From patchwork Wed Sep 2 13:41:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= X-Patchwork-Id: 2296666 X-Patchwork-Delegate: festevam@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=DnZOyKf6; dkim=pass (2048-bit key; unprotected) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=dkim header.b=nhTELMHN; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.138; helo=smtp1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZkRW0TFjz1xwZ for ; Wed, 02 Sep 2026 23:41:59 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id 4167B80EC5; Wed, 2 Sep 2026 13:41:57 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id FeAdSuACmR7f; Wed, 2 Sep 2026 13:41:56 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788356516; bh=bcgBAQQ9l2yg4Dv0Bz/e6sHcs+0K+LO2YO+3TspM+GE=; h=From:Date:Subject:References:In-Reply-To:To:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=DnZOyKf6HtXbFWOyz9PAfJwNGMTZhRQsmtf1KrJo95tOwJ1RMQJc4Z6pGPNQqw8rl fIUlsnzItqYzlXS5UklOw3E1gSZOoB42y6UzHIfSjRC3a/12ZRbUBtZFnIUKcIJ8ou 1ydYcNjuiVTFgQlonZ6WfsE6oHVbIX9RcvWPVnl8rarVXn42DJ+cuqDHCG5MZ07hIw eNCpru8Ugov8YyDS0/RJeDtMwvJFgMd8OM676FahI2cZ0Ce1/2nNCz3KASTrEBxFw/ FS/ZBuUbndf+0nKcDhkZG5CW+fZCv79vHh27+iqPi/Ec1BOYyF+S5JpNpKC6tQOIVv TwBZxPylPezvA== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp1.osuosl.org (Postfix) with ESMTP id 6238A80EB4; Wed, 2 Sep 2026 13:41:56 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) by lists1.osuosl.org (Postfix) with ESMTP id 594131D9 for ; Wed, 2 Sep 2026 13:41:55 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 4B17F606CF for ; Wed, 2 Sep 2026 13:41:55 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id MnTFvU_Nh0C1 for ; Wed, 2 Sep 2026 13:41:54 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=185.246.84.56; helo=smtpout-02.galae.net; envelope-from=jeremie.dautheribes@bootlin.com; receiver= Authentication-Results: smtp3.osuosl.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp3.osuosl.org; dkim=pass (2048-bit key, unprotected) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=dkim header.b=nhTELMHN Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) by smtp3.osuosl.org (Postfix) with ESMTPS id 679936069C for ; Wed, 2 Sep 2026 13:41:54 +0000 (UTC) Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id 206971A1957; Wed, 2 Sep 2026 13:41:52 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id E5FE66053C; Wed, 2 Sep 2026 13:41:51 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 1FE8A11C7977F; Wed, 2 Sep 2026 15:41:47 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1788356510; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=bcgBAQQ9l2yg4Dv0Bz/e6sHcs+0K+LO2YO+3TspM+GE=; b=nhTELMHN4m/zifptizVTQgIEizk8ZXcLrNWSdmDJPs+X3265UorjpgCKutwMSGWqr0ByDC 5TR+PsUbi4/nfHqMo00drR4My87LSICUZVY+OZmNk8eFD5WRV+jevohWD9IevbeaivKP0l WX/XAFcqkKLgmG1SfzFM1xtDepXIxbs0OrjaVhLrlVCasT9iuXAUUtplKd1jTKggU1wbJ5 KqQ+kdeMQXKdfu0hKVvsgF446RPPmRjg4s7WTGASXykzWRGiCKCiRE/HJsxlF+7Qj6NhTD JgE+lgqtmM0V6qyhBID5xdo7oRbu+9vUfRl7XyiYm95AdmM+QT/hqg0WMlOZ5g== From: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= Date: Wed, 02 Sep 2026 15:41:28 +0200 Subject: [PATCH v2 1/7] binman: add nxp_imxcst base etype for i.MX CST signing MIME-Version: 1.0 Message-Id: <20260902-imx93-secureboot-v2-1-5947b92a5072@bootlin.com> References: <20260902-imx93-secureboot-v2-0-5947b92a5072@bootlin.com> In-Reply-To: <20260902-imx93-secureboot-v2-0-5947b92a5072@bootlin.com> To: "NXP i.MX U-Boot Team" , u-boot@lists.u-boot-project.org Cc: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= , =?utf-8?q?Miqu=C3=A8l_Raynal?= , Thomas Petazzoni , Tom Rini , Simon Glass , Alper Nebi Yasak , Stefano Babic , Fabio Estevam , Marek Vasut , Denis Mukhin , Rasmus Villemoes , Ilias Apalodimas , =?utf-8?q?Krzysztof_Drobi?= =?utf-8?q?=C5=84ski?= , Peng Fan , Alice Guo , Simona Toaca , Ye Li , Quentin Schulz , Christophe Guerreiro X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=4959; i=jeremie.dautheribes@bootlin.com; h=from:subject:message-id; bh=kAUr5fYXN/6NRqAj3EpxrY/RE5CMTIm6sHATadyaies=; b=owEBbQKS/ZANAwAKASsAXqAbWo8DAcsmYgBqmCeUE1rMGnAvjDW32eA5SLOB1hMKFLohAXdPa Kp1qz5RcxKJAjMEAAEKAB0WIQT7FK2Qhtu4QpBIBAkrAF6gG1qPAwUCapgnlAAKCRArAF6gG1qP Awu3D/wIWzjVgLf6huKudyigRWrg1u7w+volUknphpPQMJlwUdMb7bkqOvv7AgVFll3FyS5zezc n/S3ddwFUNczIEFJce/jKWcL0eoHwDs9xDAnQUR2+zxkCYVnibtO90AUrhyIAOheuAJNdFksSYS v08FUOF3yBB//LVdXpm55QXmRx2A5yvGoq0z3V9xBZPawXcriGWfXJmKvemxeHw1NaHV9ylwSAQ NAvqjUSIfE9Gzyg80ndkf+YPCEzMeknD3C98sCWKKy97ov8aAuLUPS3uNeO+IqCwKgM/BB8EUpL E1S2pmz574URMvHdaTvN0jxDdYWxE6/SHIfMHDRMy+rlzy3z18u0Az6hhsz6y3jSBaWPk17P25v Dvy2lshOK7PynmOqWPBPDZESqiIXV/r1Af7dB3Al/GDd2fb/wXAYbOawCQY4Zl+EXCGp/ME2gh8 UBJ5IbZKIFT56uDrC67Rn9u1f/mfm6JkN/UNgO/XqUZHXbq7o/mrCXoDQtXJvQtQLgf+pe/WEx8 aIx7g2SVFui3vFOQbzpAS9uuwm+2aw2z9RLo8HEsiah821Lv5HXOOPD2iEG2e0DyAyqCoPzrNks kF0SnIVpDj6xpLDw+8FQbbGqcsbRs4HJPucL296OD46DVSmPcZgtQF7kcF3VrQ7zx9fSaPaj1rj 0/JL0HER9OB5R3Q== X-Developer-Key: i=jeremie.dautheribes@bootlin.com; a=openpgp; fpr=FB14AD9086DBB842904804092B005EA01B5A8F03 X-Last-TLS-Session-Version: TLSv1.3 X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org Add a common etype which provides the shared functionality for signing i.MX images with the NXP Code Signing Tool (CST). This includes the SRK table property handling, the CST bintool registration, and helpers for writing the input data and configuration files and for running cst. The nxp_imx8mcst etype and the upcoming nxp_imx93cst etype will be converted to use this common base in the following commits. No functional changes. Signed-off-by: Jérémie Dautheribes (Schneider Electric) --- tools/binman/etype/nxp_imxcst.py | 121 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 121 insertions(+) diff --git a/tools/binman/etype/nxp_imxcst.py b/tools/binman/etype/nxp_imxcst.py new file mode 100644 index 00000000000..3f863704b87 --- /dev/null +++ b/tools/binman/etype/nxp_imxcst.py @@ -0,0 +1,121 @@ +# SPDX-License-Identifier: GPL-2.0+ +# Copyright 2026 (C) Bootlin +# Author: Jérémie Dautheribes +# +# Derived from nxp_imx8mcst.py +# Copyright 2023-2024 Marek Vasut + +# Entry-type module for NXP i.MX Code Signing Tool (CST) base class +# + +import configparser +import os + +from binman.etype.mkimage import Entry_mkimage +from binman.etype.section import Entry_section +from dtoc import fdt_util +from u_boot_pylib import tools + + +class Entry_nxp_imxcst(Entry_mkimage): + """NXP i.MX CST .cfg file generator and cst invoker base class + + Properties / Entry arguments: + - nxp,srk-table - full path to SRK_1_2_3_4_table.bin + """ + + def __init__(self, section, etype, node): + super().__init__(section, etype, node) + self.cst = None + self.srk_table = None + + def ReadNode(self): + super().ReadNode() + self.srk_table = os.getenv( + 'SRK_TABLE', + fdt_util.GetString(self._node, 'nxp,srk-table', 'SRK_1_2_3_4_table.bin'), + ) + + def SetImagePos(self, image_pos): + # Customized SoC specific SetImagePos which skips the mkimage etype + # implementation and removes the 0x48 offset introduced there. That + # offset is only used for uImage/fitImage, which is not the case in + # here. + upto = 0x00 + for entry in super().GetEntries().values(): + entry.SetOffsetSize(upto, None) + + # Give up if any entries lack a size + if entry.size is None: + return + upto += entry.size + + Entry_section.SetImagePos(self, image_pos) + + def AddBintools(self, btools): + super().AddBintools(btools) + self.cst = self.AddBintool(btools, 'cst') + + def write_input_data(self, data, uniq): + """Write input data to a temporary file for CST + + Args: + data: Data to write + uniq: Unique string for naming output files + + Returns: + str: Path to the written file + """ + output_dname = tools.get_output_filename(f'nxp.cst-input-data.{uniq}') + tools.write_file(output_dname, data) + return output_dname + + def get_config(self, template): + """Get a ConfigParser loaded with the given template + + Args: + template: Configuration template string + + Returns: + ConfigParser instance + """ + config = configparser.ConfigParser() + # Do not make key names lowercase + config.optionxform = str + config.read_string(template) + return config + + def write_config(self, config, uniq): + """Write ConfigParser object to a temporary file for CST + + Args: + config: ConfigParser instance + uniq: Unique string for naming output files + + Returns: + str: Path to the written configuration file + """ + cfg_fname = tools.get_output_filename(f'nxp.csf-config-txt.{uniq}') + with open(cfg_fname, 'w') as cfgf: + config.write(cfgf) + return cfg_fname + + def run_cst(self, cfg_fname, uniq, backend=None): + """Run CST tool with given configuration file + + Args: + cfg_fname: Filename of the CST configuration file + uniq: Unique string for naming output files + backend: Optional backend (e.g. 'ssl' or 'pkcs11') + + Returns: + bytes: Output data from CST, or None if bintool is missing + """ + output_fname = tools.get_output_filename(f'nxp.csf-output-blob.{uniq}') + args = ['-i', cfg_fname, '-o', output_fname] + if backend: + args.extend(['-b', backend]) + if self.cst.run_cmd(*args) is not None: + return tools.read_file(output_fname) + self.record_missing_bintool(self.cst) + return None From patchwork Wed Sep 2 13:41:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= X-Patchwork-Id: 2296667 X-Patchwork-Delegate: festevam@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=R7S+W80y; dkim=pass (2048-bit key; unprotected) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=dkim header.b=ICvKbaGr; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.138; helo=smtp1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZkRb71Zxz1xwZ for ; Wed, 02 Sep 2026 23:42:03 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id A009880F76; Wed, 2 Sep 2026 13:42:01 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id 3DuOs_3XmG_l; Wed, 2 Sep 2026 13:41:59 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788356519; bh=qmCJj6w1WXHLj2t5lHMeqrOtc7bdJ05xCIbIjbWAAlU=; h=From:Date:Subject:References:In-Reply-To:To:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=R7S+W80yh4tdwiel5f/KedBWbSJYF6JtjDbAIyb8R/yWD2iLiNiRFYQoPswguUqcT uJaMvw9YW/ZbZpSKeVHBuEXrj3O7GbS3op0mpezux69MCCkftyQU6GMJaRBBejdSqz A62/hhTRhCLffng+6rvJ8Zfarp8GZ5qdROzMztAFrzquAmomNWSugHi/kbHjuHKacF Mi2dqCsKln4DdpvuPtgQqnMDcHRep5Jbo04zIaCrTTrYhkxgVwjWR7ga3vqMFg8CTH OuLJ8rQ1L0RjOkXCpPbg1y2/WrFqSUMuMDZ9GvoCn1gOw1tvj5qjwPJAZShxp2VDbU 4ONsto8SOp9tw== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp1.osuosl.org (Postfix) with ESMTP id 80B8C80F36; Wed, 2 Sep 2026 13:41:59 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp2.osuosl.org (smtp2.osuosl.org [IPv6:2605:bc80:3010::133]) by lists1.osuosl.org (Postfix) with ESMTP id 1FA5A498 for ; Wed, 2 Sep 2026 13:41:58 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id F1D204006F for ; Wed, 2 Sep 2026 13:41:57 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id eC1zP_Y5jeee for ; Wed, 2 Sep 2026 13:41:57 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=185.246.85.4; helo=smtpout-03.galae.net; envelope-from=jeremie.dautheribes@bootlin.com; receiver= Authentication-Results: smtp2.osuosl.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp2.osuosl.org; dkim=pass (2048-bit key, unprotected) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=dkim header.b=ICvKbaGr Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) by smtp2.osuosl.org (Postfix) with ESMTPS id B760D4004D for ; Wed, 2 Sep 2026 13:41:56 +0000 (UTC) Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id C46894E414CD; Wed, 2 Sep 2026 13:41:54 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 98B666053C; Wed, 2 Sep 2026 13:41:54 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id BD2F711C792AB; Wed, 2 Sep 2026 15:41:50 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1788356513; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=qmCJj6w1WXHLj2t5lHMeqrOtc7bdJ05xCIbIjbWAAlU=; b=ICvKbaGr9ClLKRPMTdCsoKXNaYjF4NeU3FgU5UPM2gENH8gQ9vDQJdMFNLFA9jKX/pnF9A HVZcWZAQzO2+1mCL5TI/GZ5dUs5R7bK7dsLSXul/re/CA/HatgqpPwb5PDiBDvMFvuITI+ 2TKyQtaI15tR21JazTaWnR7yUCMBthSSp0D1G5iIvbL9uNXkAkQ1cJsu+oYmaUkysl/UzC yQM9Tz+tIbCrYajyQBH+Ihh0J11Z1kdlxk8NHP1rV2SjUebxnKN600yUO57RNhqs27yacw CwLKZLW5d7OoovQBUy2+Hw1WYpAe0jyvCqRT44GaG8SbbX/PXaf4nNMySsDUTw== From: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= Date: Wed, 02 Sep 2026 15:41:29 +0200 Subject: [PATCH v2 2/7] binman: nxp_imx8mcst: use the nxp_imxcst base etype MIME-Version: 1.0 Message-Id: <20260902-imx93-secureboot-v2-2-5947b92a5072@bootlin.com> References: <20260902-imx93-secureboot-v2-0-5947b92a5072@bootlin.com> In-Reply-To: <20260902-imx93-secureboot-v2-0-5947b92a5072@bootlin.com> To: "NXP i.MX U-Boot Team" , u-boot@lists.u-boot-project.org Cc: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= , =?utf-8?q?Miqu=C3=A8l_Raynal?= , Thomas Petazzoni , Tom Rini , Simon Glass , Alper Nebi Yasak , Stefano Babic , Fabio Estevam , Marek Vasut , Denis Mukhin , Rasmus Villemoes , Ilias Apalodimas , =?utf-8?q?Krzysztof_Drobi?= =?utf-8?q?=C5=84ski?