device tree overlay in secure boot/imx-mkimage

eduardo3 — Tue, 22 Jul 2025 11:13:07 GMT

Currently we have our yocto configured to use secure boot, where we sign the bootloader, kernel and device tree.

What I am unable to find are examples using imx-mkimage to create images with multiple device trees / device tree overlays and select them in u-boot.

I've found examples using standard mkimage, which it takes an image tree source (.its) file and how to select a configuration. At this point, I don't know if the same is available in imx-mkimage.

Could you provide an example how to use imx-mkimage to create a boot container with multiple device trees (dtb) and device tree overlays (dtbo)?

Re: device tree overlay in secure boot/imx-mkimage

danielchen — Wed, 23 Jul 2025 10:00:29 GMT

Hi eduardo:

unfortunately we don't have such an example.

Regarding the image tree source image file (.its) , it has already been generated, but it is subsequently deleted.

You can check the Makefile, let's take i.MX93 as an example,

iMX93/soc.mak

You can comment out this line and get the .its file.

Regards

Daniel

Re: device tree overlay in secure boot/imx-mkimage

eduardo3 — Wed, 23 Jul 2025 10:58:59 GMT

I've seen that mkimage_fit_atf.sh used in other places. My build uses mkimage_imx8, which doesn't seem to support the -f option to provide the FIT image description. All examples of .its files are for mkimage_uboot.

What I am trying to do now (not sure if that will work) is creating a FIT image and pass that to mkimage_imx8, and the FIT image to be embedded in the boot container. Any idea if that is possible or supported?

Re: device tree overlay in secure boot/imx-mkimage

danielchen — Tue, 29 Jul 2025 07:38:12 GMT

Hi @eduardo3

On i.MX8M platform, imx-mkimage support multiple dtbs with supp_dtbs parameters.

For example, command make SOC=iMX8MP flash_evk supp_dtbs="kernel_dtb.bin" will add another FDT image and config to flash.bin.

