[PATCH 0/6] implement i.MX93 AHAB secure boot

[Sascha Hauer]

This adds support for AHAB based secure boot on i.MX93. The user
interface is integrated into the existing hab command used for ealier
i.MX variants. On i.MX93 the hab command can:

- read/write the SRK hash
- lock the device
- show lock status of the device

Like done with HAB the AHAB events will be shown during boot so that
possible failure events are seen should there be any issues like no
or wrong SRK hash fused or an unsigned image is attempted to be started.

Unlike with HAB it is currently not possible to sign the barebox images
directly within the barebox build system. Instead, the images need to be
signed afterwards with the NXP CST tool. I am currently unsure if it's
worth the hassle, as it turned out to be quite straight forward to
integrate the signing process into YOCTO (likely also ptxdist, but I
haven't tried yet). In the end it might be easier than adding another
indirection with tunneling the necessary keys through the barebox build
process. I might be convinced otherwise though.

Sascha

Sascha Hauer (6):
  hab: drop incomplete i.MX28 support
  hab: drop i.MX35
  hab: cleanup hab status printing during boot
  hab: pass flags to lockdown_device()
  ARM: i.MX: ele: implement more ELE operations
  hab: implement i.MX9 support

 arch/arm/mach-imx/Kconfig |   5 +
 arch/arm/mach-imx/ele.c   | 345 +++++++++++++++++++++++++++++++++++++-
 drivers/hab/hab.c         | 137 ++++++++++++++-
 drivers/hab/hab.h         |  10 ++
 drivers/hab/habv3.c       |   6 +-
 drivers/hab/habv4.c       |  62 +------
 include/hab.h             |  20 +--
 include/mach/imx/ele.h    |  18 ++
 8 files changed, 516 insertions(+), 87 deletions(-)
 create mode 100644 drivers/hab/hab.h

-- 
2.39.2