Merge branch '2023-07-22-TI-K3-improvements'

- Actually merge the assorted K3 platform improvements that were
  supposed to be in commit 247aa5a19115 ("Merge branch
  '2023-07-21-assorted-TI-platform-updates'")

45 files changed, 354 insertions, 241 deletions

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index b3115b0..bdd535f 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -798,6 +798,8 @@ config ARCH_K3
 	select SPL
 	select SUPPORT_SPL
 	select FIT
+	select REGEX
+	select FIT_SIGNATURE if ARM64
 
 config ARCH_OMAP2PLUS
 	bool "TI OMAP2+"
diff --git a/arch/arm/dts/k3-am625-sk-binman.dtsi b/arch/arm/dts/k3-am625-sk-binman.dtsi
index b468d95..a35d641 100644
--- a/arch/arm/dts/k3-am625-sk-binman.dtsi
+++ b/arch/arm/dts/k3-am625-sk-binman.dtsi
@@ -145,7 +145,7 @@
 #define SPL_AM625_SK_DTB "spl/dts/k3-am625-sk.dtb"
 
 #define UBOOT_NODTB "u-boot-nodtb.bin"
-#define AM625_SK_DTB "arch/arm/dts/k3-am625-sk.dtb"
+#define AM625_SK_DTB "u-boot.dtb"
 
 &binman {
 	ti-dm {
diff --git a/arch/arm/dts/k3-am62a-sk-binman.dtsi b/arch/arm/dts/k3-am62a-sk-binman.dtsi
index a79d3f1..de09430 100644
--- a/arch/arm/dts/k3-am62a-sk-binman.dtsi
+++ b/arch/arm/dts/k3-am62a-sk-binman.dtsi
@@ -148,7 +148,7 @@
 #define SPL_AM62A7_SK_DTB "spl/dts/k3-am62a7-sk.dtb"
 
 #define UBOOT_NODTB "u-boot-nodtb.bin"
-#define AM62A7_SK_DTB "arch/arm/dts/k3-am62a7-sk.dtb"
+#define AM62A7_SK_DTB "u-boot.dtb"
 
 &binman {
 	ti-dm {
diff --git a/arch/arm/dts/k3-am64x-binman.dtsi b/arch/arm/dts/k3-am64x-binman.dtsi
index 26e17bd..a5e5400 100644
--- a/arch/arm/dts/k3-am64x-binman.dtsi
+++ b/arch/arm/dts/k3-am64x-binman.dtsi
@@ -123,7 +123,7 @@
 #define SPL_AM642_SK_DTB "spl/dts/k3-am642-sk.dtb"
 
 #define UBOOT_NODTB "u-boot-nodtb.bin"
-#define AM642_EVM_DTB "arch/arm/dts/k3-am642-evm.dtb"
+#define AM642_EVM_DTB "u-boot.dtb"
 #define AM642_SK_DTB "arch/arm/dts/k3-am642-sk.dtb"
 
 &binman {
diff --git a/arch/arm/dts/k3-am65x-binman.dtsi b/arch/arm/dts/k3-am65x-binman.dtsi
index 4bf0845..59605ca 100644
--- a/arch/arm/dts/k3-am65x-binman.dtsi
+++ b/arch/arm/dts/k3-am65x-binman.dtsi
@@ -210,7 +210,7 @@
 #define SPL_AM654_EVM_DTB "spl/dts/k3-am654-base-board.dtb"
 
 #define UBOOT_NODTB "u-boot-nodtb.bin"
-#define AM654_EVM_DTB "arch/arm/dts/k3-am654-base-board.dtb"
+#define AM654_EVM_DTB "u-boot.dtb"
 
 &binman {
 	ti-spl {
diff --git a/arch/arm/dts/k3-j7200-binman.dtsi b/arch/arm/dts/k3-j7200-binman.dtsi
index 613aca5..14f7dea 100644
--- a/arch/arm/dts/k3-j7200-binman.dtsi
+++ b/arch/arm/dts/k3-j7200-binman.dtsi
@@ -184,7 +184,7 @@
 #define SPL_J7200_EVM_DTB "spl/dts/k3-j7200-common-proc-board.dtb"
 
 #define UBOOT_NODTB "u-boot-nodtb.bin"
-#define J7200_EVM_DTB "arch/arm/dts/k3-j7200-common-proc-board.dtb"
+#define J7200_EVM_DTB "u-boot.dtb"
 
 &binman {
 	ti-dm {
diff --git a/arch/arm/dts/k3-j721e-binman.dtsi b/arch/arm/dts/k3-j721e-binman.dtsi
index 7fb63d6..4f566c2 100644
--- a/arch/arm/dts/k3-j721e-binman.dtsi
+++ b/arch/arm/dts/k3-j721e-binman.dtsi
@@ -299,7 +299,7 @@
 #define SPL_J721E_SK_DTB "spl/dts/k3-j721e-sk.dtb"
 
 #define UBOOT_NODTB "u-boot-nodtb.bin"
-#define J721E_EVM_DTB "arch/arm/dts/k3-j721e-common-proc-board.dtb"
+#define J721E_EVM_DTB "u-boot.dtb"
 #define J721E_SK_DTB "arch/arm/dts/k3-j721e-sk.dtb"
 
 &binman {
diff --git a/arch/arm/dts/k3-j721s2-binman.dtsi b/arch/arm/dts/k3-j721s2-binman.dtsi
index 1671217..5bca4e9 100644
--- a/arch/arm/dts/k3-j721s2-binman.dtsi
+++ b/arch/arm/dts/k3-j721s2-binman.dtsi
@@ -146,7 +146,7 @@
 #define SPL_AM68_SK_DTB "spl/dts/k3-am68-sk-base-board.dtb"
 
 #define UBOOT_NODTB "u-boot-nodtb.bin"
-#define J721S2_EVM_DTB "arch/arm/dts/k3-j721s2-common-proc-board.dtb"
+#define J721S2_EVM_DTB "u-boot.dtb"
 #define AM68_SK_DTB "arch/arm/dts/k3-am68-sk-base-board.dtb"
 
 &binman {
diff --git a/arch/arm/mach-k3/Kconfig b/arch/arm/mach-k3/Kconfig
index bae0a82..bf1c3c5 100644
--- a/arch/arm/mach-k3/Kconfig
+++ b/arch/arm/mach-k3/Kconfig
@@ -52,7 +52,7 @@ config SYS_K3_MAX_DOWNLODABLE_IMAGE_SIZE
 config SYS_K3_MCU_SCRATCHPAD_BASE
 	hex
 	default 0x40280000 if SOC_K3_AM654
-	default 0x40280000 if SOC_K3_J721S2
+	default 0x41cff9fc if SOC_K3_J721S2
 	default 0x41cff9fc if SOC_K3_J721E
 	help
 	  Describes the base address of MCU Scratchpad RAM.
diff --git a/arch/arm/mach-k3/common.c b/arch/arm/mach-k3/common.c
index 450c7b7..a351104 100644
--- a/arch/arm/mach-k3/common.c
+++ b/arch/arm/mach-k3/common.c
@@ -497,8 +497,7 @@ static void remove_fwl_regions(struct fwl_data fwl_data, size_t num_regions,
 
 		/* Don't disable the background regions */
 		if (region.control != 0 &&
-		    ((region.control & K3_FIREWALL_BACKGROUND_BIT) ==
-		     fwl_type)) {
+		    ((region.control >> K3_FIREWALL_BACKGROUND_BIT) & 1) == fwl_type) {
 			pr_debug("Attempting to disable firewall %5d (%25s)\n",
 				 region.fwl_id, fwl_data.name);
 			region.control = 0;
diff --git a/arch/arm/mach-k3/common.h b/arch/arm/mach-k3/common.h
index 6cffbd4..9bd9ad6 100644
--- a/arch/arm/mach-k3/common.h
+++ b/arch/arm/mach-k3/common.h
@@ -9,7 +9,7 @@
 #include <asm/armv7_mpu.h>
 #include <asm/hardware.h>
 
-#define K3_FIREWALL_BACKGROUND_BIT BIT(8)
+#define K3_FIREWALL_BACKGROUND_BIT (8)
 
 struct fwl_data {
 	const char *name;
diff --git a/arch/arm/mach-k3/security.c b/arch/arm/mach-k3/security.c
index 02a2c12..6038c96 100644
--- a/arch/arm/mach-k3/security.c
+++ b/arch/arm/mach-k3/security.c
@@ -91,8 +91,9 @@ void ti_secure_image_post_process(void **p_image, size_t *p_size)
 		return;
 	}
 
-	if (get_device_type() != K3_DEVICE_TYPE_HS_SE &&
-	    get_device_type() != K3_DEVICE_TYPE_HS_FS)
+	if (get_device_type() == K3_DEVICE_TYPE_GP &&
+	    (get_device_type() != K3_DEVICE_TYPE_HS_SE &&
+	     !ti_secure_cert_detected(*p_image)))
 		return;
 
