_boot_spl_unsigned: u-boot-spl {
 			no-expanded;
@@ -146,6 +153,24 @@
 			#address-cells = <1>;
 
 			images {
+				atf {
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+				};
+
+				tee {
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+				};
+
+				spl {
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+				};
+
 				dm {
 					blob-ext {
 						filename = "/dev/null";
@@ -159,7 +184,7 @@
 					compression = "none";
 					ti-secure {
 						content = <&spl_am642_phyboard_electra_dtb>;
-						keyfile = "custMpk.pem";
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 					};
 					spl_am642_phyboard_electra_dtb: blob-ext {
 						filename = SPL_AM642_PHYBOARD_ELECTRA_DTB;
@@ -190,6 +215,9 @@
 			images {
 				uboot {
 					description = "U-Boot for AM64 board";
+					ti-secure {
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
 				};
 
 				fdt-0 {
@@ -199,7 +227,7 @@
 					compression = "none";
 					ti-secure {
 						content = <&am642_phyboard_electra_dtb>;
-						keyfile = "custMpk.pem";
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 					};
 					am642_phyboard_electra_dtb: blob-ext {
 						filename = AM642_PHYBOARD_ELECTRA_DTB;
@@ -324,7 +352,7 @@
 					compression = "none";
 					ti-secure {
 						content = <&spl_am642_phyboard_electra_dtb>;
-						keyfile = "custMpk.pem";
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 					};
 					spl_am642_phyboard_electra_dtb: blob-ext {
 						filename = SPL_AM642_PHYBOARD_ELECTRA_DTB;
@@ -363,8 +391,11 @@
 					compression = "none";
 					load = <0x8F000000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_rtc_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_rtc_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-rtc.dtbo";
 					};
 				};
@@ -375,8 +406,11 @@
 					compression = "none";
 					load = <0x8F001000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_spi_not_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_spi_not_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-spi-nor.dtbo";
 					};
 				};
@@ -387,8 +421,11 @@
 					compression = "none";
 					load = <0x8F002000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_eth_phy_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_eth_phy_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-eth-phy.dtbo";
 					};
 				};
@@ -399,8 +436,11 @@
 					compression = "none";
 					load = <0x8F003000>;
 					arch = "arm";
-
-					blob-ext {
+					ti-secure {
+						content = <&am6xx_phycore_disable_qspi_nor_dtbo>;
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
+					};
+					am6xx_phycore_disable_qspi_nor_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-qspi-nor.dtbo";
 					};
 				};
@@ -412,7 +452,7 @@
 					compression = "none";
 					ti-secure {
 						content = <&am642_phyboard_electra_dtb>;
-						keyfile = "custMpk.pem";
+						keyfile = CONFIG_PHYTEC_K3_MPK_KEY;
 					};
 					am642_phyboard_electra_dtb: blob-ext {
 						filename = AM642_PHYBOARD_ELECTRA_DTB;
-- 
2.25.1

[PATCH 07/10] include: env: phytec: k3_mmc: Use PHYTEC_K3_EMBED_RAUC_ENV to enable RAUC

[Daniel Schultz]

There's no need to include RAUC logic if it isn't required.
Use CONFIG_PHYTEC_K3_EMBED_RAUC_ENV to conditionally include RAUC.
Additionally, include the test for raucboot only when this
configuration is enabled.

Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
 include/env/phytec/k3_mmc.env | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/include/env/phytec/k3_mmc.env b/include/env/phytec/k3_mmc.env
index ad8d3a8b764..c4354fbb884 100644
--- a/include/env/phytec/k3_mmc.env
+++ b/include/env/phytec/k3_mmc.env
@@ -7,13 +7,19 @@
 /* Logic for TI K3 based SoCs to boot from a MMC device. */
 
 #include <env/phytec/overlays.env>
+#ifdef CONFIG_PHYTEC_K3_EMBED_RAUC_ENV
 #include <env/phytec/rauc.env>
+doraucboot=1
+#endif
 
 mmcargs=setenv bootargs console=${console} earlycon=${earlycon}
 	root=/dev/mmcblk${mmcdev}p${mmcroot} ${raucargs} rootwait rw
 mmcloadimage=load mmc ${mmcdev}:${mmcpart} ${kernel_addr_r} Image
 mmcloadfdt=load mmc ${mmcdev}:${mmcpart} ${fdt_addr_r} ${fdtfile}
-mmcboot=if test ${doraucboot} = 1; then run raucinit; fi;
+mmcboot=
+#ifdef CONFIG_PHYTEC_K3_EMBED_RAUC_ENV
+	if test -n ${doraucboot}; then run raucinit; fi;
+#endif
 	run mmcargs;
 	mmc dev ${mmcdev};
 	mmc rescan;
-- 
2.25.1

[PATCH 08/10] include: env: phytec: k3_mmc: Add support for FIT boot

[Daniel Schultz]

From: Nathan Morrisson <nmorrisson@phytec.com>

Our Secure Boot implementation uses a fitimage while our normal
boot flow doesn't. Load and boot a fitimage when
PHYTEC_K3_DOFITBOOT_DEFAULT is enabled. Otherwise, use our normal
k3 mmc boot flow.

Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
 include/env/phytec/k3_mmc.env | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/env/phytec/k3_mmc.env b/include/env/phytec/k3_mmc.env
index c4354fbb884..d90bf8277c8 100644
--- a/include/env/phytec/k3_mmc.env
+++ b/include/env/phytec/k3_mmc.env
@@ -15,6 +15,7 @@ doraucboot=1
 mmcargs=setenv bootargs console=${console} earlycon=${earlycon}
 	root=/dev/mmcblk${mmcdev}p${mmcroot} ${raucargs} rootwait rw
 mmcloadimage=load mmc ${mmcdev}:${mmcpart} ${kernel_addr_r} Image
+mmcloadfitimage=load mmc ${mmcdev}:${mmcpart} ${fit_addr_r} fitImage;
 mmcloadfdt=load mmc ${mmcdev}:${mmcpart} ${fdt_addr_r} ${fdtfile}
 mmcboot=
 #ifdef CONFIG_PHYTEC_K3_EMBED_RAUC_ENV
@@ -23,7 +24,12 @@ mmcboot=
 	run mmcargs;
 	mmc dev ${mmcdev};
 	mmc rescan;
+#ifdef CONFIG_PHYTEC_K3_DOFITBOOT_DEFAULT
+	run mmcloadfitimage;
+	bootm ${fit_addr_r};
+#else
 	run mmcloadimage;
 	run mmcloadfdt;
 	run mmc_apply_overlays;
 	booti ${kernel_addr_r} - ${fdt_addr_r}
+#endif
-- 
2.25.1

[PATCH 09/10] board: phytec: phycore_am62x: Update environment for fitboot

[Daniel Schultz]

From: Nathan Morrisson <nmorrisson@phytec.com>

Add fit_addr_r to the environment to allow us to boot from a FIT image.

Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
 board/phytec/phycore_am62x/phycore_am62x.env | 1 +
 1 file changed, 1 insertion(+)

diff --git a/board/phytec/phycore_am62x/phycore_am62x.env b/board/phytec/phycore_am62x/phycore_am62x.env
index 711ca3040c4..a5160a1e56a 100644
--- a/board/phytec/phycore_am62x/phycore_am62x.env
+++ b/board/phytec/phycore_am62x/phycore_am62x.env
@@ -10,6 +10,7 @@ fdt_addr_r=0x88000000
 kernel_addr_r=0x82000000
 ramdisk_addr_r=0x88080000
 fdtoverlay_addr_r=0x89000000
+fit_addr_r=0x90000000
 
 fdtfile=CONFIG_DEFAULT_FDT_FILE
 mmcdev=1
-- 
2.25.1

[PATCH 10/10] board: phytec: phycore_am64x: Update environment for fitboot

[Daniel Schultz]

From: Nathan Morrisson <nmorrisson@phytec.com>

Add fit_addr_r to the environment to allow us to boot from a FIT image.

Signed-off-by: Nathan Morrisson <nmorrisson@phytec.com>
Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
---
 board/phytec/phycore_am64x/phycore_am64x.env | 1 +
 1 file changed, 1 insertion(+)

diff --git a/board/phytec/phycore_am64x/phycore_am64x.env b/board/phytec/phycore_am64x/phycore_am64x.env
index 3032b518e0b..3d5bd03118e 100644
--- a/board/phytec/phycore_am64x/phycore_am64x.env
+++ b/board/phytec/phycore_am64x/phycore_am64x.env
@@ -9,6 +9,7 @@ fdt_addr_r=0x88000000
 kernel_addr_r=0x82000000
 ramdisk_addr_r=0x88080000
 fdtoverlay_addr_r=0x89000000
+fit_addr_r=0x90000000
 
 fdtfile=CONFIG_DEFAULT_FDT_FILE
 mmcdev=1
-- 
2.25.1

Re: [PATCH 00/10] phyCORE-AM62x/AM64x: Add RAUC and Secure Boot

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 718 bytes --]

On Wed, Feb 05, 2025 at 12:01:36AM -0800, Daniel Schultz wrote:

> This patch series adds support to boot PHYTEC's reference distros for
> RAUC and Secure Boot.
> 
> It adds a new Kconfig entry to embed the RAUC boot logic into the K3 MMC
> boot logic. The boot flow itself got extended to run the raucinit function.
> 
> It also adds Kconfig entries to pass private keys from an external location
> to U-Boot to sign bootloader images. An additional config entries allows to
> enable FIT image, because our Secure Boot implementation uses fitimages
> instead of normal images.

