[PATCH 0/3] i.MX6 uuu support for signed images

[PATCH 0/3] i.MX6 uuu support for signed images

[Sascha Hauer]

So far uploading signed images via USB on i.MX6 requires using the
barebox included imx-usb-loader. This series adds a new image target for
i.MX6 which generates images compatible with NXPs uuu tool.

Background is that our signed USB images contain a DCD table to setup
DRAM. We interpret the DCD table on the host and setup the DRAM using
register-write commands. The DCD table in the image must then be zeroed
so that the i.MX6 ROM doesn't execute it again (thus disabling DRAM
during that process). To overcome the signature check we must sign the
image with a zeroed DCD table.

The uuu tool uses another approach. Here the DCD table is executed by
the ROM instead of the host, so the image doesn't need to be modified,
but instead the DCD table must be signed as well.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
Matthias Zoechmann (3):
      scripts: imx: fix string in further auth block
      scripts: imx-image: support DCD_WRITE on closed dev
      mach-imx: Kconfig: add option for image with dcd auth block

 arch/arm/mach-imx/Kconfig     |  9 +++++++++
 images/Makefile.imx           | 11 +++++++----
 include/mach/imx/imx-header.h |  2 ++
 scripts/imx/imx-image.c       | 19 ++++++++++++++++++-
 scripts/imx/imx.c             | 24 +++++++++++++++++++++++-
 5 files changed, 59 insertions(+), 6 deletions(-)
---
base-commit: b5561f3bdd4845b478e5b35aab04f1d8e71ea93b
change-id: 20250901-imx6-usb-uuu-2bb40fcce626

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>

[PATCH 1/3] scripts: imx: fix string in further auth block

[Sascha Hauer]

From: Matthias Zoechmann <matthias.zoechmann@ife-doors.com>

If an additional block to be authenticated is added via
'hab_do_block off+size@addr' the CST tool will fail.
It seems that an own line is expected for each authentication
block. Add a '\' and linefeed after the comma to avoid a fail of CST.

Signed-off-by: Matthias Zoechmann <matthias.zoechmann@ife-doors.com>
---
 scripts/imx/imx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/imx/imx.c b/scripts/imx/imx.c
index 26027f0f3548ce5ce60c84bf1c94d3a699a331cc..6dabaf59c159b582dfe84eff81cec039c4863b77 100644
--- a/scripts/imx/imx.c
+++ b/scripts/imx/imx.c
@@ -488,7 +488,7 @@ static int do_hab_blocks(struct config_data *data, int argc, char *argv[])
 			return -EINVAL;
 		}
 
-		ret = asprintf(&str, ", 0x%08x 0x%08x 0x%08x \"%s\"", addr, off, size, data->outfile);
+		ret = asprintf(&str, ", \\\n 0x%08x 0x%08x 0x%08x \"%s\"", addr, off, size, data->outfile);
 		if (ret < 0)
 			return -ENOMEM;
 

-- 
2.47.2

[PATCH 2/3] scripts: imx-image: support DCD_WRITE on closed dev

[Sascha Hauer]

From: Matthias Zoechmann <matthias.zoechmann@ife-doors.com>

If an image is loaded by serial download protocol with DCD_WRITE ROM
command on closed i.mx6 devices, the DCD table block loaded into the
OCRAM must be signed.
This patch adds the option '-a' to apply the additional authentication
block for the OCRAM section into the CSF.
The load address for the block is fixed to '0x00910000' which is the
default address configured in mfg-tools of NXP.

Signed-off-by: Matthias Zoechmann <matthias.zoechmann@ife-doors.com>
---
 include/mach/imx/imx-header.h |  2 ++
 scripts/imx/imx-image.c       | 19 ++++++++++++++++++-
 scripts/imx/imx.c             | 22 ++++++++++++++++++++++
 3 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/include/mach/imx/imx-header.h b/include/mach/imx/imx-header.h
index 08329e3d056171ff1b4b5d9399f68fb8e0387f77..e8ead33a9ead4024da63574a71afc96923d54671 100644
--- a/include/mach/imx/imx-header.h
+++ b/include/mach/imx/imx-header.h
@@ -115,6 +115,7 @@ struct config_data {
 	int (*write_mem)(const struct config_data *data, uint32_t addr,
 			 uint32_t val, int width, int set_bits, int clear_bits);
 	int (*nop)(const struct config_data *data);
+	int (*get_dcd_length)(void);
 	char *csf;
 	char *flexspi_csf;
 	int sign_image;
@@ -122,6 +123,7 @@ struct config_data {
 	int encrypt_image;
 	size_t dek_size;
 	bool hab_qspi_support;
+	bool dcd_usb_image;
 };
 
