device tree overlay in secure boot/imx-mkimage

[eduardo3]

Currently we have our yocto configured to use secure boot, where we sign the bootloader, kernel and device tree.

What I am unable to find are examples using imx-mkimage to create images with multiple device trees / device tree overlays and select them in u-boot.

I've found examples using standard mkimage, which it takes an image tree source (.its) file and how to select a configuration. At this point, I don't know if the same is available in imx-mkimage.

Could you provide an example how to use imx-mkimage to create a boot container with multiple device trees (dtb) and device tree overlays (dtbo)? 

[danielchen]

Hi  eduardo:

unfortunately we don't have such an example.

Regarding the image tree source image file (.its)  ,   it has already been generated, but it is subsequently deleted.

You can check the Makefile, let's take i.MX93 as an example, 

iMX93/soc.mak

You can comment out this line and get the .its file.

Regards

Daniel

[eduardo3]

I've seen that mkimage_fit_atf.sh used in other places. My build uses mkimage_imx8, which doesn't seem to support the -f option to provide the FIT image description. All examples of .its files are for mkimage_uboot.

What I am trying to do now (not sure if that will work) is creating a FIT image and pass that to mkimage_imx8, and the FIT image to be embedded in the boot container. Any idea if that is possible or supported? 

[danielchen]

Hi @eduardo3 

 On i.MX8M platform, imx-mkimage support multiple dtbs with supp_dtbs parameters.

   For example, command make SOC=iMX8MP flash_evk supp_dtbs="kernel_dtb.bin" will add another FDT image and config to flash.bin.