First, does CI pass with this series? Second, is this also based on the
RAUC support to bootstd series? Thanks.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: [PATCH 00/10] phyCORE-AM62x/AM64x: Add RAUC and Secure Boot

[Daniel Schultz]

Hi,

On 05.02.25 15:51, Tom Rini wrote:
> On Wed, Feb 05, 2025 at 12:01:36AM -0800, Daniel Schultz wrote:
>
>> This patch series adds support to boot PHYTEC's reference distros for
>> RAUC and Secure Boot.
>>
>> It adds a new Kconfig entry to embed the RAUC boot logic into the K3 MMC
>> boot logic. The boot flow itself got extended to run the raucinit function.
>>
>> It also adds Kconfig entries to pass private keys from an external location
>> to U-Boot to sign bootloader images. An additional config entries allows to
>> enable FIT image, because our Secure Boot implementation uses fitimages
>> instead of normal images.
> First, does CI pass with this series? Second, is this also based on the
> RAUC support to bootstd series? Thanks.

I just ran the CI tests and they pass: 
https://github.com/u-boot/u-boot/pull/739

This is what we have for quite some time to boot RAUC or Secure Boot 
with our downstream U-Boot. It's not really nice but working... Martin 
started to work on bootstd implementation after we implemented that. Our 
plan is get the current boot flow upstream and switch completely to 
bootstd later this year. Afterwards, we would mark the current boot flow 
as legacy.

- Daniel

Re: [PATCH 00/10] phyCORE-AM62x/AM64x: Add RAUC and Secure Boot

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 1794 bytes --]

On Thu, Feb 06, 2025 at 11:41:14AM +0100, Daniel Schultz wrote:
> Hi,
> 
> On 05.02.25 15:51, Tom Rini wrote:
> > On Wed, Feb 05, 2025 at 12:01:36AM -0800, Daniel Schultz wrote:
> > 
> > > This patch series adds support to boot PHYTEC's reference distros for
> > > RAUC and Secure Boot.
> > > 
> > > It adds a new Kconfig entry to embed the RAUC boot logic into the K3 MMC
> > > boot logic. The boot flow itself got extended to run the raucinit function.
> > > 
> > > It also adds Kconfig entries to pass private keys from an external location
> > > to U-Boot to sign bootloader images. An additional config entries allows to
> > > enable FIT image, because our Secure Boot implementation uses fitimages
> > > instead of normal images.
> > First, does CI pass with this series? Second, is this also based on the
> > RAUC support to bootstd series? Thanks.
> 
> I just ran the CI tests and they pass:
> https://github.com/u-boot/u-boot/pull/739

Thanks. I was concerned that with keys and such we might run in to a
failure to build in CI.

> This is what we have for quite some time to boot RAUC or Secure Boot with
> our downstream U-Boot. It's not really nice but working... Martin started to
> work on bootstd implementation after we implemented that. Our plan is get
> the current boot flow upstream and switch completely to bootstd later this
> year. Afterwards, we would mark the current boot flow as legacy.

How challenging for your plans would it be to not upstream the legacy
path here and just build on the bootstd method entirely? I can certainly
see why you need to support the legacy model commercially but if we can
avoid adding it and intending to replace it in the community that would
make a lower burden here long term. Thanks!

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: [PATCH 00/10] phyCORE-AM62x/AM64x: Add RAUC and Secure Boot

[Daniel Schultz]

On 06.02.25 18:07, Tom Rini wrote:
> On Thu, Feb 06, 2025 at 11:41:14AM +0100, Daniel Schultz wrote:
>> Hi,
>>
>> On 05.02.25 15:51, Tom Rini wrote:
>>> On Wed, Feb 05, 2025 at 12:01:36AM -0800, Daniel Schultz wrote:
>>>
>>>> This patch series adds support to boot PHYTEC's reference distros for
>>>> RAUC and Secure Boot.
>>>>
>>>> It adds a new Kconfig entry to embed the RAUC boot logic into the K3 MMC
>>>> boot logic. The boot flow itself got extended to run the raucinit function.
>>>>
>>>> It also adds Kconfig entries to pass private keys from an external location
>>>> to U-Boot to sign bootloader images. An additional config entries allows to
>>>> enable FIT image, because our Secure Boot implementation uses fitimages
>>>> instead of normal images.
>>> First, does CI pass with this series? Second, is this also based on the
>>> RAUC support to bootstd series? Thanks.
>> I just ran the CI tests and they pass:
>> https://github.com/u-boot/u-boot/pull/739
> Thanks. I was concerned that with keys and such we might run in to a
> failure to build in CI.
>
>> This is what we have for quite some time to boot RAUC or Secure Boot with
>> our downstream U-Boot. It's not really nice but working... Martin started to
>> work on bootstd implementation after we implemented that. Our plan is get
>> the current boot flow upstream and switch completely to bootstd later this
>> year. Afterwards, we would mark the current boot flow as legacy.
> How challenging for your plans would it be to not upstream the legacy
> path here and just build on the bootstd method entirely? I can certainly
> see why you need to support the legacy model commercially but if we can
> avoid adding it and intending to replace it in the community that would
> make a lower burden here long term. Thanks!

Sure, we can keep the current boot flow on our downstream U-Boot for now 
and will add bootstd later here.

However, there are some patches in this series which are require to sign 
images, device-trees, etc with external keys. I will send a v2 and drop 
all boot flow related patches.

- Daniel