 	/* Clean out image so it can be seen by system firmware */
diff --git a/board/ti/am62ax/am62ax.env b/board/ti/am62ax/am62ax.env
index 8c1c26e..491ec97 100644
--- a/board/ti/am62ax/am62ax.env
+++ b/board/ti/am62ax/am62ax.env
@@ -1,7 +1,7 @@
 #include <environment/ti/ti_armv7_common.env>
 #include <environment/ti/mmc.env>
 
-default_device_tree=k3-am62a7-sk.dtb
+default_device_tree=ti/k3-am62a7-sk.dtb
 findfdt=
 	setenv name_fdt ${default_device_tree};
 	setenv fdtfile ${name_fdt}
@@ -17,7 +17,6 @@ bootpart=1:2
 bootdir=/boot
 rd_spec=-
 init_mmc=run args_all args_mmc
-get_fdt_mmc=load mmc ${bootpart} ${fdtaddr} ${bootdir}/${name_fdt}
 get_overlay_mmc=
 	fdt address ${fdtaddr};
 	fdt resize 0x100000;
diff --git a/board/ti/am62x/am62x.env b/board/ti/am62x/am62x.env
index 5ac15fd..0901a85 100644
--- a/board/ti/am62x/am62x.env
+++ b/board/ti/am62x/am62x.env
@@ -1,7 +1,7 @@
 #include <environment/ti/ti_armv7_common.env>
 #include <environment/ti/mmc.env>
 
-default_device_tree=k3-am625-sk.dtb
+default_device_tree=ti/k3-am625-sk.dtb
 findfdt=
 	setenv name_fdt ${default_device_tree};
 	setenv fdtfile ${name_fdt}
@@ -17,7 +17,6 @@ bootpart=1:2
 bootdir=/boot
 rd_spec=-
 init_mmc=run args_all args_mmc
-get_fdt_mmc=load mmc ${bootpart} ${fdtaddr} ${bootdir}/${name_fdt}
 get_overlay_mmc=
 	fdt address ${fdtaddr};
 	fdt resize 0x100000;
diff --git a/board/ti/am64x/am64x.env b/board/ti/am64x/am64x.env
index c3960be..015f63a 100644
--- a/board/ti/am64x/am64x.env
+++ b/board/ti/am64x/am64x.env
@@ -4,11 +4,12 @@
 
 findfdt=
 	if test $board_name = am64x_gpevm; then
-		setenv name_fdt k3-am642-evm.dtb; fi;
+		setenv name_fdt ti/k3-am642-evm.dtb; fi;
 	if test $board_name = am64x_skevm; then
-		setenv name_fdt k3-am642-sk.dtb; fi;
+		setenv name_fdt ti/k3-am642-sk.dtb; fi;
 	if test $name_fdt = undefined; then
 		echo WARNING: Could not determine device tree to use; fi;
+	setenv fdtfile ${name_fdt}
 name_kern=Image
 console=ttyS2,115200n8
 args_all=setenv optargs earlycon=ns16550a,mmio32,0x02800000 ${mtdparts}
@@ -20,7 +21,6 @@ bootpart=1:2
 bootdir=/boot
 rd_spec=-
 init_mmc=run args_all args_mmc
-get_fdt_mmc=load mmc ${bootpart} ${fdtaddr} ${bootdir}/${name_fdt}
 get_overlay_mmc=
 	fdt address ${fdtaddr};
 	fdt resize 0x100000;
diff --git a/board/ti/am65x/am65x.env b/board/ti/am65x/am65x.env
index a048b47..d7130cc 100644
--- a/board/ti/am65x/am65x.env
+++ b/board/ti/am65x/am65x.env
@@ -6,7 +6,7 @@
 #endif
 
 findfdt=
-	setenv name_fdt k3-am654-base-board.dtb;
+	setenv name_fdt ti/k3-am654-base-board.dtb;
 	setenv fdtfile ${name_fdt}
 name_kern=Image
 console=ttyS2,115200n8
@@ -20,7 +20,6 @@ bootpart=1:2
 bootdir=/boot
 rd_spec=-
 init_mmc=run args_all args_mmc
-get_fdt_mmc=load mmc ${bootpart} ${fdtaddr} ${bootdir}/${name_fdt}
 get_overlay_mmc=
 	fdt address ${fdtaddr};
 	fdt resize 0x100000;
diff --git a/board/ti/j721e/j721e.env b/board/ti/j721e/j721e.env
index c181741..23ce7e1 100644
--- a/board/ti/j721e/j721e.env
+++ b/board/ti/j721e/j721e.env
@@ -7,15 +7,15 @@
 #include <environment/ti/k3_rproc.env>
 #endif
 
-default_device_tree=k3-j721e-common-proc-board.dtb
+default_device_tree=ti/k3-j721e-common-proc-board.dtb
 findfdt=
 	setenv name_fdt ${default_device_tree};
 	if test $board_name = j721e; then
-		setenv name_fdt k3-j721e-common-proc-board.dtb; fi;
+		setenv name_fdt ti/k3-j721e-common-proc-board.dtb; fi;
 	if test $board_name = j7200; then
-		setenv name_fdt k3-j7200-common-proc-board.dtb; fi;
+		setenv name_fdt ti/k3-j7200-common-proc-board.dtb; fi;
 	if test $board_name = j721e-eaik || test $board_name = j721e-sk; then
-		setenv name_fdt k3-j721e-sk.dtb; fi;
+		setenv name_fdt ti/k3-j721e-sk.dtb; fi;
 	setenv fdtfile ${name_fdt}
 name_kern=Image
 console=ttyS2,115200n8
@@ -37,7 +37,6 @@ bootpart=1:2
 bootdir=/boot
 rd_spec=-
 init_mmc=run args_all args_mmc
-get_fdt_mmc=load mmc ${bootpart} ${fdtaddr} ${bootdir}/${name_fdt}
 get_overlay_mmc=
 	fdt address ${fdtaddr};
 	fdt resize 0x100000;
diff --git a/board/ti/j721s2/j721s2.env b/board/ti/j721s2/j721s2.env
index f446777..9464fe4 100644
--- a/board/ti/j721s2/j721s2.env
+++ b/board/ti/j721s2/j721s2.env
@@ -7,13 +7,13 @@
 #include <environment/ti/k3_rproc.env>
 #endif
 