 #define MAX_RECORDS_DCD_V2 1024
diff --git a/scripts/imx/imx-image.c b/scripts/imx/imx-image.c
index a8ac34091fc0811ad76064b178416056a02ea2c9..c08857a6157e92ae7cb4a395a618b3eaeaedae9f 100644
--- a/scripts/imx/imx-image.c
+++ b/scripts/imx/imx-image.c
@@ -495,6 +495,9 @@ static void usage(const char *prgname)
 		"             variable 'CST'\n"
 		"-u           create USB image suitable for imx-usb-loader\n"
 		"             necessary for signed images (-s) only\n"
+		"-a           authenticate additionaly the DCD block loaded via\n"
+		"             'SDP: DCD_WRITE' to the internal RAM on i.mx6 devices\n"
+		"             necessary for usb images (-u) only\n"
 		"-h           this help\n", prgname);
 	exit(1);
 }
@@ -662,6 +665,11 @@ static int nop(const struct config_data *data)
 	}
 }
 
+static int get_dcd_length(void)
+{
+	return sizeof(uint32_t) + (curdcd * sizeof(uint32_t));
+}
+
 /*
  * This uses the Freescale Code Signing Tool (CST) to sign the image.
  * The cst is expected to be executable as 'cst' or if exists, the content
@@ -875,6 +883,7 @@ int main(int argc, char *argv[])
 		.write_mem = write_mem,
 		.check = check,
 		.nop = nop,
+		.get_dcd_length = get_dcd_length
 	};
 	uint32_t *bb_header;
 	size_t sizeof_bb_header;
@@ -883,7 +892,7 @@ int main(int argc, char *argv[])
 
 	prgname = argv[0];
 
-	while ((opt = getopt(argc, argv, "c:hf:o:p:bduse")) != -1) {
+	while ((opt = getopt(argc, argv, "c:hf:o:p:bduase")) != -1) {
 		switch (opt) {
 		case 'c':
 			configfile = optarg;
@@ -909,6 +918,9 @@ int main(int argc, char *argv[])
 		case 'u':
 			create_usb_image = true;
 			break;
+		case 'a':
+			data.dcd_usb_image = true;
+			break;
 		case 'e':
 			data.encrypt_image = 1;
 			break;
@@ -969,6 +981,11 @@ int main(int argc, char *argv[])
 		create_usb_image = 0;
 	}
 
+	if (data.dcd_usb_image && !create_usb_image) {
+		fprintf(stderr, "Warning: the -a option only has effect with usb images\n");
+		data.dcd_usb_image = false;
+	}
+
 	if (data.image_ivt_offset == 0xffffffff) {
 		if (create_usb_image)
 			data.image_ivt_offset = 0x0;
diff --git a/scripts/imx/imx.c b/scripts/imx/imx.c
index 6dabaf59c159b582dfe84eff81cec039c4863b77..26efe6d813dca5ecc7b2a06459df2b2f26673e0f 100644
--- a/scripts/imx/imx.c
+++ b/scripts/imx/imx.c
@@ -430,6 +430,28 @@ static int do_hab_blocks(struct config_data *data, int argc, char *argv[])
 		ret = asprintf(&str, "Blocks = 0x%08x 0x%08x 0x%08x \"%s\"",
 			data->image_load_addr + data->image_ivt_offset, offset,
 			signed_size - data->image_ivt_offset, data->outfile);
+
+		if (data->dcd_usb_image && (data->cpu_type == IMX_CPU_IMX6)) {
+			char *str_dcd_blk;
+			uint32_t dcd_offset = offset + offsetof(struct imx_flash_header_v2, dcd_header);
+			uint32_t dcd_length = data->get_dcd_length();
+
+			if(!dcd_length) {
+				fprintf(stderr, "failed to get dcd length\n");
+				return -EINVAL;
+			}
+
+			ret |= asprintf(&str_dcd_blk, ", \\\n 0x00910000 0x%08x 0x%08x \"%s\"",
+				dcd_offset, dcd_length, data->outfile);
+
+			str = strcata(str, str_dcd_blk);
+			free(str_dcd_blk);
+
+			if(!str) {
+				return -ENOMEM;
+			}
+		}
+
 		if (data->flexspi_csf)
 			ret |= asprintf(&flexspi_str,
 					"Blocks = 0x%08x 0x%08x 0x%08x \"%s\"",

