i.MX 8ULP AHAB with U-BOOT

This notebook describes how to build a bootable AHAB image with ELE firmware and U-BOOT bootloader, load it using the NXPUUU app and how to use NXPELE app. We are going to reproduce the flash_singleboot image created by the imx-mkimage tool.

1. Prerequisites

• SPSDK is needed with examples extension. pip install spsdk[examples] (Please refer to the installation documentation.)

• This demo was tested with i.MX93 EVK board

1.1 Images preparation

• to create resulting binary containing AHAB containers, we need to prepare the binaries

• in this section we reproduce the process which is done by the imx-mkimage tool as flash singleboot binary

• Obtain all the necessary binaries (upower, u-boot, bl31, ELE firmware) and put them into inputs directory

1.2 U-Boot

Read the U-Boot documentation to understand the U-Boot build process In order to use the nxpele app, U-Boot must be built with AHAB support. CONFIG_AHAB_BOOT=y If you want to use the nxpele over fastboot, also multiplexing of console output to fastboot must be enabled by setting CONFIG_CONSOLE_MUX=y.

1.3 Requirements

Download these files from the https://www.nxp.com/lgfiles/NMG/MAD/YOCTO/<package name> and put them into the inputs directory.

• uPower

• u-boot binary (u-boot SPL and u-boot) built with AHAB support.

• bl31.bin binary (ARM Trusted Firmware)

• ELE firmware binary AHAB

• i.MX8ULP EVK board

2. AHAB Image

The U-Boot image (flash.bin created by imx-mkimage) consists of two container sets - first container set is load to OCRAM using the SDPS protocol supported by ROM. The first container set contains U-Boot SPL binary, ELE firmware and uPower firmware. The second container set contains the full U-Boot and ATF image and is loaded to DDR by U-Boot SPL.

2.1 AHAB Template

We can generate the template using the nxpimage ahab get-template command. The command will generate a template. The template is a YAML file that contains the AHAB header and the AHAB container. The AHAB header contains the information about the image, such as the version, the number of containers, and the signature. The AHAB container contains the information about the image, such as the image type, the image version, the image size, and the image signature.

The following command generates the template:

nxpimage ahab get-template -f mimx8ulp -o ahab_template.yaml

2.2 Exporting of the AHAB image

The AHAB image can be exported using the nxpimage ahab export command. The command will create the AHAB image from the template. The following command creates the AHAB image:

nxpimage ahab export -c ahab_template.yaml 

2.3 U-Boot SPL image

U-Boot SPL image contains ELE firmware (Optional), uPower, and U-Boot SPL binary. It is the first container set that is loaded to OCRAM by ROM using SDPS protocol. Let’s prepare the configuration from the template.

nxpimage ahab get-template -f mimx8ulp -o workspace/ahab_template.yaml --force 
Creating workspace/ahab_template.yaml template file.

Configuration Differences

Show Diff Download Config

# ========================  Advanced High-Assurance Boot Configuration template for mimx8ulp.  =========================

# ======================================================================================================================
#                                                 == General Options ==                                                 
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
# Possible options: 
family: mimx8ulp
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: 
revision: latest
# -----------------------------------------===== Target memory [Optional] =====-----------------------------------------
# Description: Target memory for AHAB container
# Possible options: 
target_memory: standard Change the target memory to serial downloader
target_memory: serial_downloader
# ---------------------------------------===== Output file name [Required] =====----------------------------------------
# Description: Output AHAB file name
output: generated_ahab.bin Change the output file name
output: outputs/u-boot-spl-container.img
# ------------------------------===== List of containers present in AHAB [Required] =====-------------------------------
# Description: The order of containers in the list defines the order in AHAB.
containers: All
attributes related to the signing might be removed
  -
  # ====================================================================================================================
  #                                          == List of possible 2 options. ==                                          
  #                                        Options [binary_container, container]                                        
  # ====================================================================================================================

  #  =========================== [Example of possible configuration: #0 , erase if not used] ============================
    # -----------------------------------===== Binary AHAB container [Required] =====-----------------------------------
    # Description: Binary Container format to add to AHAB image, Typically it could be used to add ELE Firmware.
    binary_container: Define the path to the EdgeLock Enclave Firmware container
  - binary_container:
      # -----------------------------===== The AHAB container binary file [Required] =====------------------------------
      # Description: The binary file that contains AHAB "my_binary_container.bin
      path: my_ahab_container.bin All attributes related to the signing might be removed
      path: inputs/mx8ulpa2-ahab-container.img

  #  =========================== [Example of possible configuration: #1 , erase if not used] ============================
    # --------------------------------------===== AHAB Container [Required] =====---------------------------------------
    # Description: Configurable Container format to add to AHAB image. This allow to configure all aspects of the AHAB
    # container.
    container: All attributes related to the signing might be removed
  - container:
      # --------------------------------===== Super Root Key (SRK) set [Required] =====---------------------------------
      # Description: Defines which set is used to authenticate the container.
      # Possible options: 
      srk_set: none
      # ---------------------------------===== Used SRK [Conditionally required] =====----------------------------------
      # Description: Which key from SRK set is being used.
      used_srk_id: 0
      # -------------------------------------===== SRK revoke mask [Optional] =====-------------------------------------
      # Description: Bit-mask to indicate which SRKs to revoke. Bit set to 1 means revoke key. Bit 0 = revoke SRK_0, bit
      # 1 = revoke SRK_1 etc. Example of revocation SRK_0 and SRK_1 - the value should be 0x03
      srk_revoke_mask: '0x00'
      # ----------------------------------===== GDET runtime behavior [Optional] =====----------------------------------
      # Description: This option defines runtime behavior of Glitch detector. Not supported by all devices and their ELE
      # firmware.
      #  - disabled:       GDET is disabled after the first OEM container has been authenticated (default behavior)
      #  - enabled_eleapi: Automatically enable GDET during all ELE API calls
      #  - enabled:        Leave GDET enabled
      # Possible options: 
      gdet_runtime_behavior: disabled
      # --------------------------------------===== Fuse version [Optional] =====---------------------------------------
      # Description: The value must be equal or greater than the version stored in fuses to allow loading this
      # container.
      fuse_version: 0
      # ------------------------------------===== Software version [Optional] =====-------------------------------------
      # Description: Number used by Privileged Host Boot Companion (PHBC) to select between multiple images with same
      # Fuse version field.
      sw_version: 0
      # -------------------------------===== AHAB container signing key [Optional] =====--------------------------------
      # Description: Private key used for sign the container header. Header can be signed by SRK. The referenced SRK
      # must not have been revoked.
      signing_key: my_signing_key.pem
      # -----------------------------------===== Signature Provider [Optional] =====------------------------------------
      # Description: Signature provider configuration in format 'type=;=;='. The
      # signature provider could be used instead of definition of 'signing_key'.
      signature_provider: type=file;file_path=my_prv_key.pem