= , Peng Fan , Alice Guo , Simona Toaca , Ye Li , Quentin Schulz , Christophe Guerreiro X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=4880; i=jeremie.dautheribes@bootlin.com; h=from:subject:message-id; bh=vdKdUi9fS5wXwZhuKIVF5S9BdFBwqgz9RMXFQVZMYiQ=; b=owEBbQKS/ZANAwAKASsAXqAbWo8DAcsmYgBqmCeU52CHwWEwFx2R1NhmvReNAdWwOntNKIt70 BZiGp0s3DCJAjMEAAEKAB0WIQT7FK2Qhtu4QpBIBAkrAF6gG1qPAwUCapgnlAAKCRArAF6gG1qP AxsNEACo6aUyA9lB/0xORjr3Mbw+k7OVPKFtM18Sj4flXCyP2JEPa0yaNVg1fO7MhERrnsbUNcS twsG3nHCf8FsLMWCC2Yo7dy9nl+iN0KtS7KHszK+/oDBg/HGo6NYPQie6pbbv6xbikFdGX5HJea nrLCwUPmWgmgn+l3sXnCb5iqf4FdFTAY7mxh5IlQf4TcNIKcOfLRhaN8UtuWruqRpee+IapBJx7 zviYLbnK1yiPcgJ9EMtT5BHMKD/qN6izojbIhu6Gp7dUASQOK2XKDAQ/dTRP925WkQ1CMmADwIU 8MvEjj4ISyhVU/BWwE6Eyv57yipPOdqXtnsYPiLzCRrPKp6czpY9AEa3Sd49XJJwQBYEuMa968j CR2GDiNP8DNsHPOIpzkR/UAdq6UEMltG/Lrg8Pim900b881n5jkyWZy1UcrbLV568DqvYPfrqcQ Dxuw5mNaHq6k79K+JHQa1KXF7cEycxOQvblso7+hKY2BIvDKcDlBL1jvz1QinqoBjydBMco00ha g+2xUkxhWYD7VVZJvxzi3qrIk7hgbIRNmC4mVGdAo/Q50OkajeaUCImngNeRuezPemD+rL9q6na entqq5+ifosJl9nwszbGpeaFvNsqurpaD++k3wNWaptB134NtFHvj8ikpXIJCI8usuCXwvVTNAw fEO2COCLkCXcNJA== X-Developer-Key: i=jeremie.dautheribes@bootlin.com; a=openpgp; fpr=FB14AD9086DBB842904804092B005EA01B5A8F03 X-Last-TLS-Session-Version: TLSv1.3 X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org Use the freshly introduced new nxp_imxcst base etype and remove dupplicated code. This should not have any functional impact. Signed-off-by: Jérémie Dautheribes (Schneider Electric) --- tools/binman/etype/nxp_imx8mcst.py | 60 +++++++------------------------------- 1 file changed, 10 insertions(+), 50 deletions(-) diff --git a/tools/binman/etype/nxp_imx8mcst.py b/tools/binman/etype/nxp_imx8mcst.py index 29a7451678d..3f81b9f83c6 100644 --- a/tools/binman/etype/nxp_imx8mcst.py +++ b/tools/binman/etype/nxp_imx8mcst.py @@ -7,16 +7,10 @@ # input configuration file and input data to be signed. # -import configparser import os import struct -from collections import OrderedDict - -from binman.entry import Entry -from binman.etype.mkimage import Entry_mkimage -from binman.etype.section import Entry_section -from binman import elf +from binman.etype.nxp_imxcst import Entry_nxp_imxcst from dtoc import fdt_util from u_boot_pylib import tools @@ -61,7 +55,8 @@ CSF_CONFIG_TEMPLATE = f''' Blocks = 0x1234 0x78 0xabcd "data.bin" ''' -class Entry_nxp_imx8mcst(Entry_mkimage): + +class Entry_nxp_imx8mcst(Entry_nxp_imxcst): """NXP i.MX8M CST .cfg file generator and cst invoker Properties / Entry arguments: @@ -82,9 +77,6 @@ class Entry_nxp_imx8mcst(Entry_mkimage): def ReadNode(self): super().ReadNode() self.loader_address = fdt_util.GetInt(self._node, 'nxp,loader-address') - self.srk_table = os.getenv( - 'SRK_TABLE', fdt_util.GetString(self._node, 'nxp,srk-table', - 'SRK_1_2_3_4_table.bin')) self.fast_auth = fdt_util.GetBool(self._node, 'nxp,fast-auth') if not self.fast_auth: self.csf_crt = os.getenv( @@ -158,17 +150,11 @@ class Entry_nxp_imx8mcst(Entry_mkimage): return data # Write out customized data to be signed - output_dname = tools.get_output_filename(f'nxp.cst-input-data.{uniq}') - tools.write_file(output_dname, data) + output_dname = self.write_input_data(data, uniq) # Generate CST configuration file used to sign payload - cfg_fname = tools.get_output_filename(f'nxp.csf-config-txt.{uniq}') - config = configparser.ConfigParser() - # Do not make key names lowercase - config.optionxform = str - # Load configuration template and modify keys of interest - config.read_string(CSF_CONFIG_TEMPLATE) - config['Install SRK']['File'] = f'"{self.srk_table}"' + config = self.get_config(CSF_CONFIG_TEMPLATE) + config['Install SRK']['File'] = f'"{self.srk_table}"' if not self.fast_auth: config.remove_section('Install NOCAK') config['Install CSFK']['File'] = f'"{self.csf_crt}"' @@ -184,8 +170,7 @@ class Entry_nxp_imx8mcst(Entry_mkimage): if not self.unlock: config.remove_section('Unlock') - with open(cfg_fname, 'w') as cfgf: - config.write(cfgf) + cfg_fname = self.write_config(config, uniq) # SSL is the default backend, PKCS11 backend is optional if self.backend == "pkcs11": @@ -193,34 +178,9 @@ class Entry_nxp_imx8mcst(Entry_mkimage): else: cst_backend = "ssl" - output_fname = tools.get_output_filename(f'nxp.csf-output-blob.{uniq}') - args = ['-i', cfg_fname, '-o', output_fname, '-b', cst_backend] - if self.cst.run_cmd(*args) is not None: - outdata = tools.read_file(output_fname) + outdata = self.run_cst(cfg_fname, uniq, cst_backend) + if outdata is not None: # fixme: 0x2000 should be CONFIG_CSF_SIZE outdata += tools.get_bytes(0, 0x2000 - 0x20 - len(outdata)) return data + outdata - else: - # Bintool is missing; just use the input data as the output - self.record_missing_bintool(self.cst) - return data - - def SetImagePos(self, image_pos): - # Customized SoC specific SetImagePos which skips the mkimage etype - # implementation and removes the 0x48 offset introduced there. That - # offset is only used for uImage/fitImage, which is not the case in - # here. - upto = 0x00 - for entry in super().GetEntries().values(): - entry.SetOffsetSize(upto, None) - - # Give up if any entries lack a size - if entry.size is None: - return - upto += entry.size - - Entry_section.SetImagePos(self, image_pos) - - def AddBintools(self, btools): - super().AddBintools(btools) - self.cst = self.AddBintool(btools, 'cst') + return data From patchwork Wed Sep 2 13:41:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= X-Patchwork-Id: 2296668 X-Patchwork-Delegate: festevam@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=HSrZG08j; dkim=pass (2048-bit key; unprotected) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=dkim header.b=wgrQZ3Ft; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=2605:bc80:3010::137; helo=smtp4.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp4.osuosl.org (smtp4.osuosl.org [IPv6:2605:bc80:3010::137]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZkRf3pwZz1xwZ for ; Wed, 02 Sep 2026 23:42:06 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id 2C51F40A5B; Wed, 2 Sep 2026 13:42:05 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id QoqomfPU1U8R; Wed, 2 Sep 2026 13:42:03 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788356523; bh=s+vosXfZX09Oom75wGdCDVEHN7P/bhWEvtlqIUofX2M=; h=From:Date:Subject:References:In-Reply-To:To:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=HSrZG08jDk6AbKjGPnDqOaRZjh/lTRtm74rk7ZXKSI9D3eEtFcc19qaYtxixgwlcF 5A57Zese39iX0HFp9pgXcjJNinnjOmD+hk182/o+7HZBPJAOSE5mVl6WJzWKjZKqJy m9/VN6j9vPjczVkixhDAGwXZbnKZWpHgNKMdTX23wxgzhPeoDXDdglXhycggdWWbrL KndrvmmsteaYCG0lXe5e7gYDY6aw27W9fFoqbt0xUqBqwisZidSDUuzcfVjSaJnACQ 32zOz8PHIa5su469y82le8mwYuZsXRrxvMwInk3yXOrLyzk4hHa1imB78vJPfYAYLk 6n/fdFxYi5TSA== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp4.osuosl.org (Postfix) with ESMTP id 3DD5840836; Wed, 2 Sep 2026 13:42:03 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp2.osuosl.org (smtp2.osuosl.org [IPv6:2605:bc80:3010::133]) by lists1.osuosl.org (Postfix) with ESMTP id 5ABD6498 for ; Wed, 2 Sep 2026 13:42:01 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id 4128D4006F for ; Wed, 2 Sep 2026 13:42:01 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id uMh0eEEWoJYm for ; Wed, 2 Sep 2026 13:42:00 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=185.246.85.4; helo=smtpout-03.galae.net; envelope-from=jeremie.dautheribes@bootlin.com; receiver= Authentication-Results: smtp2.osuosl.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp2.osuosl.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=dkim header.b=wgrQZ3Ft Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) by smtp2.osuosl.org (Postfix) with ESMTPS id 5D04D4004D for ; Wed, 2 Sep 2026 13:42:00 +0000 (UTC) Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id 322C74E414CE; Wed, 2 Sep 2026 13:41:58 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 030506053C; Wed, 2 Sep 2026 13:41:58 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id B2B5811C792E0; Wed, 2 Sep 2026 15:41:53 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1788356516; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=s+vosXfZX09Oom75wGdCDVEHN7P/bhWEvtlqIUofX2M=; b=wgrQZ3FtllrsHQH9J4G31FpS5kf1LwRSlGuMlq4Xcrp+mKkgvcnpfAezwj3jATPCnsXuwQ qivyD/6gzwIkAgZDvpKOtGi63sAMNYExCkgjegnlb2RknuoF9VTgsbQeiHNZ/Sbrqhr/JS 4sDN9q6WRrDl3AtsICN+TSUcPOABhBJxWKzzZjlsCtOQEkP2HesOlNG/pabc2d+Bc+OrIt AmScqAeWxP1skmcF3XzUTDhnsVyqlSGfEKLod+WEKwfZyRGo0TdZd3hwtqBBxivOFaOhFd 9sWFd8R4l9U1ZPcuX7YOtfu1Ipf1Wysy9GygBZXD7in56JoASY5mhuAEt27B1A== From: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= Date: Wed, 02 Sep 2026 15:41:30 +0200 Subject: [PATCH v2 3/7] tools: binman: add nxp_imx93cst etype for i.MX93 flash.bin signing MIME-Version: 1.0 Message-Id: <20260902-imx93-secureboot-v2-3-5947b92a5072@bootlin.com> References: <20260902-imx93-secureboot-v2-0-5947b92a5072@bootlin.com> In-Reply-To: <20260902-imx93-secureboot-v2-0-5947b92a5072@bootlin.com> To: "NXP i.MX U-Boot Team" , u-boot@lists.u-boot-project.org Cc: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= , =?utf-8?q?Miqu=C3=A8l_Raynal?= , Thomas Petazzoni , Tom Rini , Simon Glass , Alper Nebi Yasak , Stefano Babic , Fabio Estevam , Marek Vasut , Denis Mukhin , Rasmus Villemoes , Ilias Apalodimas , =?utf-8?q?Krzysztof_Drobi?= =?utf-8?q?=C5=84ski?= , Peng Fan , Alice Guo , Simona Toaca , Ye Li , Quentin Schulz , Christophe Guerreiro X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=4868; i=jeremie.dautheribes@bootlin.com; h=from:subject:message-id; bh=N8qvNPa18KBg1qdkKVtxeeyM9eXAdu3T+okoo4fHV24=; b=owEBbQKS/ZANAwAKASsAXqAbWo8DAcsmYgBqmCeU2pi0JinMsvzzjt5C99Uvfk8Dlf1OoR7M1 Xb8r4bNrvCJAjMEAAEKAB0WIQT7FK2Qhtu4QpBIBAkrAF6gG1qPAwUCapgnlAAKCRArAF6gG1qP A2mwEADIkxcbNZRoKNIZu/58AukX/rXLUqO0MVt+YIxeH2tshV4aaIk6e8GH8uwLpu+nxsVqtZF tfV+BsMx/97TrF3i4rTAmpxltlx4LUtUKn3yjCKntH3vtNxVawDA10mKZZ9XZdZH0RMgErcj8Pm seQ279AEeBcmlYur9NoVbvmfbOdIrtp4ayC3Cq8AfK3KcyuOtJmm2c8Pp5RbxC0HTxk6DAHx/kh b/qNublanWKBpzBsd2P9yCBUUT6obzrTZslLce1LmJOIdG81eyA8NYO79ZwTvhwTWVVlOdsGNiz ijKospQvsLPpG87aQ8KO1/ECteTAPoaWcJOMyNp1zf4eWqL93RzF6AYpwOIyYQSa4/HLEgaTKdh Tj7LzhkCpUmeg6a0VquM7rkJwNyg+675/d5tK/0TYyj7siiDRhS2B/uRG9pUttgt6CKNz6Du2yv SR5dsgOVZ1WHNkzukfrzahpuJzh9jZk3nnGEH/m4dCs+npSHbs9OqIFPr2NNAocW8DZTpxgr5LA 1CkpqOPW8qLuxc9x6Br5BSpRSgndtDuKVkKVPxXKH8KWYwf4fBfym2u3CWyf4QxVgjENEXmfFXz CqpBN/BdN7LI1JhcniZxC8DWpPGoNm2twjih3fj/QSMfXLkPt+p5GIb2fHNO0mneh8vSf59Y0Ta cQXMAvAvDkBvO0g== X-Developer-Key: i=jeremie.dautheribes@bootlin.com; a=openpgp; fpr=FB14AD9086DBB842904804092B005EA01B5A8F03 X-Last-TLS-Session-Version: TLSv1.3 X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org Add a binman etype which allows signing the SPL and U-Boot proper sections of the i.MX93 flash.bin using CST and AHAB. The implementation reuses the shared functionality from the nxp_imxcst base etype. Signed-off-by: Jérémie Dautheribes (Schneider Electric) --- .gitignore | 2 + tools/binman/etype/nxp_imx93cst.py | 112 +++++++++++++++++++++++++++++++++++++ 2 files changed, 114 insertions(+) diff --git a/.gitignore b/.gitignore index 0e09715cc60..5cb135fc58c 100644 --- a/.gitignore +++ b/.gitignore @@ -82,6 +82,8 @@ fit-dtb.blob* /keep-syms-lto.* /*imx8mimage* /*imx8mcst* +/*imx9image* +/*imx93cst* /*rcar4-sa0* /drivers/video/u_boot_logo.bmp.S /test/fdt_overlay/test-fdt-overlay-stacked.dtbo.S diff --git a/tools/binman/etype/nxp_imx93cst.py b/tools/binman/etype/nxp_imx93cst.py new file mode 100644 index 00000000000..41326728c5d --- /dev/null +++ b/tools/binman/etype/nxp_imx93cst.py @@ -0,0 +1,112 @@ +# SPDX-License-Identifier: GPL-2.0+ +# Copyright 2026 (C) Bootlin +# Author: Jérémie Dautheribes +# +# Derived from nxp_imx8mcst.py +# Copyright 2023-2024 Marek Vasut + +# Entry-type module for generating the i.MX93 code signing tool +# input configuration file and invocation of cst on generated +# input configuration file and input data to be signed. +# + +import os +import struct + +from binman.etype.nxp_imxcst import Entry_nxp_imxcst +from dtoc import fdt_util + +CONTAINER_HDR_TAG = 0x87 +SPL_CONTAINER_OFFSET = 1024 # 0x400 +CONTAINER_HDR_SIZE = 16 +AHAB_IMAGE_ENTRY_FLAGS_OFFSET = 24 +ELE_IMAGE_CORE_AND_TYPE = 0x66 + +KEY_NAME = 'sha384_secp384r1_v3_usr_crt' + +CSF_CONFIG_TEMPLATE = f''' +[Header] + Target = AHAB + Version = 1.0 + +[Install SRK] + File = "SRK_1_2_3_4_table.bin" + Source = "SRK1_{KEY_NAME}.pem" + Source index = 0 + Source set = OEM + Revocations = 0x0 + +[Authenticate Data] + File = "data.bin" + Offsets = 0x0 0x0 + +''' + + +class Entry_nxp_imx93cst(Entry_nxp_imxcst): + """NXP i.MX93 CST .cfg file generator and cst invoker + + Properties / Entry arguments: + - nxp,srk-table - full path to SRK_1_2_3_4_table.bin + - nxp,srk-crt - full path to the SRK Key SRK1_sha384_secp384r1_v3_usr_crt.pem + + The nxp,srk-table and nxp,srk-crt properties can be overridden with + the SRK_TABLE and SRK_KEY environment variables, respectively. + """ + + def ReadNode(self): + super().ReadNode() + self.srk_crt = os.getenv( + 'SRK_KEY', + fdt_util.GetString(self._node, 'nxp,srk-crt', f'SRK1_{KEY_NAME}.pem'), + ) + self.ReadEntries() + + def BuildSectionData(self, required): + data, _, uniq = self.collect_contents_to_file(self._entries.values(), 'input') + + flags_offset = CONTAINER_HDR_SIZE + AHAB_IMAGE_ENTRY_FLAGS_OFFSET + + # Give up early if the input is too short to contain the container + # header fields read below + if len(data) < flags_offset + 4: + return data + + if data[3] != CONTAINER_HDR_TAG: + # Unknown section type, pass input data through. + return data + + hdr_addr = 0 + + # The SPL AHAB image can optionally contain and start with the ELE FW, + # which is already signed by NXP. + # In this case, the SPL container header address is not 0x0. + + image_flags = struct.unpack(' X-Patchwork-Id: 2296669 X-Patchwork-Delegate: festevam@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=Fhy4tWq4; dkim=pass (2048-bit key; unprotected) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=dkim header.b=GBLll3nH; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.138; helo=smtp1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZkRl4w95z1xwg for ; Wed, 02 Sep 2026 23:42:11 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id 50790809D3; Wed, 2 Sep 2026 13:42:10 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id YCX7uJ6aFtbm; Wed, 2 Sep 2026 13:42:09 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788356529; bh=xa9XP1pXZrI/hq56WRDHgO5nH8nW5oPGPimbz7pYOng=; h=From:Date:Subject:References:In-Reply-To:To:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=Fhy4tWq4Rtqf0Be/gCwHt75VC1XGY64r2p85txJlLUtdt0xWsJwKeB790wwzjcc/G acj+m5rJxkPaF9W3mtDu8joXuBvHrcskfZn5AFotaSJgc7Fw+FkxS/zs2H8nk+8kSM e+3Ut/AVBukjjLW3XeAASvSU+Ulcdgl9QRqUxj9T29Ll+bBWvZbm6E+2OpPmfZ7Rp4 ZghcE2rS15g1UbeKE1/JOCMgxk1/JlsZUMlkJn74B7lQkpZqc/fm03IT1coDSqN6sF K0pyLoKNj+32E+bl0DbwrkV2HFMeSL82Gbbt4dzEzWE1rf5Fts9vGrZXvTxLom5yWb TR9DB4OcNwdGw== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp1.osuosl.org (Postfix) with ESMTP id 6E14380D1C; Wed, 2 Sep 2026 13:42:09 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by lists1.osuosl.org (Postfix) with ESMTP id C628E2FD for ; Wed, 2 Sep 2026 13:42:08 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id C3B3780AAF for ; Wed, 2 Sep 2026 13:42:08 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id UaLs9RubZ8PK for ; Wed, 2 Sep 2026 13:42:08 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=185.246.85.4; helo=smtpout-03.galae.net; envelope-from=jeremie.dautheribes@bootlin.com; receiver= Authentication-Results: smtp1.osuosl.