-default_device_tree=k3-j721s2-common-proc-board.dtb
+default_device_tree=ti/k3-j721s2-common-proc-board.dtb
 findfdt=
 	setenv name_fdt ${default_device_tree};
 	if test $board_name = j721s2; then			\
-		setenv name_fdt k3-j721s2-common-proc-board.dtb; fi;
+		setenv name_fdt ti/k3-j721s2-common-proc-board.dtb; fi;
 	if test $board_name = am68-sk; then
-		setenv name_fdt k3-am68-sk-base-board.dtb; fi;
+		setenv name_fdt ti/k3-am68-sk-base-board.dtb; fi;
 	setenv fdtfile ${name_fdt}
 name_kern=Image
 console=ttyS2,115200n8
@@ -31,7 +31,6 @@ name_mcur5f0_0fw=/lib/firmware/j7-mcu-r5f0_0-fw
 #endif
 rd_spec=-
 init_mmc=run args_all args_mmc
-get_fdt_mmc=load mmc ${bootpart} ${fdtaddr} ${bootdir}/${name_fdt}
 get_overlay_mmc=
 	fdt address ${fdtaddr};
 	fdt resize 0x100000;
diff --git a/board/ti/keys/custMpk.crt b/board/ti/keys/custMpk.crt
new file mode 100644
index 0000000..01bd64a
--- /dev/null
+++ b/board/ti/keys/custMpk.crt
@@ -0,0 +1,33 @@
+-----BEGIN CERTIFICATE-----
+MIIFwzCCA6sCFHKW0ueol0+vsilVaZyqKhppo9ryMA0GCSqGSIb3DQEBCwUAMIGd
+MQswCQYDVQQGEwJVUzELMAkGA1UECAwCVFgxDzANBgNVBAcMBkRhbGxhczEnMCUG
+A1UECgweVGV4YXMgSW5zdHJ1bWVudHMgSW5jb3Jwb3JhdGVkMRMwEQYDVQQLDApQ
+cm9jZXNzb3JzMRMwEQYDVQQDDApUSSBTdXBwb3J0MR0wGwYJKoZIhvcNAQkBFg5z
+dXBwb3J0QHRpLmNvbTAeFw0yMzA2MDEwNTIxMTZaFw0zMzA1MjkwNTIxMTZaMIGd
+MQswCQYDVQQGEwJVUzELMAkGA1UECAwCVFgxDzANBgNVBAcMBkRhbGxhczEnMCUG
+A1UECgweVGV4YXMgSW5zdHJ1bWVudHMgSW5jb3Jwb3JhdGVkMRMwEQYDVQQLDApQ
+cm9jZXNzb3JzMRMwEQYDVQQDDApUSSBTdXBwb3J0MR0wGwYJKoZIhvcNAQkBFg5z
+dXBwb3J0QHRpLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAL8U
+rknYf3LTayPN60gOZdwiTfIOT4L27bXy3dt8kfpuWf/V97beBB2KzNKV2dHgxMH4
+UL//SAyRIlCaTHuL85YKKCazpNngqVVBGvs+Wydsv8rAca8vciLuRgElYq0+xwT2
+sRi2LMASbg/imz7lpqCoBkUDQRdOFh+pdNaETtZ5pxC4EakOkh8l3X+x8tG58mjY
+M1lLgn13zNGc+iO0+1iI8s3q1RbyLHUt+mLDwQlu4AZw4LUHCZli2dbk52xtyIIH
+UJP34tjt0V/j0J7Pk1TZX91dzjdg8asUigR7Zae6f99FRXxLoVuuTsaUPYxOh9KU
+PKTzn9r88jZ85w2tWkI38SqB0G6hp2cDHoftALtzSmgoMaKCmqMEweiH/0V+qsGf
+1DsFx4P9IXH+vX84yRYZUg7mAzONHR7JNhzNTp2CKYjNmyq+bF97srI6eQBqffWt
+Gp0ezVgqz170ToCrO0/d+NTeNKLEINlZGS2FAl4faLFMjbkRBuktdrVYjFCoN25m
+eG+DMEZNNJ+0GEq5u/p7xa7WMhCEhGw/moAzNfxNvNVuYFRQz35tgJcE+o8LIP29
+mCuhN71Z/UrsRaEJixfJchQztwVeEl3iWh3OIVT24erVVaon600J3xlAgi5miRdl
+2W6z1jhOjWEW1nTU3hZfURnVQriD0sjeS6lpl7aNAgMBAAEwDQYJKoZIhvcNAQEL
+BQADggIBAHy+h1FQKedFTJWgqGJkTwtcym5LyXD6ig8LyhJpVEbXmqK7ZKY2F2hB
+PqVbfCZNogszIvl8q3ykz+tcGbfBk3rq+KMUwbk5E29mSMmAJ9DNNozudgKkKq9w
+RmcO1bXCEspFgNvNEkYAQCBvMOyH/nCyFu9QzOzN35XIzf0fI3jM6rueLxSXq3xO
+7yHUZ3mzAZp6e1Qo6cuABAw1q6KqKYJCnJ3Nq6F42bmGp8mSD+2AuGV8cU+7Z3sh
+k/ooFMCsulj1R5+TlKgEfqspQXbefEsvRW3n3ZD8bcQF0ytiX7XVmDMFVpQkTzps
+92fjZ08Zcj7bCZQsFXXACIQkMiTiiMW6NwLFZDyq11/B1oe1bhjFUuqqUkHC/PKx
+gdWRwluGRt+onFRD5/upXnugKT99j/hQ7sy80a64A1xoCcKVbwcHU7YBQG1vLk6D
+idg0vI3gj7v+/jZEPkv/KrqAI6YuvpplkcHkEKuAUFAkozvVJ5pPK3K0xHBJGNMK
+kJ9FMAakFj6jfZaR5Ay3ZuOAn5oPMwd6RaauNOzVpBll6DFOyw2rU6fbId/gi841
+drmBfM6ufue6ecslkp9zSOpPLXhjt2g9NRVKPE20CmRetVSDLcMFet7ZImbxqggw
+yjDxA7oR+Px+o+xr+djcDlfj6500Rys6W1SNHe99HXOCcpQqivX0
+-----END CERTIFICATE-----
diff --git a/board/ti/keys/custMpk.key b/board/ti/keys/custMpk.key
new file mode 100644
index 0000000..adba378
--- /dev/null
+++ b/board/ti/keys/custMpk.key
@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEAvxSuSdh/ctNrI83rSA5l3CJN8g5PgvbttfLd23yR+m5Z/9X3
+tt4EHYrM0pXZ0eDEwfhQv/9IDJEiUJpMe4vzlgooJrOk2eCpVUEa+z5bJ2y/ysBx
+ry9yIu5GASVirT7HBPaxGLYswBJuD+KbPuWmoKgGRQNBF04WH6l01oRO1nmnELgR
+qQ6SHyXdf7Hy0bnyaNgzWUuCfXfM0Zz6I7T7WIjyzerVFvIsdS36YsPBCW7gBnDg
+tQcJmWLZ1uTnbG3IggdQk/fi2O3RX+PQns+TVNlf3V3ON2DxqxSKBHtlp7p/30VF
+fEuhW65OxpQ9jE6H0pQ8pPOf2vzyNnznDa1aQjfxKoHQbqGnZwMeh+0Au3NKaCgx
+ooKaowTB6If/RX6qwZ/UOwXHg/0hcf69fzjJFhlSDuYDM40dHsk2HM1OnYIpiM2b
+Kr5sX3uysjp5AGp99a0anR7NWCrPXvROgKs7T9341N40osQg2VkZLYUCXh9osUyN
+uREG6S12tViMUKg3bmZ4b4MwRk00n7QYSrm7+nvFrtYyEISEbD+agDM1/E281W5g
+VFDPfm2AlwT6jwsg/b2YK6E3vVn9SuxFoQmLF8lyFDO3BV4SXeJaHc4hVPbh6tVV
+qifrTQnfGUCCLmaJF2XZbrPWOE6NYRbWdNTeFl9RGdVCuIPSyN5LqWmXto0CAwEA
+AQKCAgAzkAwcJ0z1GnId/lJQZno8NhGckRoJuEKbR8dwlCP8VUz6Ca5H7Y9kvXDa
+Hs/hn+rYgP6hYOz7XyrIX2rmJ/T6dxEwqGeC1+o59FConcIRWHpE5zuGT6JYJL5F
+TuZa48bm4v8VMQvQZOjIZpkIFwao8c6HTwKAnHTB5IN/48I2hCt+Cn3RhfoOZ7Rm
+4gkpaSkt+7GXlhXHb82YfujNO+hbktEamhUYlQ9EK70Wa8aqmf3gHxO0JgsEFjW8
+lJaSnultlTW8SDcx3LMUUjCYumECk4oX/VlJfmKYjPlVjkr3QQ+Cm3nNucb4K4hc
+c+JL+2ERhSj8RjXL7VgbNgdPnIjvQDJuTNqecTU8xWPYrkOLQpNibbLjnutLkhJz
+fMyRtmDtrsey8WiCDuCHkPJ8/f8RjL2zWI9fzTDDIzdlEKouUFGOovaHVnbua6pn
+hymcu9d9FV3p2rcbj0ivCs7e8j+vhSxFJEJoAbcQdXCTi/n2uR7pLtoMNiUzsejy
+d46Uz+KEU920NTwE2z6JJq8I2vegnxjc7PDDrV3/5rK04B93aXiqvwWseCpxelrI
+xaMkRHbXrIXRO6MXQ3N+zNq8Dg3hjGTTvaBKuwgvqLwlXY8+Aa3ooFzEOInIOSsI
+XcWqXxt/tgZgsj9RwpC42t8kbA+BkbNk9EIUa+P5kEr2P/fO7QKCAQEA4EtArnOX
+D6tQF8uTw8USOZC2P9s/ez1z4jRq3oKP0Kv4tJiuIObJ/dUvGVD7aM5v2xaCfhm8
+xpk09VPUgghfG5jR5qVvQr75kCNToJQudWi4ngk1HwKJzzTO11giFEdybvTUA+Pj
+fmxCM0dYYqRWZoj0hLqXlUCwxE74BFIhJVjeYbf+nTQrqpllTLoW7MTZHzGx5SXx
+4dNzyVAUH49Yt2D8mgXXCkf5sGLh762wj34b/rR10Kr4O5utGMZrfTRIbuQ1pNjU
+m66baPzq+mC0BzqZEW70TgEb7lOr8rcVXLOi3r36omfd9/MHx7iZD6o3K1axSO15
+grD4ZrN7Ac3QJwKCAQEA2heCoBdpvy6YUk8AO2k8qDygTdmPQRuwjjT+Z2fMslBt
+D7DkpKwZ6Bl9OclcpiiLHmH+hv65KqYg+tR0RRb7PcogB9El9x7yKkGTPZEYWGky
+n8P84rJpKwjnwWQvPQktI1cs3YGvZA9DQTFBavRrwuzgd1oSJq5aPQ2tme0kMvWp
+l1/B/cPK+PKCi/Wfisaze1TjijP9qIeUwkdNN6WLrLU3QgsGppcg2I7RQtAIikT6
+GkuiOQAvWMsrJVV6PNrVKz4fJDJ59Rz6jbDHZNi1MEYNxQoB/Pl7QIakbfjWpHLv
+8Ey7cB2JKxjQy8tmyl8WNQVbXbE6daPXcMTUmaRAKwKCAQBv1lYMJmq+T2eCVen6
+BbvOpE+bi5EdvEiaFBTtmiBnpjg+pJq+oRU60h/H+c9CNR0lGxY6Fk9An4f+g6xE
+ojP6KLsQzJCrsVny+wpp2TlJJcxYULMCIVvhy60PR0zG29E9biqBPhJjKUvhEcQK
+e3LxcXyq6fdHXphFajLUxLbuTl+kTgBRFoBnclFGbsubh5PTsA3J+p+fQLZNPPar
+veg4l82cZykQYU8pGkUaI3sUMYd3+zd7sqRP5JHs9pMGPRmY4YW2CsAIWIn5UZNB
+ARMDP76vKKn8cyUgMuxb+9pU/OVLN2NPs4bEaZQJjAwV+YPEwldny7F47xEM9JVz
+EtKlAoIBAQDUt62u3GdGE/p5/ZgqWoDRTyDEDfmN9aYFbmbdEP80xQE7FrxMaZhz
+K7laja6SWmUm40nQ/c45bQQp4uLtKHcxU15egX7YRBTLZl5o5IasZR79ebnEm2O8
+l9kEZeU1USf3mmWmP4GExOZCRfqaiYA6BbUCdJXTqKdXeWnkAssV8UrS3JFoJHpq
+yo7OWGqefyQ8nRW6jO9SW7uaqtUD+7H6aF5XSk3YWvusfdBZrHNH+fM/hpnZovaL
+Us7ogTDS/laA8PyK37jYfMVdQhmZoU1Iomt3zkUWK3gt/aWPpfAlQf4Jka4YspZB
+tNiijefaZ1hPqsPs5Joyd/YAhdsfaHc1AoIBAQCn/9j6RRjRaw0ip756oad4AXHz
+XBwVB2CrY96qT6Hj9Sq7tGgdskqGkOQkAivBLBizUdcWv0t1yenOsSgasQeMlvlh
+B8md9cLvpKXPB3HM3rTDH/xNXe0TpVKLf7SXC8HfDyIweHwMW3QgO2DWrvI4BV/T
+ckBatRNQ90HxkqGFhC/Mp529lQlyg3ifxPxJsvZOyPMUnrflAvsKQk5c2ZiQg3nZ
+h7I2pjSYgCl+Ib52l8p9bf1kcrVGgPM+auzm496i0RPobFeDBoBvSoznJktHJ7+3
+NnZH+jLiZCODiQPGtQUi+T6eIZUIJF0YASpsCCtUzXCxwW3lYIDNy7UlMivF
+-----END RSA PRIVATE KEY-----
diff --git a/boot/Kconfig b/boot/Kconfig
index b424265..e8fb03b 100644
--- a/boot/Kconfig
+++ b/boot/Kconfig
@@ -125,8 +125,7 @@ config FIT_BEST_MATCH
 config FIT_IMAGE_POST_PROCESS
 	bool "Enable post-processing of FIT artifacts after loading by U-Boot"
 	depends on FIT
-	depends on TI_SECURE_DEVICE || SOCFPGA_SECURE_VAB_AUTH
-	default y if TI_SECURE_DEVICE
+	depends on SOCFPGA_SECURE_VAB_AUTH
 	help
 	  Allows doing any sort of manipulation to blobs after they got extracted
 	  from FIT images like stripping off headers or modifying the size of the
diff --git a/configs/am335x_hs_evm_defconfig b/configs/am335x_hs_evm_defconfig
index 1e93439..a3a4ab3 100644
--- a/configs/am335x_hs_evm_defconfig
+++ b/configs/am335x_hs_evm_defconfig
@@ -37,7 +37,6 @@ CONFIG_SYS_BOOTM_LEN=0x1000000
 CONFIG_SYS_I2C_EEPROM_ADDR_LEN=2
 # CONFIG_CMD_FLASH is not set
 CONFIG_CMD_NAND=y
-# CONFIG_CMD_SETEXPR is not set
 CONFIG_BOOTP_DNS2=y
 CONFIG_CMD_MTDPARTS=y
 CONFIG_MTDIDS_DEFAULT="nand0=nand.0"
diff --git a/configs/am43xx_hs_evm_defconfig b/configs/am43xx_hs_evm_defconfig
index 466b12e..01428ac 100644
--- a/configs/am43xx_hs_evm_defconfig
+++ b/configs/am43xx_hs_evm_defconfig
@@ -38,7 +38,6 @@ CONFIG_SYS_MAXARGS=64
 CONFIG_SYS_I2C_EEPROM_ADDR_LEN=2
 # CONFIG_CMD_FLASH is not set
 CONFIG_CMD_NAND=y
-# CONFIG_CMD_SETEXPR is not set
 CONFIG_BOOTP_DNS2=y
 CONFIG_CMD_MTDPARTS=y
 CONFIG_MTDIDS_DEFAULT="nand0=nand.0"
diff --git a/configs/am43xx_hs_evm_qspi_defconfig b/configs/am43xx_hs_evm_qspi_defconfig
index ad6ce2b..54051ca 100644
--- a/configs/am43xx_hs_evm_qspi_defconfig
+++ b/configs/am43xx_hs_evm_qspi_defconfig
@@ -31,7 +31,6 @@ CONFIG_CMD_I2C=y
 CONFIG_CMD_MMC=y
 CONFIG_CMD_SPI=y
 CONFIG_CMD_USB=y
-# CONFIG_CMD_SETEXPR is not set
 CONFIG_BOOTP_DNS2=y
 CONFIG_CMD_EXT4_WRITE=y
 CONFIG_OF_CONTROL=y
diff --git a/configs/am57xx_hs_evm_defconfig b/configs/am57xx_hs_evm_defconfig
index 1b03848..94ffce1 100644
--- a/configs/am57xx_hs_evm_defconfig
+++ b/configs/am57xx_hs_evm_defconfig
@@ -49,7 +49,6 @@ CONFIG_CMD_ABOOTIMG=y
 CONFIG_SYS_I2C_EEPROM_ADDR_LEN=2
 CONFIG_CMD_BCB=y
 # CONFIG_CMD_FLASH is not set
-# CONFIG_CMD_SETEXPR is not set
 CONFIG_CMD_AB_SELECT=y
 CONFIG_BOOTP_DNS2=y
 # CONFIG_CMD_PMIC is not set
diff --git a/configs/am57xx_hs_evm_usb_defconfig b/configs/am57xx_hs_evm_usb_defconfig
index 39fdc05..404e714 100644
--- a/configs/am57xx_hs_evm_usb_defconfig