      # ================================================================================================================
      #                     == Configuration of AHAB Container images (array of multiple images) ==                     
      # ================================================================================================================
      # ---------------------------------------===== Image array [Required] =====---------------------------------------
      # Description: Array of image entries.
      images:
        -
        # ==============================================================================================================
        #                                       == List of possible 7 options. ==                                       
        #   Options [uPower, SPL, Uboot ATF, Uboot, TEE Trusted Execution Environment, MCU Image, General Image Entry]  
        # ==============================================================================================================

        #  ===================== [Example of possible configuration: #0 uPower, erase if not used] ======================
        # uPower firmware
        # Image array default settings. Can be overridden by definitions that are hidden in the template:
        # load_address:                  0x0000000028300200
        # image_type:                    executable
        # core_id:                       cortex-a53
        # hash_type:                     SHA384
          # ---------------------------------------===== uPower [Required] =====----------------------------------------
          # Description: uPower firmware
          upower: upower.bin
        - upower: upower.bin

        #  ======================= [Example of possible configuration: #1 SPL, erase if not used] =======================
        # U-Boot SPL (Secondary program loader)
        # Image array default settings. Can be overridden by definitions that are hidden in the template:
        # load_address:                  0x0000000022020000
        # image_type:                    executable
        # core_id:                       cortex-a55
        # meta_data_start_cpu_id:        2
        # hash_type:                     SHA384
          # -----------------------------------------===== SPL [Required] =====-----------------------------------------
          # Description: SPL firmware
          spl: spl.bin Add path to the U-Boot SPL image
        - spl: u-boot-spl.bin

        #  ==================== [Example of possible configuration: #2 Uboot ATF, erase if not used] ====================
        # U-Boot ATF container definition
        # Image array default settings. Can be overridden by definitions that are hidden in the template:
        # load_address:                  0x0000000020040000
        # image_type:                    executable
        # core_id:                       cortex-a55
        # hash_type:                     SHA384
          # -------------------------------------===== ATF binary [Required] =====--------------------------------------
          # Description: ARM Trusted Firmware binary file.
          atf: bl31.bin

        #  ====================== [Example of possible configuration: #3 Uboot, erase if not used] ======================
        # U-Boot container definition
        # Image array default settings. Can be overridden by definitions that are hidden in the template:
        # load_address:                  0x0000000080200000
        # image_type:                    executable
        # core_id:                       cortex-a55
        # hash_type:                     SHA384
          # ------------------------------------===== U-Boot binary [Required] =====------------------------------------
          # Description: U-Boot binary file.
          uboot: u-boot.bin

        #  ======== [Example of possible configuration: #4 TEE Trusted Execution Environment, erase if not used] ========
        # A TEE (Trusted Execution Environment) is a trusted OS running in some secure environment, for example, TrustZone on ARM CPUs, or a separate secure co-processor etc. A TEE driver handles the details needed to communicate with the TEE.
        # Image array default settings. Can be overridden by definitions that are hidden in the template:
        # load_address:                  0x00000000A6000000
        # image_type:                    executable
        # core_id:                       cortex-a55
        # hash_type:                     SHA384
          # -----------------------------------------===== TEE [Required] =====-----------------------------------------
          # Description: TEE - Trusted Execution Environment binary
          tee: tee.bin

        #  ==================== [Example of possible configuration: #5 MCU Image, erase if not used] ====================
        # MCU Image
          # --------------------------------------===== MCU Image [Required] =====--------------------------------------
          # Description: MCU Image
          mcu: m33_image.bin

