topic Re: SPSDK OTFAD for mx93 in i.MX Processors

SPSDK OTFAD for mx93

pilotnite — Fri, 18 Oct 2024 14:32:50 GMT

Hello All,

This is my first time playing with spsdk tool for i.mx93 and getting following error:

(spsdk-venv) [10/18/24 10:27:01] -> spsdk -> nxpimage otfad export -i 1 -c mx93_otfad.yaml

ERROR:SPSDK: The UID:otfad1_key is not found in loaded registers for mx93 device.

I don't see any field "otfad1_key" in YAML file, here is my YAML template:

(spsdk-venv) [10/18/24 10:02:31] -> spsdk -> cat mx93_otfad.yaml

# ============================ On-The-Fly AES decryption Configuration template for mx93. ============================

# -------------------------------------------------------- Note --------------------------------------------------------

# Is important to use physical addresses (non-secure) in settings of OTFAD to proper run the decryption on device.

# For example:

# In case of using FlexSPI2 the secure base address address is 0x1400_0000. But in setting of the OTFAD use

# 0x0400_0000 as a base address.

# The code must be still linked on secure base address 0x1400_0000 to proper run of OTFAD hardware.

# Same is for FlexSPI1, but instead of 0x3800_0000 base address, the 0x2800_0000 must be used in OTFAD configuration.

# ======================================================================================================================

# == Basic Settings ==

# ======================================================================================================================

# ------------------------------------------===== MCU family [Required] =====-------------------------------------------

# Description: MCU family name.

# Possible options: <mx93, rt1010, rt116x, rt117x, rt118x, rt5xx, rt6xx>

family: mx93

# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------

# Description: Path to directory where the OTFAD output will be generated

output_folder: otfad_output

# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------

# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin

# will be appended)

output_name: otfad_whole_image

# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------

# Description: Filename of the keyblob without file extension (.bin will be appended)

keyblob_name: OTFAD_Table

# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------

# Description: filename of the encrypted datablobs without file extension (.bin will be appended)

encrypted_name: encrypted_blob

# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------

# Description: Readme file contains information about image layout

generate_readme: true

# ======================================================================================================================

# == OTFAD Settings ==

# ======================================================================================================================

# ----------------------------------------------===== KEK [Required] =====----------------------------------------------

# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing

# KEK or as a string or number

# kek: my_secret_kek.bin

kek: '3b910ece1b46502e0039d4deedcdee5e'

# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------

# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)

otfad_table_address: '0x08000000'

# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------

# Description: List of all data blobs included in this key blob

data_blobs:

# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------

# Description: Path to binary file with plain text data to be encrypted if desired

# data: my_data.bin

data: imx-boot--fspi.bin-flash_singleboot

# -------------------------------------===== Data blob address [Required] =====-------------------------------------

# Description: Data blob address, it could be omitted if data blob starts at start_address

address: '0x08001000'

# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------

# Description: The list of definition of individual key blobs including plain data. Add other array items as you need

# and device allows

key_blobs:

# ------------------------------------------===== AES key [Required] =====------------------------------------------

# Description: AES key for the key blob

aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'

# -------------------------------------===== AES Counter value [Required] =====-------------------------------------

# Description: AES counter value for the key blob

aes_ctr: '0x5689fab8b4bfb264'

# ------------------------------===== Start address of key blob data [Required] =====-------------------------------

# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)

start_address: '0x08001000'

# -------------------------------===== End address of key blob data [Required] =====--------------------------------

# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)

end_address: '0x08010000'

# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------

# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or

# simply bypassed

aes_decryption_enable: true

# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------

# Description: This field signals if the context is valid or not

valid: true

# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------

# Description: This field signals if the context is Read only or not

read_only: true

Any help will be highly appreciated.

Cheers,

Re: SPSDK OTFAD for mx93

pilotnite — Mon, 21 Oct 2024 12:08:57 GMT

Support,

Any insights will be highly appreciated.

Cheers,

Re: SPSDK OTFAD for mx93

AldoG — Thu, 24 Oct 2024 01:42:17 GMT

Hello,

Could you share what are you testing?
Is it some of the examples for i.MX93?

Also, if you could share the actual commands/method you are using when getting the error would help a lot.

Thank you,
Best regards/Saludos,
Aldo.

Re: SPSDK OTFAD for mx93

pilotnite — Thu, 24 Oct 2024 11:13:21 GMT

Hi @AldoG,

Thank you for your feedback.

Our goal is to encrypt the bootloader and boot it from SPI flash on the i.MX93. Initially, we tried using the "otfad_tool," but we realized this tool is designed for the i.MX7 and is incompatible with the i.MX93 due to differences in the fuse maps.

We were then advised to use the SPSDK tool: https://spsdk.readthedocs.io/en/latest/. However, it lacks information specific to the i.MX93. Recently, after updating the SPSDK tool, I noticed that the family "mimx9352" was added, replacing the previous "mx93." I followed the instructions to set up the SPSDK tool and generated the template file for the "mimx9352" family.

Here’s a summary of the steps I followed:
(spsdk-venv) ➜ spsdk ➜ nxpimage otfad get-template -f mimx9352 -o mimx9352_otfad-1.yaml
Creating /home/nitesh/Projects/spsdk/mimx9352_otfad.yaml template file.

After editing the template with the location of my binary and KEK blob, I ran the export command:
(spsdk-venv) ➜ spsdk ➜ nxpimage otfad export -i 1 -c mimx9352_otfad.yaml
SPSDKRegsErrorRegisterNotFound: SPSDK: The UID:otfad1_key is not found in loaded registers for mimx9352 device.

I encountered the following error:
SPSDKRegsErrorRegisterNotFound: SPSDK: The UID:otfad1_key is not found in loaded registers for mimx9352 device.

Interestingly, if I change the family name to "rt118x," the tool generates all the necessary binary files and fuse map, but they are for the "rt118x" family, not for the i.MX93.

I would greatly appreciate it if you could share the proper documentation or guidance on using the SPSDK tool for the i.MX93 to avoid this error and proceed with the bootloader encryption.

Thank you for your assistance!

Re: SPSDK OTFAD for mx93

AldoG — Tue, 29 Oct 2024 00:52:02 GMT

Hello,

Then, you may refer to the following documentation:
https://spsdk.readthedocs.io/en/latest/examples/imx93/imx93_ahab_uboot.html

Best regards/Saludos,
Aldo.

Re: SPSDK OTFAD for mx93

pilotnite — Wed, 30 Oct 2024 13:29:33 GMT

@AldoG

What I need is this https://spsdk.readthedocs.io/en/latest/apps/nxpimage.html#nxpimage-otfad but it does not work as the script returns error:

(spsdk-venv) [10/18/24 12:07:48] ➜ spsdk ➜ nxpimage otfad export -i 1 -c mimx9352_otfad.yaml
SPSDKRegsErrorRegisterNotFound: SPSDK: The UID:otfad1_key is not found in loaded registers for mimx9352 device.

Re: SPSDK OTFAD for mx93

pilotnite — Wed, 30 Oct 2024 17:27:32 GMT

@AldoG and to add I need to encrypt the bootloader and not just sign it.

Re: SPSDK OTFAD for mx93

nxa17177 — Wed, 06 Aug 2025 08:10:48 GMT

Hello @pilotnite , have you tried using latest SPSDK? Let me know if you still have this issue in the latest spsdk version.

Re: SPSDK OTFAD for mx93

pilotnite — Fri, 08 Aug 2025 11:58:03 GMT

Hello @nxa17177,
Thank you for your reply... Yes, using latest SPSDK resolved the issues.