* [Buildroot] [PATCH 1/2] boot/arm-trusted-firmware: add NXP Layerscape secure boot support
2026-11-12 9:38 [Buildroot] [PATCH 0/2] NXP Layerscape secure boot support for TF-A Leo Denieul
@ 2026-11-12 9:39 ` Leo Denieul
2026-11-12 9:39 ` [Buildroot] [PATCH 2/2] board/freescale/lx2160a-rdb: add " Leo Denieul
2026-11-12 10:22 ` [Buildroot] [PATCH 0/2] NXP Layerscape secure boot support for TF-A Leo Denieul
2 siblings, 0 replies; 5+ messages in thread
From: Leo Denieul @ 2026-11-12 9:39 UTC (permalink / raw)
To: buildroot; +Cc: Dick Olsson, Sergey Matyukevich
Add options to build signed boot images for NXP Layerscape SoCs with
the NXP Code Signing Tool (host-qoriq-cst), as done by NXP flexbuild:
the PBI and BL2 get a CSF header signed with the SRK key, checked by
the BootROM against the SRKH fuses, and BL31, BL33 and the DDR PHY
firmware get X.509 certificates checked by BL2.
With TF-A versions that build the mbed TLS sources with their own
CFLAGS (e.g. NXP lf-6.12.34-2.1.0, used by
freescale_lx2160ardb_defconfig), mbed TLS 3.6 fails to build:
mbedtls/include/psa/crypto.h:122:29: error: redundant redeclaration
of 'psa_key_attributes_init' [-Werror=redundant-decls]
as psa/crypto.h redeclares functions already defined static inline in
psa/crypto_struct.h. Add -Wno-error=redundant-decls when X.509 is
enabled. Recent TF-A versions build mbed TLS through CMake and are not
affected.
Signed-off-by: Leo Denieul <leo.denieul.yoshino@gmail.com>
---
boot/arm-trusted-firmware/Config.in | 75 +++++++++++++++++++
.../arm-trusted-firmware.mk | 63 ++++++++++++++++
2 files changed, 138 insertions(+)
diff --git a/boot/arm-trusted-firmware/Config.in b/boot/arm-trusted-firmware/Config.in
index 70fdec5c2a..084af08792 100644
--- a/boot/arm-trusted-firmware/Config.in
+++ b/boot/arm-trusted-firmware/Config.in
@@ -300,4 +300,79 @@ config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_LEVEL
default "strong" if BR2_SSP_STRONG
default "all" if BR2_SSP_ALL
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT
+ bool "NXP Layerscape secure boot"
+ depends on BR2_TARGET_ARM_TRUSTED_FIRMWARE_RCW
+ select BR2_PACKAGE_HOST_QORIQ_CST
+ help
+ Sign the boot images with the NXP Code Signing Tool
+ (TRUSTED_BOARD_BOOT=1).
+
+if BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT
+
+choice
+ prompt "Signature format"
+ help
+ Format used to sign the BL31, BL33 and DDR images. BL2 and
+ the PBI are always signed by CST with the SRK keys, whatever
+ the format.
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509
+ bool "X.509"
+ help
+ Sign BL31, BL33 and DDR images with X.509 certificates
+ (TF-A NXP_TBBR_USE_X509=1, GENERATE_COT=1, mbed TLS).
+
+endchoice
+
+choice
+ prompt "CST input files"
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_FROM_KEYS
+ bool "Generate from SRK keys"
+ help
+ Use the TF-A default input files with the SRK keys below.
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_CUSTOM
+ bool "Custom input files (advanced)"
+ help
+ Use your own input files instead of the TF-A defaults.
+
+endchoice
+
+if BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_FROM_KEYS
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_KEYS_DIR
+ string "SRK keys directory"
+ help
+ Absolute path to the directory containing the SRK key pair,
+ srk.pub and srk.pri, as generated by the gen_keys tool of
+ qoriq-cst. If empty, TF-A generates a new development SRK
+ key pair in its build directory and images are signed with
+ them.
