vhaudiquet/u-boot-krane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

binman: add CST backend selection for i.MX8M signing

Browse Source 
Add support for setting the CST backend, both via DT property and
CST_BACKEND environment variable. The CST currently supports two
backends, 'ssl' and 'pkcs11', with 'ssl' being the default when
CST tool is invoked without any -b parameter. Keep 'ssl' backend
as the default, but explicitly pass it via the '-b' parameter,
unless the user selects 'pkcs11' via either method.

Signed-off-by: Marek Vasut <marex@nabladev.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit is contained in:
Marek Vasut
2026-08-03 09:31:24 -03:00
committed by Fabio Estevam
parent 14ca9eb18d
commit 4eeaaee054
4 changed files with 79 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/imx/habv4/guides/mx8m_spl_secure_boot.txt
+19 -11
View File
@@ -167,17 +167,25 @@ The nxp-imx8mcst etype is configurable using either DT properties or environment
variables. The following DT properties and environment variables are supported.
Note that environment variables override DT properties.
+--------------------+-----------+------------------------------------------------------------------+
| DT property | Variable | Description |
+====================+===========+==================================================================+
| nxp,loader-address | | SPL base address |
+--------------------+-----------+------------------------------------------------------------------+
| nxp,srk-table | SRK_TABLE | full path to SRK_1_2_3_4_table.bin |
+--------------------+-----------+------------------------------------------------------------------+
| nxp,csf-crt | CSF_KEY | full path to the CSF Key CSF1_1_sha256_4096_65537_v3_usr_crt.pem |
+--------------------+-----------+------------------------------------------------------------------+
| nxp,img-crt | IMG_KEY | full path to the IMG Key IMG1_1_sha256_4096_65537_v3_usr_crt.pem |
+--------------------+-----------+------------------------------------------------------------------+
+--------------------+-------------+------------------------------------------------------------------+
| DT property | Variable | Description |
+====================+=============+==================================================================+
| nxp,loader-address | | SPL base address |
+--------------------+-------------+------------------------------------------------------------------+
| nxp,srk-table | SRK_TABLE | full path to SRK_1_2_3_4_table.bin |
+--------------------+-------------+------------------------------------------------------------------+
| nxp,csf-crt | CSF_KEY | full path to the CSF Key CSF1_1_sha256_4096_65537_v3_usr_crt.pem |
+--------------------+-------------+------------------------------------------------------------------+
| nxp,img-crt | IMG_KEY | full path to the IMG Key IMG1_1_sha256_4096_65537_v3_usr_crt.pem |
+--------------------+-------------+------------------------------------------------------------------+
| nxp,fast-auth | | enable fast authentication method |
+--------------------+-------------+------------------------------------------------------------------+
| nxp,srk-crt | SRK_KEY | full path to the SRK Key SRK1_sha256_4096_65537_v3_ca_crt.pem |
+--------------------+-------------+------------------------------------------------------------------+
| nxp,unlock | | unlock CAAM in SPL |
+--------------------+-------------+------------------------------------------------------------------+
| nxp,cst-backend | CST_BACKEND | CST tool backend, default is 'ssl', or selectable 'pkcs11' |
+--------------------+-------------+------------------------------------------------------------------+
Environment variables can be set as follows to point the build process
to external key material: