Hello, This series adds support for signing i.MX93 images by leveraging binman and CST, the NXP tool used for secure boot. This introduces a new binman entry type (etype) for this purpose.
As the implementation is largely similar to the existing i.MX8M support, this series also introduce a new common nxp_imxcst etype to share the common functionnalities. This procedure has been tested on the imx93-evk board, using both ECDSA and RSA-PSS keys. Patches 1-2: introduce the new common etype and convert the imx8cst one Patch 3: introduces the new nxp_imx93cst etype Patch 4: updates the imx93-u-boot.dtsi description to include the new signing nodes Patches 5-6: documentation Patches 7-9: add test coverage Signed-off-by: Jérémie Dautheribes (Schneider Electric) <[email protected]> --- Changes in v6: - patch 3: drop the redundant ReadEntries() call from ReadNode(), as it is already called by super.ReadNode(). Since that code rewrites the imageN devicetree property in place, the second run no longer detected that bl31.bin was missing and wrote it into the mkimage config, making the build fail with: ././bl31.bin: Can't open: No such file or directory (see https://lore.kernel.org/u-boot/caomzo5cwr4lh9ej-xudfsrzu23c7snt0lop2ezqlqmksa76...@mail.gmail.com/) - Link to v5: https://patch.msgid.link/[email protected] Changes in v5: - test: add short-input test instead of SetImagePos and delete nxp_imx93_csf_imagename.dts, which became useless after this change (as recommended by Simon Glass) - test: factor the SPL container setup - Link to v4: https://patch.msgid.link/[email protected] Changes in v4: - new patches: move the fake cst run_cmd() mock into a _MockCstRunCmd() helper and use it from the imx8m test - binman: test: nxp_imx93cst coverage: check the CST configuration offsets generated in the missing-bintool case, reuse the new mock helper, and drop the unneeded force_missing_bintools='mkimage' - doc: imx: ahab: fix the i.MX 9x diagram box characters, and reword the mx93 guide signing description (two signing nodes), key location and CST_DIR example - Link to v3: https://patch.msgid.link/[email protected] Changes in v3: - doc: removed *.txt files wrongly introduced in the previous series - doc: fixed some inconsistencies between what the doc states and CST v4.0.1 - doc: fixed broken bootflow diagrams - Link to v2: https://patch.msgid.link/[email protected] Changes in v2: - Following Simong Glass' feedback: - Created a new common class shared between the nxp_imx8mcst and the nxp_imx93cst etypes - rewrote the doc in reStructuredText and mention binman instead of imx-mkimage - took into account the other minor suggestions - Link to v1: https://patch.msgid.link/[email protected] To: "NXP i.MX U-Boot Team" <[email protected]> To: [email protected] Cc: Miquèl Raynal <[email protected]> Cc: Thomas Petazzoni <[email protected]> Cc: Tom Rini <[email protected]> Cc: Simon Glass <[email protected]> Cc: Alper Nebi Yasak <[email protected]> Cc: Stefano Babic <[email protected]> Cc: Fabio Estevam <[email protected]> Cc: "Jérémie Dautheribes (Schneider Electric)" <[email protected]> Cc: Marek Vasut <[email protected]> Cc: Denis Mukhin <[email protected]> Cc: Rasmus Villemoes <[email protected]> Cc: Ilias Apalodimas <[email protected]> Cc: Krzysztof Drobiński <[email protected]> Cc: Peng Fan <[email protected]> Cc: Alice Guo <[email protected]> Cc: Simona Toaca <[email protected]> Cc: Ye Li <[email protected]> Cc: Quentin Schulz <[email protected]> Cc: Christophe Guerreiro <[email protected]> Cc: Thomas Bonnefille <[email protected]> Cc: Marek Vasut <[email protected]> Cc: Mathieu Dubois-Briand <[email protected]> Cc: Lei Xu <[email protected]> Cc: Joseph Guo <[email protected]> Cc: Vincent Jardin <[email protected]> --- Jérémie Dautheribes (Schneider Electric) (9): binman: add nxp_imxcst base etype for i.MX CST signing binman: nxp_imx8mcst: use the nxp_imxcst base etype binman: add nxp_imx93cst etype for i.MX93 flash.bin signing imx93-u-boot: wrap SPL and U-Boot nodes in a CST node if AHAB_BOOT enabled doc: imx: ahab: add AHAB introduction doc: imx: ahab: add i.MX93 secure boot guide binman: test: add a helper to mock the cst bintool run_cmd() binman: test: use the cst mock helper in testNxpImx8mCSTSigned binman: test: add code coverage for nxp_imx93cst etype .gitignore | 2 + arch/arm/dts/imx93-u-boot.dtsi | 54 ++-- doc/board/nxp/index.rst | 1 + doc/imx/ahab/guides/mx93_secure_boot.rst | 297 +++++++++++++++++++ doc/imx/ahab/introduction_ahab.rst | 460 +++++++++++++++++++++++++++++ doc/imx/index.rst | 14 + tools/binman/etype/nxp_imx8mcst.py | 60 +--- tools/binman/etype/nxp_imx93cst.py | 111 +++++++ tools/binman/etype/nxp_imxcst.py | 120 ++++++++ tools/binman/ftest.py | 125 +++++++- tools/binman/test/vendor/nxp_imx93_csf.dts | 18 ++ 11 files changed, 1182 insertions(+), 80 deletions(-) --- base-commit: ed869863c7e2aca50d57a05d843830dd843138c4 change-id: 20260814-imx93-secureboot-b914e7b6cbbf Best regards, -- Jérémie Dautheribes (Schneider Electric) <[email protected]>