+++ b/configs/am57xx_hs_evm_usb_defconfig
@@ -52,7 +52,6 @@ CONFIG_CMD_ABOOTIMG=y
 CONFIG_SYS_I2C_EEPROM_ADDR_LEN=2
 CONFIG_CMD_BCB=y
 # CONFIG_CMD_FLASH is not set
-# CONFIG_CMD_SETEXPR is not set
 CONFIG_CMD_AB_SELECT=y
 CONFIG_BOOTP_DNS2=y
 # CONFIG_CMD_PMIC is not set
diff --git a/configs/am62ax_evm_a53_defconfig b/configs/am62ax_evm_a53_defconfig
index 76ec5ed..773cf3a 100644
--- a/configs/am62ax_evm_a53_defconfig
+++ b/configs/am62ax_evm_a53_defconfig
@@ -23,6 +23,7 @@ CONFIG_SPL_LIBDISK_SUPPORT=y
 CONFIG_SPL_LOAD_FIT=y
 CONFIG_SPL_LOAD_FIT_ADDRESS=0x81000000
 CONFIG_DISTRO_DEFAULTS=y
+CONFIG_BOOTCOMMAND="run envboot; run distro_bootcmd;"
 CONFIG_SPL_MAX_SIZE=0x58000
 CONFIG_SPL_PAD_TO=0x0
 CONFIG_SPL_HAS_BSS_LINKER_SECTION=y
diff --git a/configs/am62x_evm_a53_defconfig b/configs/am62x_evm_a53_defconfig
index 5c572df..424a032 100644
--- a/configs/am62x_evm_a53_defconfig
+++ b/configs/am62x_evm_a53_defconfig
@@ -29,8 +29,7 @@ CONFIG_SPL_SPI=y
 CONFIG_SPL_LOAD_FIT=y
 CONFIG_SPL_LOAD_FIT_ADDRESS=0x81000000
 CONFIG_DISTRO_DEFAULTS=y
-CONFIG_BOOTCOMMAND="run findfdt; run envboot; run init_${boot}; run get_kern_${boot}; run get_fdt_${boot}; run get_overlay_${boot}; run run_kern; setenv fdtfile ti/${name_fdt}; run distro_bootcmd"
-CONFIG_SPL_MAX_SIZE=0x58000
+CONFIG_BOOTCOMMAND="run envboot; run distro_bootcmd;"
 CONFIG_SPL_HAS_BSS_LINKER_SECTION=y
 CONFIG_SPL_BSS_START_ADDR=0x80c80000
 CONFIG_SPL_BSS_MAX_SIZE=0x80000
diff --git a/configs/am64x_evm_a53_defconfig b/configs/am64x_evm_a53_defconfig
index 6485ed1..5fdaafb 100644
--- a/configs/am64x_evm_a53_defconfig
+++ b/configs/am64x_evm_a53_defconfig
@@ -14,7 +14,7 @@ CONFIG_TARGET_AM642_A53_EVM=y
 CONFIG_HAS_CUSTOM_SYS_INIT_SP_ADDR=y
 CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x80480000
 CONFIG_ENV_SIZE=0x20000
-CONFIG_ENV_OFFSET=0x680000
+CONFIG_SYS_SPI_U_BOOT_OFFS=0x300000
 CONFIG_DM_GPIO=y
 CONFIG_SPL_DM_SPI=y
 CONFIG_DEFAULT_DEVICE_TREE="k3-am642-evm"
@@ -33,7 +33,7 @@ CONFIG_SPL_SPI=y
 CONFIG_SPL_LOAD_FIT=y
 CONFIG_SPL_LOAD_FIT_ADDRESS=0x81000000
 CONFIG_DISTRO_DEFAULTS=y
-CONFIG_BOOTCOMMAND="run findfdt; run envboot; run init_${boot}; run get_kern_${boot}; run get_fdt_${boot}; run run_kern"
+CONFIG_BOOTCOMMAND="run envboot; run distro_bootcmd;"
 CONFIG_BOARD_LATE_INIT=y
 CONFIG_SPL_MAX_SIZE=0x180000
 CONFIG_SPL_HAS_BSS_LINKER_SECTION=y
@@ -62,7 +62,6 @@ CONFIG_SPL_SPI_LOAD=y
 CONFIG_SYS_SPI_U_BOOT_OFFS=0x280000
 CONFIG_SPL_YMODEM_SUPPORT=y
 CONFIG_SYS_MAXARGS=64
-CONFIG_SYS_BOOTM_LEN=0x800000
 CONFIG_CMD_ASKENV=y
 CONFIG_CMD_DFU=y
 CONFIG_CMD_DM=y
@@ -79,8 +78,6 @@ CONFIG_OF_LIST="k3-am642-evm k3-am642-sk"
 CONFIG_MULTI_DTB_FIT=y
 CONFIG_SPL_MULTI_DTB_FIT=y
 CONFIG_SPL_MULTI_DTB_FIT_NO_COMPRESSION=y
-CONFIG_ENV_IS_IN_MMC=y
-CONFIG_SYS_MMC_ENV_PART=1
 CONFIG_NET_RANDOM_ETHADDR=y
 CONFIG_SPL_DM=y
 CONFIG_SPL_DM_SEQ_ALIAS=y
diff --git a/configs/am65x_evm_a53_defconfig b/configs/am65x_evm_a53_defconfig
index c3a2f09..4301553 100644
--- a/configs/am65x_evm_a53_defconfig
+++ b/configs/am65x_evm_a53_defconfig
@@ -71,7 +71,6 @@ CONFIG_CMD_MMC=y
 CONFIG_CMD_PCI=y
 CONFIG_CMD_REMOTEPROC=y
 CONFIG_CMD_USB=y
-# CONFIG_CMD_SETEXPR is not set
 CONFIG_CMD_TIME=y
 CONFIG_MTDIDS_DEFAULT="nor0=47040000.spi.0"
 CONFIG_MTDPARTS_DEFAULT="mtdparts=47040000.spi.0:512k(ospi.tiboot3),2m(ospi.tispl),4m(ospi.u-boot),128k(ospi.env),128k(ospi.env.backup),1m(ospi.sysfw),-@8m(ospi.rootfs)"
diff --git a/configs/am65x_hs_evm_a53_defconfig b/configs/am65x_hs_evm_a53_defconfig
index e0277d4..3f9626e 100644
--- a/configs/am65x_hs_evm_a53_defconfig
+++ b/configs/am65x_hs_evm_a53_defconfig
@@ -69,7 +69,6 @@ CONFIG_CMD_MMC=y
 CONFIG_CMD_PCI=y
 CONFIG_CMD_REMOTEPROC=y
 CONFIG_CMD_USB=y
-# CONFIG_CMD_SETEXPR is not set
 CONFIG_CMD_TIME=y
 CONFIG_MTDIDS_DEFAULT="nor0=47040000.spi.0"
 CONFIG_MTDPARTS_DEFAULT="mtdparts=47040000.spi.0:512k(ospi.tiboot3),2m(ospi.tispl),4m(ospi.u-boot),128k(ospi.env),128k(ospi.env.backup),1m(ospi.sysfw),-@8m(ospi.rootfs)"
diff --git a/configs/j7200_evm_a72_defconfig b/configs/j7200_evm_a72_defconfig
index cc68a21..c68d525 100644
--- a/configs/j7200_evm_a72_defconfig
+++ b/configs/j7200_evm_a72_defconfig
@@ -12,7 +12,6 @@ CONFIG_TARGET_J7200_A72_EVM=y
 CONFIG_HAS_CUSTOM_SYS_INIT_SP_ADDR=y
 CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x80480000
 CONFIG_ENV_SIZE=0x20000
-CONFIG_ENV_OFFSET=0x680000
 CONFIG_DM_GPIO=y
 CONFIG_SPL_DM_SPI=y
 CONFIG_DEFAULT_DEVICE_TREE="k3-j7200-common-proc-board"
@@ -23,7 +22,6 @@ CONFIG_SPL_MMC=y
 CONFIG_SPL_SERIAL=y
 CONFIG_SPL_DRIVERS_MISC=y
 CONFIG_SPL_STACK_R_ADDR=0x82000000
-CONFIG_ENV_OFFSET_REDUND=0x6A0000
 CONFIG_SPL_FS_FAT=y
 CONFIG_SPL_LIBDISK_SUPPORT=y
 CONFIG_SPL_SPI_FLASH_SUPPORT=y
@@ -35,7 +33,7 @@ CONFIG_SPL_LOAD_FIT_ADDRESS=0x81000000
 CONFIG_OF_BOARD_SETUP=y
 CONFIG_OF_SYSTEM_SETUP=y
 CONFIG_DISTRO_DEFAULTS=y
-CONFIG_BOOTCOMMAND="run findfdt; run envboot; run init_${boot}; run main_cpsw0_qsgmii_phyinit; run boot_rprocs; if test ${boot_fit} -eq 1; then run get_fit_${boot}; run get_overlaystring; run run_fit; else; run get_kern_${boot}; run get_fdt_${boot}; run get_overlay_${boot}; run run_kern; fi;"
+CONFIG_BOOTCOMMAND="run envboot; run distro_bootcmd;"
 CONFIG_LOGLEVEL=7
 CONFIG_SPL_MAX_SIZE=0xc0000
 CONFIG_SPL_HAS_BSS_LINKER_SECTION=y
@@ -78,7 +76,6 @@ CONFIG_CMD_REMOTEPROC=y
 CONFIG_CMD_UFS=y
 CONFIG_CMD_USB=y
 CONFIG_CMD_USB_MASS_STORAGE=y
-# CONFIG_CMD_SETEXPR is not set
 CONFIG_CMD_TIME=y
 CONFIG_CMD_EXT4_WRITE=y
 CONFIG_MTDIDS_DEFAULT="nor0=47040000.spi.0,nor0=47034000.hyperbus"
@@ -90,8 +87,6 @@ CONFIG_OF_CONTROL=y
 CONFIG_SPL_OF_CONTROL=y
 CONFIG_SPL_MULTI_DTB_FIT=y
 CONFIG_SPL_MULTI_DTB_FIT_NO_COMPRESSION=y
-CONFIG_ENV_OVERWRITE=y
-CONFIG_ENV_IS_IN_MMC=y
 CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
 CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 CONFIG_NET_RANDOM_ETHADDR=y
diff --git a/configs/j721e_evm_a72_defconfig b/configs/j721e_evm_a72_defconfig
index 32ac47c..525f150 100644
--- a/configs/j721e_evm_a72_defconfig
+++ b/configs/j721e_evm_a72_defconfig
@@ -33,7 +33,7 @@ CONFIG_SPL_LOAD_FIT_ADDRESS=0x81000000
 CONFIG_OF_BOARD_SETUP=y
 CONFIG_OF_SYSTEM_SETUP=y
 CONFIG_DISTRO_DEFAULTS=y
-CONFIG_BOOTCOMMAND="run findfdt; run distro_bootcmd; run init_${boot}; run main_cpsw0_qsgmii_phyinit; run boot_rprocs; if test ${boot_fit} -eq 1; then run get_fit_${boot}; run get_overlaystring; run run_fit; else; run get_kern_${boot}; run get_fdt_${boot}; run get_overlay_${boot}; run run_kern; fi;"
+CONFIG_BOOTCOMMAND="run envboot; run distro_bootcmd;"
 CONFIG_LOGLEVEL=7
 CONFIG_SPL_MAX_SIZE=0xc0000
 CONFIG_SPL_HAS_BSS_LINKER_SECTION=y
@@ -76,7 +76,6 @@ CONFIG_CMD_REMOTEPROC=y
 CONFIG_CMD_UFS=y
 CONFIG_CMD_USB=y
 CONFIG_CMD_USB_MASS_STORAGE=y
-# CONFIG_CMD_SETEXPR is not set
 CONFIG_CMD_TIME=y
 CONFIG_CMD_EXT4_WRITE=y
 CONFIG_MTDIDS_DEFAULT="nor0=47040000.spi.0,nor0=47034000.hyperbus"
@@ -91,11 +90,7 @@ CONFIG_OF_LIST="k3-j721e-common-proc-board k3-j721e-sk"
 CONFIG_MULTI_DTB_FIT=y
 CONFIG_SPL_MULTI_DTB_FIT=y
 CONFIG_SPL_MULTI_DTB_FIT_NO_COMPRESSION=y
-CONFIG_ENV_OVERWRITE=y
-CONFIG_ENV_IS_NOWHERE=y
-CONFIG_ENV_IS_IN_FAT=y
 CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
-CONFIG_ENV_FAT_DEVICE_AND_PART="1:1"
 CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 CONFIG_NET_RANDOM_ETHADDR=y
 CONFIG_SPL_DM=y
diff --git a/configs/j721s2_evm_a72_defconfig b/configs/j721s2_evm_a72_defconfig
index 37c1fde..d59f315 100644
--- a/configs/j721s2_evm_a72_defconfig
+++ b/configs/j721s2_evm_a72_defconfig
@@ -32,7 +32,7 @@ CONFIG_SPL_LOAD_FIT=y
 CONFIG_SPL_LOAD_FIT_ADDRESS=0x81000000
 CONFIG_OF_SYSTEM_SETUP=y
 CONFIG_DISTRO_DEFAULTS=y
-CONFIG_BOOTCOMMAND="run findfdt; run envboot; run init_${boot}; run boot_rprocs; if test ${boot_fit} -eq 1; then run get_fit_${boot}; run get_overlaystring; run run_fit; else; run get_kern_${boot}; run get_fdt_${boot}; run get_overlay_${boot}; run run_kern; fi;"
+CONFIG_BOOTCOMMAND="run envboot; run distro_bootcmd;"
 CONFIG_LOGLEVEL=7
 CONFIG_SPL_MAX_SIZE=0xc0000
 CONFIG_SPL_HAS_BSS_LINKER_SECTION=y
@@ -76,7 +76,6 @@ CONFIG_CMD_REMOTEPROC=y
 CONFIG_CMD_UFS=y
 CONFIG_CMD_USB=y
 CONFIG_CMD_USB_MASS_STORAGE=y
-# CONFIG_CMD_SETEXPR is not set
 CONFIG_CMD_TIME=y
 CONFIG_CMD_EXT4_WRITE=y
 CONFIG_MTDIDS_DEFAULT="nor0=47040000.spi.0,nor0=47034000.hyperbus"
@@ -89,10 +88,7 @@ CONFIG_SPL_OF_CONTROL=y
 CONFIG_OF_LIST="k3-j721s2-common-proc-board k3-am68-sk-base-board"
 CONFIG_SPL_MULTI_DTB_FIT=y
 CONFIG_SPL_MULTI_DTB_FIT_NO_COMPRESSION=y
-CONFIG_ENV_OVERWRITE=y
-CONFIG_ENV_IS_IN_FAT=y
 CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
-CONFIG_ENV_FAT_DEVICE_AND_PART="1:1"
 CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 CONFIG_NET_RANDOM_ETHADDR=y
 CONFIG_SPL_DM=y
diff --git a/doc/board/ti/k3.rst b/doc/board/ti/k3.rst
index 7390e03..2db7bbd 100644
--- a/doc/board/ti/k3.rst
+++ b/doc/board/ti/k3.rst
@@ -241,3 +241,173 @@ wakeup and main domain and to boot to the U-Boot prompt
 