        #  =============== [Example of possible configuration: #6 General Image Entry, erase if not used] ===============
        # General Image Entry
          # -------------------------------------===== Image path [Optional] =====--------------------------------------
          # Description: Path to image binary (absolute/relative). In case that only Image Array entry without any data
          # image is needed, Just do not use the image path. In case that the image size in container should be aligned
          # differently then SPSDK do (4 bytes for ELE images, 1 byte otherwise), there is hidden option
          # 'image_size_alignment' where could be override image size by any custom value.
          image_path: my_image.bin
          # ---------------------------===== Image offset in AHAB container [Optional] =====----------------------------
          # Description: Offset in bytes from start of container header to beginning of the image. Zero value means
          # automatic placing the image with proper alignment after previous one, this is recommended for
          # serial_downloader mode. In case of XiP type of AHAB image, the load_address and entry_point must correspond
          # to this values. Example of setting of load_address - AHAB_IMAGE_ADDRESS+IMAGE_OFFSET=LOAD_ADDRESS. The
          # Booting core images must be located after the other ones
          image_offset: 0
          # ------------------------------===== Image destination address [Required] =====------------------------------
          # Description: Address the image is written to in memory (absolute address in system memory).
          load_address: '0x1FFC_0000'
          # ----------------------------------===== Image entry point [Required] =====----------------------------------
          # Description: Image entry point (absolute address). Valid only for executable image types.
          entry_point: '0x1FFC_0000'
          # -------------------------------------===== Image type [Required] =====--------------------------------------
          # Description: Kind of image.
          # Possible options: 
          image_type: executable
          # ---------------------------------------===== Core ID [Required] =====---------------------------------------
          # Description: Defines the core the image is dedicated for. Not all cores are supported for all families.
          # Possible options: 
          core_id: cortex-m33
          # ----------------------------------===== Image encryption [Required] =====-----------------------------------
          # Description: Determines, whether image is encrypted or not.
          is_encrypted: false
          # -------------------------------------===== Boot flags [Optional] =====--------------------------------------
          # Description: Boot flags controlling SCFW boot.
          boot_flags: 0
          # ------------------------------------===== Start CPU ID [Optional] =====-------------------------------------
          # Description: Resource ID of CPU to be started
          meta_data_start_cpu_id: 0
          # ------------------------------===== CPU memory unit start ID [Optional] =====-------------------------------
          # Description: Resource ID of the MU associated with the CPU
          meta_data_mu_cpu_id: 0
          # ---------------------------------===== Start partition ID [Optional] =====----------------------------------
          # Description: Partition ID of the partition to start
          meta_data_start_partition_id: 0
          # ----------------------------------===== Images HASH type [Optional] =====-----------------------------------
          # Description: HASH type of image.
          # Possible options: 
          hash_type: sha512

      # ================================================================================================================
      #                                      == Configuration of AHAB SRK table ==                                      
      # ================================================================================================================
      # ---------------------------------===== SRK Table [Conditionally required] =====---------------------------------
      # Description: SRK (Super Root key) table definition.
      srk_table:
        # ----------------------------------------===== CA Flag [Optional] =====----------------------------------------
        # Description: CA Flag is used by HAB to indicate if the SRK is allowed to sign other keys
        flag_ca: false
        # ------------------------------===== Super Root Key (SRK) table [Required] =====-------------------------------
        # Description: Table containing the used SRK records. All SRKs must be of the same type. Supported signing
        # algorithms are: RSA-PSS, ECDSA, Dilithium or SM2. Supported hash algorithms: sha256, sha384, sha512, sha3_256,
        # sha3_384, sha3_512, sm3. Supported key sizes/curves: prime256v1, sec384r1, sec512r1, rsa2048, rsa4096,
        # dilithium3, sm2. Certificate may be of Certificate Authority. Dilithium algorithms are supported just in new
        # type of AHAB container
        srk_array:
          - my_srk_public_key0.pub
          - my_srk_public_key1.pub
          - my_srk_public_key2.pub
          - my_srk_public_key3.pub

      # ================================================================================================================
      #         == Optional configuration of AHAB Container Encryption blob (if not used, erase the section) ==         
      # ================================================================================================================
      # -------------------------------------===== Encryption blob [Optional] =====-------------------------------------
      # Description: Encryption blob container definition
      blob: And
finally remove unused parts for AHAB Certificate and Encryption blob
        # ------------------------------------===== Key identifier [Required] =====-------------------------------------
        # Description: The key identifier that has been used to generate DEK keyblob.
        key_identifier: 0
        # -------------------------------------===== DEK key size [Required] =====--------------------------------------
        # Description: Data Encryption key size. Used for AES CBC-MAC (128/192/256 size)
        # Possible options: <128, 192, 256>
        dek_key_size: 128
        # ----------------------------------------===== DEK key [Required] =====----------------------------------------
        # Description: Data Encryption key. Used for AES CBC-MAC (128/192/256 size). The HEX format is accepted
        dek_key: my_dek_key.txt
        # --------------------------------------===== DEK keyblob [Optional] =====--------------------------------------
        # Description: Wrapped Data Encryption key. Used for AES CBC-MAC (128/192/256 size). The HEX format is accepted.
        # If NOT used, the empty keyblob is inserted into container and need to be updated later.
        dek_keyblob: my_wrapped_key.txt And finally remove unused parts for AHAB Certificate and Encryption blob

# ========================  Advanced High-Assurance Boot Configuration template for mimx8ulp.  =========================

# ======================================================================================================================
#                                                 == General Options ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
# Possible options: 
family: mimx8ulp
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: 
revision: latest
# -----------------------------------------===== Target memory [Optional] =====-----------------------------------------
# Description: Target memory for AHAB container
# Possible options: 
target_memory: serial_downloader Change the target memory to serial downloader
# ---------------------------------------===== Output file name [Required] =====----------------------------------------
# Description: Output AHAB file name
output: outputs/u-boot-spl-container.img Change the output file name
# ------------------------------===== List of containers present in AHAB [Required] =====-------------------------------
# Description: The order of containers in the list defines the order in AHAB.
containers: All
attributes related to the signing might be removed
  # ====================================================================================================================
  #                                          == List of possible 2 options. ==
  #                                        Options [binary_container, container]
  # ====================================================================================================================

  #  =========================== [Example of possible configuration: #0 , erase if not used] ============================
  # -----------------------------------===== Binary AHAB container [Required] =====-----------------------------------
  # Description: Binary Container format to add to AHAB image, Typically it could be used to add ELE Firmware.
  - binary_container: Define the path to the EdgeLock Enclave Firmware container
      # -----------------------------===== The AHAB container binary file [Required] =====------------------------------
      # Description: The binary file that contains AHAB "my_binary_container.bin
      path: inputs/mx8ulpa2-ahab-container.img All attributes related to the signing might be removed