+endif
+
+if BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_CUSTOM
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_DIR
+ string "Custom CST input files directory"
+ help
+ Directory with input files named as in TF-A, e.g.
+ input_pbi_ch3_2, input_bl2_ch3_2 and input_blx_ch3.
+
+endif
+
+if BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509
+
+config BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509_KEYS_DIR
+ string "X.509 keys directory"
+ help
+ Directory with rot.pem, trusted_world.pem,
+ non_trusted_world.pem, bl31.pem, bl33.pem and ddr.pem.
+ If empty, TF-A generates automatically new keys at each build.
+
+endif
+
+endif
+
endif
diff --git a/boot/arm-trusted-firmware/arm-trusted-firmware.mk b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
index 2aaa7e3d19..b711d673c2 100644
--- a/boot/arm-trusted-firmware/arm-trusted-firmware.mk
+++ b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
@@ -243,4 +243,67 @@ endif
endif
+ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT),y)
+ARM_TRUSTED_FIRMWARE_NXP_KEYS_DIR = $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_KEYS_DIR))
+ARM_TRUSTED_FIRMWARE_DEPENDENCIES += host-qoriq-cst
+ARM_TRUSTED_FIRMWARE_MAKE_OPTS += TRUSTED_BOARD_BOOT=1 CST_DIR=$(HOST_DIR)/bin/cst
+
+ifeq ($(BR2_PACKAGE_QORIQ_DDR_PHY_BINARY),y)
+ARM_TRUSTED_FIRMWARE_DEPENDENCIES += qoriq-ddr-phy-binary
+ARM_TRUSTED_FIRMWARE_MAKE_OPTS += DDR_PHY_BIN_PATH=$(QORIQ_DDR_PHY_BINARY_DIR)/lx2160a
+define ARM_TRUSTED_FIRMWARE_BUILD_FIP_DDR
+ $(ARM_TRUSTED_FIRMWARE_MAKE_ENV) $(MAKE) -C $(@D) \
+ $(ARM_TRUSTED_FIRMWARE_MAKE_OPTS) fip_ddr
+endef
+ARM_TRUSTED_FIRMWARE_POST_BUILD_HOOKS += ARM_TRUSTED_FIRMWARE_BUILD_FIP_DDR
+endif
+
+ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_FROM_KEYS),y)
+ifneq ($(ARM_TRUSTED_FIRMWARE_NXP_KEYS_DIR),)
+ARM_TRUSTED_FIRMWARE_MAKE_OPTS += \
+ SRK_PRI_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_KEYS_DIR)/srk.pri \
+ SRK_PUB_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_KEYS_DIR)/srk.pub
+endif
+endif
+
+ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509),y)
+ARM_TRUSTED_FIRMWARE_EXTRA_DOWNLOADS += $(MBEDTLS_SITE)/$(MBEDTLS_SOURCE)
+define ARM_TRUSTED_FIRMWARE_EXTRACT_MBEDTLS
+ mkdir -p $(@D)/mbedtls
+ $(call suitable-extractor,$(MBEDTLS_SOURCE)) \
+ $(ARM_TRUSTED_FIRMWARE_DL_DIR)/$(MBEDTLS_SOURCE) | \
+ $(TAR) --strip-components=1 -C $(@D)/mbedtls $(TAR_OPTIONS) -
+endef
+ARM_TRUSTED_FIRMWARE_POST_EXTRACT_HOOKS += ARM_TRUSTED_FIRMWARE_EXTRACT_MBEDTLS