$:~/data/LINUX_8MP/imx-mkimage$ make SOC=iMX8MP flash_evk supp_dtbs="kernel_dtb.bin"
Compiling mkimage_imx8
PLAT=imx8mp HDMI=no
Compiling mkimage_imx8
cc -O2 -Wall -std=c99 -static ../iMX8M/mkimage_imx8.c -o mkimage_imx8 -lz
./../scripts/dtb_check.sh imx8mp-evk.dtb evk.dtb
Use u-boot DTB: imx8mp-evk.dtb
./../scripts/pad_image.sh tee.bin
ERROR: ./../scripts/pad_image.sh: Could not find file tee.bin. Exiting.
./../scripts/pad_image.sh bl31.bin
./../scripts/pad_image.sh u-boot-nodtb.bin evk.dtb kernel_dtb.bin
Padding kernel_dtb.bin to 42272 bytes
BL32=tee.bin DEK_BLOB_LOAD_ADDR=0x40400000 TEE_LOAD_ADDR=0x56000000 ATF_LOAD_ADDR=0x00970000 ../iMX8M/mkimage_fit_atf.sh evk.dtb kernel_dtb.bin > u-boot.its
bl31.bin size:
45392
u-boot-nodtb.bin size:
1083960
evk.dtb size:
60056
kernel_dtb.bin size:
42272
./mkimage_uboot -E -p 0x5000 -f u-boot.its u-boot.itb
FIT description: Configuration to load ATF before U-Boot
Created: Tue Jul 29 16:04:55 2025
Image 0 (uboot-1)
Description: U-Boot (64-bit)
Created: Tue Jul 29 16:04:55 2025
Type: Standalone Program
Compression: uncompressed
Data Size: 1083960 Bytes = 1058.55 KiB = 1.03 MiB
Architecture: AArch64
Load Address: 0x40200000
Entry Point: unavailable
Image 1 (fdt-1)
Description: evk
Created: Tue Jul 29 16:04:55 2025
Type: Flat Device Tree
Compression: uncompressed
Data Size: 60056 Bytes = 58.65 KiB = 0.06 MiB
Architecture: Unknown Architecture
Image 2 (fdt-2)
Description: kernel_dtb.bin
Created: Tue Jul 29 16:04:55 2025
Type: Flat Device Tree
Compression: uncompressed
Data Size: 42272 Bytes = 41.28 KiB = 0.04 MiB
Architecture: Unknown Architecture
Image 3 (atf-1)
Description: ARM Trusted Firmware
Created: Tue Jul 29 16:04:55 2025
Type: Firmware
Compression: uncompressed
Data Size: 45392 Bytes = 44.33 KiB = 0.04 MiB
Architecture: AArch64
OS: Unknown OS
Load Address: 0x00970000
Default Configuration: 'config-1'
Configuration 0 (config-1)
Description: evk
Kernel: unavailable
Firmware: uboot-1
FDT: fdt-1
Loadables: atf-1
Configuration 1 (config-2)
Description: kernel_dtb.bin
Kernel: unavailable
Firmware: uboot-1
FDT: fdt-2
Loadables: atf-1
./mkimage_imx8 -version v2 -fit -loader u-boot-spl-ddr.bin 0x920000 -second_loader u-boot.itb 0x40200000 0x60000 -out flash.bin
Platform: i.MX8M (mScale)
ROM VERSION: v2
Using FIT image
LOADER IMAGE: u-boot-spl-ddr.bin start addr: 0x00920000
SECOND LOADER IMAGE: u-boot.itb start addr: 0x40200000 offset: 0x00060000
Output: flash.bin
fit_size: 1112
1+0 records in
1+0 records out
1112 bytes (1.1 kB, 1.1 KiB) copied, 9.8461e-05 s, 11.3 MB/s
FIT hash: 8bd280d47549b241e0a775a1cfb6205b6b2d178fb0e8aa14f0db408d5868db
========= IVT HEADER [HDMI FW] =========
header.tag: 0x0
header.length: 0x0
header.version: 0x0
entry: 0x0
reserved1: 0x0
dcd_ptr: 0x0
boot_data_ptr: 0x0
self: 0x0
csf: 0x0
reserved2: 0x0
boot_data.start: 0x0
boot_data.size: 0x0
boot_data.plugin: 0x0
========= IVT HEADER [PLUGIN] =========
header.tag: 0x0
header.length: 0x0
header.version: 0x0
entry: 0x0
reserved1: 0x0
dcd_ptr: 0x0
boot_data_ptr: 0x0
self: 0x0
csf: 0x0
reserved2: 0x0
boot_data.start: 0x0
boot_data.size: 0x0
boot_data.plugin: 0x0
========= IVT HEADER [LOADER IMAGE] =========
header.tag: 0xd1
header.length: 0x2000
header.version: 0x41
entry: 0x920000
reserved1: 0x0
dcd_ptr: 0x0
boot_data_ptr: 0x91ffe0
self: 0x91ffc0
csf: 0x9535c0
reserved2: 0x0
boot_data.start: 0x91ffc0
boot_data.size: 0x35660
boot_data.plugin: 0x0
========= OFFSET dump =========
Loader IMAGE:
header_image_off 0x0
dcd_off 0x0
image_off 0x40
csf_off 0x33600
spl hab block: 0x91ffc0 0x0 0x33600

Second Loader IMAGE:
sld_header_off 0x58000
sld_csf_off 0x59020
sld hab block: 0x401fadc0 0x58000 0x1020
fit-fdt csf_off 0x5b020
fit-fdt hab block: 0x401fadc0 0x58000 0x3020
SPL CSF block:
Blocks = 0x91ffc0 0x0 0x33600 "flash.bin"
SLD CSF block:
Blocks = 0x401fadc0 0x58000 0x1020 "flash.bin",\
SLD FIT-FDT CSF block:
Blocks = 0x401fadc0 0x58000 0x3020 "flash.bin"

 To select which dtb to use, user need to implement function board_fit_config_name_match() in ./board/freescale/<soc>/spl.c.

  board_fit_config_name_match() will be called in function fit_find_config_node in ./boot/common_fit.c.

  For usage of function board_fit_config_name_match(), see https://github.com/ARM-software/u-boot/blob/master/doc/README.multi-dtb-fit.

Regards

Daniel