Hello, This series adds support for signing i.MX93 images by leveraging binman and CST, the NXP tool used for secure boot. This introduces a new binman entry type (etype) for this purpose.
As the implementation is largely similar to the existing i.MX8M support, this series also introduce a new common nxp_imxcst etype to share the common functionnalities. This procedure has been tested on the imx93-evk board, using both ECDSA and RSA-PSS keys. Patches 1-2: introduce the new common etype and convert the imx8cst one Patch 3: introduces the new nxp_imx93cst etype Patch 4: updates the imx93-u-boot.dtsi description to include the new signing nodes Patches 5-6: documentation Patches 7-9: add test coverage Signed-off-by: Jérémie Dautheribes (Schneider Electric) <[email protected]> --- Changes in v5: - test: add short-input test instead of SetImagePos and delete nxp_imx93_csf_imagename.dts, which became useless after this change (as recommended by Simon Glass) - test: factor the SPL container setup - Link to v4: https://patch.msgid.link/[email protected] Changes in v4: - new patches: move the fake cst run_cmd() mock into a _MockCstRunCmd() helper and use it from the imx8m test - binman: test: nxp_imx93cst coverage: check the CST configuration offsets generated in the missing-bintool case, reuse the new mock helper, and drop the unneeded force_missing_bintools='mkimage' - doc: imx: ahab: fix the i.MX 9x diagram box characters, and reword the mx93 guide signing description (two signing nodes), key location and CST_DIR example - Link to v3: https://patch.msgid.link/[email protected] Changes in v3: - doc: removed *.txt files wrongly introduced in the previous series - doc: fixed some inconsistencies between what the doc states and CST v4.0.1 - doc: fixed broken bootflow diagrams - Link to v2: https://patch.msgid.link/[email protected] Changes in v2: - Following Simong Glass' feedback: - Created a new common class shared between the nxp_imx8mcst and the nxp_imx93cst etypes - rewrote the doc in reStructuredText and mention binman instead of imx-mkimage - took into account the other minor suggestions - Link to v1: https://patch.msgid.link/[email protected] To: "NXP i.MX U-Boot Team" <[email protected]> To: [email protected] Cc: Miquèl Raynal <[email protected]> Cc: Thomas Petazzoni <[email protected]> Cc: Tom Rini <[email protected]> Cc: Simon Glass <[email protected]> Cc: Alper Nebi Yasak <[email protected]> Cc: Stefano Babic <[email protected]> Cc: Fabio Estevam <[email protected]> Cc: "Jérémie Dautheribes (Schneider Electric)" <[email protected]> Cc: Marek Vasut <[email protected]> Cc: Denis Mukhin <[email protected]> Cc: Rasmus Villemoes <[email protected]> Cc: Ilias Apalodimas <[email protected]> Cc: Krzysztof Drobiński <[email protected]> Cc: Peng Fan <[email protected]> Cc: Alice Guo <[email protected]> Cc: Simona Toaca <[email protected]> Cc: Ye Li <[email protected]> Cc: Quentin Schulz <[email protected]> Cc: Christophe Guerreiro <[email protected]> Cc: Thomas Bonnefille <[email protected]> Cc: Marek Vasut <[email protected]> Cc: Mathieu Dubois-Briand <[email protected]> Cc: Lei Xu <[email protected]> Cc: Joseph Guo <[email protected]> Cc: Vincent Jardin <[email protected]> --- Jérémie Dautheribes (Schneider Electric) (9): binman: add nxp_imxcst base etype for i.MX CST signing binman: nxp_imx8mcst: use the nxp_imxcst base etype binman: add nxp_imx93cst etype for i.MX93 flash.bin signing imx93-u-boot: wrap SPL and U-Boot nodes in a CST node if AHAB_BOOT enabled doc: imx: ahab: add AHAB introduction doc: imx: ahab: add i.MX93 secure boot guide binman: test: add a helper to mock the cst bintool run_cmd() binman: test: use the cst mock helper in testNxpImx8mCSTSigned binman: test: add code coverage for nxp_imx93cst etype .gitignore | 2 + arch/arm/dts/imx93-u-boot.dtsi | 54 ++-- doc/board/nxp/index.rst | 1 + doc/imx/ahab/guides/mx93_secure_boot.rst | 297 +++++++++++++++++++ doc/imx/ahab/introduction_ahab.rst | 460 +++++++++++++++++++++++++++++ doc/imx/index.rst | 14 + tools/binman/etype/nxp_imx8mcst.py | 60 +--- tools/binman/etype/nxp_imx93cst.py | 112 +++++++ tools/binman/etype/nxp_imxcst.py | 120 ++++++++ tools/binman/ftest.py | 125 +++++++- tools/binman/test/vendor/nxp_imx93_csf.dts | 18 ++ 11 files changed, 1183 insertions(+), 80 deletions(-) --- base-commit: 2b8902913c19eb581fb0d567201c09b8fa46ac74 change-id: 20260814-imx93-secureboot-b914e7b6cbbf Best regards, -- Jérémie Dautheribes (Schneider Electric) <[email protected]>