+ARM_TRUSTED_FIRMWARE_MAKE_OPTS += GENERATE_COT=1 NXP_TBBR_USE_X509=1 MBEDTLS_DIR=$(@D)/mbedtls
+
+ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR = $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509_KEYS_DIR))
+ifneq ($(ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR),)
+ARM_TRUSTED_FIRMWARE_MAKE_OPTS += \
+ ROT_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR)/rot.pem \
+ TRUSTED_WORLD_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR)/trusted_world.pem \
+ NON_TRUSTED_WORLD_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR)/non_trusted_world.pem \
+ BL31_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR)/bl31.pem \
+ BL33_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR)/bl33.pem \
+ DDR_KEY=$(ARM_TRUSTED_FIRMWARE_NXP_X509_KEYS_DIR)/ddr.pem
+endif
+
+endif
+
+ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_CUSTOM),y)
+ARM_TRUSTED_FIRMWARE_NXP_CST_INPUT_DIR = $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_DIR))
+ifeq ($(BR_BUILDING),y)
+ifeq ($(ARM_TRUSTED_FIRMWARE_NXP_CST_INPUT_DIR),)
+$(error No CST input files directory set, check BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_CST_INPUT_DIR)
+endif
+endif
+ARM_TRUSTED_FIRMWARE_MAKE_OPTS += BL2_INPUT_FILE=$(ARM_TRUSTED_FIRMWARE_NXP_CST_INPUT_DIR)/input_bl2_ch3_2 \
+ PBI_INPUT_FILE=$(ARM_TRUSTED_FIRMWARE_NXP_CST_INPUT_DIR)/input_pbi_ch3_2 \
+ BL31_INPUT_FILE=$(ARM_TRUSTED_FIRMWARE_NXP_CST_INPUT_DIR)/input_blx_ch3 \
+ BL33_INPUT_FILE=$(ARM_TRUSTED_FIRMWARE_NXP_CST_INPUT_DIR)/input_blx_ch3 \
+ DDR_INPUT_FILE=$(ARM_TRUSTED_FIRMWARE_NXP_CST_INPUT_DIR)/input_blx_ch3
+endif
+
+endif
+
$(eval $(generic-package))
--
2.53.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [Buildroot] [PATCH 2/2] board/freescale/lx2160a-rdb: add secure boot support
2026-11-12 9:38 [Buildroot] [PATCH 0/2] NXP Layerscape secure boot support for TF-A Leo Denieul
2026-11-12 9:39 ` [Buildroot] [PATCH 1/2] boot/arm-trusted-firmware: add NXP Layerscape secure boot support Leo Denieul
@ 2026-11-12 9:39 ` Leo Denieul
2026-11-14 9:58 ` Vincent Jardin via buildroot
2026-11-12 10:22 ` [Buildroot] [PATCH 0/2] NXP Layerscape secure boot support for TF-A Leo Denieul
2 siblings, 1 reply; 5+ messages in thread
From: Leo Denieul @ 2026-11-12 9:39 UTC (permalink / raw)
To: buildroot; +Cc: Dick Olsson, Sergey Matyukevich
When NXP secure boot is enabled, use the signed BL2 and DDR FIP
(bl2_sd_sec.pbl, ddr_fip_sec.bin) in the SD card image, add the hash
of the mbed TLS archive needed for X.509 and document the secure boot
build in the readme.