$:~/data/LINUX_8MP/imx-mkimage$ make SOC=iMX8MP flash_evk supp_dtbs="kernel_dtb.bin" Compiling mkimage_imx8 PLAT=imx8mp HDMI=no Compiling mkimage_imx8 cc -O2 -Wall -std=c99 -static ../iMX8M/mkimage_imx8.c -o mkimage_imx8 -lz ./../scripts/dtb_check.sh imx8mp-evk.dtb evk.dtb Use u-boot DTB: imx8mp-evk.dtb ./../scripts/pad_image.sh tee.bin ERROR: ./../scripts/pad_image.sh: Could not find file tee.bin. Exiting. ./../scripts/pad_image.sh bl31.bin ./../scripts/pad_image.sh u-boot-nodtb.bin evk.dtb kernel_dtb.bin Padding kernel_dtb.bin to 42272 bytes BL32=tee.bin DEK_BLOB_LOAD_ADDR=0x40400000 TEE_LOAD_ADDR=0x56000000 ATF_LOAD_ADDR=0x00970000 ../iMX8M/mkimage_fit_atf.sh evk.dtb kernel_dtb.bin > u-boot.its bl31.bin size: 45392 u-boot-nodtb.bin size: 1083960 evk.dtb size: 60056 kernel_dtb.bin size: 42272 ./mkimage_uboot -E -p 0x5000 -f u-boot.its u-boot.itb FIT description: Configuration to load ATF before U-Boot Created: Tue Jul 29 16:04:55 2025 Image 0 (uboot-1) Description: U-Boot (64-bit) Created: Tue Jul 29 16:04:55 2025 Type: Standalone Program Compression: uncompressed Data Size: 1083960 Bytes = 1058.55 KiB = 1.03 MiB Architecture: AArch64 Load Address: 0x40200000 Entry Point: unavailable Image 1 (fdt-1) Description: evk Created: Tue Jul 29 16:04:55 2025 Type: Flat Device Tree Compression: uncompressed Data Size: 60056 Bytes = 58.65 KiB = 0.06 MiB Architecture: Unknown Architecture Image 2 (fdt-2) Description: kernel_dtb.bin Created: Tue Jul 29 16:04:55 2025 Type: Flat Device Tree Compression: uncompressed Data Size: 42272 Bytes = 41.28 KiB = 0.04 MiB Architecture: Unknown Architecture Image 3 (atf-1) Description: ARM Trusted Firmware Created: Tue Jul 29 16:04:55 2025 Type: Firmware Compression: uncompressed Data Size: 45392 Bytes = 44.33 KiB = 0.04 MiB Architecture: AArch64 OS: Unknown OS Load Address: 0x00970000 Default Configuration: 'config-1' Configuration 0 (config-1) Description: evk Kernel: unavailable Firmware: uboot-1 FDT: fdt-1 Loadables: atf-1 Configuration 1 (config-2) Description: kernel_dtb.bin Kernel: unavailable Firmware: uboot-1 FDT: fdt-2 Loadables: atf-1 ./mkimage_imx8 -version v2 -fit -loader u-boot-spl-ddr.bin 0x920000 -second_loader u-boot.itb 0x40200000 0x60000 -out flash.bin Platform: i.MX8M (mScale) ROM VERSION: v2 Using FIT image LOADER IMAGE: u-boot-spl-ddr.bin start addr: 0x00920000 SECOND LOADER IMAGE: u-boot.itb start addr: 0x40200000 offset: 0x00060000 Output: flash.bin fit_size: 1112 1+0 records in 1+0 records out 1112 bytes (1.1 kB, 1.1 KiB) copied, 9.8461e-05 s, 11.3 MB/s FIT hash: 8bd280d47549b241e0a775a1cfb6205b6b2d178fb0e8aa14f0db408d5868db ========= IVT HEADER [HDMI FW] ========= header.tag: 0x0 header.length: 0x0 header.version: 0x0 entry: 0x0 reserved1: 0x0 dcd_ptr: 0x0 boot_data_ptr: 0x0 self: 0x0 csf: 0x0 reserved2: 0x0 boot_data.start: 0x0 boot_data.size: 0x0 boot_data.plugin: 0x0 ========= IVT HEADER [PLUGIN] ========= header.tag: 0x0 header.length: 0x0 header.version: 0x0 entry: 0x0 reserved1: 0x0 dcd_ptr: 0x0 boot_data_ptr: 0x0 self: 0x0 csf: 0x0 reserved2: 0x0 boot_data.start: 0x0 boot_data.size: 0x0 boot_data.plugin: 0x0 ========= IVT HEADER [LOADER IMAGE] ========= header.tag: 0xd1 header.length: 0x2000 header.version: 0x41 entry: 0x920000 reserved1: 0x0 dcd_ptr: 0x0 boot_data_ptr: 0x91ffe0 self: 0x91ffc0 csf: 0x9535c0 reserved2: 0x0 boot_data.start: 0x91ffc0 boot_data.size: 0x35660 boot_data.plugin: 0x0 ========= OFFSET dump ========= Loader IMAGE: header_image_off 0x0 dcd_off 0x0 image_off 0x40 csf_off 0x33600 spl hab block: 0x91ffc0 0x0 0x33600 Second Loader IMAGE: sld_header_off 0x58000 sld_csf_off 0x59020 sld hab block: 0x401fadc0 0x58000 0x1020 fit-fdt csf_off 0x5b020 fit-fdt hab block: 0x401fadc0 0x58000 0x3020 SPL CSF block: Blocks = 0x91ffc0 0x0 0x33600 "flash.bin" SLD CSF block: Blocks = 0x401fadc0 0x58000 0x1020 "flash.bin",\ SLD FIT-FDT CSF block: Blocks = 0x401fadc0 0x58000 0x3020 "flash.bin"

To select which dtb to use, user need to implement function board_fit_config_name_match() in ./board/freescale/<soc>/spl.c.

board_fit_config_name_match() will be called in function fit_find_config_node in ./boot/common_fit.c.

For usage of function board_fit_config_name_match(), see https://github.com/ARM-software/u-boot/blob/master/doc/README.multi-dtb-fit.

Regards

Daniel

topic Re: device tree overlay in secure boot/imx-mkimage in i.MX Processors

device tree overlay in secure boot/imx-mkimage

Re: device tree overlay in secure boot/imx-mkimage

Re: device tree overlay in secure boot/imx-mkimage

Re: device tree overlay in secure boot/imx-mkimage