refer to the document:
1)Uncomment " #define CONFIG_SECURE_BOOT
2)The command to sign u-boot
$ ../linux64/cst -o csf_u-boot.bin < csf_u-boot.txt
$ cat u-boot.imx csf_u-boot.bin > u-boot-signed.bin
$ objcopy -I binary -O binary --pad-to 0x5d000 --gap-fill=0xff u-boot-signed.bin u-boot-signed-pad.bin
this is example for imx6ul, for more detailed information to get csf, you need to submit a ticket on salsefore.