Re: [PATCH 3/5] doc: imx: ahab: add AHAB introduction

Hi Jérémie,

On 2026-08-14T17:07:09, Jérémie Dautheribes
<[email protected]> wrote:
> doc: imx: ahab: add AHAB introduction
>
> Add an introductory document describing the AHAB (Advanced High
> Assurance Boot) secure and encrypted boot flow, covering the
> following topics:
> - AHAB architecture overview (SCU, SECO, PKI tree)
> - AHAB secure boot and encrypted boot flow
> - PKI tree generation (ahab_pki_tree.sh)
> - SRK Table and SRK Hash generation (srktool)
> - SRK Hash fuse programming and sanity check notes
> - i.MX 8ULP/93 secure boot support
>
> This is based on doc/imx/ahab/introduction_ahab.txt from uboot-imx
> (lf_v2026.04). Originally written by Breno Lima, with contributions
> from Ye Li, Vanessa Maegima, and Utkarsh Gupta upstream in
> uboot-imx.

Firstly it's great to get some detailed documentation, thank you.

Please convert this to reStructuredText and hook it into the Sphinx
tree (e.g. under doc/imx/ with an index.rst), so it is discoverable
via https://docs.u-boot.org rather than being an orphan file only
mailing-list readers will find. New U-Boot documentation is expected
to be rst; the neighbouring habv4/introduction_habv4.txt being .txt is
legacy, not a target to match.

>
> Signed-off-by: Jérémie Dautheribes (Schneider Electric) <[email protected]>
>
> doc/imx/ahab/introduction_ahab.txt | 445 +++++++++++++++++++++++++++++++++++++
>  1 file changed, 445 insertions(+)

> +1.1.3 [i.MX 8ULP/9x] The Edgelock secure enclave
> +-------------------------------------
> +
> +EdgeLock™ Secure Enclave is the security subsystem based on a dedicated core
> +(RISC-V) to manage security tasks with a tight control on security resources
> +along with other enhancements.

Just to check - is this really verbatim from uboot-imx? The ™ is
non-ASCII and will look odd in a plain-text doc and trip up some
readers. Please drop it (or spell out 'EdgeLock Secure Enclave') here
and anywhere else it appears.

> +NOTE: The terms Sentinel, S400, and EdgeLock secure enclave (ELE), and ELE
> +are used interchangeably throughout the document.

Nit: ELE is listed twice. Please drop one.

> diff --git a/doc/imx/ahab/introduction_ahab.txt b/doc/imx/ahab/introduction_ahab.txt
> new file mode 100644
> index 00000000000..4a5b6f795c4
> --- /dev/null
> +++ b/doc/imx/ahab/introduction_ahab.txt
> @@ -0,0 +1,445 @@
> +1.2 The image container
> +------------------------
> +
> +Due to the new architecture, multiple firmwares and software are required to
> +boot AHAB supporting devices. In order to store all the images in a single
> +binary the container image structure is used.
> +
> +At least two containers are needed for the boot process, the first container
> +must include only the Security Subsystem FW (SECO/ELE FW provided by NXP).
> +Additional containers can contain one or multiple images, depending on the
> +users specific application.
> +
> +The final binary is generated by the imx-mkimage tool.

Since this series adds a binman-based path for i.MX93 (patches 1 and
2), please mention that binman is now an alternative to imx-mkimage
for producing the final signed binary, and cross-reference the new
i.MX93 guide in patch 4/5. As written, a reader would assume
imx-mkimage is the only option.

Regards,
Simon