-- 
2.47.2

[PATCH 3/3] mach-imx: Kconfig: add option for image with dcd auth block

[Sascha Hauer]

From: Matthias Zoechmann <matthias.zoechmann@ife-doors.com>

Add option CONFIG_HABV4_IMAGE_SIGNED_USB_DCD to select build of barebox
image for i.mx6 devices with an additional authentication block in CSF
("0x0091000 offset size filename").
Additional the barebox toolchain will build now a signed image e.g.
barebox-image-name-dcdus.img for usb loading with SDP DCD_WRITE ROM
command.

Signed-off-by: Matthias Zoechmann <matthias.zoechmann@ife-doors.com>
---
 arch/arm/mach-imx/Kconfig |  9 +++++++++
 images/Makefile.imx       | 11 +++++++----
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index 0d745ce2315834ec5d0c366d227b40f2adff5e83..ade4a4ce1783fc60f85aefab2da2df17a57bfe55 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -945,6 +945,15 @@ config HABV4_IMAGE_SIGNED_USB
 	  enable the creation of a usb signed image, if the habv4-imx6-gencsf.h
 	  included in the flash-header and the NXP cst Tool is available
 
+config HABV4_IMAGE_SIGNED_USB_DCD
+	bool "build signed USB images including DCD"
+	depends on ARCH_IMX6
+	depends on HABV4_IMAGE_SIGNED_USB
+	help
+	  enable the creation of a usb signed image loaded via SDP and DCD_WRITE
+	  ROM command, if the habv4-imx6-gencsf.h included in the flash-header
+	  and the NXP cst Tool is available
+
 config HABV4_IMAGE_SIGNED_ENCRYPTED
 	bool "build signed encrypted images"
 	help
diff --git a/images/Makefile.imx b/images/Makefile.imx
index 93264254e9e4cda3969bf7bf4812f2d1c5b59c09..8aa35a28e06ccffc9609054292eca026b17c0140 100644
--- a/images/Makefile.imx
+++ b/images/Makefile.imx
@@ -9,13 +9,15 @@ $(eval
 ifeq ($($(strip $(1))), y)
 	pblb-y += $(strip $(2))
 	CFG_$(strip $(2)).pblb.imximg = $(board)/$(strip $(3)).imxcfg
-	FILE_barebox-$(strip $(4)).img    = $(strip $(2)).pblb.imximg
-	FILE_barebox-$(strip $(4))-s.img  = $(strip $(2)).pblb.simximg
-	FILE_barebox-$(strip $(4))-us.img = $(strip $(2)).pblb.usimximg
-	FILE_barebox-$(strip $(4))-es.img = $(strip $(2)).pblb.esimximg
+	FILE_barebox-$(strip $(4)).img       = $(strip $(2)).pblb.imximg
+	FILE_barebox-$(strip $(4))-s.img     = $(strip $(2)).pblb.simximg
+	FILE_barebox-$(strip $(4))-us.img    = $(strip $(2)).pblb.usimximg
+	FILE_barebox-$(strip $(4))-dcdus.img = $(strip $(2)).pblb.dcdusimximg
+	FILE_barebox-$(strip $(4))-es.img    = $(strip $(2)).pblb.esimximg
 	image-y += barebox-$(strip $(4)).img
 	image-$(CONFIG_HABV4_IMAGE_SIGNED) += barebox-$(strip $(4))-s.img
 	image-$(CONFIG_HABV4_IMAGE_SIGNED_USB) += barebox-$(strip $(4))-us.img
+	image-$(CONFIG_HABV4_IMAGE_SIGNED_USB_DCD) += barebox-$(strip $(4))-dcdus.img
 	image-$(CONFIG_HABV4_IMAGE_SIGNED_ENCRYPTED) += barebox-$(strip $(4))-es.img
 endif
 )
@@ -51,6 +53,7 @@ $(call imx_image_rule,pimximg, -p $$($$(patsubst $$(obj)/%.pblb,PBL_MEMORY_SIZE_
 $(call imx_image_rule,psimximg, -p $$($$(patsubst $$(obj)/%.pblb,PBL_MEMORY_SIZE_%,$$<)) -s)
 $(call imx_image_rule,simximg, -s)
 $(call imx_image_rule,usimximg, -u -s)
+$(call imx_image_rule,dcdusimximg, -u -s -a)
 $(call imx_image_rule,esimximg, -e -s)
 $(call imx_image_rule,esimximg.dek, -e -s)
 