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp1.osuosl.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=dkim header.b=GBLll3nH Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) by smtp1.osuosl.org (Postfix) with ESMTPS id B7A7F809D3 for ; Wed, 2 Sep 2026 13:42:07 +0000 (UTC) Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id E58DB4E414CD; Wed, 2 Sep 2026 13:42:05 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id B8DA86053C; Wed, 2 Sep 2026 13:42:05 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 9B18D11C7977F; Wed, 2 Sep 2026 15:41:56 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1788356520; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=xa9XP1pXZrI/hq56WRDHgO5nH8nW5oPGPimbz7pYOng=; b=GBLll3nH7RwKIO40QQlxtzMIS/MLLcC8XbPN5U3449oF9ubE1dFA/hv1cRRiq7CCWxXz9m GXP1pN7xp+tvPecGq+fF5RH9lg56f+4UTxI1joIIdpV6J1a0G9OAzUPl3xGzqoQ1Cu8CJs d6g4r82QHDr75fI3cAiCCD7W9KPFHOZOgqvcROgd+QN2DrZEbhMGZnQO5CY5REMlg8Xh9i ul2pRhGzi87qvN2oXkybLhWUce/F2Y3DJsz/+jMsha4Im1b5PqyWWYQWg0/1ra/QfIWynP YFhx5gsfYPcFsviXvUc4wf+Y1xB+XUfzj/XfoPHBGlv204bl6B2/1TWu0vk0og== From: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= Date: Wed, 02 Sep 2026 15:41:31 +0200 Subject: [PATCH v2 4/7] imx93-u-boot: wrap SPL and U-Boot nodes in a CST node if AHAB_BOOT enabled MIME-Version: 1.0 Message-Id: <20260902-imx93-secureboot-v2-4-5947b92a5072@bootlin.com> References: <20260902-imx93-secureboot-v2-0-5947b92a5072@bootlin.com> In-Reply-To: <20260902-imx93-secureboot-v2-0-5947b92a5072@bootlin.com> To: "NXP i.MX U-Boot Team" , u-boot@lists.u-boot-project.org Cc: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= , =?utf-8?q?Miqu=C3=A8l_Raynal?= , Thomas Petazzoni , Tom Rini , Simon Glass , Alper Nebi Yasak , Stefano Babic , Fabio Estevam , Marek Vasut , Denis Mukhin , Rasmus Villemoes , Ilias Apalodimas , =?utf-8?q?Krzysztof_Drobi?= =?utf-8?q?=C5=84ski?= , Peng Fan , Alice Guo , Simona Toaca , Ye Li , Quentin Schulz , Christophe Guerreiro X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=2229; i=jeremie.dautheribes@bootlin.com; h=from:subject:message-id; bh=ZkEmdyR3F1pUrAFHik1ktGcW3RljQLHrC1VaN9f6v+g=; b=owEBbQKS/ZANAwAKASsAXqAbWo8DAcsmYgBqmCeV8Y+ycu6OPJhyRzXggJ/qHkKSF2+IlXfwn Wlfn6MnWHOJAjMEAAEKAB0WIQT7FK2Qhtu4QpBIBAkrAF6gG1qPAwUCapgnlQAKCRArAF6gG1qP A5QoEACGHtdIJiCaerlQtRwbWN9IGECnxDBe7aiXEDDPyrRxI8BkRcDPLEcYrwU2nMmFb/UDkfh Ohnq0heERjW/4DOA/A5ULPsQ4jNT1lXRc1q9XNHPUulfYIzwiCupDotDtyTHJMI8anIRptyD6+z rc1UDoCLc8nUQ63ikC7O7fOc/BLKoqTp59SEl35cGQ4v0UnS6iEr2v4s3/v8FmQ/NMBNumgbyly FXPx+zL9eXM2KNNsbi8m63QlBkMWijTmhvyPbYG8CllYZD0TPj+bLXE7US0HPV7uzAmgj3oZzK+ N28EAO5LhJOU7Sui9drk86jkiiabnARsWDseVA1IaC8zFPFoxq3fqZvGouV3brcaJLsZTWgkI4O HwYJ/gBdBiLLjGtLeaEDmynmguRWSeX7OCcD4TXgVNYf86mD5xvB+PyJL1k2WgmH/A+7fD0u63m xYTnF2qdD0tB3HgmNLlba7uIuGJMYP6zsOWmyjIKVM+XhAQtgVk07zorpYSfrqYIstz/Xlj1PXN Rupv6pYxnXJ+sPFC4Rl7zjD2WUIJIYnQSP2PTmvW+gKO6ri2pt5n28KTHy02UzHfLtcM55UEYMJ iAzVEnZ4DKhZ5hdaxBG7eJKHZlywYmxr3J+hHZTAuzuJkgw2J3yb4FNmYBygnxbUZ46ZYXO+ko0 Y0mROBXX6NBjZ7w== X-Developer-Key: i=jeremie.dautheribes@bootlin.com; a=openpgp; fpr=FB14AD9086DBB842904804092B005EA01B5A8F03 X-Last-TLS-Session-Version: TLSv1.3 X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org When CONFIG_AHAB_BOOT is enabled, wrap the SPL and U-Boot binman nodes in a CST node so that binman signs them automatically. Reviewed-by: Simon Glass Signed-off-by: Jérémie Dautheribes (Schneider Electric) --- arch/arm/dts/imx93-u-boot.dtsi | 54 +++++++++++++++++++++++++++--------------- 1 file changed, 35 insertions(+), 19 deletions(-) diff --git a/arch/arm/dts/imx93-u-boot.dtsi b/arch/arm/dts/imx93-u-boot.dtsi index bd970c955cf..569b3ef5d9c 100644 --- a/arch/arm/dts/imx93-u-boot.dtsi +++ b/arch/arm/dts/imx93-u-boot.dtsi @@ -47,32 +47,48 @@ filename = "flash.bin"; pad-byte = <0x00>; - spl { - type = "nxp-imx9image"; - cfg-path = "spl/u-boot-spl.cfgout"; +#ifdef CONFIG_AHAB_BOOT + nxp-imx93cst@0 { + filename = "spl.signed.bin"; args; - - boot-from = "sd"; - soc-type = "IMX9"; - append = "mx93a1-ahab-container.img"; - container; - image = "a55", "u-boot-spl-ddr.bin", "0x2049A000"; +#endif + spl { + type = "nxp-imx9image"; + cfg-path = "spl/u-boot-spl.cfgout"; + args; + + boot-from = "sd"; + soc-type = "IMX9"; + append = "mx93a1-ahab-container.img"; + container; + image = "a55", "u-boot-spl-ddr.bin", "0x2049A000"; + }; +#ifdef CONFIG_AHAB_BOOT }; +#endif - u-boot { - type = "nxp-imx9image"; - cfg-path = "u-boot-container.cfgout"; +#ifdef CONFIG_AHAB_BOOT + nxp-imx93cst@1 { + filename = "u-boot-container.signed.bin"; args; - - boot-from = "sd"; - soc-type = "IMX9"; - container; - image0 = "a55", "bl31.bin", "0x204E0000"; - image1 = "a55", "u-boot.bin", "0x80200000"; +#endif + u-boot { + type = "nxp-imx9image"; + cfg-path = "u-boot-container.cfgout"; + args; + + boot-from = "sd"; + soc-type = "IMX9"; + container; + image0 = "a55", "bl31.bin", "0x204E0000"; + image1 = "a55", "u-boot.bin", "0x80200000"; #if defined(CONFIG_OPTEE) - image2 = "a55", "tee.bin", "0x96000000"; + image2 = "a55", "tee.bin", "0x96000000"; #endif + }; +#ifdef CONFIG_AHAB_BOOT }; +#endif }; }; }; From patchwork Wed Sep 2 13:41:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= X-Patchwork-Id: 2296670 X-Patchwork-Delegate: festevam@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=td9gIA0C; dkim=pass (2048-bit key; unprotected) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=dkim header.b=o84T2YzE; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.138; helo=smtp1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZkS04h2yz1xwg for ; Wed, 02 Sep 2026 23:42:24 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id 43C6780EDE; Wed, 2 Sep 2026 13:42:23 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id zl717Olw-hCs; Wed, 2 Sep 2026 13:42:20 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788356540; bh=P0NaZhI8Smm6d4p612Z0Z4/gTuBMK1/2o0awUyyi6bo=; h=From:Date:Subject:References:In-Reply-To:To:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=td9gIA0CfO5Q3Jo2ruxheP1Jn0iIFkvNoKV5fXbE6tm0K72pyUEJHlTJKtUx2EwLz DpLJkfIUCdeMV52oJ29z1A2fOI4yZBXJ20QdTFR4QjJONTaaOZZyPzTp63hs1uxLSJ Bu3MnJRp6qgwakRVBuYzme70f+KwWEXoA3jH/HQWn+hmjwywWzYOsADRXvZ9VzlDv6 Obf3bvAEP/r+ILfVNt3JoxcufPgGfMg2QJsPRvccXzpUiQg1btRXVi3VtYlQ7h2kwC odWhHVHb+2hSc9ltyLGKBqsMbKbqjF8BVQN5zcnx3IEsBXehHyxClr1IWA+CJLXgiT 5eJyZ7r6VYLxg== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp1.osuosl.org (Postfix) with ESMTP id B0BE280D1C; Wed, 2 Sep 2026 13:42:20 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by lists1.osuosl.org (Postfix) with ESMTP id 4D31A230 for ; Wed, 2 Sep 2026 13:42:19 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id 333F440A4D for ; Wed, 2 Sep 2026 13:42:19 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id 5ls9c_AXlheS for ; Wed, 2 Sep 2026 13:42:17 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=185.246.84.56; helo=smtpout-02.galae.net; envelope-from=jeremie.dautheribes@bootlin.com; receiver= Authentication-Results: smtp4.osuosl.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp4.osuosl.org; dkim=pass (2048-bit key, unprotected) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=dkim header.b=o84T2YzE Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) by smtp4.osuosl.org (Postfix) with ESMTPS id BE1C540A46 for ; Wed, 2 Sep 2026 13:42:16 +0000 (UTC) Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id 84F391A195E; Wed, 2 Sep 2026 13:42:14 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 572776053C; Wed, 2 Sep 2026 13:42:14 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 9CAB511C79786; Wed, 2 Sep 2026 15:42:04 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1788356528; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=P0NaZhI8Smm6d4p612Z0Z4/gTuBMK1/2o0awUyyi6bo=; b=o84T2YzEzKXVJFdWs3+fY7Z4B/vrJcm3iGXCifKPE3tcM3BpfAQH6GPZ+qTtxWMkxMIuX7 rkt5HuM9PDn9AzRLXWpp67mbPIatJ0P/FQ34k5YAQ2ii4tPiwbybicfoNxs2RtfZw3FS2a 7C4jBltJObm+daveFrm5hUVYBlDqcflEP0ILCXqoKbXh5QCnO1EicfZZKJ5L9OXn2PH3d6 y9ArMv56jEUNP3JLwchSY3Zk3MIfP8B2NWXZeaCjc4iI7q8llBhXwU4RxBBIkNcfaR5bMP glAqr7IG44F54utiOzZO0IWuAwCIemaAYY1moDAYTLDQPA4Iz8HbPyR/+0A/JA== From: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= Date: Wed, 02 Sep 2026 15:41:32 +0200 Subject: [PATCH v2 5/7] doc: imx: ahab: add AHAB introduction MIME-Version: 1.0 Message-Id: <20260902-imx93-secureboot-v2-5-5947b92a5072@bootlin.com> References: <20260902-imx93-secureboot-v2-0-5947b92a5072@bootlin.com> In-Reply-To: <20260902-imx93-secureboot-v2-0-5947b92a5072@bootlin.com> To: "NXP i.MX U-Boot Team" , u-boot@lists.u-boot-project.org Cc: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= , =?utf-8?q?Miqu=C3=A8l_Raynal?= , Thomas Petazzoni , Tom Rini , Simon Glass , Alper Nebi Yasak , Stefano Babic , Fabio Estevam , Marek Vasut , Denis Mukhin , Rasmus Villemoes , Ilias Apalodimas , =?utf-8?q?Krzysztof_Drobi?= =?utf-8?q?=C5=84ski?= , Peng Fan , Alice Guo , Simona Toaca , Ye Li , Quentin Schulz , Christophe Guerreiro X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=60392; i=jeremie.dautheribes@bootlin.com; h=from:subject:message-id; bh=4Me5D4jW26YOEE1x2BiV6NwzqTSB0wL8fW+KSE0L0WI=; b=owEBbQKS/ZANAwAKASsAXqAbWo8DAcsmYgBqmCeVREnwLwtSruaBWXT5LXGw1CYBe1dcNfNIi u4EKdM4A4OJAjMEAAEKAB0WIQT7FK2Qhtu4QpBIBAkrAF6gG1qPAwUCapgnlQAKCRArAF6gG1qP A4v7D/0fuzg4iq2FxhJI+YpVQZPUBySG/RQ2KIR+5p7Ji3odNZ3Qu3MvkQYWrtGxkBkct+vPRsx hobgOD+12vafQ3vDapRu2OyuO9cb0UtE5OvngdLQ1ScsoV/l26PKYcdEHW+ECaZPE2Dxg6P8quQ L51eF1gD00JSlYza7ePX6DWP4G1ubtA3JLSjvNanvgHF4Tvcb87GW20kHI6ny932BNRzMcNNRMV yR1+SIahpt9QLaO0Ol97TTRvANlkdAb0FL+K4//c8FPeKJAcG3WF0uHE8XPIm5zQJQZmTo+sMvi /lRWdFgYdB18Gl6rPskrpJQ1irNrrgdh6/a36ruGC9zawEsAsjHMC/i4leBfMuzCjaazc2vu8RD bBrkftZAfVuuwYLUzxBTWSWvFB/2V+qNmNy3zRNHS4pdhfqZHHy2u1pYEChqXATNepGmnjGE7oy +vHZJ3RlApzyWEmyEo6dKRPozEhf66zeM91cX1vM/4I4ynYDtvAtY1nfWDtAwyN4urxAfjeIEV0 Bthgnf4fljMwmi1axfisQogJcOUAxLeBpW60U6sbBVVYp4D3tEbC/vKfTdeBEpPUN5VYr2FCVWq TbGUkFmuumQY8gJvNBQALSMDOJlSBNjPgS+c+CZQ1leqh1N6LZVyv/5gm1jUVKvOHt4bjA5ZUI2 /87iYRuwHRTWQrw== X-Developer-Key: i=jeremie.dautheribes@bootlin.com; a=openpgp; fpr=FB14AD9086DBB842904804092B005EA01B5A8F03 X-Last-TLS-Session-Version: TLSv1.3 X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org Add an introductory document describing the AHAB (Advanced High Assurance Boot) secure and encrypted boot flow, covering the following topics: - AHAB architecture overview (SCU, SECO, PKI tree) - AHAB secure boot and encrypted boot flow - PKI tree generation (ahab_pki_tree.sh) - SRK Table and SRK Hash generation (srktool) - SRK Hash fuse programming and sanity check notes - i.MX 8ULP/93 secure boot support This is based on doc/imx/ahab/introduction_ahab.txt from uboot-imx (lf_v2026.04). Originally written by Breno Lima, with contributions from Ye Li, Vanessa Maegima, and Utkarsh Gupta upstream in uboot-imx. Signed-off-by: Jérémie Dautheribes (Schneider Electric) --- doc/board/nxp/index.rst | 2 + doc/imx/ahab/introduction_ahab.rst | 464 +++++++++++++++++++++++++++++++++++++ doc/imx/ahab/introduction_ahab.txt | 445 +++++++++++++++++++++++++++++++++++ doc/imx/index.rst | 13 ++ 4 files changed, 924 insertions(+) diff --git a/doc/board/nxp/index.rst b/doc/board/nxp/index.rst index b28e5b6ceb9..29a90297675 100644 --- a/doc/board/nxp/index.rst +++ b/doc/board/nxp/index.rst @@ -29,6 +29,8 @@ NXP Semiconductors mx6sabresd mx6ul_14x14_evk mx6ullevk + + i.MX AHAB secure boot <../../imx/index> rproc psb quickboot diff --git a/doc/imx/ahab/introduction_ahab.rst b/doc/imx/ahab/introduction_ahab.rst new file mode 100644 index 00000000000..aef75b5e841 --- /dev/null +++ b/doc/imx/ahab/introduction_ahab.rst @@ -0,0 +1,464 @@ +.. SPDX-License-Identifier: GPL-2.0+ + +i.MX Secure and Encrypted Boot using AHAB +========================================= + +1. Introduction +--------------- + +The i.MX 8/8x/8ULP/9x family of applications processors introduce a new secure +boot concept. Due to the multi-core architecture, the Security Controller (SECO) +and System Control Unit (SCU) in i.MX 8/8x, and EdgeLock secure enclave (ELE) +in i.MX 8ULP/9x are heavily involved in the secure boot process. + +Step-by-step guides are available under doc/imx/ahab/guides/ directory, +users familiar with AHAB architecture and CST PKI tree generation should +refer to these documents instead. + +1.1 The AHAB Secure Boot Architecture +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The Advanced High Assurance Boot (AHAB) feature relies in digital signatures to +prevent unauthorized software execution during the device boot sequence. In +case a malware takes control of the boot sequence, sensitive data, services