    #  =========================== [Example of possible configuration: #1 , erase if not used] ============================
    # --------------------------------------===== AHAB Container [Required] =====---------------------------------------
    # Description: Configurable Container format to add to AHAB image. This allow to configure all aspects of the AHAB
    # container.
  - container: All attributes related to the signing might be removed
      # --------------------------------===== Super Root Key (SRK) set [Required] =====---------------------------------
      # Description: Defines which set is used to authenticate the container.
      # Possible options: 
      srk_set: none

      # ================================================================================================================
      #                     == Configuration of AHAB Container images (array of multiple images) ==
      # ================================================================================================================
      # ---------------------------------------===== Image array [Required] =====---------------------------------------
      # Description: Array of image entries.
      images:
        # ==============================================================================================================
        #                                       == List of possible 5 options. ==
        #           Options [uPower, SPL, Uboot ATF, Uboot, TEE Trusted Execution Environment, General Image Entry]
        # ==============================================================================================================

        #  ===================== [Example of possible configuration: #0 uPower, erase if not used] ======================
        # uPower firmware
        # Image array default settings. Can be overridden by definitions that are hidden in the template:
        # load_address:                  0x0000000028300200
        # image_type:                    executable
        # core_id:                       cortex-a53
        # hash_type:                     SHA384
        # ---------------------------------------===== uPower [Required] =====----------------------------------------
        # Description: uPower firmware
        - upower: upower.bin

        #  ======================= [Example of possible configuration: #1 SPL, erase if not used] =======================
        # U-Boot SPL (Secondary program loader)
        # Image array default settings. Can be overridden by definitions that are hidden in the template:
        # load_address:                  0x0000000022020000
        # image_type:                    executable
        # core_id:                       cortex-a55
        # meta_data_start_cpu_id:        2
        # hash_type:                     SHA384
        # -----------------------------------------===== SPL [Required] =====-----------------------------------------
        # Description: SPL firmware
        - spl: u-boot-spl.bin Add path to the U-Boot SPL image

2.3 U-Boot ATF Image

The secondary container set contains the U-Boot and ATF images.

nxpimage ahab get-template -f mimx8ulp -o workspace/ahab_template.yaml --force
Creating workspace/ahab_template.yaml template file.

Configuration Differences

Show Diff Download Config

# ========================  Advanced High-Assurance Boot Configuration template for mimx8ulp.  =========================

# ======================================================================================================================
#                                                 == General Options ==                                                 
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
# Possible options: 
family: mimx8ulp
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: 
revision: latest
# -----------------------------------------===== Target memory [Optional] =====-----------------------------------------
# Description: Target memory for AHAB container
# Possible options: 
target_memory: standard Change the target memory to serial downloader
target_memory: serial_downloader
# ---------------------------------------===== Output file name [Required] =====----------------------------------------
# Description: Output AHAB file name
output: generated_ahab.bin Change the output file name
output: outputs/u-boot-atf-container.img
# ------------------------------===== List of containers present in AHAB [Required] =====-------------------------------
# Description: The order of containers in the list defines the order in AHAB.
containers: All
attributes related to the signing might be removed
  -
  # ====================================================================================================================
  #                                          == List of possible 2 options. ==                                          
  #                                        Options [binary_container, container]                                        
  # ====================================================================================================================

  #  =========================== [Example of possible configuration: #0 , erase if not used] ============================
    # -----------------------------------===== Binary AHAB container [Required] =====-----------------------------------
    # Description: Binary Container format to add to AHAB image, Typically it could be used to add ELE Firmware.
    binary_container: Define the path to the EdgeLock Enclave Firmware container
      # -----------------------------===== The AHAB container binary file [Required] =====------------------------------
      # Description: The binary file that contains AHAB "my_binary_container.bin
      path: my_ahab_container.bin All attributes related to the signing might be removed

  #  =========================== [Example of possible configuration: #1 , erase if not used] ============================
    # --------------------------------------===== AHAB Container [Required] =====---------------------------------------
    # Description: Configurable Container format to add to AHAB image. This allow to configure all aspects of the AHAB
    # container.
    container: All attributes related to the signing might be removed
  - container:
      # --------------------------------===== Super Root Key (SRK) set [Required] =====---------------------------------
      # Description: Defines which set is used to authenticate the container.
      # Possible options: 
      srk_set: none
      # ---------------------------------===== Used SRK [Conditionally required] =====----------------------------------
      # Description: Which key from SRK set is being used.
      used_srk_id: 0
      # -------------------------------------===== SRK revoke mask [Optional] =====-------------------------------------
      # Description: Bit-mask to indicate which SRKs to revoke. Bit set to 1 means revoke key. Bit 0 = revoke SRK_0, bit
      # 1 = revoke SRK_1 etc. Example of revocation SRK_0 and SRK_1 - the value should be 0x03
      srk_revoke_mask: '0x00'
      # ----------------------------------===== GDET runtime behavior [Optional] =====----------------------------------
      # Description: This option defines runtime behavior of Glitch detector. Not supported by all devices and their ELE
      # firmware.
      #  - disabled:       GDET is disabled after the first OEM container has been authenticated (default behavior)
      #  - enabled_eleapi: Automatically enable GDET during all ELE API calls
      #  - enabled:        Leave GDET enabled
      # Possible options: 
      gdet_runtime_behavior: disabled
      # --------------------------------------===== Fuse version [Optional] =====---------------------------------------
      # Description: The value must be equal or greater than the version stored in fuses to allow loading this
      # container.
      fuse_version: 0
      # ------------------------------------===== Software version [Optional] =====-------------------------------------
      # Description: Number used by Privileged Host Boot Companion (PHBC) to select between multiple images with same
      # Fuse version field.
      sw_version: 0
      # -------------------------------===== AHAB container signing key [Optional] =====--------------------------------
      # Description: Private key used for sign the container header. Header can be signed by SRK. The referenced SRK
      # must not have been revoked.
      signing_key: my_signing_key.pem
      # -----------------------------------===== Signature Provider [Optional] =====------------------------------------
      # Description: Signature provider configuration in format 'type=;=;='. The
      # signature provider could be used instead of definition of 'signing_key'.
      signature_provider: type=file;file_path=my_prv_key.pem

      # ================================================================================================================
      #                     == Configuration of AHAB Container images (array of multiple images) ==                     
      # ================================================================================================================
      # ---------------------------------------===== Image array [Required] =====---------------------------------------
      # Description: Array of image entries.
      images:
        - # ---------------------------------------===== ATF binary [Required] =====----------------------------------------
          atf: inputs/bl31.bin
        -
        # ==============================================================================================================
        #                                       == List of possible 6 options. ==                                       
        #        Options [uPower, SPL, Uboot ATF, Uboot, TEE Trusted Execution Environment, General Image Entry]        
        # ==============================================================================================================

        #  ===================== [Example of possible configuration: #0 uPower, erase if not used] ======================
        # uPower firmware
        # Image array default settings. Can be overridden by definitions that are hidden in the template:
        # load_address:                  0x0000000028300200
        # image_type:                    executable
        # core_id:                       cortex-a53
        # hash_type:                     SHA384
          # ---------------------------------------===== uPower [Required] =====----------------------------------------
        - # --------------------------------------===== U-Boot binary [Required] =====--------------------------------------
          # Description: uPower firmware
          upower: upower.bin
          uboot: inputs/u-boot.bin

        #  ======================= [Example of possible configuration: #1 SPL, erase if not used] =======================
        # U-Boot SPL (Secondary program loader)
        # Image array default settings. Can be overridden by definitions that are hidden in the template:
        # load_address:                  0x0000000022020000
        # image_type:                    executable
        # core_id:                       cortex-a55
        # meta_data_start_cpu_id:        2
        # hash_type:                     SHA384
          # -----------------------------------------===== SPL [Required] =====-----------------------------------------
          # Description: SPL firmware
          spl: spl.bin

        #  ==================== [Example of possible configuration: #2 Uboot ATF, erase if not used] ====================
        # U-Boot ATF container definition
        # Image array default settings. Can be overridden by definitions that are hidden in the template:
        # load_address:                  0x0000000020040000
        # image_type:                    executable
        # core_id:                       cortex-a55
        # hash_type:                     SHA384
          # -------------------------------------===== ATF binary [Required] =====--------------------------------------
          # Description: ARM Trusted Firmware binary file.
          atf: bl31.bin

        #  ====================== [Example of possible configuration: #3 Uboot, erase if not used] ======================
        # U-Boot container definition
        # Image array default settings. Can be overridden by definitions that are hidden in the template:
        # load_address:                  0x0000000080200000
        # image_type:                    executable
        # core_id:                       cortex-a55
        # hash_type:                     SHA384
          # ------------------------------------===== U-Boot binary [Required] =====------------------------------------
          # Description: U-Boot binary file.
          uboot: u-boot.bin

        #  ======== [Example of possible configuration: #4 TEE Trusted Execution Environment, erase if not used] ========
        # A TEE (Trusted Execution Environment) is a trusted OS running in some secure environment, for example, TrustZone on ARM CPUs, or a separate secure co-processor etc. A TEE driver handles the details needed to communicate with the TEE.
        # Image array default settings. Can be overridden by definitions that are hidden in the template:
        # load_address:                  0x00000000A6000000
        # image_type:                    executable
        # core_id:                       cortex-a55
        # hash_type:                     SHA384
          # -----------------------------------------===== TEE [Required] =====-----------------------------------------
          # Description: TEE - Trusted Execution Environment binary
          tee: tee.bin

        #  =============== [Example of possible configuration: #5 General Image Entry, erase if not used] ===============
        # General Image Entry
          # -------------------------------------===== Image path [Optional] =====--------------------------------------
          # Description: Path to image binary (absolute/relative). In case that only Image Array entry without any data
          # image is needed, Just do not use the image path. In case that the image size in container should be aligned
          # differently then SPSDK do (4 bytes for ELE images, 1 byte otherwise), there is hidden option
          # 'image_size_alignment' where could be override image size by any custom value.
          image_path: my_image.bin
          # ---------------------------===== Image offset in AHAB container [Optional] =====----------------------------
          # Description: Offset in bytes from start of container header to beginning of the image. Zero value means
          # automatic placing the image with proper alignment after previous one, this is recommended for
          # serial_downloader mode. In case of XiP type of AHAB image, the load_address and entry_point must correspond
          # to this values. Example of setting of load_address - AHAB_IMAGE_ADDRESS+IMAGE_OFFSET=LOAD_ADDRESS. The
          # Booting core images must be located after the other ones
          image_offset: 0
          # ------------------------------===== Image destination address [Required] =====------------------------------
          # Description: Address the image is written to in memory (absolute address in system memory).
          load_address: '0x1FFC_0000'
          # ----------------------------------===== Image entry point [Required] =====----------------------------------
          # Description: Image entry point (absolute address). Valid only for executable image types.
          entry_point: '0x1FFC_0000'
          # -------------------------------------===== Image type [Required] =====--------------------------------------
          # Description: Kind of image.
          # Possible options: 
          image_type: executable
          # ---------------------------------------===== Core ID [Required] =====---------------------------------------
          # Description: Defines the core the image is dedicated for. Not all cores are supported for all families.
          # Possible options: 
          core_id: cortex-m33
          # ----------------------------------===== Image encryption [Required] =====-----------------------------------
          # Description: Determines, whether image is encrypted or not.
          is_encrypted: false
          # -------------------------------------===== Boot flags [Optional] =====--------------------------------------
          # Description: Boot flags controlling SCFW boot.
          boot_flags: 0
          # ------------------------------------===== Start CPU ID [Optional] =====-------------------------------------
          # Description: Resource ID of CPU to be started
          meta_data_start_cpu_id: 0
          # ------------------------------===== CPU memory unit start ID [Optional] =====-------------------------------
          # Description: Resource ID of the MU associated with the CPU
          meta_data_mu_cpu_id: 0
          # ---------------------------------===== Start partition ID [Optional] =====----------------------------------
          # Description: Partition ID of the partition to start
          meta_data_start_partition_id: 0
          # ----------------------------------===== Images HASH type [Optional] =====-----------------------------------
          # Description: HASH type of image.
          # Possible options: 
          hash_type: sha512

