From 1e9b367fe6a070ee6610f3874ad21051e1f8ea12 Mon Sep 17 00:00:00 2001 From: David Garske Date: Fri, 6 Nov 2026 10:06:38 -0800 Subject: [PATCH 1/2] Fix the i.MX8QM SDP load command and add a keep-keys build option --- docs/Targets.md | 4 ++++ tools/scripts/imx8qm/imx8qm-flash.sh | 6 ++++-- tools/scripts/imx8qm/imx8qm-mkflashbin.sh | 8 ++++++-- 3 files changed, 14 insertions(+), 4 deletions(-) diff --git a/docs/Targets.md b/docs/Targets.md index ac736baf21..2b87a5fa31 100644 --- a/docs/Targets.md +++ b/docs/Targets.md @@ -10034,6 +10034,8 @@ IMX_FIRMWARE=/path/to/firmware \ tools/scripts/imx8qm/imx8qm-mkflashbin.sh [device-tree.dtb] ``` +Each run generates a new signing key, which invalidates any payload signed earlier, such as a FIT already on the boot medium. Set `KEEP_KEYS=1` to build against the key already in the tree instead. + `IMX_FIRMWARE` must hold three binaries from the NXP BSP, none of which are redistributable. Without `IMX_MKIMAGE`/`IMX_FIRMWARE` the script stops after producing the BL33 bundle in `wolfboot.bin`, which can be passed to `imx-mkimage` by hand in place of `u-boot.bin`. | File | Source (LF v6.1.22-2.0.0) | @@ -10096,6 +10098,8 @@ SDP loads the container straight into RAM over USB and writes nothing to the boa tools/scripts/imx8qm/imx8qm-flash.sh sdp flash.bin ``` +With more than one i.MX in serial download mode attached, set `UUU_PATH` to the board's USB path as `uuu -lsusb` prints it. + To boot from a microSD card, write the container at the 32 KB offset the boot ROM reads from and set SW2 to SD1 (POS-3 and POS-4): ``` diff --git a/tools/scripts/imx8qm/imx8qm-flash.sh b/tools/scripts/imx8qm/imx8qm-flash.sh index d3596c0618..443c8bad7d 100755 --- a/tools/scripts/imx8qm/imx8qm-flash.sh +++ b/tools/scripts/imx8qm/imx8qm-flash.sh @@ -7,7 +7,9 @@ # sdp Serial Download Protocol. Set SW2 [D1-D6] to 000100, connect the J17 # USB port, and load the container straight into RAM over USB with # uuu. Nothing is written to the board, so this is the safe way to try -# a build. Power-cycle to go back to the previous image. +# a build. Power-cycle to go back to the previous image. With more +# than one i.MX in serial download mode attached, set UUU_PATH to the +# board's USB path as "uuu -lsusb" prints it. # # sd Write the container to a microSD card in the host's reader. The boot # ROM reads it from a 32 KB offset. Set SW2 to 001100 (SD1) to boot it. @@ -30,7 +32,7 @@ sdp) [ -f "$IMAGE" ] || { echo "ERROR: no such image: $IMAGE" >&2; exit 1; } command -v uuu >/dev/null || { echo "ERROR: uuu not found in PATH" >&2; exit 1; } echo "Set SW2 [D1-D6] to 000100 (SDP) and power-cycle the board, then:" - uuu -b sdps "$IMAGE" + uuu ${UUU_PATH:+-m "$UUU_PATH"} SDPS: boot -f "$IMAGE" ;; sd) diff --git a/tools/scripts/imx8qm/imx8qm-mkflashbin.sh b/tools/scripts/imx8qm/imx8qm-mkflashbin.sh index 775f31ecb5..f4aa5e0768 100755 --- a/tools/scripts/imx8qm/imx8qm-mkflashbin.sh +++ b/tools/scripts/imx8qm/imx8qm-mkflashbin.sh @@ -44,7 +44,9 @@ cd "$(dirname "$0")/../../.." # NOTE: this overwrites .config, wolfboot.bin, and the signing keys in the # working tree (it runs "make keysclean" so wolfBoot and the payload are built -# against one freshly generated key). +# against one freshly generated key). KEEP_KEYS=1 skips the keysclean and +# builds against the key already in the tree, so payloads signed with it, such +# as a FIT on the boot medium, still verify. PAYLOAD_OFFSET=$((0x200000)) # IMX8QM_BUNDLE_OFFSET (hal/imx8qm.h) DTB_OFFSET=$((0x300000)) # IMX8QM_DTB_OFFSET (hal/imx8qm.h) @@ -96,7 +98,9 @@ pad_to() { cp "$CONFIG" .config # A failure here would silently reuse stale keys, so do not swallow it. -make keysclean >/dev/null +if [ "${KEEP_KEYS:-0}" != "1" ]; then + make keysclean >/dev/null +fi make clean >/dev/null # Build wolfBoot and the signed payload together so they share one key. # shellcheck disable=SC2086 # MAKE_ARGS must word-split into separate options From 95b7d7b86e09a7144ffb5289ee0b2a4820502a87 Mon Sep 17 00:00:00 2001 From: David Garske Date: Fri, 6 Nov 2026 10:06:38 -0800 Subject: [PATCH 2/2] Remove all wolfSSL port objects in make clean --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 4c85898abf..d0429334fc 100644 --- a/Makefile +++ b/Makefile @@ -953,7 +953,7 @@ clean: $(Q)rm -f src/wolfboot_tz_nsc.o $(Q)rm -f *.asm # TI cl2000 (ARCH=C2000) intermediate listings in repo root $(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/src/fwtpm/*.o $(WOLFBOOT_LIB_WOLFTPM)/hal/*.o $(WOLFBOOT_LIB_WOLFTPM)/examples/pcr/*.o - $(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/Renesas/*.o + $(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/*/*.o $(Q)rm -f wolfboot.bin wolfboot.elf wolfboot.map test-update.rom wolfboot.hex wolfboot.srec factory.srec $(Q)rm -f $(MACHINE_OBJ) $(MAIN_TARGET) $(LSCRIPT) $(Q)rm -f $(OBJS)