Hi Pankaj,
First of all, thank you for your work on upstreaming the
EdgeLock Enclave (ELE) support. It is great to finally see the
ELE framework landing upstream after a long development effort.
I am currently evaluating the state of i.MX95 secure-boot and
storage-security support based on current linux-next, with the
goal of understanding what can already be achieved using
upstream software and what pieces are still under development.
From my review, it appears that the following infrastructure is
already available upstream:
- ELE/V2X mailbox support for i.MX95.
- OCOTP/ELE nvmem support for fuse access.
- Secure-enclave bindings documenting the i.MX95 ELE HSM.
However, I could not find upstream support for several
capabilities that would be useful for secure storage
deployments on i.MX95, including:
- An ELE-backed trusted-key provider for the Linux trusted key
framework.
- Integration allowing Linux to use ELE as a key-sealing/
unsealing backend.
- i.MX95-specific crypto acceleration exposed through the Linux
crypto API for dm-crypt use cases.
Are you aware of any ongoing upstream or planned development
activities in these areas, particularly for i.MX95?
Any information about the upstream roadmap, ongoing
development, or expected direction for these features would be
greatly appreciated.
Thanks again for your work and for any insights you can share.
Regards,
Fabio Estevam
On 13.06.26 15:58, Fabio Estevam wrote:
Hi Pankaj,
First of all, thank you for your work on upstreaming the
EdgeLock Enclave (ELE) support. It is great to finally see the
ELE framework landing upstream after a long development effort.
I am currently evaluating the state of i.MX95 secure-boot and
storage-security support based on current linux-next, with the
goal of understanding what can already be achieved using
upstream software and what pieces are still under development.
From my review, it appears that the following infrastructure is
already available upstream:
- ELE/V2X mailbox support for i.MX95.
- OCOTP/ELE nvmem support for fuse access.
There is no upstream support for OCOTP access via ELE. The
imx-ocotp-ele.c driver (despite its name) does not currently use the ELE
but the FSB to access the fuses (and is therefore limited to read-only
access).
I have some local WIP to add ELE support for the OCOTP driver. I think I
can post it soonish.
- Secure-enclave bindings documenting the i.MX95 ELE HSM.
However, I could not find upstream support for several
capabilities that would be useful for secure storage
deployments on i.MX95, including:
- An ELE-backed trusted-key provider for the Linux trusted key
framework.
- Integration allowing Linux to use ELE as a key-sealing/
unsealing backend.
- i.MX95-specific crypto acceleration exposed through the Linux
crypto API for dm-crypt use cases.
Are you aware of any ongoing upstream or planned development
activities in these areas, particularly for i.MX95?
Any information about the upstream roadmap, ongoing
development, or expected direction for these features would be
greatly appreciated.
Thanks again for your work and for any insights you can share.
Regards,
Fabio Estevam
Hi Frieder,
On Mon, Jun 15, 2026 at 4:18 AM Frieder Schrempf
[off-list ref] wrote:
There is no upstream support for OCOTP access via ELE. The
imx-ocotp-ele.c driver (despite its name) does not currently use the ELE
but the FSB to access the fuses (and is therefore limited to read-only
access).
I have some local WIP to add ELE support for the OCOTP driver. I think I
can post it soonish.
Thanks for the clarification, appreciate it.
Hi Fabio,
Thank you for your kind words and for your interest in the upstream EdgeLock Enclave (ELE) work.
Regarding the specific areas you mentioned, please find my comments inline below.
Regards,
Pankaj Gupta
NXP Semiconductor
-----Original Message-----
From: Fabio Estevam <festevam@gmail.com>
Sent: 13 June 2026 19:29
To: Pankaj Gupta <pankaj.gupta@nxp.com>
Cc: Schrempf Frieder <redacted>; moderated
list:ARM/FREESCALE IMX / MXC ARM ARCHITECTURE <linux-arm-
kernel@lists.infradead.org>; open list:HARDWARE RANDOM NUMBER
GENERATOR CORE [off-list ref]; Peng Fan
[off-list ref]; Stefano Babic [off-list ref]; Frank Li
[off-list ref]
Subject: [EXT] i.MX95: EdgeLock Enclave secure storage
Caution: This is an external email. Please take care when clicking links or
opening attachments. When in doubt, report the message using the 'Report
this email' button
Hi Pankaj,
First of all, thank you for your work on upstreaming the EdgeLock Enclave (ELE)
support. It is great to finally see the ELE framework landing upstream after a
long development effort.
I am currently evaluating the state of i.MX95 secure-boot and storage-security
support based on current linux-next, with the goal of understanding what can
already be achieved using upstream software and what pieces are still under
development.
From my review, it appears that the following infrastructure is already available
upstream:
- ELE/V2X mailbox support for i.MX95.
The current upstream driver only supports i.MX8ULP. However, it establishes the foundation for ELE/V2X mailbox support on i.MX95.
- OCOTP/ELE nvmem support for fuse access.
The upstream OCOTP/ELE nvmem support is independent of the recently accepted Secure Enclave driver for i.MX8ULP.
- Secure-enclave bindings documenting the i.MX95 ELE HSM.
However, I could not find upstream support for several capabilities that would
be useful for secure storage deployments on i.MX95, including:
- An ELE-backed trusted-key provider for the Linux trusted key framework.
Work in this area is currently ongoing. The intention is to provide an ELE-backed trusted key implementation that can integrate with the Linux trusted key framework.
- Integration allowing Linux to use ELE as a key-sealing/ unsealing backend.
Support for using ELE as a backend for key sealing and unsealing is also under development and is planned to build on top of the trusted key support.
- i.MX95-specific crypto acceleration exposed through the Linux crypto API for
dm-crypt use cases.
ELE itself is not designed to act as a general-purpose cryptographic accelerator.
For dm-crypt use cases, the current direction is to perform the cryptographic operations through OP-TEE using Arm Cryptography Extensions (Arm-CE),
while ensuring that plaintext keys are only present in on-chip OCRAM and never leave the SoC.
Upstream discussions and corresponding RFC patches are expected once the related OP-TEE PTA support is available for review in OP-TEE OS.
Are you aware of any ongoing upstream or planned development activities in
these areas, particularly for i.MX95?
The activities mentioned above are the primary ongoing efforts related to secure storage and key management on i.MX95.
As these developments progress, they will be proposed and discussed through the relevant upstream mailing lists.
Any information about the upstream roadmap, ongoing development, or
expected direction for these features would be greatly appreciated.
Thanks again for your work and for any insights you can share.
Regards,
Fabio Estevam