Hi Jérémie, On 2026-08-14T17:07:09, Jérémie Dautheribes <[email protected]> wrote: > doc: imx: ahab: add AHAB introduction > > Add an introductory document describing the AHAB (Advanced High > Assurance Boot) secure and encrypted boot flow, covering the > following topics: > - AHAB architecture overview (SCU, SECO, PKI tree) > - AHAB secure boot and encrypted boot flow > - PKI tree generation (ahab_pki_tree.sh) > - SRK Table and SRK Hash generation (srktool) > - SRK Hash fuse programming and sanity check notes > - i.MX 8ULP/93 secure boot support > > This is based on doc/imx/ahab/introduction_ahab.txt from uboot-imx > (lf_v2026.04). Originally written by Breno Lima, with contributions > from Ye Li, Vanessa Maegima, and Utkarsh Gupta upstream in > uboot-imx.
Firstly it's great to get some detailed documentation, thank you. Please convert this to reStructuredText and hook it into the Sphinx tree (e.g. under doc/imx/ with an index.rst), so it is discoverable via https://docs.u-boot.org rather than being an orphan file only mailing-list readers will find. New U-Boot documentation is expected to be rst; the neighbouring habv4/introduction_habv4.txt being .txt is legacy, not a target to match. > > Signed-off-by: Jérémie Dautheribes (Schneider Electric) > <[email protected]> > > doc/imx/ahab/introduction_ahab.txt | 445 +++++++++++++++++++++++++++++++++++++ > 1 file changed, 445 insertions(+) > +1.1.3 [i.MX 8ULP/9x] The Edgelock secure enclave > +------------------------------------- > + > +EdgeLock™ Secure Enclave is the security subsystem based on a dedicated core > +(RISC-V) to manage security tasks with a tight control on security resources > +along with other enhancements. Just to check - is this really verbatim from uboot-imx? The ™ is non-ASCII and will look odd in a plain-text doc and trip up some readers. Please drop it (or spell out 'EdgeLock Secure Enclave') here and anywhere else it appears. > +NOTE: The terms Sentinel, S400, and EdgeLock secure enclave (ELE), and ELE > +are used interchangeably throughout the document. Nit: ELE is listed twice. Please drop one. > diff --git a/doc/imx/ahab/introduction_ahab.txt > b/doc/imx/ahab/introduction_ahab.txt > new file mode 100644 > index 00000000000..4a5b6f795c4 > --- /dev/null > +++ b/doc/imx/ahab/introduction_ahab.txt > @@ -0,0 +1,445 @@ > +1.2 The image container > +------------------------ > + > +Due to the new architecture, multiple firmwares and software are required to > +boot AHAB supporting devices. In order to store all the images in a single > +binary the container image structure is used. > + > +At least two containers are needed for the boot process, the first container > +must include only the Security Subsystem FW (SECO/ELE FW provided by NXP). > +Additional containers can contain one or multiple images, depending on the > +users specific application. > + > +The final binary is generated by the imx-mkimage tool. Since this series adds a binman-based path for i.MX93 (patches 1 and 2), please mention that binman is now an alternative to imx-mkimage for producing the final signed binary, and cross-reference the new i.MX93 guide in patch 4/5. As written, a reader would assume imx-mkimage is the only option. Regards, Simon