and +network can be impacted. + +The AHAB authentication is based on public key cryptography in which image +data is signed offline using one or more private keys. The resulting signed +image data is then verified on the i.MX processor using the corresponding +public keys. The public keys are included in the final binary and the SRK +Hash is programmed in the SoC fuses for establishing the root of trust. + +In i.MX8 and i.MX8x families the SCU is responsible to interface with the boot +media, managing the process of loading the firmware and software images in +different partitions of the SoC. The SECO is responsible to authenticate the +images and authorize the execution of them. + +1.1.1 [i.MX 8/8x] The System Control Unit (SCU) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The System Control Unit SCU is a subsystem equipped with a programmable M4 +core, which is responsible to handle the resource allocation, power, clocking, +IO configuration and muxing. + +The SCU is also responsible to interface between the rest of the system. In the +secure boot flow the SCU interfaces with the Security Controller (SECO), +requesting the image authentication. + +The System Control Unit FW (SCFW) is responsible to control all the +functionalities of the SCU. This firmware is distributed in a porting kit form. +Instructions to download the SCFW Porting Kit are available in the Linux BSP +Release Notes. + +Details about SCU can be found in the processors Reference Manual (RM). + +1.1.2 [i.MX 8/8x] The Security Controller (SECO) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The SECO is a M0+ core dedicated to handle the SoC security subsystem. The +controller communicates with SCU domain through a dedicate message unit (MU). + +The SECO has a dedicate ROM which is responsible to initialize low level +security features and to authenticate the SECO firmware previously loaded by +the SCU ROM. + +The SECO firmware provides security services at run-time to different domains +of the SoC, one of these being the capability of authenticate images. + +The SECO firmware is signed and distributed by NXP and is always authenticated +in OEM open and closed configuration, instructions to download the SECO FW are +available in the Linux BSP Release Notes. + +Details about SECO can be found in the processors Security Reference Manual +(SRM). + +1.1.3 [i.MX 8ULP/9x] The EdgeLock secure enclave +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +EdgeLock Secure Enclave is the security subsystem based on a dedicated core +(RISC-V) to manage security tasks with a tight control on security resources +along with other enhancements. + +The secure enclave has a dedicate ROM which is responsible to initialize low +level security features and to authenticate the secure enclave firmware +previously loaded by the boot management core. + +The secure enclave firmware provides security services at run-time to different +domains of the SoC, one of these being the capability of authenticate images. + +The secure enclave firmware is signed and distributed by NXP and is always +authenticated in OEM open and closed configuration, instructions to download +this FW are available in the Linux BSP Release Notes. + +Details about EdgeLock secure enclave can be found in the processors Security +Reference Manual (SRM). + +.. note:: + + The terms Sentinel, S400, and EdgeLock secure enclave (ELE) + are used interchangeably throughout the document. + +1.2 The image container +~~~~~~~~~~~~~~~~~~~~~~~ + +Due to the new architecture, multiple firmwares and software are required to +boot AHAB supporting devices. In order to store all the images in a single +binary the container image structure is used. + +At least two containers are needed for the boot process, the first container +must include only the Security Subsystem FW (SECO/ELE FW provided by NXP). +Additional containers can contain one or multiple images, depending on the +users specific application. + +The final binary is generated by the binman tool. + +1.3 The i.MX8/8x secure boot flow +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +As mentioned in the introduction, due to the multiple cores architecture the +i.MX8 boot sequence involves SCU ROM, SCFW, SECO ROM, and SECO FW. + +The diagram below illustrate the secure boot flow overview: + +.. code-block:: text + + System Controller │ Security Controller │ Cortex-M │ Cortex-A + (SCU) │ (SECO) │ │ + │ │ │ + ╔═════════════╗ │ ╔═════════════╗ ┌───────────┐ ┌─────────┐ + ║ SCU INIT ║ │ ║ SECO INIT ║ │ │ │ │ │ │ + ╚══════╤══════╝ │ ╚══════╤══════╝ │ │ v │ │ v + │ │ │ │ │ ┌──────────┐ │ │ ┌────────────┐ + ╔══════╧══════╗ │ │ │ │ │ Start M4 │ │ │ │ Start AP │ + ║Load SECO FW ║ │ │ │ │ │ IMG │ │ │ │ IMG │ + ╚══════╤══════╝ │ ╔══════╧══════╗ │ │ └──────────┘ │ │ └─────┬──────┘ + ├──────────────>║Auth SECO FW ║ │ │ │ │ │ + ╔══════╧══════╗ │ ╚══════╤══════╝ │ │ ┌────────────┘ │ │ + ║ Load SCU FW ║ │ │ │ │ │ │ │ + ║ and DCD ║ │ │ │ │ │ │ ┌─────┴──────┐ + ╚══════╤══════╝ │ ┌──────┴──────┐ │ │ │ │ │ Load │ + ├──────────────>│ Auth SCU FW │ │ │ │ │ │ Add AP IMG │ + │ │ │ and DCD │ │ │ │ │ └─────┬──────┘ + ╔══════╧══════╗ │ └──────┬──────┘ │ │ │ │ │ + ║ Run DCD ║<──────────────┤ │ │ │ │ │ + ╚══════╤══════╝ │ │ │ │ │ ┌───────────────┤ + │ │ │ │ │ │ │ │ │ + ╔══════╧══════╗ │ │ │ │ │ │ │ │ + ║ Load M4 IMG ║ │ │ │ │ │ │ │ │ + ╚══════╤══════╝ │ ┌──────┴──────┐ │ │ │ │ │ │ + ├──────────────>│ Auth M4 IMG │ │ │ │ │ │ │ + ╔══════╧══════╗ │ └──────┬──────┘ │ │ │ │ │ ┌─────┴──────┐ + ║ Load AP IMG ║ │ │ │ │ │ │ │ │ Run │ + ╚══════╤══════╝ │ ┌──────┴──────┐ │ │ │ │ │ │ Add AP IMG │ + ├──────────────>│ Auth AP IMG │ │ │ │ │ │ └────────────┘ + ╔══════╧══════╗ │ └─────────────┘ │ │ │ │ │ + ║Start SCU FW ║ │ ┌──────────────────┘ │ │ │ │ + ╚══════╤══════╝ │ │ │ │ │ │ + │ │ │ ┌─────────────────────┘ │ │ + ┌──────┴──────┐ │ │ │ │ │ │ + │ Start M4 ├──────┘ │ ┌──────────────────────┘ │ + └──────┬──────┘ │ │ │ │ │ + │ │ │ │ │ │ + ┌──────┴──────┐ │ │ │ │ │ + │ Start AP ├──────────┘ │ │ │ + └─────────────┘ │ │ │ │ + ┌───────────────────────┘ │ │ + │ │ │ │ + v │ │ │ + ┌─────────────┐ │ ┌─────────────┐ │ │ + │Request SECO ├───────>│ Auth AP IMG │ │ │ + └─────────────┘ │ └─────────────┘ │ │ + │ │ │ + +Notes: All boxes enclosed by double dash (═) are performed at SCU/SECO ROM +level. + +The sequence below explains the i.MX8 and i.MX8x boot flow: + +1. At reset, the SCU ROM and SECO ROM both start execution. +2. The SCU ROM reads the boot configuration and loads the SECO FW (First + container) from the boot media to the SECO TCM. +3. A message is sent by the SCU ROM via MU requesting the SECO ROM to + authenticate the SECO FW which is signed using NXP key. +4. The SCU ROM loads the second container from the boot media, this container + must contain at least the SCFW which is signed using the OEM keys. +5. The SCU ROM loads the SCFW to the SCU TCM, a message is sent via MU + requesting the SECO FW to authenticate the SCFW and DCD table. +6. The SCU ROM configures the DDR and loads the M4 and AP images included in + the second container to their respective load addresses. +7. The SCU ROM request the SECO FW to authenticate the M4 image. +8. The SCU ROM request the SECO FW to authenticate the AP image. This image + is the initial AP core software, depending in the U-Boot target it can + be the U-Boot and ATF or only SPL. +9. The SCFW is initialized and starts the ARM Cortex-M and Cortex-A cores. +10. From this point additional containers can be loaded by Cortex-M and + Cortex-A cores and authenticated by SECO, the AP SW must interface with + SCU by calling the sc_misc_seco_authenticate() API function. In current + U-Boot implementation the additional image can be the Linux Kernel binary + or the U-Boot proper and ATF. + +1.4 The i.MX 8ULP/9x secure boot flow +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The secure boot sequence involves multiple cores booting up at same time and +EdgeLock secure enclave ensure authentication of any boot software being loaded. + +The diagram below illustrate the secure boot flow overview for dual boot +scenario in i.MX 8ULP: + +.. code-block:: text + + Cortex-M(CM) │ EdgeLock Secure │ Cortex-A(CA) │ uPower(uP) + │ Enclave(ELE) │ │ + │ │ │ │ │ │ │ + ┌┬─────┴─────┬┐ │ ┌┬─────┴─────┬┐ │ │ │ ┌┬─────┴─────┬┐ + ││ INIT ││ │ ││ INIT ││ │ │ │ ││ INIT ││ + └┴─────┬─────┴┘ │ └┴─────┬─────┴┘ │ │ │ └┴─────┬─────┴┘ + │ │ │ │ ┌┬─────┴─────┬┐ │ │ + ┌┬─────┴─────┬┐ │ │ │ ││Load CA FW ││ │ ┌──────┐ │ + ││Load uP FW ││ │ │ │ └┴─────┬─────┴┘ ││ │ │ + └┴─────┬─────┴┘ │ │ │ │ ││ ┌┬──v──┴─────┬┐ + │ │ ┌┬─────┴─────┬┐ │┌────────┤ ││ ││Load &Start││ + ├─────────────>├│Auth uP FW ││ ││ │ ││ ││ uP FW ││ + │ │ └┴─────┬─────┴┘ ││ │ ││ └┴───────────┴┘ + ┌┬─────┴─────┬┐ │ │ ││ │ ││ + ││Load CM FW││ │ ├────────────────────┼────────┘│ + └┴─────┬─────┴┘ │ │ ││ │ │ + │ │ ┌┬─────┴─────┬┐ ││ │ │ + ├─────────────>├│Auth CM FW ││ ││ ┌┬─────┴─────┬┐ │ + │ │ └┴─────┬─────┴┘ ││ ││Start CA FW││ │ + ┌┬─────┴─────┬┐ │ │ ││ └┴─────┬─────┴┘ │ + ││Load ELE FW││ │ │ ││ │ │ + └┴─────┬─────┴┘ │ │ ││ │ │ + │ │ ┌┬─────┴─────┬┐ ││ │ │ + ├─────────────>├│Auth ELE FW││ ││ │ │ + │ │ └┴─────┬─────┴┘ ││ ┌┬─────┴─────┬┐ │ + ┌┬─────┴─────┬┐ │ │ ││ ││ Load SPL ││ │ + ││Start CM FW││ │ │ ││ └┴─────┬─────┴┘ │ + └┴─────┬─────┴┘ │ │ ││ │ │ + │ │ ┌┬─────┴─────┬┐ ││ ┌────┤ │ + │ │ ││Auth CA FW │┤<───┘ │ │ │ + │ │ └┴─────┬─────┴┘ │ │ │ │ + │ │ │ │ │ │ │ + │ │ ┌┬─────┴─────┬┐ │ │ │ │ + │ │ ││ Auth SPL │┤<───────┘ │ │ + │ │ └┴─────┬─────┴┘ │ │ │ + │ │ ├─────────────────┐ │ │ + │ │ │ │ │ │ │ + │ │ │ │ ┌┬──v──v─────┬┐ │ + │ │ │ │ ││ Run SPL ││ │ + │ │ │ │ └┴───────────┴┘ │ + +The diagram below illustrate the secure boot flow overview for single boot +scenario in i.MX 9x: + +.. code-block:: text + + Cortex-A(CA) │ EdgeLock Secure │ Cortex-M(CM) + │ Enclave(ELE) │ + │ │ │ │ │ + ┌┬─────┴─────┬┐ │ ┌┬─────┴─────┬┐ │ │ + ││ INIT ││ │ ││ INIT ││ │ │ + └┴─────┬─────┴┘ │ └┴─────┬─────┴┘ │ │ + │ │ │ │ ┌┬─────┴─────┬┐ + │ │ │ │┌>││ INIT ││ + │ │ │ ││ └┴─────┬─────┴┘ + ┌┬─────┴─────┬┐ │ │ ││ | + ││Load ELE FW││─────────────>│ ││ │ + └┴─────┬─────┴┘ | | |│ │ + │ │ ┌┬─────┴─────┬┐ ││ ┌┬─────┴─────┬┐ + │ │ ├│Auth ELE FW││ ││ ││Start CM FW││ + │ │ └┴─────┬─────┴┘ ││ └┴─────┬─────┴┘ + | | | |│ | + ┌┬─────┴─────┬┐ │ │ ││ │ + ││Load CM FW││ │ | ││ │ + └┴─────┬─────┴┘ │ │ ││ │ + │ │ ┌┬─────┴─────┬┐ ││ │ + ├─────────────>├│Auth CM FW ││ ││ │ + │ │ └┴─────┬─────┴┘ ││ │ + | │ │ ││ │ + │ │ |───────────┘ │ + ┌┬─────┴─────┬┐ │ │ │ │ + ││Load CA FW││ │ │ │ │ + └┴─────┬─────┴┘ │ │ │ │ + │ │ ┌┬─────┴─────┬┐ │ │ + ├─────────────>├│Auth CA FW││ │ │ + │ │ └┴─────┬─────┴┘ │ │ + ┌┬─────┴─────┬┐ │ │ │ │ + ││Start CA FW││ │ | │ │ + └┴─────┬─────┴┘ │ │ │ │ + | │ │ │ │ + | │ │ │ │ + | │ │ │ │ + +More details on the boot flow can be found in respective Security Reference +Manual (SRM). + +2. Generating a PKI tree +------------------------ + +The first step is to generate the private keys and public keys certificates. +The AHAB architecture is based on a Public Key Infrastructure (PKI) tree. + +The Code Signing Tools package contains an OpenSSL based key generation script +under keys/ directory. The ahab_pki_tree.sh script generates a PKI tree +containing 4 Super Root Keys (SRK), possible to also include a subordinate +SGK key. + +The AHAB supports both RSA and ECC keys, a new PKI tree can be generated by +following the example below: + +- Generating a P384 ECC PKI tree on CST (starting from v3.1.0): + + .. code-block:: console + + $ ./ahab_pki_tree.sh + ... + Do you want to use an existing CA key (y/n)?: n + Do you want to use Elliptic Curve Cryptography (y/n)?: y + Enter length for elliptic curve to be used for PKI tree: + Possible values p256, p384, p521: p384 + Enter the digest algorithm to use: sha384 + Enter PKI tree duration (years): 5 + Do you want the SRK certificates to have the CA flag set? (y/n)?: n + +The diagram below illustrate the PKI tree generated: + +.. code-block:: text + + ┌─────────┐ + │ CA │ + └────┬────┘ + │ + │ + ┌───────────────┬────────┴────────┬───────────────┐ + │ │ │ │ + │ │ │ │ + v v v v + ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ + │ SRK1 │ │ SRK2 │ │ SRK3 │ │ SRK4 │ + └────────┘ └────────┘ └────────┘ └────────┘ + +2.1 Generating a PKI tree including a subordinate SGK key +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The ahab_pki_tree.sh script is also able to generate a PKI tree containing a +subordinate key of the SRK, this key can be used to verify the signature +included in the final signed image. + +Users should set the CA flag when generating the SRK certificates. + +- Generating a P384 ECC PKI tree with a subordinate SGK key on CST (starting + from v3.1.0): + + .. code-block:: console + + $ ./ahab_pki_tree.sh + ... + Do you want to use an existing CA key (y/n)?: n + Do you want to use Elliptic Curve Cryptography (y/n)?: y + Enter length for elliptic curve to be used for PKI tree: + Possible values p256, p384, p521: p384 + Enter the digest algorithm to use: sha384 + Enter PKI tree duration (years): 5 + Do you want the SRK certificates to have the CA flag set? (y/n)?: y + +The diagram below illustrate the PKI tree generated: + +.. code-block:: text + + ┌─────────┐ + │ CA │ + └────┬────┘ + │ + │ + ┌───────────────┬────────┴────────┬───────────────┐ + │ │ │ │ + │ │ │ │ + v v v v + ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ + │ SRK1 │ │ SRK2 │ │ SRK3 │ │ SRK4 │ + └────┬───┘ └───┬────┘ └────┬───┘ └───┬────┘ + │ │ │ │ + v v v v + ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ + │ SGK1 │ │ SGK2 │ │ SGK3 │ │ SGK4 │ + └────────┘ └────────┘ └────────┘ └────────┘ + +2.2 Generating a SRK Table and SRK Hash +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The next step is to generated the SRK Table and its respective SRK Table Hash +from the SRK public key certificates created in one of the steps above. + +In the AHAB architecture, the SRK Table is included in the signed image and the +SRK Hash is programmed in the SoC SRK_HASH[511:0]/SRK_HASH[255:0] fuses. + +On the target device during the authentication process the AHAB code verify the +SRK Table against the SoC SRK_HASH fuses, in case the verification is successful +the root of trust is established and the AHAB code can progress with the image +authentication. + +The srktool can be used to generate the SRK Table and its respective SRK +Table Hash. + +- Generating SRK Table and SRK Hash in Linux 64-bit machines: + - In i.MX 8/8x family, the expected SRK HASH is of 512 bit. + + .. code-block:: console + + $ cd ../crts/ + $ ../linux64/bin/srktool -a -s sha384 -t SRK_1_2_3_4_table.bin \ + -e SRK_1_2_3_4_fuse.bin -f 1 -c \ + SRK1_sha384_secp384r1_v3_usr_crt.pem,\ + SRK2_sha384_secp384r1_v3_usr_crt.pem,\ + SRK3_sha384_secp384r1_v3_usr_crt.pem,\ + SRK4_sha384_secp384r1_v3_usr_crt.pem + + - In i.MX 8ULP/9x, the expected SRK HASH is of 256 bit. + + .. code-block:: console + + $ cd ../crts/ + $ ../linux64/bin/srktool -a -d sha256 -s sha384 -t SRK_1_2_3_4_table.bin \ + -e SRK_1_2_3_4_fuse.bin -f 1 -c \ + SRK1_sha384_secp384r1_v3_usr_crt.pem,\ + SRK2_sha384_secp384r1_v3_usr_crt.pem,\ + SRK3_sha384_secp384r1_v3_usr_crt.pem,\ + SRK4_sha384_secp384r1_v3_usr_crt.pem + + Regenerate the SRK HASH (SRK_1_2_3_4_fuse.bin) by using SHA256 with + SRK_1_2_3_4_table.bin: + + .. code-block:: console + + $ openssl dgst -binary -sha256 SRK_1_2_3_4_table.bin + +- Optionally users can check if the sha512sum/sha256sum of SRK_1_2_3_4_table + matches with the SRK_1_2_3_4_fuse.bin: + + .. code-block:: console + + $ od -t x4 --endian=big SRK_1_2_3_4_fuse.bin + 0000000 01b04697 0253376b 2066fe56 aaef9a91 + 0000020 e62e09d8 14fb7e36 d5b38d05 0982edab + 0000040 7ada6576 2f6b4f59 1fd9347e 46e7305d + 0000060 46e34bf0 89780bd1 c809e714 a17e2f4e + + $ sha512sum SRK_1_2_3_4_table.bin + 01b046970253376b2066fe56aaef9a91\ + e62e09d814fb7e36d5b38d050982edab\ + 7ada65762f6b4f591fd9347e46e7305d\ + 46e34bf089780bd1c809e714a17e2f4e\ + SRK_1_2_3_4_table.bin + +.. note:: + + The commands above cannot be used as reference to program the SoC + SRK_HASH fuses. + +3 Known limitations +------------------- + +- Due to a limitation in i.MX8QXP B0 silicon it's not possible to use RSA + 4096-bit SRK keys with an additional subordinate SGK key. diff --git a/doc/imx/ahab/introduction_ahab.txt b/doc/imx/ahab/introduction_ahab.txt new file mode 100644 index 00000000000..4a5b6f795c4 --- /dev/null +++ b/doc/imx/ahab/introduction_ahab.txt @@ -0,0 +1,445 @@ + +=======================================================+ + + i.MX Secure and Encrypted Boot using AHAB + + +=======================================================+ + +1. Introduction +---------------- + +The i.MX 8/8x/8ULP/9x family of applications processors introduce a new secure +boot concept. Due to the multi-core architecture, the Security Controller (SECO) +and System Control Unit (SCU) in i.MX 8/8x, and Edgelock secure enclave (ELE) +in i.MX 8ULP/9x are heavily involved in the secure boot process. + +Step-by-step guides are available under doc/imx/ahab/guides/ directory, +users familiar with AHAB architecture and CST PKI tree generation should +refer to these documents instead. + +1.1 The AHAB Secure Boot Architecture +-------------------------------------- + +The Advanced High Assurance Boot (AHAB) feature relies in digital signatures to +prevent unauthorized software execution during the device boot sequence. In +case a malware takes control of the boot sequence, sensitive data, services and +network can be impacted. + +The AHAB authentication is based on public key cryptography in which image +data is signed offline using one or more private keys. The resulting signed +image data is then verified on the i.MX processor using the corresponding +public keys. The public keys are included in the final binary and the SRK +Hash is programmed in the SoC fuses for establishing the root of trust. + +In i.MX8 and i.MX8x families the SCU is responsible to interface with the boot +media, managing the process of loading the firmware and software images in +different partitions of the SoC. The SECO is responsible to authenticate the +images and authorize the execution of them. + +1.1.1 [i.MX 8/8x] The System Control Unit (SCU) +------------------------------------ + +The System Control Unit SCU is a subsystem equipped with a programmable M4 +core, which is responsible to handle the resource allocation, power, clocking, +IO configuration and muxing. + +The SCU is also responsible to interface between the rest of the system. In the +secure boot flow the SCU interfaces with the Security Controller (SECO), +requesting the image authentication. + +The System Control Unit FW (SCFW) is responsible to control all the +functionalities of the SCU. This firmware is distributed in a porting kit form. +Instructions to download the SCFW Porting Kit are available in the Linux BSP +Release Notes. + +Details about SCU can be found in the processors Reference Manual (RM). + +1.1.2 [i.MX 8/8x] The Security Controller (SECO) +------------------------------------- + +The SECO is a M0+ core dedicated to handle the SoC security subsystem. The +controller communicates with SCU domain through a dedicate message unit (MU). + +The SECO has a dedicate ROM which is responsible to initialize low level +security features and to authenticate the SECO firmware previously loaded by +the SCU ROM. + +The SECO firmware provides security services at run-time to different domains +of the SoC, one of these being the capability of authenticate images. + +The SECO firmware is signed and distributed by NXP and is always authenticated +in OEM open and closed configuration, instructions to download the SECO FW are +available in the Linux BSP Release Notes. + +Details about SECO can be found in the processors Security Reference Manual +(SRM). + +1.1.3 [i.MX 8ULP/9x] The Edgelock secure enclave +------------------------------------- + +EdgeLock™ Secure Enclave is the security subsystem based on a dedicated core +(RISC-V) to manage security tasks with a tight control on security resources +along with other enhancements. + +The secure enclave has a dedicate ROM which is responsible to initialize low +level security features and to authenticate the secure enclave firmware +previously loaded by the boot management core. + +The secure enclave firmware provides security services at run-time to different + domains of the SoC, one of these being the capability of authenticate images. + +The secure enclave firmware is signed and distributed by NXP and is always +authenticated in OEM open and closed configuration, instructions to download +this FW are available in the Linux BSP Release Notes. + +Details about Edgelock secure enclave can be found in the processors Security +Reference Manual (SRM). + +NOTE: The terms Sentinel, S400, and EdgeLock secure enclave (ELE), and ELE +are used interchangeably throughout the document. + +1.2 The image container +------------------------ + +Due to the new architecture, multiple firmwares and software are required to +boot AHAB supporting devices. In order to store all the images in a single +binary the container image structure is used. + +At least two containers are needed for the boot process, the first container +must include only the Security Subsystem FW (SECO/ELE FW provided by NXP). +Additional containers can contain one or multiple images, depending on the +users specific application. + +The final binary is generated by the imx-mkimage tool. + +1.3 The i.MX8/8x secure boot flow +---------------------------------- + +As mentioned in the introduction, due to the multiple cores architecture the +i.MX8 boot sequence involves SCU ROM, SCFW, SECO ROM, and SECO FW. + +The diagram below illustrate the secure boot flow overview: + +System Controller │ Security Controller │ Cortex-M │ Cortex-A + (SCU) │ (SECO) │ │ + │ │ │ + ╔═════════════╗ │ ╔═════════════╗ ┌───────────┐ ┌─────────┐ + ║ SCU INIT ║ │ ║ SECO INIT ║ │ │ │ │ │ │ + ╚══════╤══════╝ │ ╚══════╤══════╝ │ │ v │ │ v + │ │ │ │ │ ┌──────────┐ │ │ ┌────────────┐ + ╔══════╧══════╗ │ │ │ │ │ Start M4 │ │ │ │ Start AP │ + ║Load SECO FW ║ │ │ │ │ │ IMG │ │ │ │ IMG │ + ╚══════╤══════╝ │ ╔══════╧══════╗ │ │ └──────────┘ │ │ └─────┬──────┘ + ├──────────────>║Auth SECO FW ║ │ │ │ │ │ + ╔══════╧══════╗ │ ╚══════╤══════╝ │ │ ┌────────────┘ │ │ + ║ Load SCU FW ║ │ │ │ │ │ │ │ + ║ and DCD ║ │ │ │ │ │ │ ┌─────┴──────┐ + ╚══════╤══════╝ │ ┌──────┴──────┐ │ │ │ │ │ Load │ + ├──────────────>│ Auth SCU FW │ │ │ │ │ │ Add AP IMG │ + │ │ │ and DCD │ │ │ │ │ └─────┬──────┘ + ╔══════╧══════╗ │ └──────┬──────┘ │ │ │ │ │ + ║ Run DCD ║<──────────────┤ │ │ │ │ │ + ╚══════╤══════╝ │ │ │ │ │ ┌───────────────┤ + │ │ │ │ │ │ │ │ │ + ╔══════╧══════╗ │ │ │ │ │ │ │ │ + ║ Load M4 IMG ║ │ │ │ │ │ │ │ │ + ╚══════╤══════╝ │ ┌──────┴──────┐ │ │ │ │ │ │ + ├──────────────>│ Auth M4 IMG │ │ │ │ │ │ │ + ╔══════╧══════╗ │ └──────┬──────┘ │ │ │ │ │ ┌─────┴──────┐ + ║ Load AP IMG ║ │ │ │ │ │ │ │ │ Run │ + ╚══════╤══════╝ │ ┌──────┴──────┐ │ │ │ │ │ │ Add AP IMG │ + ├──────────────>│ Auth AP IMG │ │ │ │ │ │ └────────────┘ + ╔══════╧══════╗ │ └─────────────┘ │ │ │ │ │ + ║Start SCU FW ║ │ ┌──────────────────┘ │ │ │ │ + ╚══════╤══════╝ │ │ │ │ │ │ + │ │ │ ┌─────────────────────┘ │ │ + ┌──────┴──────┐ │ │ │ │ │ │ + │ Start M4 ├──────┘ │ ┌──────────────────────┘ │ + └──────┬──────┘ │ │ │ │ │ + │ │ │ │ │ │ + ┌──────┴──────┐ │ │ │ │ │ + │ Start AP ├──────────┘ │ │ │ + └─────────────┘ │ │ │ │ + ┌───────────────────────┘ │ │ + │ │ │ │ + v │ │ │ + ┌─────────────┐ │ ┌─────────────┐ │ │ + │Request SECO ├───────>│ Auth AP IMG │ │ │ + └─────────────┘ │ └─────────────┘ │ │ + │ │ │ + + +Notes: +All boxes enclosed by double dash (═) are performed at SCU/SECO ROM level. + +The sequence below explains the i.MX8 and i.MX8x boot flow: + +1 - At reset, the SCU ROM and SECO ROM both start execution. +2 - The SCU ROM reads the boot configuration and loads the SECO FW (First + container) from the boot media to the SECO TCM. +3 - A message is sent by the SCU ROM via MU requesting the SECO ROM to + authenticate the SECO FW which is signed using NXP key. +4 - The SCU ROM loads the second container from the boot media, this container + must contain at least the SCFW which is signed using the OEM keys. +5 - The SCU ROM loads the SCFW to the SCU TCM, a message is sent via MU + requesting the SECO FW to authenticate the SCFW and DCD table. +6 - The SCU ROM configures the DDR and loads the M4 and AP images included in + the second container to their respective load addresses. +7 - The SCU ROM request the SECO FW to authenticate the M4 image. +8 - The SCU ROM request the SECO FW to authenticate the AP image. This image + is the initial AP core software, depending in the U-Boot target it can + be the U-Boot and ATF or only SPL. +9 - The SCFW is initialized and starts the ARM Cortex-M and Cortex-A cores. +10 - From this point additional containers can be loaded by Cortex-M and + Cortex-A cores and authenticated by SECO, the AP SW must interface with + SCU by calling the sc_misc_seco_authenticate() API function. In current + U-Boot implementation the additional image can be the Linux Kernel binary + or the U-Boot proper and ATF. Details about current U-Boot implementation + can be found in AHAB guides included in doc/imx/ahab/guides/ directory. + +1.4 The i.MX 8ULP/9x secure boot flow +---------------------------------- + +The secure boot sequence involves multiple cores booting up at same time and +Edgelock secure enclave ensure authentication of any boot software being loaded. + +The diagram below illustrate the secure boot flow overview for dual boot +scenario in i.MX 8ULP: + + + Cortex-M(CM) │ Edgelock Secure │ Cortex-A(CA) │ uPower(uP) + │ Enclave(ELE) │ │ + │ │ │ │ │ │ │ + ┌┬─────┴─────┬┐ │ ┌┬─────┴─────┬┐ │ │ │ ┌┬─────┴─────┬┐ + ││ INIT ││ │ ││ INIT ││ │ │ │ ││ INIT ││ + └┴─────┬─────┴┘ │ └┴─────┬─────┴┘ │ │ │ └┴─────┬─────┴┘ + │ │ │ │ ┌┬─────┴─────┬┐ │ │ + ┌┬─────┴─────┬┐ │ │ │ ││Load CA FW ││ ┌──────┐ │ + ││Load uP FW ││ │ │ │ └┴─────┬─────┴┘ ││ │ │ + └┴─────┬─────┴┘ │ │ │ │ ││ ┌┬──v──┴─────┬┐ + │ │ ┌┬─────┴─────┬┐ │┌────────┤ ││ ││Load &Start││ + ├─────────────>├│Auth uP FW ││ ││ │ ││ ││ uP FW ││ + │ │ └┴─────┬─────┴┘ ││ │ ││ └┴───────────┴┘ + ┌┬─────┴─────┬┐ │ │ ││ │ ││ + ││Load CM FW││ │ ├────────────────────┼────────┘│ + └┴─────┬─────┴┘ │ │ ││ │ │ + │ │ ┌┬─────┴─────┬┐ ││ │ │ + ├─────────────>├│Auth CM FW ││ ││ ┌┬─────┴─────┬┐ │ + │ │ └┴─────┬─────┴┘ ││ ││Start CA FW││ │ + ┌┬─────┴─────┬┐ │ │ ││ └┴─────┬─────┴┘ │ + ││Load ELE FW││ │ │ ││ │ │ + └┴─────┬─────┴┘ │ │ ││ │ │ + │ │ ┌┬─────┴─────┬┐ ││ │ │ + ├─────────────>├│Auth ELE FW││ ││ │ │ + │ │ └┴─────┬─────┴┘ ││ ┌┬─────┴─────┬┐ │ + ┌┬─────┴─────┬┐ │ │ ││ ││ Load SPL ││ │ + ││Start CM FW││ │ │ ││ └┴─────┬─────┴┘ │ + └┴─────┬─────┴┘ │ │ ││ │ │ + │ │ ┌┬─────┴─────┬┐ ││ ┌────┤ │ + │ │ ││Auth CA FW │┤<───┘ │ │ │ + │ │ └┴─────┬─────┴┘ │ │ │ │ + │ │ │ │ │ │ │ + │ │ ┌┬─────┴─────┬┐ │ │ │ │ + │ │ ││ Auth SPL │┤<───────┘ │ │ + │ │ └┴─────┬─────┴┘ │ │ │ + │ │ ├─────────────────┐ │ │ + │ │ │ │ │ │ │ + │ │ │ │ ┌┬──v──v─────┬┐ │ + │ │ │ │ ││ Run SPL ││ │ + │ │ │ │ └┴───────────┴┘ │ + + +The diagram below illustrate the secure boot flow overview for single boot +scenario in i.MX 9x: + + + Cortex-A(CA) │ Edgelock Secure │ Cortex-M(CM) + │ Enclave(ELE) │ + │ │ │ │ │ + ┌┬─────┴─────┬┐ │ ┌┬─────┴─────┬┐ │ │ + ││ INIT ││ │ ││ INIT ││ │ │ + └┴─────┬─────┴┘ │ └┴─────┬─────┴┘ │ │ + │ │ │ │ ┌┬─────┴─────┬┐ + │ │ │ │┌>││ INIT ││ + │ │ │ ││ └┴─────┬─────┴┘ + ┌┬─────┴─────┬┐ │ │ ││ | + ││Load ELE FW││─────────────>│ ││ │ + └┴─────┬─────┴┘ | | |│ | + │ │ ┌┬─────┴─────┬┐ ││ ┌┬─────┴─────┬┐ + │ │ ├│Auth ELE FW││ ││ ││Start CM FW││ + │ │ └┴─────┬─────┴┘ ││ └┴─────┬─────┴┘ + | | | |│ | + ┌┬─────┴─────┬┐ │ │ ││ │ + ││Load CM FW││ │ | ││ │ + └┴─────┬─────┴┘ │ │ ││ │ + │ │ ┌┬─────┴─────┬┐ ││ │ + ├─────────────>├│Auth CM FW ││ ││ │ + │ │ └┴─────┬─────┴┘ ││ │ + | │ │ ││ │ + │ │ |───────────┘ │ + ┌┬─────┴─────┬┐ │ │ │ │ + ││Load CA FW││ │ │ │ │ + └┴─────┬─────┴┘ │ │ │ │ + │ │ ┌┬─────┴─────┬┐ │ │ + ├─────────────>├│Auth CA FW││ │ │ + │ │ └┴─────┬─────┴┘ │ │ + ┌┬─────┴─────┬┐ │ │ │ │ + ││Start CA FW││ │ | │ │ + └┴─────┬─────┴┘ │ │ │ │ + | │ │ │ │ + | │ │ │ │ + | │ │ │ │ + +More details on the boot flow can be found in respective Security Reference +Manual (SRM). + + +2. Generating a PKI tree +------------------------- + +The first step is to generate the private keys and public keys certificates. +The AHAB architecture is based on a Public Key Infrastructure (PKI) tree. + +The Code Signing Tools package contains an OpenSSL based key generation script +under keys/ directory. The ahab_pki_tree.sh script generates a PKI tree +containing 4 Super Root Keys (SRK), possible to also include a subordinate +SGK key. + +The AHAB supports both RSA and ECC keys, a new PKI tree can be generated by +following the example below: + +- Generating a P384 ECC PKI tree on CST (starting from v3.1.0): + + $ ./ahab_pki_tree.sh + ... + Do you want to use an existing CA key (y/n)?: n + Do you want to use Elliptic Curve Cryptography (y/n)?: y + Enter length for elliptic curve to be used for PKI tree: + Possible values p256, p384, p521: p384 + Enter the digest algorithm to use: sha384 + Enter PKI tree duration (years): 5 + Do you want the SRK certificates to have the CA flag set? (y/n)?: n + +The diagram below illustrate the PKI tree generated: + + ┌─────────┐ + │ CA │ + └────┬────┘ + │ + │ + ┌───────────────┬────────┴────────┬───────────────┐ + │ │ │ │ + │ │ │ │ + v v v v + ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ + │ SRK1 │ │ SRK2 │ │ SRK3 │ │ SRK4 │ + └────────┘ └────────┘ └────────┘ └────────┘ + +2.1 Generating a PKI tree including a subordinate SGK key +---------------------------------------------------------- + +The ahab_pki_tree.sh script is also able to generate a PKI tree containing a +subordinate key of the SRK, this key can be used to verify the signature +included in the final signed image. + +Users should set the CA flag when generating the SRK certificates. + +- Generating a P384 ECC PKI tree with a subordinate SGK key on CST (starting +from v3.1.0): + + $ ./ahab_pki_tree.sh + ... + Do you want to use an existing CA key (y/n)?: n + Do you want to use Elliptic Curve Cryptography (y/n)?: y + Enter length for elliptic curve to be used for PKI tree: + Possible values p256, p384, p521: p384 + Enter the digest algorithm to use: sha384 + Enter PKI tree duration (years): 5 + Do you want the SRK certificates to have the CA flag set? (y/n)?: y + +The diagram below illustrate the PKI tree generated: + + ┌─────────┐ + │ CA │ + └────┬────┘ + │ + │ + ┌───────────────┬────────┴────────┬───────────────┐ + │ │ │ │ + v v v v + ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ + │ SRK1 │ │ SRK2 │ │ SRK3 │ │ SRK4 │ + └────┬───┘ └───┬────┘ └────┬───┘ └───┬────┘ + │ │ │ │ + v v v v + ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ + │ SGK1 │ │ SGK2 │ │ SGK3 │ │ SGK4 │ + └────────┘ └────────┘ └────────┘ └────────┘ + +2.2 Generating a SRK Table and SRK Hash +---------------------------------------- + +The next step is to generated the SRK Table and its respective SRK Table Hash +from the SRK public key certificates created in one of the steps above. + +In the AHAB architecture, the SRK Table is included in the signed image and the +SRK Hash is programmed in the SoC SRK_HASH[511:0]/SRK_HASH[255:0] fuses. + +On the target device during the authentication process the AHAB code verify the +SRK Table against the SoC SRK_HASH fuses, in case the verification is successful +the root of trust is established and the AHAB code can progress with the image +authentication. + +The srktool can be used to generate the SRK Table and its respective SRK +Table Hash. + +- Generating SRK Table and SRK Hash in Linux 64-bit machines: + - In i.MX 8/8x family, the expected SRK HASH is of 512 bit. + $ cd ../crts/ + $ ../linux64/bin/srktool -a -s sha384 -t SRK_1_2_3_4_table.bin \ + -e SRK_1_2_3_4_fuse.bin -f 1 -c \ + SRK1_sha384_secp384r1_v3_usr_crt.pem,\ + SRK2_sha384_secp384r1_v3_usr_crt.pem,\ + SRK3_sha384_secp384r1_v3_usr_crt.pem,\ + SRK4_sha384_secp384r1_v3_usr_crt.pem + + - In i.MX 8ULP/9x, the expected SRK HASH is of 256 bit. + $ cd ../crts/ + $ ../linux64/bin/srktool -a -d sha256 -s sha384 -t SRK_1_2_3_4_table.bin \ + -e SRK_1_2_3_4_fuse.bin -f 1 -c \ + SRK1_sha384_secp384r1_v3_usr_crt.pem,\ + SRK2_sha384_secp384r1_v3_usr_crt.pem,\ + SRK3_sha384_secp384r1_v3_usr_crt.pem,\ + SRK4_sha384_secp384r1_v3_usr_crt.pem + + Regenerate the SRK HASH (SRK_1_2_3_4_fuse.bin) by using SHA256 with + SRK_1_2_3_4_table.bin. + $ openssl dgst -binary -sha256 SRK_1_2_3_4_table.bin + + + +- Optionally users can check if the sha512sum/sha256sum of SRK_1_2_3_4_table +matches with the SRK_1_2_3_4_fuse.bin: + + $ od -t x4 --endian=big SRK_1_2_3_4_fuse.bin + 0000000 01b04697 0253376b 2066fe56 aaef9a91 + 0000020 e62e09d8 14fb7e36 d5b38d05 0982edab + 0000040 7ada6576 2f6b4f59 1fd9347e 46e7305d + 0000060 46e34bf0 89780bd1 c809e714 a17e2f4e + + $ sha512sum SRK_1_2_3_4_table.bin + 01b046970253376b2066fe56aaef9a91\ + e62e09d814fb7e36d5b38d050982edab\ + 7ada65762f6b4f591fd9347e46e7305d\ + 46e34bf089780bd1c809e714a17e2f4e\ + SRK_1_2_3_4_table.bin + +NOTE: The commands above cannot be used as reference to program the SoC + SRK_HASH fuses. + +The SRK_1_2_3_4_table.bin and SRK_1_2_3_4_fuse.bin files can be used in further +steps as explained in AHAB guides available under doc/imx/ahab/guides/ +directory. + +3 Known limitations +---------------------------------------- + +- Due to a limitation in i.MX8QXP B0 silicon it's not possible to use RSA +4096-bit SRK keys with an additional subordinate SGK key. diff --git a/doc/imx/index.rst b/doc/imx/index.rst new file mode 100644 index 00000000000..cc5f427de92 --- /dev/null +++ b/doc/imx/index.rst @@ -0,0 +1,13 @@ +.. SPDX-License-Identifier: GPL-2.0+ + +i.MX AHAB secure boot +====================== + +This section provides documentation for the NXP i.MX AHAB (Advanced +High Assurance Boot) secure boot mechanisms, covering the AHAB +architecture introduction and the i.MX93 secure boot guide. + +.. toctree:: + :maxdepth: 2 + + ahab/introduction_ahab From patchwork Wed Sep 2 13:41:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= X-Patchwork-Id: 2296671 X-Patchwork-Delegate: festevam@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=IXB8ryG1; dkim=pass (2048-bit key; unprotected) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=dkim header.b=bnpkO/y9; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=2605:bc80:3010::138; helo=smtp1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp1.osuosl.org (smtp1.osuosl.org [IPv6:2605:bc80:3010::138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZkSB3l5Sz1xwg for ; Wed, 02 Sep 2026 23:42:34 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id 2A87280F18; Wed, 2 Sep 2026 13:42:33 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id hQdevfFtfC2N; Wed, 2 Sep 2026 13:42:28 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788356548; bh=8nSgbs0qy5Cylg0ptpitkdje6NNdsMAY5MziO5geMpI=; h=From:Date:Subject:References:In-Reply-To:To:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=IXB8ryG1C7phog6UYJQ+FUWaO85R8tawBbDJZ4ga8JjlBaeUuIoxcNRhcCqaZkyV5 lCP5L5tVuSzVY7tSSv0W/PiF46Nv86nW09XeFXXUKwuQtJtQrYnNFy0soV2zkdSV4J EekJnQ2uZaHshDsQJYq18KGb9odnzeptWhGxeg1NB6NB8QI2XRyGPZb80UyaZZLxkT ywwV2vbWzNVKzK5P7r9bAfGSNBnY7QA+yS1I7qrw+1zmFqvGA0v0WEwdemwPIhvu+2 bBYvse8+vWrQCM/rSPV5Vfb/TwARtf2UDjBUzbpHXa+8MkOjkTmyhPLUMG8Fg0GUi5 PbrvEiTBXCA6w== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp1.osuosl.org (Postfix) with ESMTP id 28A7C80F7E; Wed, 2 Sep 2026 13:42:28 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by lists1.osuosl.org (Postfix) with ESMTP id E50992FD for ; Wed, 2 Sep 2026 13:42:26 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id D67EF80EDB for ; Wed, 2 Sep 2026 13:42:26 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id hkiTeAxWAO7L for ; Wed, 2 Sep 2026 13:42:24 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=185.246.85.4; helo=smtpout-03.galae.net; envelope-from=jeremie.dautheribes@bootlin.com; receiver= Authentication-Results: smtp1.osuosl.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp1.osuosl.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=dkim header.b=bnpkO/y9 Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) by smtp1.osuosl.org (Postfix) with ESMTPS id 723B180D1C for ; Wed, 2 Sep 2026 13:42:23 +0000 (UTC) Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id 9D84D4E414D1; Wed, 2 Sep 2026 13:42:21 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 6AB3E6053C; Wed, 2 Sep 2026 13:42:21 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 8991811C79A84; Wed, 2 Sep 2026 15:42:13 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1788356536; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=8nSgbs0qy5Cylg0ptpitkdje6NNdsMAY5MziO5geMpI=; b=bnpkO/y9O7qLMgcrcIA8xpPN1KmthSc8hsM5kzdgi05Wj4/PWXiHT2gUCt1lqyFIAjUhoW tuRKLcDLQUAQ2W4koYxDntcgqqs/VQytl6+dMnW1SRYmp2y78AO0558cGaELk/1lB8sflx 0rEzWxoyZ5coc4uI6h86kIrYorh8WKhUjBZZb41Tbd8SDlIzQR1NyjHegYvEyYtzEI0NgL UWBbfZfaIdeFwWj9feZs8WTYY2+jBeE0LS5nBaZbf7zcKW8xARthAdwgQlTwA1rO765vrH iI8UUP9AWXD9rEaWFU5bXhuxwj55UTbCvEQI15Rc3wSCgdb4JcAbCxp9iKuXjQ== From: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= Date: Wed, 02 Sep 2026 15:41:33 +0200 Subject: [PATCH v2 6/7] doc: imx: ahab: add i.MX93 secure boot guide MIME-Version: 1.0 Message-Id: <20260902-imx93-secureboot-v2-6-5947b92a5072@bootlin.com> References: <20260902-imx93-secureboot-v2-0-5947b92a5072@bootlin.com> In-Reply-To: <20260902-imx93-secureboot-v2-0-5947b92a5072@bootlin.com> To: "NXP i.MX U-Boot Team" , u-boot@lists.u-boot-project.org Cc: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= , =?utf-8?q?Miqu=C3=A8l_Raynal?= , Thomas Petazzoni , Tom Rini , Simon Glass , Alper Nebi Yasak , Stefano Babic , Fabio Estevam , Marek Vasut , Denis Mukhin , Rasmus Villemoes , Ilias Apalodimas , =?utf-8?q?Krzysztof_Drobi?= =?utf-8?q?=C5=84ski?= , Peng Fan , Alice Guo , Simona Toaca , Ye Li , Quentin Schulz , Christophe Guerreiro X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=25812; i=jeremie.dautheribes@bootlin.com; h=from:subject:message-id; bh=aav0byNmo9G6ENoy9uLVpz2Jfyo+q+nya026e26/BJ8=; b=owEBbQKS/ZANAwAKASsAXqAbWo8DAcsmYgBqmCeVuKEldC7O0Y2e31q9xznunLmtnT00UAckY V9MzWf/LWiJAjMEAAEKAB0WIQT7FK2Qhtu4QpBIBAkrAF6gG1qPAwUCapgnlQAKCRArAF6gG1qP A+DoD/9D8jx0q8GLHWq+RSJG1e/TxdWoSgSDQk5E1ujziPf4wMzbYSMp8/BITCDDFMRSMo4k0G7 coe0G0tMjFa4R9dn8YIDWGJpw/8+D4gNneEuXXZ2GvRBajh5kL+pDWbHnmoEJgnu2QJWKaw5/7D zGjfu60Ykzgn3H+AkA/8wQoE2xCH+ahMFBi8eVnmW242kY19/HMcBcDr0n/cx7VzRRG4X3Z0ppc LSouz5RnvtQnvFRjpaSom0Admfq12PraS31uys4Ig0EZ/WPvk3FUbGxHx5DWftaLhhcgjgqC+fw DAUBAIjQGoLZiZmK3pY6kqSlZxK1YrOjnIfijfMQtZOEEC6OgByOH5zjBeKeQpYHtTLGXaSk1OZ KvZohwfAYzDOUOCN9HfsQotPUsb08/OxtstqCob/Y/DIfrZH8glcDy5ywt+48LRJGbP4wFTPtk9 WOok7HNjkFPWTuJQ4b3hBLvLBCwg6tHzVg7EIdzC02hVWfubPcPubvtwO8R2ow7IIBTaSOgEnqJ Ob2ZhM9y2sJ5pZ/8WGLRSx5AOzeOWjIBewfGIKDaNFqNBE9LqQgVrXP7C7Gh84aqLrwrPwiGXrb Zmme9GkYgOiMf8f4e5gZ3aVHsNZy1ht21TEqiTR6aBYA6DJpWP7yx6sLvPGZ9vp9KjJloXWbUTN XQ/SRo2cOLWK2SQ== X-Developer-Key: i=jeremie.dautheribes@bootlin.com; a=openpgp; fpr=FB14AD9086DBB842904804092B005EA01B5A8F03 X-Last-TLS-Session-Version: TLSv1.3 X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org Add a step-by-step guide describing how to securely boot an i.MX93 image using AHAB. This guide is largely based on the following documents: - doc/imx/ahab/guides/mx8ulp_9x_secure_boot.txt, from uboot-imx (lf_v2026.04), originally written by Utkarsh Gupta - doc/imx/habv4/guides/mx8m_spl_secure_boot.txt, from this tree, originally written by Marek Vasut Signed-off-by: Jérémie Dautheribes (Schneider Electric) --- doc/imx/ahab/guides/mx93_secure_boot.rst | 294 +++++++++++++++++++++++++++++++ doc/imx/ahab/guides/mx93_secure_boot.txt | 269 ++++++++++++++++++++++++++++ doc/imx/ahab/introduction_ahab.rst | 3 +- doc/imx/index.rst | 1 + 4 files changed, 566 insertions(+), 1 deletion(-) diff --git a/doc/imx/ahab/guides/mx93_secure_boot.rst b/doc/imx/ahab/guides/mx93_secure_boot.rst new file mode 100644 index 00000000000..2a966ffed1b --- /dev/null +++ b/doc/imx/ahab/guides/mx93_secure_boot.rst @@ -0,0 +1,294 @@ +.. SPDX-License-Identifier: GPL-2.0+ + +i.MX93 Secure boot guide using AHAB +=================================== + +This document provides a step-by-step guide on how to securely boot an +i.MX93 boot image. It is assumed that the reader is familiar with basic +AHAB concepts and with the PKI tree generation. Details about AHAB can be +found in the :doc:`AHAB introduction <../introduction_ahab>` document and +in the processor Security Reference Manual (SRM). The i.MX93 signing +procedure is integrated in the U-Boot build thanks to binman. + +1. Preparing the environment to build a secure boot image +--------------------------------------------------------- + +Secure boot image preparation requires the U-Boot build system to build +the image and the Code Signing Tool (CST) to sign it. + +The following files are needed to prepare the boot image: + + - EdgeLock secure enclave Firmware (ELE) (Optional). + - DDR PHY initialization firmware. + - U-Boot proper and SPL. + - ARM Trusted Firmware (ATF). + - OPTEE (Optional) + +The ELE FW is distributed by NXP and is already signed using NXP keys. +In the following sections, designates the repository where all +parts have been downloaded and built. + +2. Preparing U-Boot to support AHAB secure boot features +-------------------------------------------------------- + +The U-Boot/SPL provides extra AHAB supported functionalities that include +extension of Root of Trust, checking any events(issues) after image +authentication, chip lifecycle status, securing the target etc. + +The support is enabled by adding CONFIG_AHAB_BOOT to the defconfig file +used by your target: + + - Defconfig: + CONFIG_AHAB_BOOT=y + - Kconfig: + ARM architecture -> Support i.MX9 AHAB features + +Enabling this feature allows the SPL and U-Boot images to extend the Root +of Trust by using the AHAB API call via ELE FW. It also enables binman to +automatically sign the SPL and U-Boot containers while building +flash.bin, as described in the next sections. + +3. i.MX93 AHAB image layout +--------------------------- + +The i.MX93 flash.bin image is built by binman and is composed of up to +three containers. The ELE FW container is optional and is provided by NXP, +it is appended at the beginning of the image when the file +mx93a1-ahab-container.img is present in the build directory. The SPL and +U-Boot containers are built by the nxp-imx9image etype and signed by the +nxp-imx93cst etype. + +.. code-block:: text + + *start ----> +---------------------------+ --------- + | 1st Container header | ^ + | and signature | | Authenticated at + +---------------------------+ | ELE ROM/FW Level + | Padding | | + +---------------------------+ | + | ELE FW | v + *start + 0x400 ---> +---------------------------+ --------- + | 2nd Container header | ^ + | and signature | | Authenticated at + +---------------------------+ | ELE ROM/FW Level + | Padding | | + +---------------------------+ | + | SPL | v + +---------------------------+ --------- + | 3rd Container header | ^ + | and signature | | Authenticated at + +---------------------------+ | SPL Level + | Padding | | + +---------------------------+ | + | ARM Trusted FW (ATF) | | + +---------------------------+ | + | U-Boot proper | | + +---------------------------+ | + | OPTEE (optional) | v + +---------------------------+ --------- + +The first container includes the ELE FW which is signed using NXP keys, +this container is authenticated by ELE ROM. + +The second container includes the SPL which is signed using OEM keys, +this container is authenticated at ELE FW level. + +The third container includes the U-Boot proper and the ATF. The SPL is in +charge to load this container and also to interface with ELE FW to +authenticate the additional container. + +The signing procedure is slightly different when compared with HABv4 +series. On AHAB the signature is directly included in the container, the +CST is responsible to sign and handle the "Signature Block": + +.. code-block:: text + + +----------------------------+ --------- + | | ^ + | | | + | Container header | | + | | | + | | | + +---+------------------------+ | + | S | Signature block header | | Signed + | i +------------------------+ | + | g | | | + | n | | | + | a | SRK table | | + | t | | | + | u | | v + | r +------------------------+ --------- + | e | Signature | + | +------------------------+ + | B | | + | l | SGK Key | + | o | Certificate (optional) | + | c | | + | k | | + +---+------------------------+ + +The certificate block is divided into: + +.. code-block:: text + + +---------------+ ^ + | Public key | | Signed + | Permission | | + +---------------+ v + | Signature | + +---------------+ + +The first block (public key permission) verifies the Signature block +preceding (between SRK table and Certificate blocks), while the second +block (signature) is verified by the SRK table block. + +In case not using the subordinate key, the container signature is +verified against the SRK keys directly. + +4. Signing the images +--------------------- + +Internally, Command Sequence Files (CSF) are used. The CSF files contain +all the commands that the AHAB executes during the secure boot. These +commands instruct the AHAB code on which memory areas of the image to +authenticate, which keys to install and use, and so on. The CSF is generated +using the CST Code Signing Tool based on input configuration file. This +tool input configuration file is generated using binman, and the tool +is invoked from binman as well. + +The existing file structure is automatically collected by the nxp-imx93cst +etype and submitted as a single signing operation: the container header +and the signature block offsets are read from the i.MX container header, +so the offsets in the CST configuration file are always correct, whether +the ELE FW is bundled in the image or not. + +Per default the AHAB keys and certificates need to be located in the +build directory, this means creating a symbolic link or copying the +following files from the AHAB PKI tree directory into the u-boot build +directory for the CST Code Signing Tool to locate them: + +- ``crts/SRK_1_2_3_4_table.bin`` +- ``crts/SRK1_sha384_secp384r1_v3_usr_crt.pem`` +- ``keys/SRK1_sha384_secp384r1_v3_usr_key.pem`` +- ``keys/key_pass.txt`` + +See the :doc:`AHAB introduction <../introduction_ahab>` document for the +PKI tree generation procedure (ahab_pki_tree tool) and for the SRK Table +generation (srktool). + +The paths to the SRK table and the certificate can be modified via +changes to the nxp-imx93cst device tree node(s) or via the environment +variables. + +The nxp-imx93cst etype is configurable using either DT properties or +environment variables. The following DT properties and environment +variables are supported. Note that environment variables override DT +properties. + +.. list-table:: + :header-rows: 1 + + * - DT property + - Variable + - Description + * - ``nxp,srk-table`` + - ``SRK_TABLE`` + - full path to ``SRK_1_2_3_4_table.bin`` + * - ``nxp,srk-crt`` + - ``SRK_KEY`` + - full path to the SRK certificate ``SRK1_sha384_secp384r1_v3_usr_crt.pem`` + + +The SRK private key (``SRK1_sha384_secp384r1_v3_usr_key.pem``) must be located +next to the certificate so that can find it. + +Environment variables can be set as follows to point the build process +to external key material: + +.. code-block:: console + + $ export SRK_TABLE=$CST_DIR/crts/SRK_1_2_3_4_table.bin + $ export SRK_KEY=$CST_DIR/crts/SRK1_sha384_secp384r1_v3_usr_crt.pem + $ make flash.bin + +5. Programming SRK Hash +----------------------- + +As explained in the :doc:`AHAB introduction <../introduction_ahab>` +document, the SRK Hash fuse values are generated by the srktool and +should be programmed in the SoC SRK_HASH[255:0] fuses. + +Be careful when programming these values, as this data is the basis for +the root of trust. An error in SRK Hash results in a part that does not +boot. + +The U-Boot fuse tool can be used for programming eFuses on i.MX SoCs. + +- Dump SRK Hash fuses values in host machine: + + On i.MX93 family, the SRK Hash uses sha256 and dump 8 words fuses: + + .. code-block:: console + + $ od -t x4 SRK_1_2_3_4_fuse.bin + 0000000 db2959f2 90dfc39c 53394566 e0b75829 + 0000020 85e6f3b1 af00983d e5e804fe 7a451024 + +- Program SRK_HASH[255:0] fuses: + +On i.MX93: + +.. code-block:: console + + => fuse prog 16 0 0xdb2959f2 + => fuse prog 16 1 0x90dfc39c + => fuse prog 16 2 0x53394566 + => fuse prog 16 3 0xe0b75829 + => fuse prog 16 4 0x85e6f3b1 + => fuse prog 16 5 0xaf00983d + => fuse prog 16 6 0xe5e804fe + => fuse prog 16 7 0x7a451024 + +6. Verify AHAB events +--------------------- + +If the fuses have been burned properly, there should be no AHAB events +after boot. To validate this, power on the board, and run ahab_status +command on U-Boot terminal. + +No events should be returned after this command: + +.. code-block:: console + + => ahab_status + Lifecycle: 0x00000008, OEM Open + + No Events Found! + +7. Close the device +------------------- +.. warning:: + + Before closing the device, please ensure your sample is in OEM Open state, + OEM SRK hash has been fused, and you are able to boot a signed image + successfully without any AHAB events reported . If not, your sample will be + unrecoverable. + +After the device successfully boots a signed image without generating any +AHAB security events, it is safe to close the device. The chip lifecycle +should be changed from OEM open to OEM closed. Be aware this step can +damage your board if a previous step failed. It is also irreversible. Run +on the U-Boot terminal: + +.. code-block:: console + + => ahab_close + +Now reboot the target, and run: + +.. code-block:: console + + => ahab_status + Lifecycle: 0x00000020, OEM Closed + + No Events Found! diff --git a/doc/imx/ahab/guides/mx93_secure_boot.txt b/doc/imx/ahab/guides/mx93_secure_boot.txt new file mode 100644 index 00000000000..45a70926d51 --- /dev/null +++ b/doc/imx/ahab/guides/mx93_secure_boot.txt @@ -0,0 +1,269 @@ ++=========================================================+ ++ i.MX93 Secure boot guide using AHAB + ++=========================================================+ + +1. AHAB secure boot process +---------------------------- + +This document provides a step-by-step guide on how to securely boot an +i.MX93 boot image. It is assumed that the reader is familiar with basic +AHAB concepts and with the PKI tree generation. Details about AHAB can be +found in the introduction_ahab.txt document and in processors Security +Reference Manual Document (SRM). The i.MX93 signing procedure is +integrated in the U-Boot build thanks to binman. + +1.1 Preparing the environment to build a secure boot image +----------------------------------------------------------- + +Secure boot image preparation requires the U-Boot build system to build +the image and the Code Signing Tool (CST) to sign it. + +Based on boot mode, the following files are needed to prepare the boot +image: + +- All boot modes + - Edgelock secure enclave Firmware (ELE) (Optional). + - DDR PHY initialization firmware. + - U-Boot proper and SPL. + - ARM Trusted Firmware (ATF). + - OPTEE (Optional) + +The ELE FW is distributed by NXP and is already signed using NXP keys. +In the following sections, designates the repository where all +parts have been downloaded and built. + +1.2 Preparing U-Boot to support AHAB secure boot features +---------------------------------------------------------- + +The U-Boot/SPL provides extra AHAB supported functionalities that include +extension of Root of Trust, checking any events(issues) after image +authentication, chip lifecycle status, securing the target etc. + +The support is enabled by adding CONFIG_AHAB_BOOT to the defconfig file +used by your target: + + - Defconfig: + CONFIG_AHAB_BOOT=y + - Kconfig: + ARM architecture -> Support i.MX9 AHAB features + +Enabling this feature allows the SPL and U-Boot images to extend the Root +of Trust by using the AHAB API call via ELE FW. It also enables binman to +automatically sign the SPL and U-Boot containers while building +flash.bin, as described in the next sections. + +1.3 i.MX93 AHAB image layout +----------------------------- + +The i.MX93 flash.bin image is built by binman and is composed of up to +three containers. The ELE FW container is optional and is provided by NXP, +it is appended at the beginning of the image when the file +mx93a1-ahab-container.img is present in the build directory. The SPL and +U-Boot containers are built by the nxp-imx9image etype and signed by the +nxp-imx93cst etype. + + *start ----> +---------------------------+ --------- + | 1st Container header | ^ + | and signature | | Authenticated at + +---------------------------+ | ELE ROM/FW Level + | Padding | | + +---------------------------+ | + | ELE FW | v + *start + 0x400 ---> +---------------------------+ --------- + | 2nd Container header | ^ + | and signature | | Authenticated at + +---------------------------+ | ELE ROM/FW Level + | Padding | | + +---------------------------+ | + | SPL | v + +---------------------------+ --------- + | 3rd Container header | ^ + | and signature | | Authenticated at + +---------------------------+ | SPL Level + | Padding | | + +---------------------------+ | + | ARM Trusted FW (ATF) | | + +---------------------------+ | + | U-Boot proper | | + +---------------------------+ | + | OPTEE (optional) | v + +---------------------------+ --------- + +The first container includes the ELE FW which is signed using NXP keys, +this container is authenticated by ELE ROM. + +The second container includes the SPL which is signed using OEM keys, +this container is authenticated at ELE FW level. + +The third container includes the U-Boot proper and the ATF. The SPL is in +charge to load this container and also to interface with ELE FW to +authenticate the additional container. + +The signing procedure is slightly different when compared with HABv4 +series. On AHAB the signature is directly included in the container, the +CST is responsible to sign and handle the "Signature Block": + + +----------------------------+ --------- + | | ^ + | | | + | Container header | | + | | | + | | | + +---+------------------------+ | + | S | Signature block header | | Signed + | i +------------------------+ | + | g | | | + | n | | | + | a | SRK table | | + | t | | | + | u | | v + | r +------------------------+ --------- + | e | Signature | + | +------------------------+ + | B | | + | l | SGK Key | + | o | Certificate (optional) | + | c | | + | k | | + +---+------------------------+ + +The certificate block is divided