Signed-off-by: Leo Denieul <leo.denieul.yoshino@gmail.com>
---
.../arm-trusted-firmware.hash | 2 ++
board/freescale/lx2160a-rdb/post-build.sh | 6 ++++
board/freescale/lx2160a-rdb/readme.txt | 34 +++++++++++++++++++
3 files changed, 42 insertions(+)
diff --git a/board/freescale/lx2160a-rdb/patches/arm-trusted-firmware/arm-trusted-firmware.hash b/board/freescale/lx2160a-rdb/patches/arm-trusted-firmware/arm-trusted-firmware.hash
index 367a03c1ce..24c30057e3 100644
--- a/board/freescale/lx2160a-rdb/patches/arm-trusted-firmware/arm-trusted-firmware.hash
+++ b/board/freescale/lx2160a-rdb/patches/arm-trusted-firmware/arm-trusted-firmware.hash
@@ -1,2 +1,4 @@
# Locally computed
sha256 b807d8bf190b7c46b4260729b4bbe2f7df83cd1086edcb181d66595ae6598d23 arm-trusted-firmware-v2.15.0-git4.tar.gz
+# From https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.7:
+sha256 a7e8bcbec0e6f761b4af24f25677626b35f762f68eef79c08677a363212d11f6 mbedtls-3.6.7.tar.bz2
diff --git a/board/freescale/lx2160a-rdb/post-build.sh b/board/freescale/lx2160a-rdb/post-build.sh
index 4042bf9c7e..b5d7c12ba6 100755
--- a/board/freescale/lx2160a-rdb/post-build.sh
+++ b/board/freescale/lx2160a-rdb/post-build.sh
@@ -9,3 +9,9 @@ ln -sf dpc-usxgmii.dtb "$TARGET_DIR/boot/dpc.dtb"
ln -sf dpl-eth.19.dtb "$TARGET_DIR/boot/dpl.dtb"
sed "s/%PARTUUID%/$PARTUUID/g" "$BOARD_DIR/extlinux.conf" > "$TARGET_DIR/boot/extlinux/extlinux.conf"
sed "s/%PARTUUID%/$PARTUUID/g" "$BOARD_DIR/genimage.cfg" > "$BINARIES_DIR/genimage.cfg"
+
+if grep -q "^BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT=y" "$BR2_CONFIG"; then
+ sed -i -e 's/"bl2_sd.pbl"/"bl2_sd_sec.pbl"/' \
+ -e 's/"fip_ddr.bin"/"ddr_fip_sec.bin"/' \
+ "$BINARIES_DIR/genimage.cfg"
+fi
diff --git a/board/freescale/lx2160a-rdb/readme.txt b/board/freescale/lx2160a-rdb/readme.txt
index f0c03a5958..90a5964ab1 100644
--- a/board/freescale/lx2160a-rdb/readme.txt
+++ b/board/freescale/lx2160a-rdb/readme.txt
@@ -39,6 +39,40 @@ board/freescale/lx2160ardb/readme.txt.
For details about the medium image layout, see the definition in
board/freescale/lx2160a-rdb/genimage.cfg.
+Secure boot
+===========
+
+With BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT=y, TF-A signs the
+boot images with the NXP Code Signing Tool (host-qoriq-cst):
+ - the PBI and BL2 get a CSF header signed with the SRK key; the
+ BootROM checks it against the SRKH fuses;
+ - BL31, BL33 and the DDR PHY firmware get X.509 certificates; BL2
+ checks them against the ROT key hash embedded in BL2.
+
+Set the images to install:
+
+ BR2_TARGET_ARM_TRUSTED_FIRMWARE_IMAGES="fip.bin bl2_sd_sec.pbl ddr_fip_sec.bin"
+
+Set the keys to use:
+ - BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_KEYS_DIR: directory
+ containing srk.pri and srk.pub;
+ - BR2_TARGET_ARM_TRUSTED_FIRMWARE_NXP_SECURE_BOOT_X509_KEYS_DIR:
+ directory containing rot.pem, trusted_world.pem,
+ non_trusted_world.pem, bl31.pem, bl33.pem and ddr.pem.
+
+If these directories are empty, development keys are generated in the
+TF-A build directory. For the CSF headers, custom CST input files can
+be used instead of the SRK keys directory.
+
+The post-build script then puts the signed images in sdcard.img.
+
+When changing any of these options, rebuild TF-A from scratch:
+
+ make arm-trusted-firmware-dirclean && make
+
+While the ITS fuse is not blown, a BootROM authentication failure is not
+fatal: the board still boots, with the SNVS in Non-Secure state.
+
Known limitations
=================
--
2.53.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 5+ messages in thread