      # ================================================================================================================
      #                                      == Configuration of AHAB SRK table ==                                      
      # ================================================================================================================
      # ---------------------------------===== SRK Table [Conditionally required] =====---------------------------------
      # Description: SRK (Super Root key) table definition.
      srk_table: Remove srk table definition
        # ----------------------------------------===== CA Flag [Optional] =====----------------------------------------
        # Description: CA Flag is used by HAB to indicate if the SRK is allowed to sign other keys
        flag_ca: false
        # ------------------------------===== Super Root Key (SRK) table [Required] =====-------------------------------
        # Description: Table containing the used SRK records. All SRKs must be of the same type. Supported signing
        # algorithms are: RSA-PSS, ECDSA, Dilithium or SM2. Supported hash algorithms: sha256, sha384, sha512, sha3_256,
        # sha3_384, sha3_512, sm3. Supported key sizes/curves: prime256v1, sec384r1, sec512r1, rsa2048, rsa4096,
        # dilithium3, sm2. Certificate may be of Certificate Authority. Dilithium algorithms are supported just in new
        # type of AHAB container
        srk_array:
          - my_srk_public_key0.pub
          - my_srk_public_key1.pub
          - my_srk_public_key2.pub
          - my_srk_public_key3.pub

      # ================================================================================================================
      #         == Optional configuration of AHAB Container Encryption blob (if not used, erase the section) ==         
      # ================================================================================================================
      # -------------------------------------===== Encryption blob [Optional] =====-------------------------------------
      # Description: Encryption blob container definition
      blob: And
finally remove unused parts for AHAB Certificate and Encryption blob
        # ------------------------------------===== Key identifier [Required] =====-------------------------------------
        # Description: The key identifier that has been used to generate DEK keyblob.
        key_identifier: 0
        # -------------------------------------===== DEK key size [Required] =====--------------------------------------
        # Description: Data Encryption key size. Used for AES CBC-MAC (128/192/256 size)
        # Possible options: <128, 192, 256>
        dek_key_size: 128
        # ----------------------------------------===== DEK key [Required] =====----------------------------------------
        # Description: Data Encryption key. Used for AES CBC-MAC (128/192/256 size). The HEX format is accepted
        dek_key: my_dek_key.txt
        # --------------------------------------===== DEK keyblob [Optional] =====--------------------------------------
        # Description: Wrapped Data Encryption key. Used for AES CBC-MAC (128/192/256 size). The HEX format is accepted.
        # If NOT used, the empty keyblob is inserted into container and need to be updated later.
        dek_keyblob: my_wrapped_key.txt And finally remove unused parts for AHAB Certificate and Encryption blob

# =============================  AHAB recreated configuration from :06/02/2024 13:32:32.  ==============================

# ======================================================================================================================
#                                                 == General Options ==
# ======================================================================================================================
# ------------------------------------------===== MCU family [Required] =====-------------------------------------------
# Description: Family identifier including the chip revision. If revision is not present, latest revision is used as
# default.
# Possible options: 
family: mimx8ulp
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon
revision: latest
# ----------------------------------===== Target memory [Conditionally required] =====----------------------------------
# Description: Target memory for AHAB container
# Possible options: 
target_memory: serial_downloader Change the target memory to serial downloader
# ---------------------------------------===== Output file name [Required] =====----------------------------------------
# Description: Output AHAB file name
output: outputs/u-boot-atf-container.img Change the output file name
# ------------------------------===== List of containers present in AHAB [Required] =====-------------------------------
# Description: The order of containers in the list defines the order in AHAB.
containers: All
attributes related to the signing might be removed
  - container: All attributes related to the signing might be removed
      # --------------------------------===== Super Root Key (SRK) set [Required] =====---------------------------------
      # Description: Defines which set is used to authenticate the container.
      # Possible options: 
      srk_set: none
      # ================================================================================================================
      #                     == Configuration of AHAB Container images (array of multiple images) ==
      # ================================================================================================================
      # ---------------------------------------===== Image array [Required] =====---------------------------------------
      # Description: Array of image entries.
      images:
        - # ---------------------------------------===== ATF binary [Required] =====----------------------------------------
          # Description: ATF binary file.
          atf: inputs/bl31.bin

        - # --------------------------------------===== U-Boot binary [Required] =====--------------------------------------
          # Description: U-Boot binary file.
          uboot: inputs/u-boot.bin

3. AHAB Image Container set

Now we have the AHAB image with U-Boot SPL DDR and AHAB Image with U-Boot ATF container. We can use the nxpimage binary-image merge command to merge the AHAB images into one binary image. The following command merges the AHAB images:

nxpimage -v bootable-image merge -c u-boot-flash_template.yaml -o flash.bin

We have to prepare the configuration. In configuration file we just specify the target memory (in our case we are downloading the image using the nxpuuu so serial downloader is enough).

YamlDiffWidget("inputs/mimx8ulp_ahab_bimg.diffc").html

nxpimage bootable-image get-templates -f mimx8ulp -o workspace --force
Creating workspace/bootimg_mimx8ulp_serial_downloader.yaml template file.
Creating workspace/bootimg_mimx8ulp_flexspi_nor.yaml template file.
Creating workspace/bootimg_mimx8ulp_emmc.yaml template file.
Creating workspace/bootimg_mimx8ulp_sd.yaml template file.
Creating workspace/bootimg_mimx8ulp_flexspi_nand.yaml template file.
Creating workspace/bootimg_mimx8ulp_recovery_spi.yaml template file.

Configuration Differences

Show Diff Download Config

# =====================  Bootable Image Configuration template for mimx8ulp / Serial downloader.  ======================

# ======================================================================================================================
#                                                 == General Options ==                                                 
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
# Possible options: 
# lpc5528, lpc5534, lpc5536, lpc55s04, lpc55s06, lpc55s14, lpc55s16, lpc55s26, lpc55s28, lpc55s36, lpc55s66, lpc55s69,
# mc56f81646, mc56f81648, mc56f81666, mc56f81668, mc56f81746, mc56f81748, mc56f81766, mc56f81768, mcxa132, mcxa133,
# mcxa142, mcxa143, mcxa144, mcxa145, mcxa146, mcxa152, mcxa153, mcxa154, mcxa155, mcxa156, mcxn235, mcxn236, mcxn546,
# mcxn547, mcxn946, mcxn947, mcxw716a, mcxw716c, mimx8ulp, mimx9131, mimx9352, mimx9596, mimxrt1010, mimxrt1015,
# mimxrt1020, mimxrt1024, mimxrt1040, mimxrt1050, mimxrt1060, mimxrt1064, mimxrt1165, mimxrt1166, mimxrt1171,
# mimxrt1172, mimxrt1173, mimxrt1175, mimxrt1176, mimxrt1181, mimxrt1182, mimxrt1187, mimxrt1189, mimxrt533s,
# mimxrt555s, mimxrt595s, mimxrt685s, mimxrt735s, mimxrt758s, mimxrt798s, mwct2012, mwct2012a, nhs52s04, rw610, rw612>
family: mimx8ulp
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: 
revision: latest
# ------------------------------------------===== Memory type [Required] =====------------------------------------------
# Description: Specify type of memory used by bootable image description.
memory_type: serial_downloader

# ----------------------------------------===== Initial segment [Optional] =====----------------------------------------
# Description: The segment name or the index of initial segment in exported image
init_offset: 0
# ======================================================================================================================
#                                      == Primary Executable Segment definition ==                                      
# ======================================================================================================================
# ----------------------------------===== Primary Image Container Set [Optional] =====----------------------------------
# Description: This is primary Image Container Set that is validated by ROM and usually contains DDR initialization and
# SPL code. It could be used as pre-prepared binary form of AHAB and also YAML configuration file for AHAB. In case that
# YAML configuration file is used, the Bootable image tool build the AHAB itself.
primary_image_container_set: primary_image_container_set.yaml path to our SPL U-Boot image configuration
primary_image_container_set: u-boot-spl-container-img_config.yaml
# ======================================================================================================================
#                                     == Secondary Executable Segment definition ==                                     
# ======================================================================================================================
# ---------------------------------===== Secondary Image Container Set [Optional] =====---------------------------------
# Description: This is secondary AHAB image that is validated by SPL from primary image. It could be used as pre-
# prepared binary form of AHAB and also YAML configuration file for AHAB. In case that YAML configuration file is used,
# the Bootable image tool build the AHAB itself.
secondary_image_container_set: secondary_image_container_set.yaml path to our U-Boot ATF image configuration
secondary_image_container_set: u-boot-atf-container-img_config.yaml

# ======================================  Bootable Image Configuration for mimx9352.  ======================================

# ======================================================================================================================
#                                                 == General Options ==
# ======================================================================================================================
# ------------------------------------------===== MCU family [Required] =====-------------------------------------------
# Description: MCU family name.
# Possible options: 
# mimxrt1024, mimxrt1040, mimxrt1050, mimxrt1064, mimxrt1166, mimxrt1176, mimxrt1189, mimxrt595s, mimxrt685s, rw612>
family: mimx8ulp
# -------------------------------------===== Chip silicon revision [Optional] =====-------------------------------------
# Description: If needed this could be used to specify silicon revision of device.
# Possible options: 
revision: latest
# ------------------------------------------===== Memory type [Required] =====------------------------------------------
# Description: Specify type of memory used by bootable image description.
# Possible options: 
memory_type: serial_downloader

# ======================================================================================================================
#                                      == Primary executable Segment definition ==
# ======================================================================================================================
# ------------------------------------===== Primary AHAB container [Optional] =====-------------------------------------
# Description: This is primary AHAB image that is validated by ROM and usually contains DDR initialization and SPL code.
# AHAB container image path. It could be used as pre-prepared binary form of AHAB and also YAML configuration file for
# AHAB. In case that YAML configuration file is used, the Bootable image tool build the AHAB itself.
primary_image_container_set: u-boot-spl-container-img_config.yaml path to our SPL U-Boot image configuration
# ======================================================================================================================
#                                     == Secondary executable Segment definition ==
# ======================================================================================================================
# -----------------------------------===== Secondary AHAB container [Optional] =====------------------------------------
# Description: This is secondary AHAB image that is validated by SPL from primary image. AHAB container image path. It
# could be used as pre-prepared binary form of AHAB and also YAML configuration file for AHAB. In case that YAML
# configuration file is used, the Bootable image tool build the AHAB itself.
secondary_image_container_set: u-boot-atf-container-img_config.yaml path to our U-Boot ATF image configuration