    | `tispl.bin` for HS devices or `tispl.bin_unsigned` for GP devices
    | `u-boot.img` for HS devices or `u-boot.img_unsigned` for GP devices
+
+Fit Signature Signing
+---------------------
+
+K3 Platforms have fit signature signing enabled by default on their primary
+platforms. Here we'll take an example for creating fit image for J721e platform
+and the same can be extended to other platforms
+
+1. Describing FIT source
+
+  .. code-block:: bash
+
+    /dts-v1/;
+
+    / {
+            description = "Kernel fitImage for j721e-hs-evm";
+            #address-cells = <1>;
+
+            images {
+                    kernel-1 {
+                            description = "Linux kernel";
+                            data = /incbin/("Image");
+                            type = "kernel";
+                            arch = "arm64";
+                            os = "linux";
+                            compression = "none";
+                            load = <0x80080000>;
+                            entry = <0x80080000>;
+                            hash-1 {
+                                    algo = "sha512";
+                            };
+
+                    };
+                    fdt-ti_k3-j721e-common-proc-board.dtb {
+                            description = "Flattened Device Tree blob";
+                            data = /incbin/("k3-j721e-common-proc-board.dtb");
+                            type = "flat_dt";
+                            arch = "arm64";
+                            compression = "none";
+                            load = <0x83000000>;
+                            hash-1 {
+                                    algo = "sha512";
+                            };
+
+                    };
+            };
+
+            configurations {
+                    default = "conf-ti_k3-j721e-common-proc-board.dtb";
+                    conf-ti_k3-j721e-common-proc-board.dtb {
+                            description = "Linux kernel, FDT blob";
+                            fdt = "fdt-ti_k3-j721e-common-proc-board.dtb";
+                            kernel = "kernel-1";
+                            signature-1 {
+                                    algo = "sha512,rsa4096";
+                                    key-name-hint = "custMpk";
+                                    sign-images = "kernel", "fdt";
+                            };
+                    };
+            };
+    };
+
+  You would require to change the '/incbin/' lines to point to the respective
+  files in your local machine and the key-name-hint also needs to be changed
+  if you are using some other key other than the TI dummy key that we are
+  using for this example.
+
+2. Compile U-boot for the respective board
+
+  .. code-block:: bash
+
+     make O=build/a72 CROSS_COMPILE=aarch64-none-linux-gnu- ARCH=arm
+     BL31=/path/to/bl31.bin TEE=/path/to/bl32.bin
+     BINMAN_INDIRS="/path/to/ti-linux-firmware" -j15
+
+  .. note::
+
+    The changes only affect a72 binaries so the example just builds that
+
+3. Sign the fit image and embed the dtb in uboot
+
+  Now once the build is done, you'll have a dtb for your board that you'll
+  be passing to mkimage for signing the fitImage and embedding the key in
+  the u-boot dtb.
+
+  .. code-block:: bash
+
+    mkimage -r -f fitImage.its -k $UBOOT_PATH/board/ti/keys -K
+    $UBOOT_PATH/build/a72/dts/dt.dtb
+
+  For signing a secondary platform, pass the -K parameter to that DTB
+
+  .. code-block:: bash
+
+    mkimage -f fitImage.its -k $UBOOT_PATH/board/ti/keys -K
+    $UBOOT_PATH/build/a72/arch/arm/dts/k3-j721e-sk.dtb
+
+  .. note::
+
+    If changing `CONFIG_DEFAULT_DEVICE_TREE` to the secondary platform,
+    binman changes would also be required so that correct dtb gets packaged.
+
+    .. code-block:: bash
+
+      diff --git a/arch/arm/dts/k3-j721e-binman.dtsi b/arch/arm/dts/k3-j721e-binman.dtsi
+      index 673be646b1e3..752fa805fe8d 100644
+      --- a/arch/arm/dts/k3-j721e-binman.dtsi
+      +++ b/arch/arm/dts/k3-j721e-binman.dtsi
+      @@ -299,8 +299,8 @@
+       #define SPL_J721E_SK_DTB "spl/dts/k3-j721e-sk.dtb"
+
+       #define UBOOT_NODTB "u-boot-nodtb.bin"
+      -#define J721E_EVM_DTB "u-boot.dtb"
+      -#define J721E_SK_DTB "arch/arm/dts/k3-j721e-sk.dtb"
+      +#define J721E_EVM_DTB "arch/arm/dts/k3-j721e-common-proc-board.dtb"
+      +#define J721E_SK_DTB "u-boot.dtb"
+
+5. Rebuilt u-boot
+
+   This is required so that the modified dtb gets updated in u-boot.img
+
+   .. code-block:: bash
+
+     make O=build/a72 CROSS_COMPILE=aarch64-none-linux-gnu- ARCH=arm
+     BL31=/path/to/bl31.bin TEE=/path/to/bl32.bin
+     BINMAN_INDIRS="/path/to/ti-linux-firmware" -j15
+
+6. (Optional) Enabled FIT_SIGNATURE_ENFORCED
+
+   By default u-boot will boot up the fit image without any authentication as
+   such if the public key is not embedded properly, to check if the public key
+   nodes are proper you can enable FIT_SIGNATURE_ENFORCED that would not rely
+   on the dtb for anything else then the signature node for checking the fit
+   image, rest other things will be enforced such as the property of
+   required-keys. This is not an extensive check so do manual checks also
+
+   This is by default enabled for devices with TI_SECURE_DEVICE enabled.
+
+.. note::
+
+   The devices now also have distroboot enabled so if the fit image doesn't
+   work then the fallback to normal distroboot will be there on hs devices,
+   this will need to be explicitly disabled by changing the boot_targets.
+
+Saving environment
+------------------
+
+SAVEENV is disabled by default and for the new flow uses Uenv.txt as the default
+way for saving the environments. This has been done as Uenv.txt is more granular
+then the saveenv command and can be used across various bootmodes too.
+
+**Writing to MMC/EMMC**
+
+.. code-block::
+
+  => env export -t $loadaddr <list of variables>
+  => fatwrite mmc ${mmcdev} ${loadaddr} ${bootenvfile} ${filesize}
+
+**Reading from MMC/EMMC**
+
+By default run envboot will read it from the MMC/EMMC partition ( based on
+mmcdev) and set the environments.
+
+If manually needs to be done then the environment can be read from the
+filesystem and then imported
+
+.. code-block::
+
+  => fatload mmc ${mmcdev} ${loadaddr} ${bootenvfile}
+  => env import -t ${loadaddr} ${filesize}
diff --git a/include/configs/am62ax_evm.h b/include/configs/am62ax_evm.h
index d8ef250..3997ce5 100644
--- a/include/configs/am62ax_evm.h
+++ b/include/configs/am62ax_evm.h
@@ -15,77 +15,6 @@
 /* DDR Configuration */
 #define CFG_SYS_SDRAM_BASE1		0x880000000
 