-- 
2.47.2

Re: [PATCH 3/3] mach-imx: Kconfig: add option for image with dcd auth block

[Ahmad Fatoum]

On 9/1/25 9:35 AM, Sascha Hauer wrote:
> From: Matthias Zoechmann <matthias.zoechmann@ife-doors.com>
> 
> Add option CONFIG_HABV4_IMAGE_SIGNED_USB_DCD to select build of barebox
> image for i.mx6 devices with an additional authentication block in CSF
> ("0x0091000 offset size filename").
> Additional the barebox toolchain will build now a signed image e.g.
> barebox-image-name-dcdus.img for usb loading with SDP DCD_WRITE ROM
> command.
> 
> Signed-off-by: Matthias Zoechmann <matthias.zoechmann@ife-doors.com>
> ---
>  arch/arm/mach-imx/Kconfig |  9 +++++++++
>  images/Makefile.imx       | 11 +++++++----
>  2 files changed, 16 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
> index 0d745ce2315834ec5d0c366d227b40f2adff5e83..ade4a4ce1783fc60f85aefab2da2df17a57bfe55 100644
> --- a/arch/arm/mach-imx/Kconfig
> +++ b/arch/arm/mach-imx/Kconfig
> @@ -945,6 +945,15 @@ config HABV4_IMAGE_SIGNED_USB
>  	  enable the creation of a usb signed image, if the habv4-imx6-gencsf.h
>  	  included in the flash-header and the NXP cst Tool is available
>  
> +config HABV4_IMAGE_SIGNED_USB_DCD
> +	bool "build signed USB images including DCD"
> +	depends on ARCH_IMX6
> +	depends on HABV4_IMAGE_SIGNED_USB
> +	help
> +	  enable the creation of a usb signed image loaded via SDP and DCD_WRITE
> +	  ROM command, if the habv4-imx6-gencsf.h included in the flash-header
> +	  and the NXP cst Tool is available

Can you add here the info that this makes the image loadable via uuu?
Can imx-usb-loader still load this image?