VERBOSITY = "-v"
U_BOOT_FLASH_BOOT_CFG = "inputs/u-boot-bootable.yaml"
U_BOOT_FLASH_BOOT = "outputs/flash.bin"
%! nxpimage $VERBOSITY bootable-image merge --config $U_BOOT_FLASH_BOOT_CFG --output $U_BOOT_FLASH_BOOT

nxpimage -v bootable-image merge --config inputs/u-boot-bootable.yaml --output outputs/flash.bin 
INFO:spsdk.apps.nxpimage:Created Bootable Image:
Name:      Bootable Image for mimx8ulp
Starts:    0x0
Ends:      0x1ae3ff
Size:      Size: 1.7 MiB; 1,762,304 B
Alignment: 1 B
Execution Start Address: Not defined
Pattern:zeros
Memory type: MemoryType.SERIAL_DOWNLOADER
Revision: latest

INFO:spsdk.apps.nxpimage:Created Bootable Image memory map:

+==0x0000_0000= Bootable Image for mimx8ulp =====================+
|                   Size: 1.7 MiB; 1,762,304 B                   |
|   Memory type: MemoryType.SERIAL_DOWNLOADER Revision: latest   |
|                         Pattern: zeros                         |
|+==0x0000_0000= primary_image_container_set ===================+|
||                  Size: 193.5 kiB; 198,144 B                  ||
||                  AHAB Image for mimx8ulp_a2                  ||
||                        Pattern: zeros                        ||
||+==0x0000_0000= AHAB Containers =============================+||
|||                   Size: 8.0 kiB; 8,192 B                   |||
|||                   AHAB Containers block                    |||
|||                       Pattern: zeros                       |||
|||+==0x0000_0000= AHAB Container 0 ==========================+|||
||||                       Size: 544 B                        ||||
||||              AHAB Container for nxp_SWver:0              ||||
|||+==0x0000_021f=============================================+|||
|||                         Gap: 480 B                         |||
|||+==0x0000_0400= AHAB Container 1 ==========================+|||
||||                       Size: 288 B                        ||||
||||             AHAB Container for none_SWver:0              ||||
|||+==0x0000_051f=============================================+|||
||+==0x0000_1fff===============================================+||
||+==0x0000_2000= Container 0 AHAB Data Image 0 ===============+||
|||                  Size: 63.9 kiB; 65,440 B                  |||
||| AHAB encrypted data block for ele core and ele Image Type. |||
||+==0x0001_1f9f===============================================+||
||                          Gap: 96 B                           ||
||+==0x0001_2000= uPower ======================================+||
|||                  Size: 42.5 kiB; 43,520 B                  |||
|||  AHAB data block for cortex-a53 core and executable Image  |||
|||                           Type.                            |||
||+==0x0001_c9ff===============================================+||
||                          Gap: 512 B                          ||
||+==0x0001_cc00= U-Boot SPL ==================================+||
|||                  Size: 78.5 kiB; 80,384 B                  |||
|||  AHAB data block for cortex-a55 core and executable Image  |||
|||                           Type.                            |||
||+==0x0003_05ff===============================================+||
|+==0x0003_05ff=================================================+|
|                           Gap: 512 B                           |
|+==0x0003_0800= secondary_image_container_set =================+|
||                  Size: 1.5 MiB; 1,563,648 B                  ||
||                  AHAB Image for mimx8ulp_a2                  ||
||                        Pattern: zeros                        ||
||+==0x0003_0800= AHAB Containers =============================+||
|||                   Size: 8.0 kiB; 8,192 B                   |||
|||                   AHAB Containers block                    |||
|||                       Pattern: zeros                       |||
|||+==0x0003_0800= AHAB Container 0 ==========================+|||
||||                       Size: 416 B                        ||||
||||             AHAB Container for none_SWver:0              ||||
|||+==0x0003_099f=============================================+|||
||+==0x0003_27ff===============================================+||
||+==0x0003_2800= ATF - ARM Trusted Firmware ==================+||
|||                  Size: 52.5 kiB; 53,760 B                  |||
|||  AHAB data block for cortex-a55 core and executable Image  |||
|||                           Type.                            |||
||+==0x0003_f9ff===============================================+||
||                          Gap: 512 B                          ||
||+==0x0003_fc00= U-Boot Firmware =============================+||
|||                 Size: 909.0 kiB; 930,816 B                 |||
|||  AHAB data block for cortex-a55 core and executable Image  |||
|||                           Type.                            |||
||+==0x0012_2fff===============================================+||
||+==0x0012_3000= U-Boot TEE - Trusted Execution Environment ==+||
|||                 Size: 557.0 kiB; 570,368 B                 |||
|||  AHAB data block for cortex-a55 core and executable Image  |||
|||                           Type.                            |||
||+==0x001a_e3ff===============================================+||
|+==0x001a_e3ff=================================================+|
+==0x001a_e3ff===================================================+

Success. (Bootable Image: outputs/flash.bin created) 

4. Image download

First we put the iMX8ULP into serial downloader mode SW5 (01xx_xxxx), and use uuu to upload the flash.bin containing U-Boot.

%! nxpuuu $VERBOSITY write -f mimx9352 -b emmc $U_BOOT_FLASH_BOOT

nxpuuu -v write -f mimx9352 -b emmc outputs/flash.bin 
SDPS: boot -f outputs/flash.bin


Done