Skip to content

Fix i.MX8QM SDP loading and stale wolfSSL port objects after make clean #978

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dgarske wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Fix i.MX8QM SDP loading and stale wolfSSL port objects after make clean #978

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1e9b367
Fix the i.MX8QM SDP load command and add a keep-keys build option
dgarske Nov 6, 2026
95b7d7b
Remove all wolfSSL port objects in make clean
dgarske Nov 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -953,7 +953,7 @@ clean:
$(Q)rm -f src/wolfboot_tz_nsc.o
$(Q)rm -f *.asm # TI cl2000 (ARCH=C2000) intermediate listings in repo root
$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/src/*.o $(WOLFBOOT_LIB_WOLFTPM)/src/fwtpm/*.o $(WOLFBOOT_LIB_WOLFTPM)/hal/*.o $(WOLFBOOT_LIB_WOLFTPM)/examples/pcr/*.o
$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/Renesas/*.o
$(Q)rm -f $(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/port/*/*.o
$(Q)rm -f wolfboot.bin wolfboot.elf wolfboot.map test-update.rom wolfboot.hex wolfboot.srec factory.srec
$(Q)rm -f $(MACHINE_OBJ) $(MAIN_TARGET) $(LSCRIPT)
$(Q)rm -f $(OBJS)
Expand Down
4 changes: 4 additions & 0 deletions docs/Targets.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10034,6 +10034,8 @@ IMX_FIRMWARE=/path/to/firmware \
tools/scripts/imx8qm/imx8qm-mkflashbin.sh [device-tree.dtb]
```

Each run generates a new signing key, which invalidates any payload signed earlier, such as a FIT already on the boot medium. Set `KEEP_KEYS=1` to build against the key already in the tree instead.

`IMX_FIRMWARE` must hold three binaries from the NXP BSP, none of which are redistributable. Without `IMX_MKIMAGE`/`IMX_FIRMWARE` the script stops after producing the BL33 bundle in `wolfboot.bin`, which can be passed to `imx-mkimage` by hand in place of `u-boot.bin`.

| File | Source (LF v6.1.22-2.0.0) |
Expand Down Expand Up @@ -10096,6 +10098,8 @@ SDP loads the container straight into RAM over USB and writes nothing to the boa
tools/scripts/imx8qm/imx8qm-flash.sh sdp flash.bin
```

With more than one i.MX in serial download mode attached, set `UUU_PATH` to the board's USB path as `uuu -lsusb` prints it.

To boot from a microSD card, write the container at the 32 KB offset the boot ROM reads from and set SW2 to SD1 (POS-3 and POS-4):

```
Expand Down
6 changes: 4 additions & 2 deletions tools/scripts/imx8qm/imx8qm-flash.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,9 @@
# sdp Serial Download Protocol. Set SW2 [D1-D6] to 000100, connect the J17
# USB port, and load the container straight into RAM over USB with
# uuu. Nothing is written to the board, so this is the safe way to try
# a build. Power-cycle to go back to the previous image.
# a build. Power-cycle to go back to the previous image. With more
# than one i.MX in serial download mode attached, set UUU_PATH to the
# board's USB path as "uuu -lsusb" prints it.
#
# sd Write the container to a microSD card in the host's reader. The boot
# ROM reads it from a 32 KB offset. Set SW2 to 001100 (SD1) to boot it.
Expand All @@ -30,7 +32,7 @@ sdp)
[ -f "$IMAGE" ] || { echo "ERROR: no such image: $IMAGE" >&2; exit 1; }
command -v uuu >/dev/null || { echo "ERROR: uuu not found in PATH" >&2; exit 1; }
echo "Set SW2 [D1-D6] to 000100 (SDP) and power-cycle the board, then:"
uuu -b sdps "$IMAGE"
uuu ${UUU_PATH:+-m "$UUU_PATH"} SDPS: boot -f "$IMAGE"
;;

sd)
Expand Down
8 changes: 6 additions & 2 deletions tools/scripts/imx8qm/imx8qm-mkflashbin.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,9 @@ cd "$(dirname "$0")/../../.."

# NOTE: this overwrites .config, wolfboot.bin, and the signing keys in the
# working tree (it runs "make keysclean" so wolfBoot and the payload are built
# against one freshly generated key).
# against one freshly generated key). KEEP_KEYS=1 skips the keysclean and
# builds against the key already in the tree, so payloads signed with it, such
# as a FIT on the boot medium, still verify.

PAYLOAD_OFFSET=$((0x200000)) # IMX8QM_BUNDLE_OFFSET (hal/imx8qm.h)
DTB_OFFSET=$((0x300000)) # IMX8QM_DTB_OFFSET (hal/imx8qm.h)
Expand Down Expand Up @@ -96,7 +98,9 @@ pad_to() {

cp "$CONFIG" .config
# A failure here would silently reuse stale keys, so do not swallow it.
make keysclean >/dev/null
if [ "${KEEP_KEYS:-0}" != "1" ]; then
make keysclean >/dev/null
fi
make clean >/dev/null
# Build wolfBoot and the signed payload together so they share one key.
# shellcheck disable=SC2086 # MAKE_ARGS must word-split into separate options
Expand Down
Loading