Hi Jérémie, On 2026-09-11T16:35:05, Jérémie Dautheribes (Schneider Electric) <[email protected]> wrote: > doc: imx: ahab: add i.MX93 secure boot guide > > Add a step-by-step guide describing how to securely boot an i.MX93 > image using AHAB. > > This guide is largely based on the following documents: > - doc/imx/ahab/guides/mx8ulp_9x_secure_boot.txt, from uboot-imx > (lf_v2026.04), originally written by Utkarsh Gupta > - doc/imx/habv4/guides/mx8m_spl_secure_boot.txt, from this tree, > originally written by Marek Vasut > > Signed-off-by: Jérémie Dautheribes (Schneider Electric) > <[email protected]> > > doc/imx/ahab/guides/mx93_secure_boot.rst | 294 +++++++++++++++++++++++++++++++ > doc/imx/ahab/introduction_ahab.rst | 3 +- > doc/imx/index.rst | 1 + > 3 files changed, 297 insertions(+), 1 deletion(-)
> diff --git a/doc/imx/ahab/guides/mx93_secure_boot.rst > b/doc/imx/ahab/guides/mx93_secure_boot.rst > @@ -0,0 +1,294 @@ > +The paths to the SRK table and the certificate can be modified via > +changes to the nxp-imx93cst device tree node(s) or via the environment > +variables. > + > +The nxp-imx93cst etype is configurable using either DT properties or > +environment variables. The following DT properties and environment > +variables are supported. Note that environment variables override DT > +properties. These two paragraphs say the same thing. Please can you drop the first one, or fold it into the second? > diff --git a/doc/imx/ahab/guides/mx93_secure_boot.rst > b/doc/imx/ahab/guides/mx93_secure_boot.rst > @@ -0,0 +1,294 @@ > +The SRK private key (``SRK1_sha384_secp384r1_v3_usr_key.pem``) must be > located > +next to the certificate so that can find it. Missing word: 'so that CST can find it'. Also, 'next to the certificate' does not look right. The list above tells the reader to copy crts/... and keys/... into the build directory, and the environment-variable example below points SRK_KEY at $CST_DIR/crts/, where the key lives in the sibling keys/ directory rather than next to the certificate. My understanding is that CST derives the key path from the certificate path (crts -> keys, _crt -> _key), so both layouts work, but the text contradicts the example. The mx8m guide says the other files 'are required by the CST tools as well, and will be searched for in relation to them'; something similar here would avoid the confusion. It is also worth mentioning key_pass.txt in that sentence, since it is listed above but never explained. > diff --git a/doc/imx/ahab/guides/mx93_secure_boot.rst > b/doc/imx/ahab/guides/mx93_secure_boot.rst > @@ -0,0 +1,294 @@ > + $ export SRK_TABLE=$CST_DIR/crts/SRK_1_2_3_4_table.bin > + $ export SRK_KEY=$CST_DIR/crts/SRK1_sha384_secp384r1_v3_usr_crt.pem > + $ make flash.bin Just to check, is CST_DIR the CST installation directory or the PKI-tree directory? The introduction generates the tree under the CST directory, so it works, but it would be clearer to define the variable (or use <work> as in section 1) before using it. > diff --git a/doc/imx/ahab/guides/mx93_secure_boot.rst > b/doc/imx/ahab/guides/mx93_secure_boot.rst > @@ -0,0 +1,294 @@ > +The existing file structure is automatically collected by the nxp-imx93cst > +etype and submitted as a single signing operation: the container header > +and the signature block offsets are read from the i.MX container header, > +so the offsets in the CST configuration file are always correct, whether > +the ELE FW is bundled in the image or not. 'The existing file structure' is unclear; I suspect you mean the SPL and U-Boot containers produced by nxp-imx9image. Also, from patch 4 each container is wrapped in its own nxp-imx93cst node, so this is two signing operations (one per container), not a single one. Please can you reword this to match what the etype actually does? Regards, Simon