-#define PARTS_DEFAULT \
-	/* Linux partitions */ \
-	"name=rootfs,start=0,size=-,uuid=${uuid_gpt_rootfs}\0" \
-
-/* U-Boot general configuration */
-#define EXTRA_ENV_AM62A7_BOARD_SETTINGS					\
-	"default_device_tree=" CONFIG_DEFAULT_DEVICE_TREE ".dtb\0"	\
-	"findfdt="							\
-		"setenv name_fdt ${default_device_tree};"		\
-		"setenv fdtfile ${name_fdt}\0"				\
-	"name_kern=Image\0"						\
-	"console=ttyS2,115200n8\0"					\
-	"args_all=setenv optargs earlycon=ns16550a,mmio32,0x02800000 "	\
-		"${mtdparts}\0"						\
-	"run_kern=booti ${loadaddr} ${rd_spec} ${fdtaddr}\0"
-
-/* U-Boot MMC-specific configuration */
-#define EXTRA_ENV_AM62A7_BOARD_SETTINGS_MMC				\
-	"boot=mmc\0"							\
-	"mmcdev=1\0"							\
-	"bootpart=1:2\0"						\
-	"bootdir=/boot\0"						\
-	"rd_spec=-\0"							\
-	"init_mmc=run args_all args_mmc\0"				\
-	"get_fdt_mmc=load mmc ${bootpart} ${fdtaddr} ${bootdir}/${name_fdt}\0" \
-	"get_overlay_mmc="						\
-		"fdt address ${fdtaddr};"				\
-		"fdt resize 0x100000;"					\
-		"for overlay in $name_overlays;"			\
-		"do;"							\
-		"load mmc ${bootpart} ${dtboaddr} ${bootdir}/${overlay} && "	\
-		"fdt apply ${dtboaddr};"				\
-		"done;\0"						\
-	"get_kern_mmc=load mmc ${bootpart} ${loadaddr} "		\
-		"${bootdir}/${name_kern}\0"				\
-	"get_fit_mmc=load mmc ${bootpart} ${addr_fit} "			\
-		"${bootdir}/${name_fit}\0"				\
-	"partitions=" PARTS_DEFAULT
-
-#define BOOTENV_DEV_TI_MMC(devtypeu, devtypel, instance)		\
-	DEFAULT_MMC_TI_ARGS						\
-	EXTRA_ENV_AM62A7_BOARD_SETTINGS_MMC				\
-	"bootcmd_ti_mmc="						\
-		"run findfdt; run envboot; run init_mmc;"		\
-		"if test ${boot_fit} -eq 1; then;"			\
-			"run get_fit_mmc; run get_overlaystring;"	\
-			"run run_fit;"					\
-		"else;"							\
-			"run get_kern_mmc; run get_fdt_mmc;"		\
-			"run get_overlay_mmc;"				\
-			"run run_kern;"					\
-		"fi;\0"
-
-#define BOOTENV_DEV_NAME_TI_MMC(devtyeu, devtypel, instance)		\
-	"ti_mmc "
-
-#if IS_ENABLED(CONFIG_CMD_MMC)
-	#define BOOT_TARGET_MMC(func)					\
-		func(TI_MMC, ti_mmc, na)
-#else
-	#define BOOT_TARGET_MMC(func)
-#endif /* IS_ENABLED(CONFIG_CMD_MMC) */
-
-#define BOOT_TARGET_DEVICES(func)					\
-	BOOT_TARGET_MMC(func)
-
-#include <config_distro_bootcmd.h>
-
-/* Incorporate settings into the U-Boot environment */
-#define CFG_EXTRA_ENV_SETTINGS					\
-	BOOTENV
 
 /* Now for the remaining common defines */
 #include <configs/ti_armv7_common.h>
diff --git a/include/configs/am62x_evm.h b/include/configs/am62x_evm.h
index 7bf0780..6b2a6ee 100644
--- a/include/configs/am62x_evm.h
+++ b/include/configs/am62x_evm.h
@@ -15,33 +15,6 @@
 /* DDR Configuration */
 #define CFG_SYS_SDRAM_BASE1		0x880000000
 
-#ifdef CONFIG_CMD_MMC
-#define DISTRO_BOOT_DEV_MMC(func) func(MMC, mmc, 0) func(MMC, mmc, 1)
-#else
-#define DISTRO_BOOT_DEV_MMC(func)
-#endif
-
-#ifdef CONFIG_CMD_PXE
-#define DISTRO_BOOT_DEV_PXE(func) func(PXE, pxe, na)
-#else
-#define DISTRO_BOOT_DEV_PXE(func)
-#endif
-
-#ifdef CONFIG_CMD_DHCP
-#define DISTRO_BOOT_DEV_DHCP(func) func(DHCP, dhcp, na)
-#else
-#define DISTRO_BOOT_DEV_DHCP(func)
-#endif
-
-#define BOOT_TARGET_DEVICES(func) \
-	DISTRO_BOOT_DEV_MMC(func) \
-	DISTRO_BOOT_DEV_PXE(func) \
-	DISTRO_BOOT_DEV_DHCP(func)
-
-/* Incorporate settings into the U-Boot environment */
-#define CFG_EXTRA_ENV_SETTINGS					\
-	BOOTENV
-
 /* Now for the remaining common defines */
 #include <configs/ti_armv7_common.h>
 
diff --git a/include/configs/am65x_evm.h b/include/configs/am65x_evm.h
index c549573..2fa658d 100644
--- a/include/configs/am65x_evm.h
+++ b/include/configs/am65x_evm.h
@@ -17,20 +17,6 @@
 /* DDR Configuration */
 #define CFG_SYS_SDRAM_BASE1		0x880000000
 
-#ifdef CONFIG_TARGET_AM654_A53_EVM
-#define BOOT_TARGET_DEVICES(func) \
-	func(MMC, mmc, 1) \
-	func(MMC, mmc, 0)
-
-#include <config_distro_bootcmd.h>
-#else
-#define BOOTENV
-#endif
-
-/* Incorporate settings into the U-Boot environment */
-#define CFG_EXTRA_ENV_SETTINGS					\
-	BOOTENV
-
 /* Now for the remaining common defines */
 #include <configs/ti_armv7_common.h>
 
diff --git a/include/configs/iot2050.h b/include/configs/iot2050.h
index 82174b8..2177e0d 100644
--- a/include/configs/iot2050.h
+++ b/include/configs/iot2050.h
@@ -13,31 +13,6 @@
 
