Hello, This series adds support for signing i.MX93 images by leveraging binman and CST, the NXP tool used for secure boot. This introduces a new binman entry type (etype) for this purpose.
As the implementation is largely similar to the existing i.MX8M support, this series also introduce a new common nxp_imxcst etype to share the common functionnalities. This procedure has been tested on the imx93-evk board, using both ECDSA and RSA-PSS keys. Patches 1-2: introduces the new common etype and convert the imx8cst one Patch 3: introduce the new nxp_imx93cst etype Patch 4: updates the imx93-u-boot.dtsi description to include the new signing nodes Patches 5-6: documentation Patch 7: adds test coverage Signed-off-by: Jérémie Dautheribes (Schneider Electric) <[email protected]> --- Changes in v2: - Following Simong Glass' feedback: - Created a new common class shared between the nxp_imx8mcst and the nxp_imx93cst etypes - rewrote the doc in reStructuredText and mention binman instead of imx-mkimage - took into account the other minor suggestions - Link to v1: https://patch.msgid.link/[email protected] To: "NXP i.MX U-Boot Team" <[email protected]> To: [email protected] Cc: Miquèl Raynal <[email protected]> Cc: Thomas Petazzoni <[email protected]> Cc: Tom Rini <[email protected]> Cc: Simon Glass <[email protected]> Cc: Alper Nebi Yasak <[email protected]> Cc: Stefano Babic <[email protected]> Cc: Fabio Estevam <[email protected]> Cc: "Jérémie Dautheribes (Schneider Electric)" <[email protected]> Cc: Marek Vasut <[email protected]> Cc: Denis Mukhin <[email protected]> Cc: Rasmus Villemoes <[email protected]> Cc: Ilias Apalodimas <[email protected]> Cc: Krzysztof Drobiński <[email protected]> Cc: Peng Fan <[email protected]> Cc: Alice Guo <[email protected]> Cc: Simona Toaca <[email protected]> Cc: Ye Li <[email protected]> Cc: Quentin Schulz <[email protected]> Cc: Christophe Guerreiro <[email protected]> --- Jérémie Dautheribes (Schneider Electric) (7): binman: add nxp_imxcst base etype for i.MX CST signing binman: nxp_imx8mcst: use the nxp_imxcst base etype tools: binman: add nxp_imx93cst etype for i.MX93 flash.bin signing imx93-u-boot: wrap SPL and U-Boot nodes in a CST node if AHAB_BOOT enabled doc: imx: ahab: add AHAB introduction doc: imx: ahab: add i.MX93 secure boot guide binman: test: add code coverage for nxp_imx93cst etype .gitignore | 2 + arch/arm/dts/imx93-u-boot.dtsi | 54 ++- doc/board/nxp/index.rst | 2 + doc/imx/ahab/guides/mx93_secure_boot.rst | 294 +++++++++++++ doc/imx/ahab/guides/mx93_secure_boot.txt | 269 ++++++++++++ doc/imx/ahab/introduction_ahab.rst | 465 +++++++++++++++++++++ doc/imx/ahab/introduction_ahab.txt | 445 ++++++++++++++++++++ doc/imx/index.rst | 14 + tools/binman/etype/nxp_imx8mcst.py | 60 +-- tools/binman/etype/nxp_imx93cst.py | 112 +++++ tools/binman/etype/nxp_imxcst.py | 121 ++++++ tools/binman/ftest.py | 85 ++++ tools/binman/test/vendor/nxp_imx93_csf.dts | 18 + .../binman/test/vendor/nxp_imx93_csf_imagename.dts | 24 ++ 14 files changed, 1896 insertions(+), 69 deletions(-) --- base-commit: 4a4bcb0ada8d43390e2819e62f4baee723631f5d change-id: 20260814-imx93-secureboot-b914e7b6cbbf Best regards, -- Jérémie Dautheribes (Schneider Electric) <[email protected]>