into: + + +---------------+ ^ + | Public key | | Signed + | Permission | | + +---------------+ v + | Signature | + +---------------+ + +The first block (public key permission) verifies the Signature block +preceding (between SRK table and Certificate blocks), while the second +block (signature) is verified by the SRK table block. + +In case not using the subordinate key, the container signature is +verified against the SRK keys directly. + +1.4 Signing the images +----------------------- + +Internally, Command Sequence Files (CSF) are used. The CSF files contain +all the commands that the AHAB executes during the secure boot. These +commands instruct the AHAB code on which memory areas of the image to +authenticate, which keys to install, use and etc. The CSF is generated +using the CST Code Signing Tool based on input configuration file. This +tool input configuration file is generated using binman, and the tool +is invoked from binman as well. + +The existing file structure is automatically collected by the nxp-imx93cst +etype and submitted as a single signing operation: the container header +and the signature block offsets are read from the i.MX container header, +so the offsets in the CST configuration file are always correct, whether +the ELE FW is bundled in the image or not. + +Per default the AHAB keys and certificates need to be located in the +build directory, this means creating a symbolic link or copying the +following files from the AHAB PKI tree directory into the u-boot build +directory for the CST Code Signing Tool to locate them: + +- `crts/SRK_1_2_3_4_table.bin` +- `crts/SRK1_sha384_secp384r1_v3_usr_crt.pem` +- `keys/SRK1_sha384_secp384r1_v3_usr_key.pem` +- `keys/key_pass.txt` + +See the introduction_ahab.txt document for the PKI tree generation +procedure (ahab_pki_tree tool) and for the SRK Table generation +(srktool, use the SHA256 variant for i.MX93). + +The paths to the SRK table and the certificate can be modified via +changes to the nxp-imx93cst device tree node(s) or via the environment +variables. + +The nxp-imx93cst etype is configurable using either DT properties or +environment variables. The following DT properties and environment +variables are supported. Note that environment variables override DT +properties. + ++--------------------+-------------+--------------------------------------------------------------+ +| DT property | Variable | Description | ++====================+=============+==============================================================+ +| nxp,srk-table | SRK_TABLE | full path to SRK_1_2_3_4_table.bin | ++--------------------+-------------+--------------------------------------------------------------+ +| nxp,srk-crt | SRK_KEY | full path to the SRK Key SRK1_sha384_secp384r1_v3_usr_crt.pem| ++--------------------+-------------+--------------------------------------------------------------+ + +Environment variables can be set as follows to point the build process +to external key material: + + $ export SRK_TABLE=$CST_DIR/crts/SRK_1_2_3_4_table.bin + $ export SRK_KEY=$CST_DIR/crts/SRK1_sha384_secp384r1_v3_usr_crt.pem + $ make flash.bin + +1.5 Programming SRK Hash +------------------------- + +As explained in introduction_ahab.txt document, the SRK Hash fuse values +are generated by the srktool and should be programmed in the SoC +SRK_HASH[255:0] fuses. + +Be careful when programming these values, as this data is the basis for +the root of trust. An error in SRK Hash results in a part that does not +boot. + +The U-Boot fuse tool can be used for programming eFuses on i.MX SoCs. + +- Dump SRK Hash fuses values in host machine: + + On i.MX93 family, the SRK Hash uses sha256 and dump 8 words fuses + $ od -t x4 SRK_1_2_3_4_fuse.bin + 0000000 db2959f2 90dfc39c 53394566 e0b75829 + 0000020 85e6f3b1 af00983d e5e804fe 7a451024 + +- Program SRK_HASH[255:0] fuses: + +On i.MX93: + + => fuse prog 16 0 0xdb2959f2 + => fuse prog 16 1 0x90dfc39c + => fuse prog 16 2 0x53394566 + => fuse prog 16 3 0xe0b75829 + => fuse prog 16 4 0x85e6f3b1 + => fuse prog 16 5 0xaf00983d + => fuse prog 16 6 0xe5e804fe + => fuse prog 16 7 0x7a451024 + +1.6 Verify AHAB events +----------------------- + +If the fuses have been burned properly, there should be no AHAB events +after boot. To validate this, power on the board, and run ahab_status +command on U-Boot terminal. + +No events should be returned after this command: + + => ahab_status + Lifecycle: 0x00000008, OEM Open + + No Events Found! + +1.7 Close the device +--------------------- + +After the device successfully boots a signed image without generating any +AHAB security events, it is safe to close the device. The chip lifecycle +should be changed from OEM open to OEM closed. Be aware this step can +damage your board if a previous step failed. It is also irreversible. Run +on the U-Boot terminal: + + => ahab_close + +Warning: Please ensure your sample is in OEM Open state, OEM SRK hash +has been fused, and you are able to boot a signed image successfully +without any SECO events reported. If not, your sample will be +unrecoverable. + +Now reboot the target, and run: + + => ahab_status + Lifecycle: 0x00000020, OEM Closed + + No Events Found! diff --git a/doc/imx/ahab/introduction_ahab.rst b/doc/imx/ahab/introduction_ahab.rst index aef75b5e841..8c40c840ab5 100644 --- a/doc/imx/ahab/introduction_ahab.rst +++ b/doc/imx/ahab/introduction_ahab.rst @@ -292,7 +292,8 @@ scenario in i.MX 9x: | │ │ │ │ More details on the boot flow can be found in respective Security Reference -Manual (SRM). +Manual (SRM) and in the :doc:`i.MX93 Secure boot guide +`. 2. Generating a PKI tree ------------------------ diff --git a/doc/imx/index.rst b/doc/imx/index.rst index cc5f427de92..daf846947cc 100644 --- a/doc/imx/index.rst +++ b/doc/imx/index.rst @@ -11,3 +11,4 @@ architecture introduction and the i.MX93 secure boot guide. :maxdepth: 2 ahab/introduction_ahab + ahab/guides/mx93_secure_boot From patchwork Wed Sep 2 13:41:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= X-Patchwork-Id: 2296672 X-Patchwork-Delegate: festevam@gmail.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.u-boot-project.org header.i=@lists.u-boot-project.org header.a=rsa-sha256 header.s=default header.b=v+npI2OU; dkim=pass (2048-bit key; unprotected) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=dkim header.b=ehU9QByk; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.u-boot-project.org (client-ip=140.211.166.138; helo=smtp1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver=patchwork.ozlabs.org) Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZkSC6zqSz1xwg for ; Wed, 02 Sep 2026 23:42:35 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id 98DD080FC1; Wed, 2 Sep 2026 13:42:34 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id XzNDjMHzNPph; Wed, 2 Sep 2026 13:42:33 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=u-boot-bounces@lists.u-boot-project.org; receiver= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.u-boot-project.org; s=default; t=1788356550; bh=s8WcAu5dpeIWRaqYcYpRKPntOW8SV7IlcygdeD0uPc0=; h=From:Date:Subject:References:In-Reply-To:To:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=v+npI2OUxLiP9IBCETlCPH4eIfCfUh8WqdCn3HpIpUUrd2ZjizKq75ceR8MeKf+Z6 nUKpyuQS5KPoe6b8y3oCdq30O28NyPn80rqMPxclTH9dvFE2QKJcStmTVOLdehSXlO U74t6Nzn+qOFd4qE91eNtiGAoQAfMu4T+qgkRNECrA3OLvddBlGjSOEaD80nvIQzM4 z33aNFg+28CeaFoSZ+GsW8sm4J5ov0kNSH+YaHS6O6fV37ydNA7tWcEG01hKoTg+pt 17CdZ02arMJwlSDxj1SKUEgDr0zDUsJyohx8uW4jjsOCubLbqU0eYFoFwqlZMmdmnM wKS5wR8q9uGfQ== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp1.osuosl.org (Postfix) with ESMTP id 1C7E580EEC; Wed, 2 Sep 2026 13:42:30 +0000 (UTC) X-Original-To: u-boot@lists.u-boot-project.org Delivered-To: u-boot@lists.u-boot-project.org Received: from smtp2.osuosl.org (smtp2.osuosl.org [140.211.166.133]) by lists1.osuosl.org (Postfix) with ESMTP id 29A86498 for ; Wed, 2 Sep 2026 13:42:27 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id 1B3C14006F for ; Wed, 2 Sep 2026 13:42:27 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id ERAAHGTurlSS for ; Wed, 2 Sep 2026 13:42:26 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=185.246.84.56; helo=smtpout-02.galae.net; envelope-from=jeremie.dautheribes@bootlin.com; receiver= Authentication-Results: smtp2.osuosl.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com Authentication-Results: smtp2.osuosl.org; dkim=pass (2048-bit key) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=dkim header.b=ehU9QByk Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) by smtp2.osuosl.org (Postfix) with ESMTPS id 123404004D for ; Wed, 2 Sep 2026 13:42:25 +0000 (UTC) Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id 539251A195E; Wed, 2 Sep 2026 13:42:24 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 277396053C; Wed, 2 Sep 2026 13:42:24 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 7D76E11C792E0; Wed, 2 Sep 2026 15:42:20 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1788356542; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=s8WcAu5dpeIWRaqYcYpRKPntOW8SV7IlcygdeD0uPc0=; b=ehU9QBykdxVWewgdJQ6Cp4iEFOhCYertIdalO2f1rqO6kmRx+xACKinNw4gfqII52VTJI2 hnkVoJXVbubxYRDTj3tb/g0rfuRPW4m05EaZM2sfoDLD9mJTNpxBocKfpCjxEZjISydz9l c1Mwf/IJ7svdnoM/nzGP5/pFqFD5xhBoqAybqlKtRcLgCCyPlayJ0yubf6GPG4baXrVZSm bI02242yEKss9ubKHhsL3WfVgEfz3di9WGQ90LNibgDVUxtnlvdsVPvcN8aSwlRuOYkbPz YDEf2NuLmqIIi6uxGxhkuBPXDh1X/p7ZtGZe2XCOGNDu+6Nmhy2p9g9gBVhkfg== From: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= Date: Wed, 02 Sep 2026 15:41:34 +0200 Subject: [PATCH v2 7/7] binman: test: add code coverage for nxp_imx93cst etype MIME-Version: 1.0 Message-Id: <20260902-imx93-secureboot-v2-7-5947b92a5072@bootlin.com> References: <20260902-imx93-secureboot-v2-0-5947b92a5072@bootlin.com> In-Reply-To: <20260902-imx93-secureboot-v2-0-5947b92a5072@bootlin.com> To: "NXP i.MX U-Boot Team" , u-boot@lists.u-boot-project.org Cc: =?utf-8?q?J=C3=A9r=C3=A9mie_Dautheribes_=28Schneider_Electric=29?= , =?utf-8?q?Miqu=C3=A8l_Raynal?= , Thomas Petazzoni , Tom Rini , Simon Glass , Alper Nebi Yasak , Stefano Babic , Fabio Estevam , Marek Vasut , Denis Mukhin , Rasmus Villemoes , Ilias Apalodimas , =?utf-8?q?Krzysztof_Drobi?= =?utf-8?q?=C5=84ski?= , Peng Fan , Alice Guo , Simona Toaca , Ye Li , Quentin Schulz , Christophe Guerreiro X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=6687; i=jeremie.dautheribes@bootlin.com; h=from:subject:message-id; bh=PVxckJoGYSHJHRSpuIM0Pu+vZjbH6wMSZjEMyybi9Ek=; b=owEBbQKS/ZANAwAKASsAXqAbWo8DAcsmYgBqmCeVCOm2XjTApUCbZ5sPhht8n8bNVcNKmRefx ds/SKCoRMqJAjMEAAEKAB0WIQT7FK2Qhtu4QpBIBAkrAF6gG1qPAwUCapgnlQAKCRArAF6gG1qP A8XZD/9P4ipQLxypeXXonN0MPak++oORoh8YToU/ALCF2mTyOpheywhaFKMY5xns8SBnyKhLRbr BLBpkBvCEGsf2+lRKwo/elhekrTfbF5FyaugthAEYtpV8rEVT/VW/TQZO9P7flGTPQSLxyF4DkS k6IKC7BLZwCVTIWx3P/kC/OnVEBeKcqvl1IZnmLUrfMFCp+m6pLs8X2WRaYxPi2qgRNJgp//ael 7VOI1LnDFLMzH/z79Twgc6vi+eWVWVJDsC0Z2/pTq+QgMpSUFa/SFV+Z6Ze4JyCNAJ15K6yLD5b f3JdvIxSmeEgVrTs1GAbacdIDarSoH2ygkiLluuklALWBgXyEWbdX3yVorZvtdSVENqSGeWXmsQ umjFeDIBdtUxIdyNxjvzbjt8SLgLlEuL++81aTv93eunbPXut7xCGfHTKgv7La/HBfOGmhw173N Wq6/xUcFjNzAPKu3UBQJfcwDDHpVvw7birJvUt6K0AxwHRbZUWCcOxw8arqDdR4QUPZ62a43By8 M1OvXHYRgtcZddn9YpVPbWfGqMIeOWjGNxSckW6xUKsMMf14eJdrYxBvdvbfYOM/FRdPwhWkhkn fffc4d5r8ZzSRIJOEIP+8gSvH8ATiyqLABAw+bTaLeKqitSfxqE5tyoHmbNoiI3P3udHSsKy3FJ NXUFJWUZ85KTARg== X-Developer-Key: i=jeremie.dautheribes@bootlin.com; a=openpgp; fpr=FB14AD9086DBB842904804092B005EA01B5A8F03 X-Last-TLS-Session-Version: TLSv1.3 X-BeenThere: u-boot@lists.u-boot-project.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.u-boot-project.org Add test methods to cover all code paths of the nxp_imx93cst etype, reusing the pattern of the nxp_imx8mcst as done in commit 0cab35362d77 ("binman: test: Fix code coverage for iMX8 and cst bintool") by Simon Glass. This brings nxp_imx93cst to 100% coverage. Signed-off-by: Jérémie Dautheribes (Schneider Electric) --- tools/binman/ftest.py | 85 ++++++++++++++++++++++ tools/binman/test/vendor/nxp_imx93_csf.dts | 18 +++++ .../binman/test/vendor/nxp_imx93_csf_imagename.dts | 24 ++++++ 3 files changed, 127 insertions(+) diff --git a/tools/binman/ftest.py b/tools/binman/ftest.py index 5f0de4c74a7..ce012b415ff 100644 --- a/tools/binman/ftest.py +++ b/tools/binman/ftest.py @@ -35,6 +35,7 @@ from dtoc import fdt from dtoc import fdt_util from binman.etype import fdtmap from binman.etype import image_header +from binman.etype import nxp_imx93cst from binman.image import Image from u_boot_pylib import command from u_boot_pylib import terminal @@ -8152,6 +8153,90 @@ fdt fdtmap Extract the devicetree blob from the fdtmap result = cst.fetch(bintool.FETCH_BUILD) self.assertEqual(('cst', None), result) + def testNxpImx93cstNormal(self): + """Test CST signing with an i.MX93 SPL container (no ELE FW)""" + # Create a fake AHAB SPL container: tag at offset 3, image-entry + # flags at offset 40 whose low byte is the A55 core/type (0x23), + # and the signature block offset at offset 12 + spl_data = bytearray(64) + spl_data[3] = nxp_imx93cst.CONTAINER_HDR_TAG + spl_data[12:14] = struct.pack('; + #size-cells = <1>; + + binman { + nxp-imx93cst { + args; + + blob { + filename = "imx93-container.bin"; + }; + }; + }; +}; diff --git a/tools/binman/test/vendor/nxp_imx93_csf_imagename.dts b/tools/binman/test/vendor/nxp_imx93_csf_imagename.dts new file mode 100644 index 00000000000..13009438ee8 --- /dev/null +++ b/tools/binman/test/vendor/nxp_imx93_csf_imagename.dts @@ -0,0 +1,24 @@ +// SPDX-License-Identifier: GPL-2.0+ + +/dts-v1/; + +/ { + #address-cells = <1>; + #size-cells = <1>; + + binman { + nxp-imx93cst { + args; + + u-boot { + }; + + imagename { + type = "section"; + + u-boot { + }; + }; + }; + }; +};