 #include <linux/sizes.h>
 
-#if IS_ENABLED(CONFIG_CMD_USB)
-# define BOOT_TARGET_USB(func) \
-	func(USB, usb, 0) \
-	func(USB, usb, 1) \
-	func(USB, usb, 2)
-#else
-# define BOOT_TARGET_USB(func)
-#endif
-
-/*
- * This defines all MMC devices, even if the basic variant has no mmc1.
- * The non-supported device will be removed from the boot targets during
- * runtime, when that board was detected.
- */
-#define BOOT_TARGET_DEVICES(func) \
-	func(MMC, mmc, 1) \
-	func(MMC, mmc, 0) \
-	BOOT_TARGET_USB(func)
-
-#include <config_distro_bootcmd.h>
-
-#define CFG_EXTRA_ENV_SETTINGS						\
-	DEFAULT_LINUX_BOOT_ENV						\
-	BOOTENV
-
 #include <configs/ti_armv7_common.h>
 
 #ifdef CONFIG_ENV_WRITEABLE_LIST
diff --git a/include/configs/j721e_evm.h b/include/configs/j721e_evm.h
index de92cd4..ea39d1b 100644
--- a/include/configs/j721e_evm.h
+++ b/include/configs/j721e_evm.h
@@ -24,40 +24,8 @@
 #define CFG_SYS_UBOOT_BASE		0x50080000
 #endif
 
-#if CONFIG_IS_ENABLED(CMD_PXE)
-# define BOOT_TARGET_PXE(func) func(PXE, pxe, na)
-#else
-# define BOOT_TARGET_PXE(func)
-#endif
-
-#if CONFIG_IS_ENABLED(CMD_DHCP)
-# define BOOT_TARGET_DHCP(func) func(DHCP, dhcp, na)
-#else
-# define BOOT_TARGET_DHCP(func)
-#endif
-
-#ifdef CONFIG_CMD_USB
-# define BOOT_TARGET_USB(func)	func(USB, usb, 0)
-#else
-# define BOOT_TARGET_USB(func)
-#endif
-
-#define BOOT_TARGET_DEVICES(func) \
-	BOOT_TARGET_USB(func) \
-	func(MMC, mmc, 1) \
-	func(MMC, mmc, 0) \
-	BOOT_TARGET_PXE(func) \
-	BOOT_TARGET_DHCP(func)
-
-#include <config_distro_bootcmd.h>
-
-/* Incorporate settings into the U-Boot environment */
-#define CFG_EXTRA_ENV_SETTINGS					\
-	BOOTENV
-
 /* Now for the remaining common defines */
 #include <configs/ti_armv7_common.h>
 
-/* MMC ENV related defines */
 
 #endif /* __CONFIG_J721E_EVM_H */
diff --git a/include/configs/j721s2_evm.h b/include/configs/j721s2_evm.h
index 1e0da9f..692c6bb 100644
--- a/include/configs/j721s2_evm.h
+++ b/include/configs/j721s2_evm.h
@@ -23,12 +23,7 @@
 #define CFG_SYS_UBOOT_BASE		0x50080000
 #endif
 
-/* Incorporate settings into the U-Boot environment */
-#define CFG_EXTRA_ENV_SETTINGS
-
 /* Now for the remaining common defines */
 #include <configs/ti_armv7_common.h>
 
-/* MMC ENV related defines */
-
 #endif /* __CONFIG_J721S2_EVM_H */
diff --git a/include/configs/ti_armv7_common.h b/include/configs/ti_armv7_common.h
index 149a74d..dbbeff3 100644
--- a/include/configs/ti_armv7_common.h
+++ b/include/configs/ti_armv7_common.h
@@ -154,4 +154,54 @@
 #define NETARGS ""
 #endif
 
+#ifdef CONFIG_ARM64
+#ifdef CONFIG_DISTRO_DEFAULTS
+#ifdef CONFIG_CMD_PXE
+# define BOOT_TARGET_PXE(func) func(PXE, pxe, na)
+#else
+# define BOOT_TARGET_PXE(func)
+#endif
+
+#ifdef CONFIG_CMD_DHCP
+# define BOOT_TARGET_DHCP(func) func(DHCP, dhcp, na)
+#else
+# define BOOT_TARGET_DHCP(func)
+#endif
+
+#ifdef CONFIG_CMD_MMC
+#define BOOT_TARGET_MMC(func) \
+	func(TI_MMC, ti_mmc, na) \
+	func(MMC, mmc, 0) \
+	func(MMC, mmc, 1)
+#else
+#define BOOT_TARGET_MMC(func)
+#endif
+
+#define BOOTENV_DEV_TI_MMC(devtypeu, devtypel, instance)
+
+#define BOOTENV_DEV_NAME_TI_MMC(devtyeu, devtypel, instance)		\
+	"ti_mmc "
+
+#ifdef CONFIG_CMD_USB
+# define BOOT_TARGET_USB(func)	func(USB, usb, 0)
+#else
+# define BOOT_TARGET_USB(func)
+#endif
+
+#define BOOT_TARGET_DEVICES(func) \
+	BOOT_TARGET_MMC(func) \
+	BOOT_TARGET_USB(func) \
+	BOOT_TARGET_PXE(func) \
+	BOOT_TARGET_DHCP(func)
+
+#include <config_distro_bootcmd.h>
+
+/* Incorporate settings into the U-Boot environment */
+#define CFG_EXTRA_ENV_SETTINGS					\
+	BOOTENV
+
+#endif
+
+#endif /* CONFIG_ARM64 */
+
 #endif	/* __CONFIG_TI_ARMV7_COMMON_H__ */
diff --git a/include/environment/ti/mmc.env b/include/environment/ti/mmc.env
index 5677d05..a052d28 100644
--- a/include/environment/ti/mmc.env
+++ b/include/environment/ti/mmc.env
@@ -13,7 +13,8 @@ importbootenv=echo Importing environment from mmc${mmcdev} ...;
 	env import -t ${loadaddr} ${filesize}
 loadbootenv=fatload mmc ${mmcdev} ${loadaddr} ${bootenvfile}
 loadimage=load ${devtype} ${bootpart} ${loadaddr} ${bootdir}/${bootfile}
-loadfdt=load ${devtype} ${bootpart} ${fdtaddr} ${bootdir}/${fdtfile}
+loadfdt=load ${devtype} ${bootpart} ${fdtaddr} ${bootdir}/dtb/${fdtfile}
+get_fdt_mmc=load mmc ${bootpart} ${fdtaddr} ${bootdir}/dtb/${name_fdt}
 envboot=mmc dev ${mmcdev};
 	if mmc rescan; then
 		echo SD/MMC found on device ${mmcdev};
@@ -32,7 +33,7 @@ envboot=mmc dev ${mmcdev};
 	fi;
 mmcloados=
 	if test ${boot_fdt} = yes || test ${boot_fdt} = try; then
-		if run loadfdt; then
+		if run get_fdt_mmc; then
 			bootz ${loadaddr} - ${fdtaddr};
 		else
 			if test ${boot_fdt} = try; then
diff --git a/include/environment/ti/ti_armv7_common.env b/include/environment/ti/ti_armv7_common.env
index 0c0929d..e87a41a 100644
--- a/include/environment/ti/ti_armv7_common.env
+++ b/include/environment/ti/ti_armv7_common.env
@@ -22,4 +22,13 @@ get_overlaystring=
 	done;
 get_fit_config=setexpr name_fit_config gsub / _ conf-${fdtfile}
 run_fit=run get_fit_config; bootm ${addr_fit}#${name_fit_config}${overlaystring}
-
+bootcmd_ti_mmc=
+	run findfdt; run init_${boot};
+#if CONFIG_CMD_REMOTEPROC
+	run main_cpsw0_qsgmii_phyinit; run boot_rprocs;
+#endif
+	if test ${boot_fit} -eq 1;
+		then run get_fit_${boot}; run get_overlaystring; run run_fit;
+	else;
+		run get_kern_${boot}; run get_fdt_${boot}; run get_overlay_${boot}; run run_kern;
+	fi;
diff --git a/lib/Kconfig b/lib/Kconfig
index c8b3ec1..3926652 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -508,6 +508,7 @@ config SHA256
 
 config SHA512
 	bool "Enable SHA512 support"
+	default y if TI_SECURE_DEVICE && FIT_SIGNATURE
 	help
 	  This option enables support of hashing using SHA512 algorithm.
 	  The hash is calculated in software.