Cheers,
Ahmad

> +
>  config HABV4_IMAGE_SIGNED_ENCRYPTED
>  	bool "build signed encrypted images"
>  	help
> diff --git a/images/Makefile.imx b/images/Makefile.imx
> index 93264254e9e4cda3969bf7bf4812f2d1c5b59c09..8aa35a28e06ccffc9609054292eca026b17c0140 100644
> --- a/images/Makefile.imx
> +++ b/images/Makefile.imx
> @@ -9,13 +9,15 @@ $(eval
>  ifeq ($($(strip $(1))), y)
>  	pblb-y += $(strip $(2))
>  	CFG_$(strip $(2)).pblb.imximg = $(board)/$(strip $(3)).imxcfg
> -	FILE_barebox-$(strip $(4)).img    = $(strip $(2)).pblb.imximg
> -	FILE_barebox-$(strip $(4))-s.img  = $(strip $(2)).pblb.simximg
> -	FILE_barebox-$(strip $(4))-us.img = $(strip $(2)).pblb.usimximg
> -	FILE_barebox-$(strip $(4))-es.img = $(strip $(2)).pblb.esimximg
> +	FILE_barebox-$(strip $(4)).img       = $(strip $(2)).pblb.imximg
> +	FILE_barebox-$(strip $(4))-s.img     = $(strip $(2)).pblb.simximg
> +	FILE_barebox-$(strip $(4))-us.img    = $(strip $(2)).pblb.usimximg
> +	FILE_barebox-$(strip $(4))-dcdus.img = $(strip $(2)).pblb.dcdusimximg
> +	FILE_barebox-$(strip $(4))-es.img    = $(strip $(2)).pblb.esimximg
>  	image-y += barebox-$(strip $(4)).img
>  	image-$(CONFIG_HABV4_IMAGE_SIGNED) += barebox-$(strip $(4))-s.img
>  	image-$(CONFIG_HABV4_IMAGE_SIGNED_USB) += barebox-$(strip $(4))-us.img
> +	image-$(CONFIG_HABV4_IMAGE_SIGNED_USB_DCD) += barebox-$(strip $(4))-dcdus.img
>  	image-$(CONFIG_HABV4_IMAGE_SIGNED_ENCRYPTED) += barebox-$(strip $(4))-es.img
>  endif
>  )
> @@ -51,6 +53,7 @@ $(call imx_image_rule,pimximg, -p $$($$(patsubst $$(obj)/%.pblb,PBL_MEMORY_SIZE_
>  $(call imx_image_rule,psimximg, -p $$($$(patsubst $$(obj)/%.pblb,PBL_MEMORY_SIZE_%,$$<)) -s)
>  $(call imx_image_rule,simximg, -s)
>  $(call imx_image_rule,usimximg, -u -s)
> +$(call imx_image_rule,dcdusimximg, -u -s -a)
>  $(call imx_image_rule,esimximg, -e -s)
>  $(call imx_image_rule,esimximg.dek, -e -s)
>  
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |

Re: [PATCH 3/3] mach-imx: Kconfig: add option for image with dcd auth block

[Sascha Hauer]

On Mon, Sep 01, 2025 at 10:23:13AM +0200, Ahmad Fatoum wrote:
> 
> 
> On 9/1/25 9:35 AM, Sascha Hauer wrote:
> > From: Matthias Zoechmann <matthias.zoechmann@ife-doors.com>
> > 
> > Add option CONFIG_HABV4_IMAGE_SIGNED_USB_DCD to select build of barebox
> > image for i.mx6 devices with an additional authentication block in CSF
> > ("0x0091000 offset size filename").
> > Additional the barebox toolchain will build now a signed image e.g.
> > barebox-image-name-dcdus.img for usb loading with SDP DCD_WRITE ROM
> > command.
> > 
> > Signed-off-by: Matthias Zoechmann <matthias.zoechmann@ife-doors.com>
> > ---
> >  arch/arm/mach-imx/Kconfig |  9 +++++++++
> >  images/Makefile.imx       | 11 +++++++----
> >  2 files changed, 16 insertions(+), 4 deletions(-)
> > 
> > diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
> > index 0d745ce2315834ec5d0c366d227b40f2adff5e83..ade4a4ce1783fc60f85aefab2da2df17a57bfe55 100644
> > --- a/arch/arm/mach-imx/Kconfig
> > +++ b/arch/arm/mach-imx/Kconfig
> > @@ -945,6 +945,15 @@ config HABV4_IMAGE_SIGNED_USB
> >  	  enable the creation of a usb signed image, if the habv4-imx6-gencsf.h
> >  	  included in the flash-header and the NXP cst Tool is available
> >  
> > +config HABV4_IMAGE_SIGNED_USB_DCD
> > +	bool "build signed USB images including DCD"
> > +	depends on ARCH_IMX6
> > +	depends on HABV4_IMAGE_SIGNED_USB
> > +	help
> > +	  enable the creation of a usb signed image loaded via SDP and DCD_WRITE
> > +	  ROM command, if the habv4-imx6-gencsf.h included in the flash-header
> > +	  and the NXP cst Tool is available
> 
> Can you add here the info that this makes the image loadable via uuu?
> Can imx-usb-loader still load this image?

I did, but that change didn't make it into this patchset :(

I would add:

	The image will have the filename ending
	*-dcdusb.img and is compatible with NXPs uuu tool. The images are not
	compatible with imx-usb-loader.

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |