Flash encryption engines#
nxpimage currently supports generation of bootable images and keyblobs for NXP bus encryption engines – OTFAD (On-the-fly AES decryption engines), BEE (Bus encryption engine), IEE (Inline encryption engine), and IPED table/keyblob images.
Note
For PRINCE-based IPED flows, SPSDK creates the IPED configuration table/keyblob and can optionally encrypt configured data blobs through the external iped-offline-tool backend. SPSDK does not include a native PRINCE/IPED encryption implementation.
IEE#
nxpimage supports generation of bootable image for MIMXRT117x. More details can be found in the security reference manual: https://www.nxp.com/webapp/sps/download/mod_download.jsp?colCode=IMXRT1170SRM&appType=moderated or in the Secure Boot modes application note https://www.nxp.com/webapp/Download?colCode=AN13250
IEE engine provides means to perform inline encryption and decryption. Following algorithms are supported AES-128/256-CTR and AES-256/512-XTS. The IEE key blob containing keys and context structures is encrypted by a KEK according to the RFC3394 key-wrapping algorithm, because the key blob resides in the external memory along with the image and it must be protected
Generation of bootable image
First step is to get a template for configuration. The template might look like the file below.
nxpimage iee get-template -f rt1170 iee_template.yaml
IEE for mimxrt1151, Revision: a0#
IEE for mimxrt1151, Revision: a0 JSON schema
IEE for mimxrt1151, Revision: a0 YAML configuration template
# ==================================== IEE template for mimxrt1151, Revision: a0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1151, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
# ----------------------------------===== IBKEK1 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK1 AES-XTS key for keyblob encryption
ibkek1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------------===== IBKEK2 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK2 AES-XTS key for keyblob encryption
ibkek2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
key_blobs:
-
# ----------------------------------===== Keyblob lock attribute [Optional] =====-----------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# -----------------------------------------===== AES mode [Required] =====------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# -----------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# ----------------------------------------===== Page offset [Optional] =====----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# --------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====---------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ---------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====---------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x30001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x30008000'
IEE for mimxrt1152, Revision: a0#
IEE for mimxrt1152, Revision: a0 JSON schema
IEE for mimxrt1152, Revision: a0 YAML configuration template
# ==================================== IEE template for mimxrt1152, Revision: a0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1152, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
# ----------------------------------===== IBKEK1 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK1 AES-XTS key for keyblob encryption
ibkek1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------------===== IBKEK2 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK2 AES-XTS key for keyblob encryption
ibkek2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
key_blobs:
-
# ----------------------------------===== Keyblob lock attribute [Optional] =====-----------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# -----------------------------------------===== AES mode [Required] =====------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# -----------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# ----------------------------------------===== Page offset [Optional] =====----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# --------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====---------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ---------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====---------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x30001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x30008000'
IEE for mimxrt1165, Revision: a0#
IEE for mimxrt1165, Revision: a0 JSON schema
IEE for mimxrt1165, Revision: a0 YAML configuration template
# ==================================== IEE template for mimxrt1165, Revision: a0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1165, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
# ----------------------------------===== IBKEK1 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK1 AES-XTS key for keyblob encryption
ibkek1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------------===== IBKEK2 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK2 AES-XTS key for keyblob encryption
ibkek2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
key_blobs:
-
# ----------------------------------===== Keyblob lock attribute [Optional] =====-----------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# -----------------------------------------===== AES mode [Required] =====------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# -----------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# ----------------------------------------===== Page offset [Optional] =====----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# --------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====---------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ---------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====---------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x30001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x30008000'
IEE for mimxrt1166, Revision: a0#
IEE for mimxrt1166, Revision: a0 JSON schema
IEE for mimxrt1166, Revision: a0 YAML configuration template
# ==================================== IEE template for mimxrt1166, Revision: a0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1166, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
# ----------------------------------===== IBKEK1 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK1 AES-XTS key for keyblob encryption
ibkek1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------------===== IBKEK2 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK2 AES-XTS key for keyblob encryption
ibkek2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
key_blobs:
-
# ----------------------------------===== Keyblob lock attribute [Optional] =====-----------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# -----------------------------------------===== AES mode [Required] =====------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# -----------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# ----------------------------------------===== Page offset [Optional] =====----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# --------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====---------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ---------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====---------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x30001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x30008000'
IEE for mimxrt1171, Revision: a0#
IEE for mimxrt1171, Revision: a0 JSON schema
IEE for mimxrt1171, Revision: a0 YAML configuration template
# ==================================== IEE template for mimxrt1171, Revision: a0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1171, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
# ----------------------------------===== IBKEK1 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK1 AES-XTS key for keyblob encryption
ibkek1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------------===== IBKEK2 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK2 AES-XTS key for keyblob encryption
ibkek2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
key_blobs:
-
# ----------------------------------===== Keyblob lock attribute [Optional] =====-----------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# -----------------------------------------===== AES mode [Required] =====------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# -----------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# ----------------------------------------===== Page offset [Optional] =====----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# --------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====---------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ---------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====---------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x30001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x30008000'
IEE for mimxrt1172, Revision: a0#
IEE for mimxrt1172, Revision: a0 JSON schema
IEE for mimxrt1172, Revision: a0 YAML configuration template
# ==================================== IEE template for mimxrt1172, Revision: a0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1172, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
# ----------------------------------===== IBKEK1 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK1 AES-XTS key for keyblob encryption
ibkek1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------------===== IBKEK2 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK2 AES-XTS key for keyblob encryption
ibkek2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
key_blobs:
-
# ----------------------------------===== Keyblob lock attribute [Optional] =====-----------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# -----------------------------------------===== AES mode [Required] =====------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# -----------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# ----------------------------------------===== Page offset [Optional] =====----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# --------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====---------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ---------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====---------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x30001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x30008000'
IEE for mimxrt1173, Revision: a0#
IEE for mimxrt1173, Revision: a0 JSON schema
IEE for mimxrt1173, Revision: a0 YAML configuration template
# ==================================== IEE template for mimxrt1173, Revision: a0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1173, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
# ----------------------------------===== IBKEK1 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK1 AES-XTS key for keyblob encryption
ibkek1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------------===== IBKEK2 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK2 AES-XTS key for keyblob encryption
ibkek2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
key_blobs:
-
# ----------------------------------===== Keyblob lock attribute [Optional] =====-----------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# -----------------------------------------===== AES mode [Required] =====------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# -----------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# ----------------------------------------===== Page offset [Optional] =====----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# --------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====---------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ---------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====---------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x30001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x30008000'
IEE for mimxrt1175, Revision: a0#
IEE for mimxrt1175, Revision: a0 JSON schema
IEE for mimxrt1175, Revision: a0 YAML configuration template
# ==================================== IEE template for mimxrt1175, Revision: a0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1175, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
# ----------------------------------===== IBKEK1 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK1 AES-XTS key for keyblob encryption
ibkek1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------------===== IBKEK2 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK2 AES-XTS key for keyblob encryption
ibkek2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
key_blobs:
-
# ----------------------------------===== Keyblob lock attribute [Optional] =====-----------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# -----------------------------------------===== AES mode [Required] =====------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# -----------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# ----------------------------------------===== Page offset [Optional] =====----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# --------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====---------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ---------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====---------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x30001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x30008000'
IEE for mimxrt1176, Revision: a0#
IEE for mimxrt1176, Revision: a0 JSON schema
IEE for mimxrt1176, Revision: a0 YAML configuration template
# ==================================== IEE template for mimxrt1176, Revision: a0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1176, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
# ----------------------------------===== IBKEK1 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK1 AES-XTS key for keyblob encryption
ibkek1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------------===== IBKEK2 AES-XTS 256-bit key [Required] =====-----------------------------------
# Description: IBKEK2 AES-XTS key for keyblob encryption
ibkek2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
key_blobs:
-
# ----------------------------------===== Keyblob lock attribute [Optional] =====-----------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# -----------------------------------------===== AES mode [Required] =====------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# -----------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# ----------------------------------------===== Page offset [Optional] =====----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# --------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====---------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ---------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====---------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x30001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x30008000'
IEE for mimxrt1181, Revision: b0#
IEE for mimxrt1181, Revision: b0 JSON schema
IEE for mimxrt1181, Revision: b0 YAML configuration template
# ==================================== IEE template for mimxrt1181, Revision: b0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1181, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
key_blob:
# -----------------------------------===== Keyblob lock attribute [Optional] =====------------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# ------------------------------------------===== AES mode [Required] =====-------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# ------------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====-------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# -----------------------------------------===== Page offset [Optional] =====-----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# ---------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====----------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====----------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# -------------------------------===== Start address of key blob data [Required] =====--------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x04001000'
# --------------------------------===== End address of key blob data [Required] =====---------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x04008000'
IEE for mimxrt1182, Revision: b0#
IEE for mimxrt1182, Revision: b0 JSON schema
IEE for mimxrt1182, Revision: b0 YAML configuration template
# ==================================== IEE template for mimxrt1182, Revision: b0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1182, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
key_blob:
# -----------------------------------===== Keyblob lock attribute [Optional] =====------------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# ------------------------------------------===== AES mode [Required] =====-------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# ------------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====-------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# -----------------------------------------===== Page offset [Optional] =====-----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# ---------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====----------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====----------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# -------------------------------===== Start address of key blob data [Required] =====--------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x04001000'
# --------------------------------===== End address of key blob data [Required] =====---------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x04008000'
IEE for mimxrt1183, Revision: b0#
IEE for mimxrt1183, Revision: b0 JSON schema
IEE for mimxrt1183, Revision: b0 YAML configuration template
# ==================================== IEE template for mimxrt1183, Revision: b0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1183, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
key_blob:
# -----------------------------------===== Keyblob lock attribute [Optional] =====------------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# ------------------------------------------===== AES mode [Required] =====-------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# ------------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====-------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# -----------------------------------------===== Page offset [Optional] =====-----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# ---------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====----------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====----------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# -------------------------------===== Start address of key blob data [Required] =====--------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x04001000'
# --------------------------------===== End address of key blob data [Required] =====---------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x04008000'
IEE for mimxrt1184, Revision: b0#
IEE for mimxrt1184, Revision: b0 JSON schema
IEE for mimxrt1184, Revision: b0 YAML configuration template
# ==================================== IEE template for mimxrt1184, Revision: b0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1184, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
key_blob:
# -----------------------------------===== Keyblob lock attribute [Optional] =====------------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# ------------------------------------------===== AES mode [Required] =====-------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# ------------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====-------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# -----------------------------------------===== Page offset [Optional] =====-----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# ---------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====----------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====----------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# -------------------------------===== Start address of key blob data [Required] =====--------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x04001000'
# --------------------------------===== End address of key blob data [Required] =====---------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x04008000'
IEE for mimxrt1185, Revision: b0#
IEE for mimxrt1185, Revision: b0 JSON schema
IEE for mimxrt1185, Revision: b0 YAML configuration template
# ==================================== IEE template for mimxrt1185, Revision: b0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1185, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
key_blob:
# -----------------------------------===== Keyblob lock attribute [Optional] =====------------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# ------------------------------------------===== AES mode [Required] =====-------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# ------------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====-------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# -----------------------------------------===== Page offset [Optional] =====-----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# ---------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====----------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====----------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# -------------------------------===== Start address of key blob data [Required] =====--------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x04001000'
# --------------------------------===== End address of key blob data [Required] =====---------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x04008000'
IEE for mimxrt1186, Revision: a0#
IEE for mimxrt1186, Revision: a0 JSON schema
IEE for mimxrt1186, Revision: a0 YAML configuration template
# ==================================== IEE template for mimxrt1186, Revision: a0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1186, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: a0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
key_blob:
# -----------------------------------===== Keyblob lock attribute [Optional] =====------------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# ------------------------------------------===== AES mode [Required] =====-------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# ------------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====-------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# -----------------------------------------===== Page offset [Optional] =====-----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# ---------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====----------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====----------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# -------------------------------===== Start address of key blob data [Required] =====--------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x04001000'
# --------------------------------===== End address of key blob data [Required] =====---------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x04008000'
IEE for mimxrt1187, Revision: b0#
IEE for mimxrt1187, Revision: b0 JSON schema
IEE for mimxrt1187, Revision: b0 YAML configuration template
# ==================================== IEE template for mimxrt1187, Revision: b0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1187, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
key_blob:
# -----------------------------------===== Keyblob lock attribute [Optional] =====------------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# ------------------------------------------===== AES mode [Required] =====-------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# ------------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====-------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# -----------------------------------------===== Page offset [Optional] =====-----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# ---------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====----------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====----------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# -------------------------------===== Start address of key blob data [Required] =====--------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x04001000'
# --------------------------------===== End address of key blob data [Required] =====---------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x04008000'
IEE for mimxrt1189, Revision: b0#
IEE for mimxrt1189, Revision: b0 JSON schema
IEE for mimxrt1189, Revision: b0 YAML configuration template
# ==================================== IEE template for mimxrt1189, Revision: b0 =====================================
# ======================================================================================================================
# == IEE for mimxrt1189, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
key_blob:
# -----------------------------------===== Keyblob lock attribute [Optional] =====------------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# ------------------------------------------===== AES mode [Required] =====-------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# ------------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====-------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# -----------------------------------------===== Page offset [Optional] =====-----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# ---------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====----------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====----------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# -------------------------------===== Start address of key blob data [Required] =====--------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x04001000'
# --------------------------------===== End address of key blob data [Required] =====---------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x04008000'
IEE for mimxrt118c, Revision: b0#
IEE for mimxrt118c, Revision: b0 JSON schema
IEE for mimxrt118c, Revision: b0 YAML configuration template
# ==================================== IEE template for mimxrt118c, Revision: b0 =====================================
# ======================================================================================================================
# == IEE for mimxrt118c, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
key_blob:
# -----------------------------------===== Keyblob lock attribute [Optional] =====------------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# ------------------------------------------===== AES mode [Required] =====-------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# ------------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====-------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# -----------------------------------------===== Page offset [Optional] =====-----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# ---------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====----------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====----------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# -------------------------------===== Start address of key blob data [Required] =====--------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x04001000'
# --------------------------------===== End address of key blob data [Required] =====---------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x04008000'
IEE for mimxrt118d, Revision: b0#
IEE for mimxrt118d, Revision: b0 JSON schema
IEE for mimxrt118d, Revision: b0 YAML configuration template
# ==================================== IEE template for mimxrt118d, Revision: b0 =====================================
# ======================================================================================================================
# == IEE for mimxrt118d, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
key_blob:
# -----------------------------------===== Keyblob lock attribute [Optional] =====------------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# ------------------------------------------===== AES mode [Required] =====-------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# ------------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====-------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# -----------------------------------------===== Page offset [Optional] =====-----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# ---------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====----------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====----------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# -------------------------------===== Start address of key blob data [Required] =====--------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x04001000'
# --------------------------------===== End address of key blob data [Required] =====---------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x04008000'
IEE for mimxrt118e, Revision: b0#
IEE for mimxrt118e, Revision: b0 JSON schema
IEE for mimxrt118e, Revision: b0 YAML configuration template
# ==================================== IEE template for mimxrt118e, Revision: b0 =====================================
# ======================================================================================================================
# == IEE for mimxrt118e, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# -------------------------------------===== IEE output directory [Required] =====--------------------------------------
# Description: Path to directory where the IEE output will be generated
output_folder: iee_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for IEE image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image filename [Optional] =====----------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: iee_full_image
# ---------------------------------------===== Keyblob filename [Optional] =====----------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: iee_keyblob
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ---------------------------===== Generate blhost batch file to burn fuses [Optional] =====----------------------------
# Description: BCF file with fuses configuration
generate_fuses_script: true
# --------------------------------===== Base address of the IEE keyblob [Required] =====--------------------------------
# Description: Should be aligned to 1 kB
keyblob_address: '0x30000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs that will be encrypted
data_blobs:
-
# -------------------------------------===== Binary data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Optional] =====-------------------------------------
# Description: Data blob address, it doesn't have to be specified for S-REC
address: '0x30001000'
key_blob:
# -----------------------------------===== Keyblob lock attribute [Optional] =====------------------------------------
# Description: Determines if the ROM will lock the IEE configuration to prevent later changes.
region_lock: false
# ------------------------------------------===== AES mode [Required] =====-------------------------------------------
# Description: AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream
# only
# Possible options: <Bypass, AesXTS, AesCTRWAddress, AesCTRWOAddress, AesCTRkeystream>
aes_mode: AesXTS
# ------------------===== AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS [Required] =====-------------------
# Description: AES mode, AES-XTS or AES-CTR
# Possible options: <CTR256XTS512, CTR128XTS256>
key_size: CTR256XTS512
# -----------------------------------------===== Page offset [Optional] =====-----------------------------------------
# Description: Page offset, IEE_REG0PO value
page_offset: 0
# ---------------------------------===== AES-XTS key1 / AES-CTR key [Required] =====----------------------------------
# Description: AES key for the key blob, size depends on key_size
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F'
# ----------------------------===== AES-CTR Counter value or AES-XTS key2 [Required] =====----------------------------
# Description: AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F'
# -------------------------------===== Start address of key blob data [Required] =====--------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x04001000'
# --------------------------------===== End address of key blob data [Required] =====---------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x04008000'
# =========== IEE: Inline Encryption Engine Configuration template for rt1170. ===========
# ----------------------------------------------------------------------------------------------------
# == Basic Settings ==
# ----------------------------------------------------------------------------------------------------
family: rt1170 # [Required], MCU family, MCU family name., Possible options:['rt1170']
output_folder: iee_output # [Required], IEE output directory, Path to directory where the IEE output will be generated
output_name: encrypted.bin # [Optional], Output binary image file name, File name of the output image containing keyblobs and encrypted data blobs
keyblob_name: iee_keyblob.bin # [Optional], Keyblob file name, File name of the keyblob, output_folder/keyblob_name
encrypted_name: encrypted_blob.bin # [Optional], Encrypted name, filename of the encrypted datablobs
# ----------------------------------------------------------------------------------------------------
# == IEE Settings ==
# ----------------------------------------------------------------------------------------------------
ibkek1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F' # [Required], IBKEK1 AES-XTS 256-bit key, IBKEK1 AES-XTS key for keyblob encryption
ibkek2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F' # [Required], IBKEK2 AES-XTS 256-bit key, IBKEK2 AES-XTS key for keyblob encryption
keyblob_address: '0x30000000' # [Required], Base address of the IEE keyblob, Should be aligned to 1 kB
data_blobs: # [Optional], Data blobs list, List of all data blobs that will be encrypted
- data: my_data.bin # [Required], Binary data blob, Path to binary file with plain text data to be encrypted
address: '0x03001000' # [Optional], Data blob address, Data blob address, it doesn't have to be specified for S-REC
key_blobs: # [Required], List of Key Blobs used by IEE, The list of definition of individual key blobs including plain data. Add other array items as you need and device allows
- region_lock: false # [Optional], Keyblob lock attribute, Determines if the ROM will lock the IEE configuration to prevent later changes.
aes_mode: AesXTS # [Required], AES mode, AES mode, Encryption bypass, AES-XTS, AES-CTR (with or without address binding) or AES-CTR keystream only, Possible options:['Bypass', 'AesXTS', 'AesCTRWAddress', 'AesCTRWOAddress', 'AesCTRkeystream']
key_size: CTR256XTS512 # [Required], AES key size, 128/256 for AES-CTR or 256/512 for AES-XTS, AES mode, AES-XTS or AES-CTR, Possible options:['CTR256XTS512', 'CTR128XTS256']
page_offset: 0 # [Optional], Page offset, Page offset, IEE_REG0PO value
key1: '0x000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F' # [Required], AES-XTS key1 / AES-CTR key, AES key for the key blob, size depends on key_size
key2: '0x202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F' # [Required], AES-CTR Counter value or AES-XTS key2, AES key for the key blob, size depends on key_size
start_address: '0x30001000' # [Required], Start address of key blob data, Start address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x30008000' # [Required], End address of key blob data, End address of key blob data, it should be aligned to 1 KB (1024 B)
Fill the configuration file and export the image.
nxpimage iee export iee_template.yaml
IPED#
The IPED support in SPSDK creates the register-image table consumed by the boot ROM/ELE
handoff for supported external-flash decrypted-XIP flows, such as i.MX943 and i.MXRT266x.
The table contains up to 16 IPED contexts followed by the IPEDCTRL and IPEDCTXCTRL
register values. The exported binary is typically placed in the bootable-image keyblob
area at offset 0x0, before the FCB at offset 0x400.
SPSDK can also encrypt configured data_blobs by using the optional
iped-offline-tool package as an in-process PRINCE/IPED backend. Install the backend in
the active Python environment when encrypted data output is required. The context key value is used only for offline
encryption and is not serialized into the IPED table.
Two access paths are used in the flag names:
IPorIP-commandmeans commands issued through the memory controller command interface.AHBmeans memory-mapped bus access, including normal XIP reads from external flash.
For a common read-only decrypted-XIP image using CTR mode, enable enable and
ahb_read_enable and leave write flags disabled. For GCM or XEX contexts, use the
corresponding GCM or XEX read/write flags instead of the CTR flags. The optional
control_word field can be used to provide a raw IPEDCTRL value; when it is present,
all boolean flags are ignored.
Configuration option |
IPEDCTRL bit |
Meaning |
|---|---|---|
|
|
Enables the hardware double encryption/decryption path. Keep disabled unless the encrypted image was prepared for that flow. |
|
|
Enables the CTR/GCM IPED engine. |
|
|
Enables CTR encryption for writes through the IP-command path. |
|
|
Enables CTR encryption for writes on the memory-mapped AHB/XIP path. |
|
|
Enables CTR decryption for memory-mapped AHB/XIP reads. |
|
|
Enables GCM encryption for writes through the IP-command path. |
|
|
Enables GCM encryption for writes on the memory-mapped AHB/XIP path. |
|
|
Enables GCM decryption/authenticated reads on the memory-mapped AHB/XIP path. |
|
|
Requests hardware protection of the loaded IPED configuration registers. |
|
|
Enables the XEX IPED engine. |
|
|
Enables XEX encryption for writes through the IP-command path. |
|
|
Enables XEX encryption for writes on the memory-mapped AHB/XIP path. |
|
|
Enables XEX decryption for memory-mapped AHB/XIP reads. |
Generate an IPED template and export the table:
nxpimage iped get-template -f mimx943 -o iped_template.yaml
nxpimage iped export -c iped_template.yaml
To generate encrypted data in the same run, add data_blobs and a matching context
key to the configuration. The export then creates the table/keyblob file, the encrypted
data blob file, and a combined image containing both.
For RT266x templates, the default external-flash base is 0x60000000
(0x28000000 on i.MX943).
When RT266x fuse-material fields (cust_mk_sk, srkh, pqc_srkh,
lifecycle) are provided, SPSDK derives per-context effective keys and IV values
from context nonce automatically, so explicit key and iv values can be omitted.
The fuse-material fields can be provided either as word arrays or as inline hexadecimal values.
For RT266x GCM contexts, encrypted output includes one 8-byte authentication tag
after each 32-byte encrypted data chunk.
keyblob_address: 0x28000000
contexts:
- start_address: 0x28001000
end_address: 0x28002000
mode: ctr
iv: 0x0001020304050607
key: 0x00000000000000000000000000000001
data_blobs:
- data: application_plain.bin
address: 0x28001000
Parse an existing IPED table/keyblob back into YAML:
nxpimage iped parse -f mimx943 -b iped_table.bin -o parsed_iped.yaml
IPED for mimx94145, Revision: a1#
IPED for mimx94145, Revision: a1 JSON schema
IPED for mimx94145, Revision: a1 YAML configuration template
# ==================================== IPED template for mimx94145, Revision: a1 =====================================
# ======================================================================================================================
# == IPED for mimx94145, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimx94245, Revision: a1#
IPED for mimx94245, Revision: a1 JSON schema
IPED for mimx94245, Revision: a1 YAML configuration template
# ==================================== IPED template for mimx94245, Revision: a1 =====================================
# ======================================================================================================================
# == IPED for mimx94245, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimx943, Revision: a1#
IPED for mimx943, Revision: a1 JSON schema
IPED for mimx943, Revision: a1 YAML configuration template
# ===================================== IPED template for mimx943, Revision: a1 ======================================
# ======================================================================================================================
# == IPED for mimx943, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimx94316, Revision: a1#
IPED for mimx94316, Revision: a1 JSON schema
IPED for mimx94316, Revision: a1 YAML configuration template
# ==================================== IPED template for mimx94316, Revision: a1 =====================================
# ======================================================================================================================
# == IPED for mimx94316, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimx94318, Revision: a1#
IPED for mimx94318, Revision: a1 JSON schema
IPED for mimx94318, Revision: a1 YAML configuration template
# ==================================== IPED template for mimx94318, Revision: a1 =====================================
# ======================================================================================================================
# == IPED for mimx94318, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimx94336, Revision: a1#
IPED for mimx94336, Revision: a1 JSON schema
IPED for mimx94336, Revision: a1 YAML configuration template
# ==================================== IPED template for mimx94336, Revision: a1 =====================================
# ======================================================================================================================
# == IPED for mimx94336, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimx94338, Revision: a1#
IPED for mimx94338, Revision: a1 JSON schema
IPED for mimx94338, Revision: a1 YAML configuration template
# ==================================== IPED template for mimx94338, Revision: a1 =====================================
# ======================================================================================================================
# == IPED for mimx94338, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimx94356, Revision: a1#
IPED for mimx94356, Revision: a1 JSON schema
IPED for mimx94356, Revision: a1 YAML configuration template
# ==================================== IPED template for mimx94356, Revision: a1 =====================================
# ======================================================================================================================
# == IPED for mimx94356, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimx94358, Revision: a1#
IPED for mimx94358, Revision: a1 JSON schema
IPED for mimx94358, Revision: a1 YAML configuration template
# ==================================== IPED template for mimx94358, Revision: a1 =====================================
# ======================================================================================================================
# == IPED for mimx94358, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimx94376, Revision: a1#
IPED for mimx94376, Revision: a1 JSON schema
IPED for mimx94376, Revision: a1 YAML configuration template
# ==================================== IPED template for mimx94376, Revision: a1 =====================================
# ======================================================================================================================
# == IPED for mimx94376, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimx94378, Revision: a1#
IPED for mimx94378, Revision: a1 JSON schema
IPED for mimx94378, Revision: a1 YAML configuration template
# ==================================== IPED template for mimx94378, Revision: a1 =====================================
# ======================================================================================================================
# == IPED for mimx94378, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimx94386, Revision: a1#
IPED for mimx94386, Revision: a1 JSON schema
IPED for mimx94386, Revision: a1 YAML configuration template
# ==================================== IPED template for mimx94386, Revision: a1 =====================================
# ======================================================================================================================
# == IPED for mimx94386, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimx94388, Revision: a1#
IPED for mimx94388, Revision: a1 JSON schema
IPED for mimx94388, Revision: a1 YAML configuration template
# ==================================== IPED template for mimx94388, Revision: a1 =====================================
# ======================================================================================================================
# == IPED for mimx94388, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimx94396, Revision: a1#
IPED for mimx94396, Revision: a1 JSON schema
IPED for mimx94396, Revision: a1 YAML configuration template
# ==================================== IPED template for mimx94396, Revision: a1 =====================================
# ======================================================================================================================
# == IPED for mimx94396, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimx94398, Revision: a1#
IPED for mimx94398, Revision: a1 JSON schema
IPED for mimx94398, Revision: a1 YAML configuration template
# ==================================== IPED template for mimx94398, Revision: a1 =====================================
# ======================================================================================================================
# == IPED for mimx94398, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# -----------------------------------===== IPED V1 output directory [Required] =====------------------------------------
# Description: Directory where nxpimage writes the generated IPED V1 configuration structure file.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for the generated IPED V1 config structure.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ------------------------------------===== Output config filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the IPED V1 configuration structure.
output_name: iped_config
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI peripheral instance used for this IPED configuration. Determines which set of fuse context keys is
# used for IV derivation. Each XSPI instance has its own set of 16 per-region keys in fuses.
# Possible options: <xspi1, xspi2>
xspi_instance: xspi1
# ---------------------------------===== Absolute IPED config address [Optional] =====----------------------------------
# Description: Absolute memory-mapped address where the IPED V1 configuration structure is placed. Must be at offset 0
# of the SPI device.
keyblob_address: '0x28000000'
# ---------------------------------------===== Firmware version [Optional] =====----------------------------------------
# Description: 32-bit firmware version value used by ELE in IV derivation: IV = AES_ECB(fuse_key, nonce || fw_version ||
# zeros)[0:8]. Chosen by OEM, should be incremented on firmware updates to ensure unique IVs across versions.
fw_version: '0x00000001'
# --------------------------------------===== User encryption key [Optional] =====--------------------------------------
# Description: 128-bit user key from fuses (IPED_USER_KEY). This key is XORed with the per-region context key from the
# device database to derive the effective PRINCE encryption key. Required when data_blobs are configured for offline
# encryption.
user_key: '0x00000000000000000000000000000000'
# -------------------------------------===== Data blobs to encrypt [Optional] =====-------------------------------------
# Description: Optional list of plaintext binary blobs to encrypt with the PRINCE cipher. Each blob must fall within a
# configured IPED region. The effective encryption key = user_key XOR context_key (from database). The IV is the nonce
# from the matching region. This produces the same output as the iped-offline-tool.
data_blobs:
-
# ---------------------------------===== Plaintext data blob path [Required] =====----------------------------------
# Description: Path to binary file with plaintext data to encrypt.
data: my_firmware.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored. Must fall within a configured IPED
# region.
address: '0x28001000'
# ----------------------------------===== IPED V1 region descriptors [Required] =====-----------------------------------
# Description: List of IPED region descriptors. Each region describes one encrypted external memory range. At most 15
# regions are supported. Each region must have a unique region_id (0-14).
regions:
-
# -----------------------------------------===== Region ID [Required] =====-----------------------------------------
# Description: Unique region identifier from 0 to 14. Each region in the configuration must have a distinct ID.
region_id: 0
# -----------------------------------===== Region start address [Required] =====------------------------------------
# Description: Start address of the IPED-protected region. Corresponds to the first address in the XSPI to be
# decrypted. The lower 8 bits are ignored by hardware.
start_address: '0x28001000'
# ------------------------------------===== Region end address [Required] =====-------------------------------------
# Description: End address of the IPED-protected region. Corresponds to the first address outside the region to be
# decrypted. The lower 8 bits are ignored by hardware.
end_address: '0x28002000'
# ---------------------------------------===== Region nonce [Optional] =====----------------------------------------
# Description: 64-bit nonce used by ELE for IV derivation. The IV is calculated as IV = AES_ECB(fuse_key, nonce ||
# fw_version || zeros), truncated to 64 bits. Each region should use a unique nonce.
nonce: '0x0011223344556677'
IPED for mimxrt2660, Revision: a0#
IPED for mimxrt2660, Revision: a0 JSON schema
IPED for mimxrt2660, Revision: a0 YAML configuration template
# ==================================== IPED template for mimxrt2660, Revision: a0 ====================================
# ======================================================================================================================
# == IPED for mimxrt2660, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# -------------------------------------===== IPED output directory [Required] =====-------------------------------------
# Description: Directory where nxpimage writes generated IPED files. A table/keyblob file is always generated; encrypted
# data and combined image files are generated only when data_blobs are configured.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for all generated IPED artifacts: the table/keyblob, optional encrypted data blob
# file, and optional combined image.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# -------------------------------------===== Output table filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the standalone IPED configuration table. This binary is the keyblob
# payload used by bootable-image when the keyblob segment points to an IPED YAML configuration.
output_name: iped_table
# ------------------------------------===== Encrypted data filename [Optional] =====------------------------------------
# Description: Filename of the encrypted data blobs without file extension. This file is generated only when data_blobs
# are configured.
encrypted_name: encrypted_blob
# ------------------------------------===== Combined image filename [Optional] =====------------------------------------
# Description: Filename of the optional combined table and encrypted-data image without file extension. It must differ
# from output_name and encrypted_name.
image_name: iped_image
# -----------------------------------===== Exported IPED table size [Optional] =====------------------------------------
# Description: Reserved size of the IPED table/keyblob area in a combined bootable image. Fixed register-image tables
# are padded to this size, while tagged ROM configuration files contain only their serialized payload. The default
# 0x400-byte area places the FCB at offset 0x400.
table_size: '0x400'
# ------------------------------===== Absolute IPED table/keyblob address [Optional] =====------------------------------
# Description: Absolute memory-mapped address where the IPED table/keyblob is placed. For bootable images this should
# match the external flash base address of the keyblob segment. It is used only to calculate relative offsets for
# data_blobs and the optional combined image; the value is not serialized into the IPED table.
keyblob_address: '0x60000000'
# -----------------------------------===== Encrypted data alignment [Optional] =====------------------------------------
# Description: Alignment, in bytes, used when placing encrypted data blobs in the generated encrypted-data and combined-
# image outputs. Individual encrypted blobs are always padded to the IPED 8-byte encryption block size.
data_alignment: 8
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI instance used for key derivation and device-specific encryption model selection. For current
# derivation-enabled families, use xspi0 or xspi1.
# Possible options: <xspi0, xspi1>
instance: xspi0
# ------------------------------===== Firmware version for key derivation [Optional] =====------------------------------
# Description: Optional 32-bit firmware version used when context IV values are derived from nonce. It is also
# serialized into ROM configuration blobs.
fw_version: '0x44332211'
# ---------------------------------===== Lifecycle for key derivation [Optional] =====----------------------------------
# Description: Optional lifecycle label used by key derivation. Must be one of: fab, nxp_prov, nxp_fr, oem_open, oem_fr,
# oem_swc, oem_lckd, oem_clsd.
# Possible options: <fab, nxp_prov, nxp_fr, oem_open, oem_fr, oem_swc, oem_lckd, oem_clsd>
lifecycle: oem_open
# -------------------------------------===== CUST_MK_SK fuse words [Optional] =====-------------------------------------
# Description: Optional array of 8 little-endian 32-bit fuse words used for key derivation. It can be specified either
# as an array of 8 words or as one inline 256-bit hexadecimal value. When provided together with
# srkh/pqc_srkh/lifecycle, SPSDK derives context key and IV values automatically.
cust_mk_sk:
- '0x33221100'
- '0x77665544'
- '0xbbaa9988'
- '0xffeeddcc'
- '0x03020100'
- '0x07060504'
- '0x0b0a0908'
- '0x0f0e0d0c'
# ----------------------------------------===== SRKH fuse words [Optional] =====----------------------------------------
# Description: Optional array of 16 little-endian 32-bit classical SRKH fuse words used by key derivation. It can be
# specified either as an array of 16 words or as one inline 512-bit hexadecimal value.
srkh:
- '0x90bf50d4'
- '0xd328ecc9'
- '0x7d28f0eb'
- '0x5f5a3f0c'
- '0xcc891f09'
- '0x88ff036e'
- '0xb6c02073'
- '0xe59c0c6b'
- '0xa0e60353'
- '0x8de9a90d'
- '0x8a83b5c9'
- '0xd34cf089'
- '0x5c73dbb1'
- '0x08a84ada'
- '0x92da26c2'
- '0x50736860'
# --------------------------------------===== PQC SRKH fuse words [Optional] =====--------------------------------------
# Description: Optional array of 16 little-endian 32-bit PQC SRKH fuse words used by key derivation. It can be specified
# either as an array of 16 words or as one inline 512-bit hexadecimal value.
pqc_srkh:
- '0x00000000'
- '0x00000001'
- '0x00000002'
- '0x00000003'
- '0x00000004'
- '0x00000005'
- '0x00000006'
- '0x00000007'
- '0x00000008'
- '0x00000009'
- '0x0000000a'
- '0x0000000b'
- '0x0000000c'
- '0x0000000d'
- '0x0000000e'
- '0x0000000f'
# ----------------------------===== Double encryption/decryption execution [Optional] =====-----------------------------
# Description: Sets IPEDCTRL CONFIG. Enables the hardware double encryption/decryption path used by selected
# provisioning flows. Keep disabled for the usual decrypted-XIP table unless the encrypted image was prepared for double
# encryption.
double_encryption: false
# -----------------------------------===== Enable IPED CTR/GCM logic [Optional] =====-----------------------------------
# Description: Sets IPEDCTRL IPED_EN. Enables the IPED CTR/GCM engine. For a typical decrypted-XIP image this should be
# enabled together with the AHB read flag matching the selected context mode.
enable: true
# ----------------------------===== Enable IP-command write CTR encryption [Optional] =====-----------------------------
# Description: Sets IPEDCTRL IPWR_EN. Enables CTR encryption for writes issued through the memory controller IP-command
# path. This does not affect normal memory-mapped XIP reads; keep disabled unless the application writes encrypted data
# through IP commands.
ip_write_enable: false
# --------------------------------===== Enable AHB write CTR encryption [Optional] =====--------------------------------
# Description: Sets IPEDCTRL AHBWR_EN. Enables CTR encryption for writes on the memory-mapped AHB/XIP path. This is
# normally disabled for read-only boot images.
ahb_write_enable: false
# --------------------------------===== Enable AHB read CTR decryption [Optional] =====---------------------------------
# Description: Sets IPEDCTRL AHBRD_EN. Enables CTR decryption for memory-mapped AHB/XIP reads. This is the usual read-
# side flag for decrypted-XIP boot from external flash when contexts use CTR mode.
ahb_read_enable: true
# ----------------------------===== Enable IP-command write GCM encryption [Optional] =====-----------------------------
# Description: Sets IPEDCTRL IPGCMWR. Enables GCM encryption for writes issued through the memory controller IP-command
# path. Use only with GCM contexts.
ip_gcm_write_enable: false
# --------------------------------===== Enable AHB write GCM encryption [Optional] =====--------------------------------
# Description: Sets IPEDCTRL AHGCMWR. Enables GCM encryption for writes on the memory-mapped AHB/XIP path. Use only with
# GCM contexts.
ahb_gcm_write_enable: false
# --------------------------------===== Enable AHB read GCM decryption [Optional] =====---------------------------------
# Description: Sets IPEDCTRL AHBGCMRD. Enables GCM decryption/authenticated reads on the memory-mapped AHB/XIP path. Use
# this instead of ahb_read_enable when contexts use GCM mode.
ahb_gcm_read_enable: false
# ------------------------------------===== Enable IPED protection [Optional] =====-------------------------------------
# Description: Sets IPEDCTRL IPED_PROTECT. Requests hardware protection of the IPED configuration registers after the
# table is loaded, preventing later changes through normal register writes.
protection: false
# -------------------------------------===== Enable IPED XEX logic [Optional] =====-------------------------------------
# Description: Sets IPEDCTRL IPED_XEX_EN. Enables the IPED XEX engine. Use together with the XEX read/write flags and
# contexts whose mode is xex.
xex_enable: false
# ----------------------------===== Enable IP-command write XEX encryption [Optional] =====-----------------------------
# Description: Sets IPEDCTRL IPSXEXWE. Enables XEX encryption for writes issued through the memory controller IP-command
# path. Use only with XEX contexts.
ip_xex_write_enable: false
# --------------------------------===== Enable AHB write XEX encryption [Optional] =====--------------------------------
# Description: Sets IPEDCTRL AHBXEXWE. Enables XEX encryption for writes on the memory-mapped AHB/XIP path. Use only
# with XEX contexts.
ahb_xex_write_enable: false
# --------------------------------===== Enable AHB read XEX decryption [Optional] =====---------------------------------
# Description: Sets IPEDCTRL AHBXEXRE. Enables XEX decryption for memory-mapped AHB/XIP reads. Use this instead of
# ahb_read_enable when contexts use XEX mode.
ahb_xex_read_enable: false
# ------------------------------------------===== Data blobs [Optional] =====-------------------------------------------
# Description: Optional list of plain binary blobs to encrypt with the matching IPED context. Each blob must fit
# completely into one configured context. Encryption is available through SPSDK's built-in Python backend; an optional
# native backend can accelerate supported legacy models.
data_blobs:
-
# --------------------------------------===== Plain data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain data to encrypt.
data: my_plain_image.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored.
address: '0x60001000'
# -----------------------------------------===== IPED contexts [Required] =====-----------------------------------------
# Description: List of IPED context or region records. At most 16 entries are supported. Each entry describes one
# encrypted/decrypted external memory range.
contexts:
-
# --------------------------------===== Hardware region identifier [Optional] =====---------------------------------
# Description: Optional hardware context identifier from 0 to 15. If omitted, the context position in the list is
# used.
region_id: 0
# -----------------------------------===== Context start address [Required] =====-----------------------------------
# Description: Start address of the IPED-protected external memory region. The address must be aligned to the
# family-specific alignment, typically 0x100 bytes.
start_address: '0x60001000'
# ------------------------------------===== Context end address [Required] =====------------------------------------
# Description: End address of the IPED-protected external memory region. The address must be aligned to the family-
# specific alignment, typically 0x100 bytes.
end_address: '0x60002000'
# -------------------------------------===== IPED context mode [Optional] =====-------------------------------------
# Description: Encryption mode for this context. The global IPEDCTRL read/write enable flags must match the selected
# mode: CTR flags for ctr, GCM flags for gcm, XEX flags for xex. Bypass leaves the region unencrypted.
# Possible options: <ctr, gcm, xex, bypass>
mode: ctr
# ------------------------------===== Context nonce for IV derivation [Optional] =====------------------------------
# Description: Optional 64-bit nonce used when key derivation is enabled. For ROM configuration blobs the nonce is
# serialized and takes precedence over an explicitly configured IV.
nonce: '0x0011223344556677'
IPED for mimxrt2661, Revision: a0#
IPED for mimxrt2661, Revision: a0 JSON schema
IPED for mimxrt2661, Revision: a0 YAML configuration template
# ==================================== IPED template for mimxrt2661, Revision: a0 ====================================
# ======================================================================================================================
# == IPED for mimxrt2661, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# -------------------------------------===== IPED output directory [Required] =====-------------------------------------
# Description: Directory where nxpimage writes generated IPED files. A table/keyblob file is always generated; encrypted
# data and combined image files are generated only when data_blobs are configured.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for all generated IPED artifacts: the table/keyblob, optional encrypted data blob
# file, and optional combined image.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# -------------------------------------===== Output table filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the standalone IPED configuration table. This binary is the keyblob
# payload used by bootable-image when the keyblob segment points to an IPED YAML configuration.
output_name: iped_table
# ------------------------------------===== Encrypted data filename [Optional] =====------------------------------------
# Description: Filename of the encrypted data blobs without file extension. This file is generated only when data_blobs
# are configured.
encrypted_name: encrypted_blob
# ------------------------------------===== Combined image filename [Optional] =====------------------------------------
# Description: Filename of the optional combined table and encrypted-data image without file extension. It must differ
# from output_name and encrypted_name.
image_name: iped_image
# -----------------------------------===== Exported IPED table size [Optional] =====------------------------------------
# Description: Reserved size of the IPED table/keyblob area in a combined bootable image. Fixed register-image tables
# are padded to this size, while tagged ROM configuration files contain only their serialized payload. The default
# 0x400-byte area places the FCB at offset 0x400.
table_size: '0x400'
# ------------------------------===== Absolute IPED table/keyblob address [Optional] =====------------------------------
# Description: Absolute memory-mapped address where the IPED table/keyblob is placed. For bootable images this should
# match the external flash base address of the keyblob segment. It is used only to calculate relative offsets for
# data_blobs and the optional combined image; the value is not serialized into the IPED table.
keyblob_address: '0x60000000'
# -----------------------------------===== Encrypted data alignment [Optional] =====------------------------------------
# Description: Alignment, in bytes, used when placing encrypted data blobs in the generated encrypted-data and combined-
# image outputs. Individual encrypted blobs are always padded to the IPED 8-byte encryption block size.
data_alignment: 8
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI instance used for key derivation and device-specific encryption model selection. For current
# derivation-enabled families, use xspi0 or xspi1.
# Possible options: <xspi0, xspi1>
instance: xspi0
# ------------------------------===== Firmware version for key derivation [Optional] =====------------------------------
# Description: Optional 32-bit firmware version used when context IV values are derived from nonce. It is also
# serialized into ROM configuration blobs.
fw_version: '0x44332211'
# ---------------------------------===== Lifecycle for key derivation [Optional] =====----------------------------------
# Description: Optional lifecycle label used by key derivation. Must be one of: fab, nxp_prov, nxp_fr, oem_open, oem_fr,
# oem_swc, oem_lckd, oem_clsd.
# Possible options: <fab, nxp_prov, nxp_fr, oem_open, oem_fr, oem_swc, oem_lckd, oem_clsd>
lifecycle: oem_open
# -------------------------------------===== CUST_MK_SK fuse words [Optional] =====-------------------------------------
# Description: Optional array of 8 little-endian 32-bit fuse words used for key derivation. It can be specified either
# as an array of 8 words or as one inline 256-bit hexadecimal value. When provided together with
# srkh/pqc_srkh/lifecycle, SPSDK derives context key and IV values automatically.
cust_mk_sk:
- '0x33221100'
- '0x77665544'
- '0xbbaa9988'
- '0xffeeddcc'
- '0x03020100'
- '0x07060504'
- '0x0b0a0908'
- '0x0f0e0d0c'
# ----------------------------------------===== SRKH fuse words [Optional] =====----------------------------------------
# Description: Optional array of 16 little-endian 32-bit classical SRKH fuse words used by key derivation. It can be
# specified either as an array of 16 words or as one inline 512-bit hexadecimal value.
srkh:
- '0x90bf50d4'
- '0xd328ecc9'
- '0x7d28f0eb'
- '0x5f5a3f0c'
- '0xcc891f09'
- '0x88ff036e'
- '0xb6c02073'
- '0xe59c0c6b'
- '0xa0e60353'
- '0x8de9a90d'
- '0x8a83b5c9'
- '0xd34cf089'
- '0x5c73dbb1'
- '0x08a84ada'
- '0x92da26c2'
- '0x50736860'
# --------------------------------------===== PQC SRKH fuse words [Optional] =====--------------------------------------
# Description: Optional array of 16 little-endian 32-bit PQC SRKH fuse words used by key derivation. It can be specified
# either as an array of 16 words or as one inline 512-bit hexadecimal value.
pqc_srkh:
- '0x00000000'
- '0x00000001'
- '0x00000002'
- '0x00000003'
- '0x00000004'
- '0x00000005'
- '0x00000006'
- '0x00000007'
- '0x00000008'
- '0x00000009'
- '0x0000000a'
- '0x0000000b'
- '0x0000000c'
- '0x0000000d'
- '0x0000000e'
- '0x0000000f'
# ----------------------------===== Double encryption/decryption execution [Optional] =====-----------------------------
# Description: Sets IPEDCTRL CONFIG. Enables the hardware double encryption/decryption path used by selected
# provisioning flows. Keep disabled for the usual decrypted-XIP table unless the encrypted image was prepared for double
# encryption.
double_encryption: false
# -----------------------------------===== Enable IPED CTR/GCM logic [Optional] =====-----------------------------------
# Description: Sets IPEDCTRL IPED_EN. Enables the IPED CTR/GCM engine. For a typical decrypted-XIP image this should be
# enabled together with the AHB read flag matching the selected context mode.
enable: true
# ----------------------------===== Enable IP-command write CTR encryption [Optional] =====-----------------------------
# Description: Sets IPEDCTRL IPWR_EN. Enables CTR encryption for writes issued through the memory controller IP-command
# path. This does not affect normal memory-mapped XIP reads; keep disabled unless the application writes encrypted data
# through IP commands.
ip_write_enable: false
# --------------------------------===== Enable AHB write CTR encryption [Optional] =====--------------------------------
# Description: Sets IPEDCTRL AHBWR_EN. Enables CTR encryption for writes on the memory-mapped AHB/XIP path. This is
# normally disabled for read-only boot images.
ahb_write_enable: false
# --------------------------------===== Enable AHB read CTR decryption [Optional] =====---------------------------------
# Description: Sets IPEDCTRL AHBRD_EN. Enables CTR decryption for memory-mapped AHB/XIP reads. This is the usual read-
# side flag for decrypted-XIP boot from external flash when contexts use CTR mode.
ahb_read_enable: true
# ----------------------------===== Enable IP-command write GCM encryption [Optional] =====-----------------------------
# Description: Sets IPEDCTRL IPGCMWR. Enables GCM encryption for writes issued through the memory controller IP-command
# path. Use only with GCM contexts.
ip_gcm_write_enable: false
# --------------------------------===== Enable AHB write GCM encryption [Optional] =====--------------------------------
# Description: Sets IPEDCTRL AHGCMWR. Enables GCM encryption for writes on the memory-mapped AHB/XIP path. Use only with
# GCM contexts.
ahb_gcm_write_enable: false
# --------------------------------===== Enable AHB read GCM decryption [Optional] =====---------------------------------
# Description: Sets IPEDCTRL AHBGCMRD. Enables GCM decryption/authenticated reads on the memory-mapped AHB/XIP path. Use
# this instead of ahb_read_enable when contexts use GCM mode.
ahb_gcm_read_enable: false
# ------------------------------------===== Enable IPED protection [Optional] =====-------------------------------------
# Description: Sets IPEDCTRL IPED_PROTECT. Requests hardware protection of the IPED configuration registers after the
# table is loaded, preventing later changes through normal register writes.
protection: false
# -------------------------------------===== Enable IPED XEX logic [Optional] =====-------------------------------------
# Description: Sets IPEDCTRL IPED_XEX_EN. Enables the IPED XEX engine. Use together with the XEX read/write flags and
# contexts whose mode is xex.
xex_enable: false
# ----------------------------===== Enable IP-command write XEX encryption [Optional] =====-----------------------------
# Description: Sets IPEDCTRL IPSXEXWE. Enables XEX encryption for writes issued through the memory controller IP-command
# path. Use only with XEX contexts.
ip_xex_write_enable: false
# --------------------------------===== Enable AHB write XEX encryption [Optional] =====--------------------------------
# Description: Sets IPEDCTRL AHBXEXWE. Enables XEX encryption for writes on the memory-mapped AHB/XIP path. Use only
# with XEX contexts.
ahb_xex_write_enable: false
# --------------------------------===== Enable AHB read XEX decryption [Optional] =====---------------------------------
# Description: Sets IPEDCTRL AHBXEXRE. Enables XEX decryption for memory-mapped AHB/XIP reads. Use this instead of
# ahb_read_enable when contexts use XEX mode.
ahb_xex_read_enable: false
# ------------------------------------------===== Data blobs [Optional] =====-------------------------------------------
# Description: Optional list of plain binary blobs to encrypt with the matching IPED context. Each blob must fit
# completely into one configured context. Encryption is available through SPSDK's built-in Python backend; an optional
# native backend can accelerate supported legacy models.
data_blobs:
-
# --------------------------------------===== Plain data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain data to encrypt.
data: my_plain_image.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored.
address: '0x60001000'
# -----------------------------------------===== IPED contexts [Required] =====-----------------------------------------
# Description: List of IPED context or region records. At most 16 entries are supported. Each entry describes one
# encrypted/decrypted external memory range.
contexts:
-
# --------------------------------===== Hardware region identifier [Optional] =====---------------------------------
# Description: Optional hardware context identifier from 0 to 15. If omitted, the context position in the list is
# used.
region_id: 0
# -----------------------------------===== Context start address [Required] =====-----------------------------------
# Description: Start address of the IPED-protected external memory region. The address must be aligned to the
# family-specific alignment, typically 0x100 bytes.
start_address: '0x60001000'
# ------------------------------------===== Context end address [Required] =====------------------------------------
# Description: End address of the IPED-protected external memory region. The address must be aligned to the family-
# specific alignment, typically 0x100 bytes.
end_address: '0x60002000'
# -------------------------------------===== IPED context mode [Optional] =====-------------------------------------
# Description: Encryption mode for this context. The global IPEDCTRL read/write enable flags must match the selected
# mode: CTR flags for ctr, GCM flags for gcm, XEX flags for xex. Bypass leaves the region unencrypted.
# Possible options: <ctr, gcm, xex, bypass>
mode: ctr
# ------------------------------===== Context nonce for IV derivation [Optional] =====------------------------------
# Description: Optional 64-bit nonce used when key derivation is enabled. For ROM configuration blobs the nonce is
# serialized and takes precedence over an explicitly configured IV.
nonce: '0x0011223344556677'
IPED for mimxrt2662, Revision: a0#
IPED for mimxrt2662, Revision: a0 JSON schema
IPED for mimxrt2662, Revision: a0 YAML configuration template
# ==================================== IPED template for mimxrt2662, Revision: a0 ====================================
# ======================================================================================================================
# == IPED for mimxrt2662, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# -------------------------------------===== IPED output directory [Required] =====-------------------------------------
# Description: Directory where nxpimage writes generated IPED files. A table/keyblob file is always generated; encrypted
# data and combined image files are generated only when data_blobs are configured.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for all generated IPED artifacts: the table/keyblob, optional encrypted data blob
# file, and optional combined image.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# -------------------------------------===== Output table filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the standalone IPED configuration table. This binary is the keyblob
# payload used by bootable-image when the keyblob segment points to an IPED YAML configuration.
output_name: iped_table
# ------------------------------------===== Encrypted data filename [Optional] =====------------------------------------
# Description: Filename of the encrypted data blobs without file extension. This file is generated only when data_blobs
# are configured.
encrypted_name: encrypted_blob
# ------------------------------------===== Combined image filename [Optional] =====------------------------------------
# Description: Filename of the optional combined table and encrypted-data image without file extension. It must differ
# from output_name and encrypted_name.
image_name: iped_image
# -----------------------------------===== Exported IPED table size [Optional] =====------------------------------------
# Description: Reserved size of the IPED table/keyblob area in a combined bootable image. Fixed register-image tables
# are padded to this size, while tagged ROM configuration files contain only their serialized payload. The default
# 0x400-byte area places the FCB at offset 0x400.
table_size: '0x400'
# ------------------------------===== Absolute IPED table/keyblob address [Optional] =====------------------------------
# Description: Absolute memory-mapped address where the IPED table/keyblob is placed. For bootable images this should
# match the external flash base address of the keyblob segment. It is used only to calculate relative offsets for
# data_blobs and the optional combined image; the value is not serialized into the IPED table.
keyblob_address: '0x60000000'
# -----------------------------------===== Encrypted data alignment [Optional] =====------------------------------------
# Description: Alignment, in bytes, used when placing encrypted data blobs in the generated encrypted-data and combined-
# image outputs. Individual encrypted blobs are always padded to the IPED 8-byte encryption block size.
data_alignment: 8
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI instance used for key derivation and device-specific encryption model selection. For current
# derivation-enabled families, use xspi0 or xspi1.
# Possible options: <xspi0, xspi1>
instance: xspi0
# ------------------------------===== Firmware version for key derivation [Optional] =====------------------------------
# Description: Optional 32-bit firmware version used when context IV values are derived from nonce. It is also
# serialized into ROM configuration blobs.
fw_version: '0x44332211'
# ---------------------------------===== Lifecycle for key derivation [Optional] =====----------------------------------
# Description: Optional lifecycle label used by key derivation. Must be one of: fab, nxp_prov, nxp_fr, oem_open, oem_fr,
# oem_swc, oem_lckd, oem_clsd.
# Possible options: <fab, nxp_prov, nxp_fr, oem_open, oem_fr, oem_swc, oem_lckd, oem_clsd>
lifecycle: oem_open
# -------------------------------------===== CUST_MK_SK fuse words [Optional] =====-------------------------------------
# Description: Optional array of 8 little-endian 32-bit fuse words used for key derivation. It can be specified either
# as an array of 8 words or as one inline 256-bit hexadecimal value. When provided together with
# srkh/pqc_srkh/lifecycle, SPSDK derives context key and IV values automatically.
cust_mk_sk:
- '0x33221100'
- '0x77665544'
- '0xbbaa9988'
- '0xffeeddcc'
- '0x03020100'
- '0x07060504'
- '0x0b0a0908'
- '0x0f0e0d0c'
# ----------------------------------------===== SRKH fuse words [Optional] =====----------------------------------------
# Description: Optional array of 16 little-endian 32-bit classical SRKH fuse words used by key derivation. It can be
# specified either as an array of 16 words or as one inline 512-bit hexadecimal value.
srkh:
- '0x90bf50d4'
- '0xd328ecc9'
- '0x7d28f0eb'
- '0x5f5a3f0c'
- '0xcc891f09'
- '0x88ff036e'
- '0xb6c02073'
- '0xe59c0c6b'
- '0xa0e60353'
- '0x8de9a90d'
- '0x8a83b5c9'
- '0xd34cf089'
- '0x5c73dbb1'
- '0x08a84ada'
- '0x92da26c2'
- '0x50736860'
# --------------------------------------===== PQC SRKH fuse words [Optional] =====--------------------------------------
# Description: Optional array of 16 little-endian 32-bit PQC SRKH fuse words used by key derivation. It can be specified
# either as an array of 16 words or as one inline 512-bit hexadecimal value.
pqc_srkh:
- '0x00000000'
- '0x00000001'
- '0x00000002'
- '0x00000003'
- '0x00000004'
- '0x00000005'
- '0x00000006'
- '0x00000007'
- '0x00000008'
- '0x00000009'
- '0x0000000a'
- '0x0000000b'
- '0x0000000c'
- '0x0000000d'
- '0x0000000e'
- '0x0000000f'
# ----------------------------===== Double encryption/decryption execution [Optional] =====-----------------------------
# Description: Sets IPEDCTRL CONFIG. Enables the hardware double encryption/decryption path used by selected
# provisioning flows. Keep disabled for the usual decrypted-XIP table unless the encrypted image was prepared for double
# encryption.
double_encryption: false
# -----------------------------------===== Enable IPED CTR/GCM logic [Optional] =====-----------------------------------
# Description: Sets IPEDCTRL IPED_EN. Enables the IPED CTR/GCM engine. For a typical decrypted-XIP image this should be
# enabled together with the AHB read flag matching the selected context mode.
enable: true
# ----------------------------===== Enable IP-command write CTR encryption [Optional] =====-----------------------------
# Description: Sets IPEDCTRL IPWR_EN. Enables CTR encryption for writes issued through the memory controller IP-command
# path. This does not affect normal memory-mapped XIP reads; keep disabled unless the application writes encrypted data
# through IP commands.
ip_write_enable: false
# --------------------------------===== Enable AHB write CTR encryption [Optional] =====--------------------------------
# Description: Sets IPEDCTRL AHBWR_EN. Enables CTR encryption for writes on the memory-mapped AHB/XIP path. This is
# normally disabled for read-only boot images.
ahb_write_enable: false
# --------------------------------===== Enable AHB read CTR decryption [Optional] =====---------------------------------
# Description: Sets IPEDCTRL AHBRD_EN. Enables CTR decryption for memory-mapped AHB/XIP reads. This is the usual read-
# side flag for decrypted-XIP boot from external flash when contexts use CTR mode.
ahb_read_enable: true
# ----------------------------===== Enable IP-command write GCM encryption [Optional] =====-----------------------------
# Description: Sets IPEDCTRL IPGCMWR. Enables GCM encryption for writes issued through the memory controller IP-command
# path. Use only with GCM contexts.
ip_gcm_write_enable: false
# --------------------------------===== Enable AHB write GCM encryption [Optional] =====--------------------------------
# Description: Sets IPEDCTRL AHGCMWR. Enables GCM encryption for writes on the memory-mapped AHB/XIP path. Use only with
# GCM contexts.
ahb_gcm_write_enable: false
# --------------------------------===== Enable AHB read GCM decryption [Optional] =====---------------------------------
# Description: Sets IPEDCTRL AHBGCMRD. Enables GCM decryption/authenticated reads on the memory-mapped AHB/XIP path. Use
# this instead of ahb_read_enable when contexts use GCM mode.
ahb_gcm_read_enable: false
# ------------------------------------===== Enable IPED protection [Optional] =====-------------------------------------
# Description: Sets IPEDCTRL IPED_PROTECT. Requests hardware protection of the IPED configuration registers after the
# table is loaded, preventing later changes through normal register writes.
protection: false
# -------------------------------------===== Enable IPED XEX logic [Optional] =====-------------------------------------
# Description: Sets IPEDCTRL IPED_XEX_EN. Enables the IPED XEX engine. Use together with the XEX read/write flags and
# contexts whose mode is xex.
xex_enable: false
# ----------------------------===== Enable IP-command write XEX encryption [Optional] =====-----------------------------
# Description: Sets IPEDCTRL IPSXEXWE. Enables XEX encryption for writes issued through the memory controller IP-command
# path. Use only with XEX contexts.
ip_xex_write_enable: false
# --------------------------------===== Enable AHB write XEX encryption [Optional] =====--------------------------------
# Description: Sets IPEDCTRL AHBXEXWE. Enables XEX encryption for writes on the memory-mapped AHB/XIP path. Use only
# with XEX contexts.
ahb_xex_write_enable: false
# --------------------------------===== Enable AHB read XEX decryption [Optional] =====---------------------------------
# Description: Sets IPEDCTRL AHBXEXRE. Enables XEX decryption for memory-mapped AHB/XIP reads. Use this instead of
# ahb_read_enable when contexts use XEX mode.
ahb_xex_read_enable: false
# ------------------------------------------===== Data blobs [Optional] =====-------------------------------------------
# Description: Optional list of plain binary blobs to encrypt with the matching IPED context. Each blob must fit
# completely into one configured context. Encryption is available through SPSDK's built-in Python backend; an optional
# native backend can accelerate supported legacy models.
data_blobs:
-
# --------------------------------------===== Plain data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain data to encrypt.
data: my_plain_image.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored.
address: '0x60001000'
# -----------------------------------------===== IPED contexts [Required] =====-----------------------------------------
# Description: List of IPED context or region records. At most 16 entries are supported. Each entry describes one
# encrypted/decrypted external memory range.
contexts:
-
# --------------------------------===== Hardware region identifier [Optional] =====---------------------------------
# Description: Optional hardware context identifier from 0 to 15. If omitted, the context position in the list is
# used.
region_id: 0
# -----------------------------------===== Context start address [Required] =====-----------------------------------
# Description: Start address of the IPED-protected external memory region. The address must be aligned to the
# family-specific alignment, typically 0x100 bytes.
start_address: '0x60001000'
# ------------------------------------===== Context end address [Required] =====------------------------------------
# Description: End address of the IPED-protected external memory region. The address must be aligned to the family-
# specific alignment, typically 0x100 bytes.
end_address: '0x60002000'
# -------------------------------------===== IPED context mode [Optional] =====-------------------------------------
# Description: Encryption mode for this context. The global IPEDCTRL read/write enable flags must match the selected
# mode: CTR flags for ctr, GCM flags for gcm, XEX flags for xex. Bypass leaves the region unencrypted.
# Possible options: <ctr, gcm, xex, bypass>
mode: ctr
# ------------------------------===== Context nonce for IV derivation [Optional] =====------------------------------
# Description: Optional 64-bit nonce used when key derivation is enabled. For ROM configuration blobs the nonce is
# serialized and takes precedence over an explicitly configured IV.
nonce: '0x0011223344556677'
IPED for mimxrt2663, Revision: a0#
IPED for mimxrt2663, Revision: a0 JSON schema
IPED for mimxrt2663, Revision: a0 YAML configuration template
# ==================================== IPED template for mimxrt2663, Revision: a0 ====================================
# ======================================================================================================================
# == IPED for mimxrt2663, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# -------------------------------------===== IPED output directory [Required] =====-------------------------------------
# Description: Directory where nxpimage writes generated IPED files. A table/keyblob file is always generated; encrypted
# data and combined image files are generated only when data_blobs are configured.
output_folder: iped_output
# ------------------------------------===== Output data file format [Optional] =====------------------------------------
# Description: Output file format used for all generated IPED artifacts: the table/keyblob, optional encrypted data blob
# file, and optional combined image.
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# -------------------------------------===== Output table filename [Optional] =====-------------------------------------
# Description: Filename, without extension, of the standalone IPED configuration table. This binary is the keyblob
# payload used by bootable-image when the keyblob segment points to an IPED YAML configuration.
output_name: iped_table
# ------------------------------------===== Encrypted data filename [Optional] =====------------------------------------
# Description: Filename of the encrypted data blobs without file extension. This file is generated only when data_blobs
# are configured.
encrypted_name: encrypted_blob
# ------------------------------------===== Combined image filename [Optional] =====------------------------------------
# Description: Filename of the optional combined table and encrypted-data image without file extension. It must differ
# from output_name and encrypted_name.
image_name: iped_image
# -----------------------------------===== Exported IPED table size [Optional] =====------------------------------------
# Description: Reserved size of the IPED table/keyblob area in a combined bootable image. Fixed register-image tables
# are padded to this size, while tagged ROM configuration files contain only their serialized payload. The default
# 0x400-byte area places the FCB at offset 0x400.
table_size: '0x400'
# ------------------------------===== Absolute IPED table/keyblob address [Optional] =====------------------------------
# Description: Absolute memory-mapped address where the IPED table/keyblob is placed. For bootable images this should
# match the external flash base address of the keyblob segment. It is used only to calculate relative offsets for
# data_blobs and the optional combined image; the value is not serialized into the IPED table.
keyblob_address: '0x60000000'
# -----------------------------------===== Encrypted data alignment [Optional] =====------------------------------------
# Description: Alignment, in bytes, used when placing encrypted data blobs in the generated encrypted-data and combined-
# image outputs. Individual encrypted blobs are always padded to the IPED 8-byte encryption block size.
data_alignment: 8
# -----------------------------------------===== XSPI instance [Optional] =====-----------------------------------------
# Description: XSPI instance used for key derivation and device-specific encryption model selection. For current
# derivation-enabled families, use xspi0 or xspi1.
# Possible options: <xspi0, xspi1>
instance: xspi0
# ------------------------------===== Firmware version for key derivation [Optional] =====------------------------------
# Description: Optional 32-bit firmware version used when context IV values are derived from nonce. It is also
# serialized into ROM configuration blobs.
fw_version: '0x44332211'
# ---------------------------------===== Lifecycle for key derivation [Optional] =====----------------------------------
# Description: Optional lifecycle label used by key derivation. Must be one of: fab, nxp_prov, nxp_fr, oem_open, oem_fr,
# oem_swc, oem_lckd, oem_clsd.
# Possible options: <fab, nxp_prov, nxp_fr, oem_open, oem_fr, oem_swc, oem_lckd, oem_clsd>
lifecycle: oem_open
# -------------------------------------===== CUST_MK_SK fuse words [Optional] =====-------------------------------------
# Description: Optional array of 8 little-endian 32-bit fuse words used for key derivation. It can be specified either
# as an array of 8 words or as one inline 256-bit hexadecimal value. When provided together with
# srkh/pqc_srkh/lifecycle, SPSDK derives context key and IV values automatically.
cust_mk_sk:
- '0x33221100'
- '0x77665544'
- '0xbbaa9988'
- '0xffeeddcc'
- '0x03020100'
- '0x07060504'
- '0x0b0a0908'
- '0x0f0e0d0c'
# ----------------------------------------===== SRKH fuse words [Optional] =====----------------------------------------
# Description: Optional array of 16 little-endian 32-bit classical SRKH fuse words used by key derivation. It can be
# specified either as an array of 16 words or as one inline 512-bit hexadecimal value.
srkh:
- '0x90bf50d4'
- '0xd328ecc9'
- '0x7d28f0eb'
- '0x5f5a3f0c'
- '0xcc891f09'
- '0x88ff036e'
- '0xb6c02073'
- '0xe59c0c6b'
- '0xa0e60353'
- '0x8de9a90d'
- '0x8a83b5c9'
- '0xd34cf089'
- '0x5c73dbb1'
- '0x08a84ada'
- '0x92da26c2'
- '0x50736860'
# --------------------------------------===== PQC SRKH fuse words [Optional] =====--------------------------------------
# Description: Optional array of 16 little-endian 32-bit PQC SRKH fuse words used by key derivation. It can be specified
# either as an array of 16 words or as one inline 512-bit hexadecimal value.
pqc_srkh:
- '0x00000000'
- '0x00000001'
- '0x00000002'
- '0x00000003'
- '0x00000004'
- '0x00000005'
- '0x00000006'
- '0x00000007'
- '0x00000008'
- '0x00000009'
- '0x0000000a'
- '0x0000000b'
- '0x0000000c'
- '0x0000000d'
- '0x0000000e'
- '0x0000000f'
# ----------------------------===== Double encryption/decryption execution [Optional] =====-----------------------------
# Description: Sets IPEDCTRL CONFIG. Enables the hardware double encryption/decryption path used by selected
# provisioning flows. Keep disabled for the usual decrypted-XIP table unless the encrypted image was prepared for double
# encryption.
double_encryption: false
# -----------------------------------===== Enable IPED CTR/GCM logic [Optional] =====-----------------------------------
# Description: Sets IPEDCTRL IPED_EN. Enables the IPED CTR/GCM engine. For a typical decrypted-XIP image this should be
# enabled together with the AHB read flag matching the selected context mode.
enable: true
# ----------------------------===== Enable IP-command write CTR encryption [Optional] =====-----------------------------
# Description: Sets IPEDCTRL IPWR_EN. Enables CTR encryption for writes issued through the memory controller IP-command
# path. This does not affect normal memory-mapped XIP reads; keep disabled unless the application writes encrypted data
# through IP commands.
ip_write_enable: false
# --------------------------------===== Enable AHB write CTR encryption [Optional] =====--------------------------------
# Description: Sets IPEDCTRL AHBWR_EN. Enables CTR encryption for writes on the memory-mapped AHB/XIP path. This is
# normally disabled for read-only boot images.
ahb_write_enable: false
# --------------------------------===== Enable AHB read CTR decryption [Optional] =====---------------------------------
# Description: Sets IPEDCTRL AHBRD_EN. Enables CTR decryption for memory-mapped AHB/XIP reads. This is the usual read-
# side flag for decrypted-XIP boot from external flash when contexts use CTR mode.
ahb_read_enable: true
# ----------------------------===== Enable IP-command write GCM encryption [Optional] =====-----------------------------
# Description: Sets IPEDCTRL IPGCMWR. Enables GCM encryption for writes issued through the memory controller IP-command
# path. Use only with GCM contexts.
ip_gcm_write_enable: false
# --------------------------------===== Enable AHB write GCM encryption [Optional] =====--------------------------------
# Description: Sets IPEDCTRL AHGCMWR. Enables GCM encryption for writes on the memory-mapped AHB/XIP path. Use only with
# GCM contexts.
ahb_gcm_write_enable: false
# --------------------------------===== Enable AHB read GCM decryption [Optional] =====---------------------------------
# Description: Sets IPEDCTRL AHBGCMRD. Enables GCM decryption/authenticated reads on the memory-mapped AHB/XIP path. Use
# this instead of ahb_read_enable when contexts use GCM mode.
ahb_gcm_read_enable: false
# ------------------------------------===== Enable IPED protection [Optional] =====-------------------------------------
# Description: Sets IPEDCTRL IPED_PROTECT. Requests hardware protection of the IPED configuration registers after the
# table is loaded, preventing later changes through normal register writes.
protection: false
# -------------------------------------===== Enable IPED XEX logic [Optional] =====-------------------------------------
# Description: Sets IPEDCTRL IPED_XEX_EN. Enables the IPED XEX engine. Use together with the XEX read/write flags and
# contexts whose mode is xex.
xex_enable: false
# ----------------------------===== Enable IP-command write XEX encryption [Optional] =====-----------------------------
# Description: Sets IPEDCTRL IPSXEXWE. Enables XEX encryption for writes issued through the memory controller IP-command
# path. Use only with XEX contexts.
ip_xex_write_enable: false
# --------------------------------===== Enable AHB write XEX encryption [Optional] =====--------------------------------
# Description: Sets IPEDCTRL AHBXEXWE. Enables XEX encryption for writes on the memory-mapped AHB/XIP path. Use only
# with XEX contexts.
ahb_xex_write_enable: false
# --------------------------------===== Enable AHB read XEX decryption [Optional] =====---------------------------------
# Description: Sets IPEDCTRL AHBXEXRE. Enables XEX decryption for memory-mapped AHB/XIP reads. Use this instead of
# ahb_read_enable when contexts use XEX mode.
ahb_xex_read_enable: false
# ------------------------------------------===== Data blobs [Optional] =====-------------------------------------------
# Description: Optional list of plain binary blobs to encrypt with the matching IPED context. Each blob must fit
# completely into one configured context. Encryption is available through SPSDK's built-in Python backend; an optional
# native backend can accelerate supported legacy models.
data_blobs:
-
# --------------------------------------===== Plain data blob [Required] =====--------------------------------------
# Description: Path to binary file with plain data to encrypt.
data: my_plain_image.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Absolute memory-mapped address where the data blob will be stored.
address: '0x60001000'
# -----------------------------------------===== IPED contexts [Required] =====-----------------------------------------
# Description: List of IPED context or region records. At most 16 entries are supported. Each entry describes one
# encrypted/decrypted external memory range.
contexts:
-
# --------------------------------===== Hardware region identifier [Optional] =====---------------------------------
# Description: Optional hardware context identifier from 0 to 15. If omitted, the context position in the list is
# used.
region_id: 0
# -----------------------------------===== Context start address [Required] =====-----------------------------------
# Description: Start address of the IPED-protected external memory region. The address must be aligned to the
# family-specific alignment, typically 0x100 bytes.
start_address: '0x60001000'
# ------------------------------------===== Context end address [Required] =====------------------------------------
# Description: End address of the IPED-protected external memory region. The address must be aligned to the family-
# specific alignment, typically 0x100 bytes.
end_address: '0x60002000'
# -------------------------------------===== IPED context mode [Optional] =====-------------------------------------
# Description: Encryption mode for this context. The global IPEDCTRL read/write enable flags must match the selected
# mode: CTR flags for ctr, GCM flags for gcm, XEX flags for xex. Bypass leaves the region unencrypted.
# Possible options: <ctr, gcm, xex, bypass>
mode: ctr
# ------------------------------===== Context nonce for IV derivation [Optional] =====------------------------------
# Description: Optional 64-bit nonce used when key derivation is enabled. For ROM configuration blobs the nonce is
# serialized and takes precedence over an explicitly configured IV.
nonce: '0x0011223344556677'
OTFAD#
The On-The-Fly AES Decryption (OTFAD) module provides an advanced hardware implementation that minimizes any incremental cycles of latency introduced by the decryption in the overall external memory-access time. It implements a block cipher mode of operation supporting the counter mode (CTR). The CTR mode provides a confidentiality mode that features the application of the forward cipher to a set of input blocks (called counters) to produce a sequence of output blocks that are exclusive-ORed with the plaintext to produce the ciphertext and vice versa. The OTFAD engine includes complete hardware support for a standard AES key unwrap mechanism to decrypt a key BLOB data instruction containing the parameters needed for up to 4 unique AES contexts. Each context has a unique 128-bit key, a 64-bit counter, and a 64-bit memory region descriptor.
OTFAD for mimx8ulp, Revision: a2#
OTFAD for mimx8ulp, Revision: a2 JSON schema
OTFAD for mimx8ulp, Revision: a2 YAML configuration template
# ==================================== OTFAD template for mimx8ulp, Revision: a2 =====================================
# ======================================================================================================================
# == OTFAD for mimx8ulp, Revision: a2 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, a2, latest>
revision: a2
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x40000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x40001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x40001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x40010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9301, Revision: a1#
OTFAD for mimx9301, Revision: a1 JSON schema
OTFAD for mimx9301, Revision: a1 YAML configuration template
# ==================================== OTFAD template for mimx9301, Revision: a1 =====================================
# ======================================================================================================================
# == OTFAD for mimx9301, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9302, Revision: a1#
OTFAD for mimx9302, Revision: a1 JSON schema
OTFAD for mimx9302, Revision: a1 YAML configuration template
# ==================================== OTFAD template for mimx9302, Revision: a1 =====================================
# ======================================================================================================================
# == OTFAD for mimx9302, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9311, Revision: a1#
OTFAD for mimx9311, Revision: a1 JSON schema
OTFAD for mimx9311, Revision: a1 YAML configuration template
# ==================================== OTFAD template for mimx9311, Revision: a1 =====================================
# ======================================================================================================================
# == OTFAD for mimx9311, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9312, Revision: a1#
OTFAD for mimx9312, Revision: a1 JSON schema
OTFAD for mimx9312, Revision: a1 YAML configuration template
# ==================================== OTFAD template for mimx9312, Revision: a1 =====================================
# ======================================================================================================================
# == OTFAD for mimx9312, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9321, Revision: a1#
OTFAD for mimx9321, Revision: a1 JSON schema
OTFAD for mimx9321, Revision: a1 YAML configuration template
# ==================================== OTFAD template for mimx9321, Revision: a1 =====================================
# ======================================================================================================================
# == OTFAD for mimx9321, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9322, Revision: a1#
OTFAD for mimx9322, Revision: a1 JSON schema
OTFAD for mimx9322, Revision: a1 YAML configuration template
# ==================================== OTFAD template for mimx9322, Revision: a1 =====================================
# ======================================================================================================================
# == OTFAD for mimx9322, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9331, Revision: a1#
OTFAD for mimx9331, Revision: a1 JSON schema
OTFAD for mimx9331, Revision: a1 YAML configuration template
# ==================================== OTFAD template for mimx9331, Revision: a1 =====================================
# ======================================================================================================================
# == OTFAD for mimx9331, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9332, Revision: a1#
OTFAD for mimx9332, Revision: a1 JSON schema
OTFAD for mimx9332, Revision: a1 YAML configuration template
# ==================================== OTFAD template for mimx9332, Revision: a1 =====================================
# ======================================================================================================================
# == OTFAD for mimx9332, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9351, Revision: a1#
OTFAD for mimx9351, Revision: a1 JSON schema
OTFAD for mimx9351, Revision: a1 YAML configuration template
# ==================================== OTFAD template for mimx9351, Revision: a1 =====================================
# ======================================================================================================================
# == OTFAD for mimx9351, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9352, Revision: a1#
OTFAD for mimx9352, Revision: a1 JSON schema
OTFAD for mimx9352, Revision: a1 YAML configuration template
# ==================================== OTFAD template for mimx9352, Revision: a1 =====================================
# ======================================================================================================================
# == OTFAD for mimx9352, Revision: a1 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, latest>
revision: a1
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx93714, Revision: a0#
OTFAD for mimx93714, Revision: a0 JSON schema
OTFAD for mimx93714, Revision: a0 YAML configuration template
# ==================================== OTFAD template for mimx93714, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimx93714, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx93734, Revision: a0#
OTFAD for mimx93734, Revision: a0 JSON schema
OTFAD for mimx93734, Revision: a0 YAML configuration template
# ==================================== OTFAD template for mimx93734, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimx93734, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx93754, Revision: a0#
OTFAD for mimx93754, Revision: a0 JSON schema
OTFAD for mimx93754, Revision: a0 YAML configuration template
# ==================================== OTFAD template for mimx93754, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimx93754, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx95224, Revision: a0#
OTFAD for mimx95224, Revision: a0 JSON schema
OTFAD for mimx95224, Revision: a0 YAML configuration template
# ==================================== OTFAD template for mimx95224, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimx95224, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx95234, Revision: a0#
OTFAD for mimx95234, Revision: a0 JSON schema
OTFAD for mimx95234, Revision: a0 YAML configuration template
# ==================================== OTFAD template for mimx95234, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimx95234, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx95244, Revision: a0#
OTFAD for mimx95244, Revision: a0 JSON schema
OTFAD for mimx95244, Revision: a0 YAML configuration template
# ==================================== OTFAD template for mimx95244, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimx95244, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx95252, Revision: a0#
OTFAD for mimx95252, Revision: a0 JSON schema
OTFAD for mimx95252, Revision: a0 YAML configuration template
# ==================================== OTFAD template for mimx95252, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimx95252, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx95254, Revision: a0#
OTFAD for mimx95254, Revision: a0 JSON schema
OTFAD for mimx95254, Revision: a0 YAML configuration template
# ==================================== OTFAD template for mimx95254, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimx95254, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx95284, Revision: a0#
OTFAD for mimx95284, Revision: a0 JSON schema
OTFAD for mimx95284, Revision: a0 YAML configuration template
# ==================================== OTFAD template for mimx95284, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimx95284, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx95292, Revision: a0#
OTFAD for mimx95292, Revision: a0 JSON schema
OTFAD for mimx95292, Revision: a0 YAML configuration template
# ==================================== OTFAD template for mimx95292, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimx95292, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx95294, Revision: a0#
OTFAD for mimx95294, Revision: a0 JSON schema
OTFAD for mimx95294, Revision: a0 YAML configuration template
# ==================================== OTFAD template for mimx95294, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimx95294, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9534, Revision: b0#
OTFAD for mimx9534, Revision: b0 JSON schema
OTFAD for mimx9534, Revision: b0 YAML configuration template
# ==================================== OTFAD template for mimx9534, Revision: b0 =====================================
# ======================================================================================================================
# == OTFAD for mimx9534, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9536, Revision: b0#
OTFAD for mimx9536, Revision: b0 JSON schema
OTFAD for mimx9536, Revision: b0 YAML configuration template
# ==================================== OTFAD template for mimx9536, Revision: b0 =====================================
# ======================================================================================================================
# == OTFAD for mimx9536, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9546, Revision: b0#
OTFAD for mimx9546, Revision: b0 JSON schema
OTFAD for mimx9546, Revision: b0 YAML configuration template
# ==================================== OTFAD template for mimx9546, Revision: b0 =====================================
# ======================================================================================================================
# == OTFAD for mimx9546, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9554, Revision: b0#
OTFAD for mimx9554, Revision: b0 JSON schema
OTFAD for mimx9554, Revision: b0 YAML configuration template
# ==================================== OTFAD template for mimx9554, Revision: b0 =====================================
# ======================================================================================================================
# == OTFAD for mimx9554, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9586, Revision: b0#
OTFAD for mimx9586, Revision: b0 JSON schema
OTFAD for mimx9586, Revision: b0 YAML configuration template
# ==================================== OTFAD template for mimx9586, Revision: b0 =====================================
# ======================================================================================================================
# == OTFAD for mimx9586, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9594, Revision: b0#
OTFAD for mimx9594, Revision: b0 JSON schema
OTFAD for mimx9594, Revision: b0 YAML configuration template
# ==================================== OTFAD template for mimx9594, Revision: b0 =====================================
# ======================================================================================================================
# == OTFAD for mimx9594, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimx9596, Revision: b0#
OTFAD for mimx9596, Revision: b0 JSON schema
OTFAD for mimx9596, Revision: b0 YAML configuration template
# ==================================== OTFAD template for mimx9596, Revision: b0 =====================================
# ======================================================================================================================
# == OTFAD for mimx9596, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, a1, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1010, Revision: a0#
OTFAD for mimxrt1010, Revision: a0 JSON schema
OTFAD for mimxrt1010, Revision: a0 YAML configuration template
# =================================== OTFAD template for mimxrt1010, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1010, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x08000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x08001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x08001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x08010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1151, Revision: a0#
OTFAD for mimxrt1151, Revision: a0 JSON schema
OTFAD for mimxrt1151, Revision: a0 YAML configuration template
# =================================== OTFAD template for mimxrt1151, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1151, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x08000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x08001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x08001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x08010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1152, Revision: a0#
OTFAD for mimxrt1152, Revision: a0 JSON schema
OTFAD for mimxrt1152, Revision: a0 YAML configuration template
# =================================== OTFAD template for mimxrt1152, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1152, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x08000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x08001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x08001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x08010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1165, Revision: a0#
OTFAD for mimxrt1165, Revision: a0 JSON schema
OTFAD for mimxrt1165, Revision: a0 YAML configuration template
# =================================== OTFAD template for mimxrt1165, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1165, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x08000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x08001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x08001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x08010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1166, Revision: a0#
OTFAD for mimxrt1166, Revision: a0 JSON schema
OTFAD for mimxrt1166, Revision: a0 YAML configuration template
# =================================== OTFAD template for mimxrt1166, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1166, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x08000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x08001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x08001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x08010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1171, Revision: a0#
OTFAD for mimxrt1171, Revision: a0 JSON schema
OTFAD for mimxrt1171, Revision: a0 YAML configuration template
# =================================== OTFAD template for mimxrt1171, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1171, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x08000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x08001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x08001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x08010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1172, Revision: a0#
OTFAD for mimxrt1172, Revision: a0 JSON schema
OTFAD for mimxrt1172, Revision: a0 YAML configuration template
# =================================== OTFAD template for mimxrt1172, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1172, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x08000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x08001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x08001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x08010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1173, Revision: a0#
OTFAD for mimxrt1173, Revision: a0 JSON schema
OTFAD for mimxrt1173, Revision: a0 YAML configuration template
# =================================== OTFAD template for mimxrt1173, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1173, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x08000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x08001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x08001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x08010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1175, Revision: a0#
OTFAD for mimxrt1175, Revision: a0 JSON schema
OTFAD for mimxrt1175, Revision: a0 YAML configuration template
# =================================== OTFAD template for mimxrt1175, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1175, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x08000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x08001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x08001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x08010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1176, Revision: a0#
OTFAD for mimxrt1176, Revision: a0 JSON schema
OTFAD for mimxrt1176, Revision: a0 YAML configuration template
# =================================== OTFAD template for mimxrt1176, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1176, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x08000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x08001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x08001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x08010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1181, Revision: b0#
OTFAD for mimxrt1181, Revision: b0 JSON schema
OTFAD for mimxrt1181, Revision: b0 YAML configuration template
# =================================== OTFAD template for mimxrt1181, Revision: b0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1181, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1182, Revision: b0#
OTFAD for mimxrt1182, Revision: b0 JSON schema
OTFAD for mimxrt1182, Revision: b0 YAML configuration template
# =================================== OTFAD template for mimxrt1182, Revision: b0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1182, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1183, Revision: b0#
OTFAD for mimxrt1183, Revision: b0 JSON schema
OTFAD for mimxrt1183, Revision: b0 YAML configuration template
# =================================== OTFAD template for mimxrt1183, Revision: b0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1183, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1184, Revision: b0#
OTFAD for mimxrt1184, Revision: b0 JSON schema
OTFAD for mimxrt1184, Revision: b0 YAML configuration template
# =================================== OTFAD template for mimxrt1184, Revision: b0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1184, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1185, Revision: b0#
OTFAD for mimxrt1185, Revision: b0 JSON schema
OTFAD for mimxrt1185, Revision: b0 YAML configuration template
# =================================== OTFAD template for mimxrt1185, Revision: b0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1185, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1186, Revision: a0#
OTFAD for mimxrt1186, Revision: a0 JSON schema
OTFAD for mimxrt1186, Revision: a0 YAML configuration template
# =================================== OTFAD template for mimxrt1186, Revision: a0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1186, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: a0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1187, Revision: b0#
OTFAD for mimxrt1187, Revision: b0 JSON schema
OTFAD for mimxrt1187, Revision: b0 YAML configuration template
# =================================== OTFAD template for mimxrt1187, Revision: b0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1187, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt1189, Revision: b0#
OTFAD for mimxrt1189, Revision: b0 JSON schema
OTFAD for mimxrt1189, Revision: b0 YAML configuration template
# =================================== OTFAD template for mimxrt1189, Revision: b0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt1189, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt118c, Revision: b0#
OTFAD for mimxrt118c, Revision: b0 JSON schema
OTFAD for mimxrt118c, Revision: b0 YAML configuration template
# =================================== OTFAD template for mimxrt118c, Revision: b0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt118c, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt118d, Revision: b0#
OTFAD for mimxrt118d, Revision: b0 JSON schema
OTFAD for mimxrt118d, Revision: b0 YAML configuration template
# =================================== OTFAD template for mimxrt118d, Revision: b0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt118d, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt118e, Revision: b0#
OTFAD for mimxrt118e, Revision: b0 JSON schema
OTFAD for mimxrt118e, Revision: b0 YAML configuration template
# =================================== OTFAD template for mimxrt118e, Revision: b0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt118e, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
key_scramble:
# ----------------------------------------===== Key Scramble [Required] =====-----------------------------------------
# Description: OTFAD Key Scramble mask (4 bytes size)
key_scramble_mask: '0x12345678'
# -------------------------------------===== Key Scramble Align [Required] =====--------------------------------------
# Description: OTFAD Key scramble mask align (1 byte size)
key_scramble_align: '0x72'
OTFAD for mimxrt533s, Revision: b0#
OTFAD for mimxrt533s, Revision: b0 JSON schema
OTFAD for mimxrt533s, Revision: b0 YAML configuration template
# =================================== OTFAD template for mimxrt533s, Revision: b0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt533s, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
OTFAD for mimxrt555s, Revision: b0#
OTFAD for mimxrt555s, Revision: b0 JSON schema
OTFAD for mimxrt555s, Revision: b0 YAML configuration template
# =================================== OTFAD template for mimxrt555s, Revision: b0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt555s, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
OTFAD for mimxrt595s, Revision: b0#
OTFAD for mimxrt595s, Revision: b0 JSON schema
OTFAD for mimxrt595s, Revision: b0 YAML configuration template
# =================================== OTFAD template for mimxrt595s, Revision: b0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt595s, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
OTFAD for mimxrt685s, Revision: b0#
OTFAD for mimxrt685s, Revision: b0 JSON schema
OTFAD for mimxrt685s, Revision: b0 YAML configuration template
# =================================== OTFAD template for mimxrt685s, Revision: b0 ====================================
# ======================================================================================================================
# == OTFAD for mimxrt685s, Revision: b0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, b0, latest>
revision: b0
# --------------------------------------===== OTFAD output folder [Required] =====--------------------------------------
# Description: Path to directory where the OTFAD output will be generated
output_folder: otfad_output
# -----------------------------------===== Output data file format's [Optional] =====-----------------------------------
# Description: Output file format for OTFAD image(s)
# Possible options: <bin, hex, srec, sparse>
output_format: bin
# ---------------------------------===== Output binary image file name [Optional] =====---------------------------------
# Description: Filename of the output image containing keyblobs and encrypted data blobs without file extension (.bin
# will be appended)
output_name: otfad_whole_image
# ---------------------------------------===== Keyblob file name [Optional] =====---------------------------------------
# Description: Filename of the keyblob without file extension (.bin will be appended)
keyblob_name: OTFAD_Table
# ----------------------------------------===== Encrypted name [Optional] =====-----------------------------------------
# Description: filename of the encrypted datablobs without file extension (.bin will be appended)
encrypted_name: encrypted_blob
# --------------------------------------===== Generate readme.txt [Optional] =====--------------------------------------
# Description: Readme file contains information about image layout
generate_readme: true
# ----------------------------------------------===== KEK [Required] =====----------------------------------------------
# Description: OTFAD Key Encryption Key to encrypt OTFAD table. Might be provided as a path to binary file containing
# KEK or as a string or number
kek: my_secret_kek.bin
# ---------------------------------===== OTFAD key blobs table address [Required] =====---------------------------------
# Description: The base address of key blob table, it should be aligned to 1 KB (1024 B)
otfad_table_address: '0x28000000'
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs included in this key blob
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted if desired
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address, it could be omitted if data blob starts at start_address
address: '0x28001000'
# --------------------------------===== List of Key Blobs used by OTFAD [Required] =====--------------------------------
# Description: The list of definition of individual key blobs including plain data. Add other array items as you need
# and device allows
key_blobs:
-
# ------------------------------------------===== AES key [Required] =====------------------------------------------
# Description: AES key for the key blob
aes_key: '0xB1A0C56AF31E98CD6936A79D9E6F829D'
# -------------------------------------===== AES Counter value [Required] =====-------------------------------------
# Description: AES counter value for the key blob
aes_ctr: '0x5689fab8b4bfb264'
# ------------------------------===== Start address of key blob data [Required] =====-------------------------------
# Description: Start address of key blob data, it should be aligned to 1 KB (1024 B)
start_address: '0x28001000'
# -------------------------------===== End address of key blob data [Required] =====--------------------------------
# Description: End address of key blob data, it should be aligned to 1 KB (1024 B)
end_address: '0x28010000'
# --------------------------------===== AES decryption enable flag [Optional] =====---------------------------------
# Description: For accesses hitting in a valid context, this bit indicates if the fetched data is to be decrypted or
# simply bypassed
aes_decryption_enable: true
# ----------------------------------------===== Valid flag [Optional] =====-----------------------------------------
# Description: This field signals if the context is valid or not
valid: true
# --------------------------------------===== Read Only flag [Optional] =====---------------------------------------
# Description: This field signals if the context is Read only or not
read_only: true
BEE#
i.MX RT10xx, except i.MX1010, provides an on-the-fly encryption engine called Bus Encryption Engine(BEE) Refer to this application note for more info: AN12852.
Bee for mimxrt1015, Revision: a0#
Bee for mimxrt1015, Revision: a0 JSON schema
Bee for mimxrt1015, Revision: a0 YAML configuration template
# =================================================== BEE template ===================================================
# ======================================================================================================================
# == Bee for mimxrt1015, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# ---------------------------------------===== BEE output folder [Required] =====---------------------------------------
# Description: Folder name to store generated BEE output
output_folder: bee_output
# ------------------------------------===== Output binary file name [Optional] =====------------------------------------
# Description: File name of the encrypted file, output_folder/output_name or full path (.bin will be appended)
output_name: encrypted
# -------------------------===== File name of the exported BEE region headers [Optional] =====--------------------------
# Description: output_folder/header_name or full path + index will be appended (.bin will be appended)
header_name: bee_ehdr
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs to be encrypted
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address where the data should be loaded
address: '0x60001000'
# ---------------------------------------===== Engine selection [Required] =====----------------------------------------
# Description: BEE Engine Selection, engine0, engine1 or both engines
# Possible options: <engine0, engine1, both>
engine_selection: engine0
# ------------------------------------------===== Bee engines [Required] =====------------------------------------------
# Description: Configuration of BEE engines
bee_engine:
-
# ====================================================================================================================
# == List of possible 2 options. ==
# Options [bee_cfg, bee_binary_cfg]
# ====================================================================================================================
# =========================== [Example of possible configuration: #0 , erase if not used] ============================
# BEE engine configuration
bee_cfg:
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key for encryption (sw_key burned into fuses). Could be defined as hex value or path to a
# binary file.
user_key: '0x0123456789abcdeffedcba9876543210'
# ---------------------------------===== Engine AES-128 KIB key [Optional] =====----------------------------------
# Description: Optional AES-128 key used to encrypt PRDB in BEE header (CBC mode). If not provided, a random key
# is generated and saved to output folder. To reuse a previously generated key, provide the value from the saved
# key file. Could be defined as hex value or path to a binary file.
engine_key: '0x00000000000000000000000000000000'
# ------------------------===== Engine AES-128 KIB initialization vector [Optional] =====-------------------------
# Description: Optional AES-128 initialization vector for PRDB encryption (CBC mode). If not provided, a random IV
# is generated and saved to output folder. Could be defined as hex value or path to a binary file.
engine_iv: '0x00000000000000000000000000000000'
# ----------------------------===== Engine AES-CTR counter (12 bytes) [Optional] =====----------------------------
# Description: Optional 12-byte nonce for AES-CTR data encryption. The last 4 bytes (block counter) are always set
# to zero automatically. If not provided, a random counter is generated and saved to output folder. Could be
# defined as hex value or path to a binary file.
engine_counter: '0x000000000000000000000000'
# ------------------------------------===== Protected region [Optional] =====-------------------------------------
# Description: List of protected regions, up to four regions
protected_region:
-
# --------------------------===== Start address of protected region [Required] =====--------------------------
# Description: Start address of protected region, it should be aligned to 1 KB (1024 B)
start_address: '0x60001000'
# -----------------------------===== Length of protected region [Required] =====------------------------------
# Description: Length of protected region, it should be aligned to 1 KB (1024 B)
length: '0x4400'
# -----------------------------------===== Protected level [Required] =====-----------------------------------
# Description: Protected level (0/1/2/3), 0 is default
protected_level: 0
# =========================== [Example of possible configuration: #1 , erase if not used] ============================
# BEE engine configuration with binary header
bee_binary_cfg:
# -------------------------------------===== BEE header path [Required] =====-------------------------------------
# Description: Path to the existing BEE header in binary form
header_path: bee_ehdr0.bin
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key that was used for header encryption. Could be defined as hex value or path to a binary
# file.
user_key: '0x0123456789abcdeffedcba9876543210'
Bee for mimxrt1020, Revision: a0#
Bee for mimxrt1020, Revision: a0 JSON schema
Bee for mimxrt1020, Revision: a0 YAML configuration template
# =================================================== BEE template ===================================================
# ======================================================================================================================
# == Bee for mimxrt1020, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# ---------------------------------------===== BEE output folder [Required] =====---------------------------------------
# Description: Folder name to store generated BEE output
output_folder: bee_output
# ------------------------------------===== Output binary file name [Optional] =====------------------------------------
# Description: File name of the encrypted file, output_folder/output_name or full path (.bin will be appended)
output_name: encrypted
# -------------------------===== File name of the exported BEE region headers [Optional] =====--------------------------
# Description: output_folder/header_name or full path + index will be appended (.bin will be appended)
header_name: bee_ehdr
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs to be encrypted
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address where the data should be loaded
address: '0x60001000'
# ---------------------------------------===== Engine selection [Required] =====----------------------------------------
# Description: BEE Engine Selection, engine0, engine1 or both engines
# Possible options: <engine0, engine1, both>
engine_selection: engine0
# ------------------------------------------===== Bee engines [Required] =====------------------------------------------
# Description: Configuration of BEE engines
bee_engine:
-
# ====================================================================================================================
# == List of possible 2 options. ==
# Options [bee_cfg, bee_binary_cfg]
# ====================================================================================================================
# =========================== [Example of possible configuration: #0 , erase if not used] ============================
# BEE engine configuration
bee_cfg:
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key for encryption (sw_key burned into fuses). Could be defined as hex value or path to a
# binary file.
user_key: '0x0123456789abcdeffedcba9876543210'
# ---------------------------------===== Engine AES-128 KIB key [Optional] =====----------------------------------
# Description: Optional AES-128 key used to encrypt PRDB in BEE header (CBC mode). If not provided, a random key
# is generated and saved to output folder. To reuse a previously generated key, provide the value from the saved
# key file. Could be defined as hex value or path to a binary file.
engine_key: '0x00000000000000000000000000000000'
# ------------------------===== Engine AES-128 KIB initialization vector [Optional] =====-------------------------
# Description: Optional AES-128 initialization vector for PRDB encryption (CBC mode). If not provided, a random IV
# is generated and saved to output folder. Could be defined as hex value or path to a binary file.
engine_iv: '0x00000000000000000000000000000000'
# ----------------------------===== Engine AES-CTR counter (12 bytes) [Optional] =====----------------------------
# Description: Optional 12-byte nonce for AES-CTR data encryption. The last 4 bytes (block counter) are always set
# to zero automatically. If not provided, a random counter is generated and saved to output folder. Could be
# defined as hex value or path to a binary file.
engine_counter: '0x000000000000000000000000'
# ------------------------------------===== Protected region [Optional] =====-------------------------------------
# Description: List of protected regions, up to four regions
protected_region:
-
# --------------------------===== Start address of protected region [Required] =====--------------------------
# Description: Start address of protected region, it should be aligned to 1 KB (1024 B)
start_address: '0x60001000'
# -----------------------------===== Length of protected region [Required] =====------------------------------
# Description: Length of protected region, it should be aligned to 1 KB (1024 B)
length: '0x4400'
# -----------------------------------===== Protected level [Required] =====-----------------------------------
# Description: Protected level (0/1/2/3), 0 is default
protected_level: 0
# =========================== [Example of possible configuration: #1 , erase if not used] ============================
# BEE engine configuration with binary header
bee_binary_cfg:
# -------------------------------------===== BEE header path [Required] =====-------------------------------------
# Description: Path to the existing BEE header in binary form
header_path: bee_ehdr0.bin
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key that was used for header encryption. Could be defined as hex value or path to a binary
# file.
user_key: '0x0123456789abcdeffedcba9876543210'
Bee for mimxrt1024, Revision: a0#
Bee for mimxrt1024, Revision: a0 JSON schema
Bee for mimxrt1024, Revision: a0 YAML configuration template
# =================================================== BEE template ===================================================
# ======================================================================================================================
# == Bee for mimxrt1024, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# ---------------------------------------===== BEE output folder [Required] =====---------------------------------------
# Description: Folder name to store generated BEE output
output_folder: bee_output
# ------------------------------------===== Output binary file name [Optional] =====------------------------------------
# Description: File name of the encrypted file, output_folder/output_name or full path (.bin will be appended)
output_name: encrypted
# -------------------------===== File name of the exported BEE region headers [Optional] =====--------------------------
# Description: output_folder/header_name or full path + index will be appended (.bin will be appended)
header_name: bee_ehdr
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs to be encrypted
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address where the data should be loaded
address: '0x60001000'
# ---------------------------------------===== Engine selection [Required] =====----------------------------------------
# Description: BEE Engine Selection, engine0, engine1 or both engines
# Possible options: <engine0, engine1, both>
engine_selection: engine0
# ------------------------------------------===== Bee engines [Required] =====------------------------------------------
# Description: Configuration of BEE engines
bee_engine:
-
# ====================================================================================================================
# == List of possible 2 options. ==
# Options [bee_cfg, bee_binary_cfg]
# ====================================================================================================================
# =========================== [Example of possible configuration: #0 , erase if not used] ============================
# BEE engine configuration
bee_cfg:
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key for encryption (sw_key burned into fuses). Could be defined as hex value or path to a
# binary file.
user_key: '0x0123456789abcdeffedcba9876543210'
# ---------------------------------===== Engine AES-128 KIB key [Optional] =====----------------------------------
# Description: Optional AES-128 key used to encrypt PRDB in BEE header (CBC mode). If not provided, a random key
# is generated and saved to output folder. To reuse a previously generated key, provide the value from the saved
# key file. Could be defined as hex value or path to a binary file.
engine_key: '0x00000000000000000000000000000000'
# ------------------------===== Engine AES-128 KIB initialization vector [Optional] =====-------------------------
# Description: Optional AES-128 initialization vector for PRDB encryption (CBC mode). If not provided, a random IV
# is generated and saved to output folder. Could be defined as hex value or path to a binary file.
engine_iv: '0x00000000000000000000000000000000'
# ----------------------------===== Engine AES-CTR counter (12 bytes) [Optional] =====----------------------------
# Description: Optional 12-byte nonce for AES-CTR data encryption. The last 4 bytes (block counter) are always set
# to zero automatically. If not provided, a random counter is generated and saved to output folder. Could be
# defined as hex value or path to a binary file.
engine_counter: '0x000000000000000000000000'
# ------------------------------------===== Protected region [Optional] =====-------------------------------------
# Description: List of protected regions, up to four regions
protected_region:
-
# --------------------------===== Start address of protected region [Required] =====--------------------------
# Description: Start address of protected region, it should be aligned to 1 KB (1024 B)
start_address: '0x60001000'
# -----------------------------===== Length of protected region [Required] =====------------------------------
# Description: Length of protected region, it should be aligned to 1 KB (1024 B)
length: '0x4400'
# -----------------------------------===== Protected level [Required] =====-----------------------------------
# Description: Protected level (0/1/2/3), 0 is default
protected_level: 0
# =========================== [Example of possible configuration: #1 , erase if not used] ============================
# BEE engine configuration with binary header
bee_binary_cfg:
# -------------------------------------===== BEE header path [Required] =====-------------------------------------
# Description: Path to the existing BEE header in binary form
header_path: bee_ehdr0.bin
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key that was used for header encryption. Could be defined as hex value or path to a binary
# file.
user_key: '0x0123456789abcdeffedcba9876543210'
Bee for mimxrt1040, Revision: a0#
Bee for mimxrt1040, Revision: a0 JSON schema
Bee for mimxrt1040, Revision: a0 YAML configuration template
# =================================================== BEE template ===================================================
# ======================================================================================================================
# == Bee for mimxrt1040, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# ---------------------------------------===== BEE output folder [Required] =====---------------------------------------
# Description: Folder name to store generated BEE output
output_folder: bee_output
# ------------------------------------===== Output binary file name [Optional] =====------------------------------------
# Description: File name of the encrypted file, output_folder/output_name or full path (.bin will be appended)
output_name: encrypted
# -------------------------===== File name of the exported BEE region headers [Optional] =====--------------------------
# Description: output_folder/header_name or full path + index will be appended (.bin will be appended)
header_name: bee_ehdr
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs to be encrypted
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address where the data should be loaded
address: '0x60001000'
# ---------------------------------------===== Engine selection [Required] =====----------------------------------------
# Description: BEE Engine Selection, engine0, engine1 or both engines
# Possible options: <engine0, engine1, both>
engine_selection: engine0
# ------------------------------------------===== Bee engines [Required] =====------------------------------------------
# Description: Configuration of BEE engines
bee_engine:
-
# ====================================================================================================================
# == List of possible 2 options. ==
# Options [bee_cfg, bee_binary_cfg]
# ====================================================================================================================
# =========================== [Example of possible configuration: #0 , erase if not used] ============================
# BEE engine configuration
bee_cfg:
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key for encryption (sw_key burned into fuses). Could be defined as hex value or path to a
# binary file.
user_key: '0x0123456789abcdeffedcba9876543210'
# ---------------------------------===== Engine AES-128 KIB key [Optional] =====----------------------------------
# Description: Optional AES-128 key used to encrypt PRDB in BEE header (CBC mode). If not provided, a random key
# is generated and saved to output folder. To reuse a previously generated key, provide the value from the saved
# key file. Could be defined as hex value or path to a binary file.
engine_key: '0x00000000000000000000000000000000'
# ------------------------===== Engine AES-128 KIB initialization vector [Optional] =====-------------------------
# Description: Optional AES-128 initialization vector for PRDB encryption (CBC mode). If not provided, a random IV
# is generated and saved to output folder. Could be defined as hex value or path to a binary file.
engine_iv: '0x00000000000000000000000000000000'
# ----------------------------===== Engine AES-CTR counter (12 bytes) [Optional] =====----------------------------
# Description: Optional 12-byte nonce for AES-CTR data encryption. The last 4 bytes (block counter) are always set
# to zero automatically. If not provided, a random counter is generated and saved to output folder. Could be
# defined as hex value or path to a binary file.
engine_counter: '0x000000000000000000000000'
# ------------------------------------===== Protected region [Optional] =====-------------------------------------
# Description: List of protected regions, up to four regions
protected_region:
-
# --------------------------===== Start address of protected region [Required] =====--------------------------
# Description: Start address of protected region, it should be aligned to 1 KB (1024 B)
start_address: '0x60001000'
# -----------------------------===== Length of protected region [Required] =====------------------------------
# Description: Length of protected region, it should be aligned to 1 KB (1024 B)
length: '0x4400'
# -----------------------------------===== Protected level [Required] =====-----------------------------------
# Description: Protected level (0/1/2/3), 0 is default
protected_level: 0
# =========================== [Example of possible configuration: #1 , erase if not used] ============================
# BEE engine configuration with binary header
bee_binary_cfg:
# -------------------------------------===== BEE header path [Required] =====-------------------------------------
# Description: Path to the existing BEE header in binary form
header_path: bee_ehdr0.bin
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key that was used for header encryption. Could be defined as hex value or path to a binary
# file.
user_key: '0x0123456789abcdeffedcba9876543210'
Bee for mimxrt1043, Revision: a0#
Bee for mimxrt1043, Revision: a0 JSON schema
Bee for mimxrt1043, Revision: a0 YAML configuration template
# =================================================== BEE template ===================================================
# ======================================================================================================================
# == Bee for mimxrt1043, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# ---------------------------------------===== BEE output folder [Required] =====---------------------------------------
# Description: Folder name to store generated BEE output
output_folder: bee_output
# ------------------------------------===== Output binary file name [Optional] =====------------------------------------
# Description: File name of the encrypted file, output_folder/output_name or full path (.bin will be appended)
output_name: encrypted
# -------------------------===== File name of the exported BEE region headers [Optional] =====--------------------------
# Description: output_folder/header_name or full path + index will be appended (.bin will be appended)
header_name: bee_ehdr
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs to be encrypted
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address where the data should be loaded
address: '0x60001000'
# ---------------------------------------===== Engine selection [Required] =====----------------------------------------
# Description: BEE Engine Selection, engine0, engine1 or both engines
# Possible options: <engine0, engine1, both>
engine_selection: engine0
# ------------------------------------------===== Bee engines [Required] =====------------------------------------------
# Description: Configuration of BEE engines
bee_engine:
-
# ====================================================================================================================
# == List of possible 2 options. ==
# Options [bee_cfg, bee_binary_cfg]
# ====================================================================================================================
# =========================== [Example of possible configuration: #0 , erase if not used] ============================
# BEE engine configuration
bee_cfg:
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key for encryption (sw_key burned into fuses). Could be defined as hex value or path to a
# binary file.
user_key: '0x0123456789abcdeffedcba9876543210'
# ---------------------------------===== Engine AES-128 KIB key [Optional] =====----------------------------------
# Description: Optional AES-128 key used to encrypt PRDB in BEE header (CBC mode). If not provided, a random key
# is generated and saved to output folder. To reuse a previously generated key, provide the value from the saved
# key file. Could be defined as hex value or path to a binary file.
engine_key: '0x00000000000000000000000000000000'
# ------------------------===== Engine AES-128 KIB initialization vector [Optional] =====-------------------------
# Description: Optional AES-128 initialization vector for PRDB encryption (CBC mode). If not provided, a random IV
# is generated and saved to output folder. Could be defined as hex value or path to a binary file.
engine_iv: '0x00000000000000000000000000000000'
# ----------------------------===== Engine AES-CTR counter (12 bytes) [Optional] =====----------------------------
# Description: Optional 12-byte nonce for AES-CTR data encryption. The last 4 bytes (block counter) are always set
# to zero automatically. If not provided, a random counter is generated and saved to output folder. Could be
# defined as hex value or path to a binary file.
engine_counter: '0x000000000000000000000000'
# ------------------------------------===== Protected region [Optional] =====-------------------------------------
# Description: List of protected regions, up to four regions
protected_region:
-
# --------------------------===== Start address of protected region [Required] =====--------------------------
# Description: Start address of protected region, it should be aligned to 1 KB (1024 B)
start_address: '0x60001000'
# -----------------------------===== Length of protected region [Required] =====------------------------------
# Description: Length of protected region, it should be aligned to 1 KB (1024 B)
length: '0x4400'
# -----------------------------------===== Protected level [Required] =====-----------------------------------
# Description: Protected level (0/1/2/3), 0 is default
protected_level: 0
# =========================== [Example of possible configuration: #1 , erase if not used] ============================
# BEE engine configuration with binary header
bee_binary_cfg:
# -------------------------------------===== BEE header path [Required] =====-------------------------------------
# Description: Path to the existing BEE header in binary form
header_path: bee_ehdr0.bin
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key that was used for header encryption. Could be defined as hex value or path to a binary
# file.
user_key: '0x0123456789abcdeffedcba9876543210'
Bee for mimxrt1046, Revision: a0#
Bee for mimxrt1046, Revision: a0 JSON schema
Bee for mimxrt1046, Revision: a0 YAML configuration template
# =================================================== BEE template ===================================================
# ======================================================================================================================
# == Bee for mimxrt1046, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# ---------------------------------------===== BEE output folder [Required] =====---------------------------------------
# Description: Folder name to store generated BEE output
output_folder: bee_output
# ------------------------------------===== Output binary file name [Optional] =====------------------------------------
# Description: File name of the encrypted file, output_folder/output_name or full path (.bin will be appended)
output_name: encrypted
# -------------------------===== File name of the exported BEE region headers [Optional] =====--------------------------
# Description: output_folder/header_name or full path + index will be appended (.bin will be appended)
header_name: bee_ehdr
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs to be encrypted
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address where the data should be loaded
address: '0x60001000'
# ---------------------------------------===== Engine selection [Required] =====----------------------------------------
# Description: BEE Engine Selection, engine0, engine1 or both engines
# Possible options: <engine0, engine1, both>
engine_selection: engine0
# ------------------------------------------===== Bee engines [Required] =====------------------------------------------
# Description: Configuration of BEE engines
bee_engine:
-
# ====================================================================================================================
# == List of possible 2 options. ==
# Options [bee_cfg, bee_binary_cfg]
# ====================================================================================================================
# =========================== [Example of possible configuration: #0 , erase if not used] ============================
# BEE engine configuration
bee_cfg:
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key for encryption (sw_key burned into fuses). Could be defined as hex value or path to a
# binary file.
user_key: '0x0123456789abcdeffedcba9876543210'
# ---------------------------------===== Engine AES-128 KIB key [Optional] =====----------------------------------
# Description: Optional AES-128 key used to encrypt PRDB in BEE header (CBC mode). If not provided, a random key
# is generated and saved to output folder. To reuse a previously generated key, provide the value from the saved
# key file. Could be defined as hex value or path to a binary file.
engine_key: '0x00000000000000000000000000000000'
# ------------------------===== Engine AES-128 KIB initialization vector [Optional] =====-------------------------
# Description: Optional AES-128 initialization vector for PRDB encryption (CBC mode). If not provided, a random IV
# is generated and saved to output folder. Could be defined as hex value or path to a binary file.
engine_iv: '0x00000000000000000000000000000000'
# ----------------------------===== Engine AES-CTR counter (12 bytes) [Optional] =====----------------------------
# Description: Optional 12-byte nonce for AES-CTR data encryption. The last 4 bytes (block counter) are always set
# to zero automatically. If not provided, a random counter is generated and saved to output folder. Could be
# defined as hex value or path to a binary file.
engine_counter: '0x000000000000000000000000'
# ------------------------------------===== Protected region [Optional] =====-------------------------------------
# Description: List of protected regions, up to four regions
protected_region:
-
# --------------------------===== Start address of protected region [Required] =====--------------------------
# Description: Start address of protected region, it should be aligned to 1 KB (1024 B)
start_address: '0x60001000'
# -----------------------------===== Length of protected region [Required] =====------------------------------
# Description: Length of protected region, it should be aligned to 1 KB (1024 B)
length: '0x4400'
# -----------------------------------===== Protected level [Required] =====-----------------------------------
# Description: Protected level (0/1/2/3), 0 is default
protected_level: 0
# =========================== [Example of possible configuration: #1 , erase if not used] ============================
# BEE engine configuration with binary header
bee_binary_cfg:
# -------------------------------------===== BEE header path [Required] =====-------------------------------------
# Description: Path to the existing BEE header in binary form
header_path: bee_ehdr0.bin
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key that was used for header encryption. Could be defined as hex value or path to a binary
# file.
user_key: '0x0123456789abcdeffedcba9876543210'
Bee for mimxrt1050, Revision: a0#
Bee for mimxrt1050, Revision: a0 JSON schema
Bee for mimxrt1050, Revision: a0 YAML configuration template
# =================================================== BEE template ===================================================
# ======================================================================================================================
# == Bee for mimxrt1050, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# ---------------------------------------===== BEE output folder [Required] =====---------------------------------------
# Description: Folder name to store generated BEE output
output_folder: bee_output
# ------------------------------------===== Output binary file name [Optional] =====------------------------------------
# Description: File name of the encrypted file, output_folder/output_name or full path (.bin will be appended)
output_name: encrypted
# -------------------------===== File name of the exported BEE region headers [Optional] =====--------------------------
# Description: output_folder/header_name or full path + index will be appended (.bin will be appended)
header_name: bee_ehdr
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs to be encrypted
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address where the data should be loaded
address: '0x60001000'
# ---------------------------------------===== Engine selection [Required] =====----------------------------------------
# Description: BEE Engine Selection, engine0, engine1 or both engines
# Possible options: <engine0, engine1, both>
engine_selection: engine0
# ------------------------------------------===== Bee engines [Required] =====------------------------------------------
# Description: Configuration of BEE engines
bee_engine:
-
# ====================================================================================================================
# == List of possible 2 options. ==
# Options [bee_cfg, bee_binary_cfg]
# ====================================================================================================================
# =========================== [Example of possible configuration: #0 , erase if not used] ============================
# BEE engine configuration
bee_cfg:
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key for encryption (sw_key burned into fuses). Could be defined as hex value or path to a
# binary file.
user_key: '0x0123456789abcdeffedcba9876543210'
# ---------------------------------===== Engine AES-128 KIB key [Optional] =====----------------------------------
# Description: Optional AES-128 key used to encrypt PRDB in BEE header (CBC mode). If not provided, a random key
# is generated and saved to output folder. To reuse a previously generated key, provide the value from the saved
# key file. Could be defined as hex value or path to a binary file.
engine_key: '0x00000000000000000000000000000000'
# ------------------------===== Engine AES-128 KIB initialization vector [Optional] =====-------------------------
# Description: Optional AES-128 initialization vector for PRDB encryption (CBC mode). If not provided, a random IV
# is generated and saved to output folder. Could be defined as hex value or path to a binary file.
engine_iv: '0x00000000000000000000000000000000'
# ----------------------------===== Engine AES-CTR counter (12 bytes) [Optional] =====----------------------------
# Description: Optional 12-byte nonce for AES-CTR data encryption. The last 4 bytes (block counter) are always set
# to zero automatically. If not provided, a random counter is generated and saved to output folder. Could be
# defined as hex value or path to a binary file.
engine_counter: '0x000000000000000000000000'
# ------------------------------------===== Protected region [Optional] =====-------------------------------------
# Description: List of protected regions, up to four regions
protected_region:
-
# --------------------------===== Start address of protected region [Required] =====--------------------------
# Description: Start address of protected region, it should be aligned to 1 KB (1024 B)
start_address: '0x60001000'
# -----------------------------===== Length of protected region [Required] =====------------------------------
# Description: Length of protected region, it should be aligned to 1 KB (1024 B)
length: '0x4400'
# -----------------------------------===== Protected level [Required] =====-----------------------------------
# Description: Protected level (0/1/2/3), 0 is default
protected_level: 0
# =========================== [Example of possible configuration: #1 , erase if not used] ============================
# BEE engine configuration with binary header
bee_binary_cfg:
# -------------------------------------===== BEE header path [Required] =====-------------------------------------
# Description: Path to the existing BEE header in binary form
header_path: bee_ehdr0.bin
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key that was used for header encryption. Could be defined as hex value or path to a binary
# file.
user_key: '0x0123456789abcdeffedcba9876543210'
Bee for mimxrt1060, Revision: a0#
Bee for mimxrt1060, Revision: a0 JSON schema
Bee for mimxrt1060, Revision: a0 YAML configuration template
# =================================================== BEE template ===================================================
# ======================================================================================================================
# == Bee for mimxrt1060, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# ---------------------------------------===== BEE output folder [Required] =====---------------------------------------
# Description: Folder name to store generated BEE output
output_folder: bee_output
# ------------------------------------===== Output binary file name [Optional] =====------------------------------------
# Description: File name of the encrypted file, output_folder/output_name or full path (.bin will be appended)
output_name: encrypted
# -------------------------===== File name of the exported BEE region headers [Optional] =====--------------------------
# Description: output_folder/header_name or full path + index will be appended (.bin will be appended)
header_name: bee_ehdr
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs to be encrypted
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address where the data should be loaded
address: '0x60001000'
# ---------------------------------------===== Engine selection [Required] =====----------------------------------------
# Description: BEE Engine Selection, engine0, engine1 or both engines
# Possible options: <engine0, engine1, both>
engine_selection: engine0
# ------------------------------------------===== Bee engines [Required] =====------------------------------------------
# Description: Configuration of BEE engines
bee_engine:
-
# ====================================================================================================================
# == List of possible 2 options. ==
# Options [bee_cfg, bee_binary_cfg]
# ====================================================================================================================
# =========================== [Example of possible configuration: #0 , erase if not used] ============================
# BEE engine configuration
bee_cfg:
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key for encryption (sw_key burned into fuses). Could be defined as hex value or path to a
# binary file.
user_key: '0x0123456789abcdeffedcba9876543210'
# ---------------------------------===== Engine AES-128 KIB key [Optional] =====----------------------------------
# Description: Optional AES-128 key used to encrypt PRDB in BEE header (CBC mode). If not provided, a random key
# is generated and saved to output folder. To reuse a previously generated key, provide the value from the saved
# key file. Could be defined as hex value or path to a binary file.
engine_key: '0x00000000000000000000000000000000'
# ------------------------===== Engine AES-128 KIB initialization vector [Optional] =====-------------------------
# Description: Optional AES-128 initialization vector for PRDB encryption (CBC mode). If not provided, a random IV
# is generated and saved to output folder. Could be defined as hex value or path to a binary file.
engine_iv: '0x00000000000000000000000000000000'
# ----------------------------===== Engine AES-CTR counter (12 bytes) [Optional] =====----------------------------
# Description: Optional 12-byte nonce for AES-CTR data encryption. The last 4 bytes (block counter) are always set
# to zero automatically. If not provided, a random counter is generated and saved to output folder. Could be
# defined as hex value or path to a binary file.
engine_counter: '0x000000000000000000000000'
# ------------------------------------===== Protected region [Optional] =====-------------------------------------
# Description: List of protected regions, up to four regions
protected_region:
-
# --------------------------===== Start address of protected region [Required] =====--------------------------
# Description: Start address of protected region, it should be aligned to 1 KB (1024 B)
start_address: '0x60001000'
# -----------------------------===== Length of protected region [Required] =====------------------------------
# Description: Length of protected region, it should be aligned to 1 KB (1024 B)
length: '0x4400'
# -----------------------------------===== Protected level [Required] =====-----------------------------------
# Description: Protected level (0/1/2/3), 0 is default
protected_level: 0
# =========================== [Example of possible configuration: #1 , erase if not used] ============================
# BEE engine configuration with binary header
bee_binary_cfg:
# -------------------------------------===== BEE header path [Required] =====-------------------------------------
# Description: Path to the existing BEE header in binary form
header_path: bee_ehdr0.bin
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key that was used for header encryption. Could be defined as hex value or path to a binary
# file.
user_key: '0x0123456789abcdeffedcba9876543210'
Bee for mimxrt1064, Revision: a0#
Bee for mimxrt1064, Revision: a0 JSON schema
Bee for mimxrt1064, Revision: a0 YAML configuration template
# =================================================== BEE template ===================================================
# ======================================================================================================================
# == Bee for mimxrt1064, Revision: a0 ==
# ======================================================================================================================
# -------------------------------------===== The chip family name [Required] =====--------------------------------------
# Description: NXP chip family identifier.
family: CHOOSE_FROM_TABLE
# -----------------------------------------===== MCU revision [Optional] =====------------------------------------------
# Description: Revision of silicon. The 'latest' name, means most current revision.
# Possible options: <a0, latest>
revision: a0
# ---------------------------------------===== BEE output folder [Required] =====---------------------------------------
# Description: Folder name to store generated BEE output
output_folder: bee_output
# ------------------------------------===== Output binary file name [Optional] =====------------------------------------
# Description: File name of the encrypted file, output_folder/output_name or full path (.bin will be appended)
output_name: encrypted
# -------------------------===== File name of the exported BEE region headers [Optional] =====--------------------------
# Description: output_folder/header_name or full path + index will be appended (.bin will be appended)
header_name: bee_ehdr
# ----------------------------------------===== Data blobs list [Optional] =====----------------------------------------
# Description: List of all data blobs to be encrypted
data_blobs:
-
# -----------------------------------===== Plain Text data blob [Required] =====------------------------------------
# Description: Path to binary file with plain text data to be encrypted
data: my_data.bin
# -------------------------------------===== Data blob address [Required] =====-------------------------------------
# Description: Data blob address where the data should be loaded
address: '0x60001000'
# ---------------------------------------===== Engine selection [Required] =====----------------------------------------
# Description: BEE Engine Selection, engine0, engine1 or both engines
# Possible options: <engine0, engine1, both>
engine_selection: engine0
# ------------------------------------------===== Bee engines [Required] =====------------------------------------------
# Description: Configuration of BEE engines
bee_engine:
-
# ====================================================================================================================
# == List of possible 2 options. ==
# Options [bee_cfg, bee_binary_cfg]
# ====================================================================================================================
# =========================== [Example of possible configuration: #0 , erase if not used] ============================
# BEE engine configuration
bee_cfg:
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key for encryption (sw_key burned into fuses). Could be defined as hex value or path to a
# binary file.
user_key: '0x0123456789abcdeffedcba9876543210'
# ---------------------------------===== Engine AES-128 KIB key [Optional] =====----------------------------------
# Description: Optional AES-128 key used to encrypt PRDB in BEE header (CBC mode). If not provided, a random key
# is generated and saved to output folder. To reuse a previously generated key, provide the value from the saved
# key file. Could be defined as hex value or path to a binary file.
engine_key: '0x00000000000000000000000000000000'
# ------------------------===== Engine AES-128 KIB initialization vector [Optional] =====-------------------------
# Description: Optional AES-128 initialization vector for PRDB encryption (CBC mode). If not provided, a random IV
# is generated and saved to output folder. Could be defined as hex value or path to a binary file.
engine_iv: '0x00000000000000000000000000000000'
# ----------------------------===== Engine AES-CTR counter (12 bytes) [Optional] =====----------------------------
# Description: Optional 12-byte nonce for AES-CTR data encryption. The last 4 bytes (block counter) are always set
# to zero automatically. If not provided, a random counter is generated and saved to output folder. Could be
# defined as hex value or path to a binary file.
engine_counter: '0x000000000000000000000000'
# ------------------------------------===== Protected region [Optional] =====-------------------------------------
# Description: List of protected regions, up to four regions
protected_region:
-
# --------------------------===== Start address of protected region [Required] =====--------------------------
# Description: Start address of protected region, it should be aligned to 1 KB (1024 B)
start_address: '0x60001000'
# -----------------------------===== Length of protected region [Required] =====------------------------------
# Description: Length of protected region, it should be aligned to 1 KB (1024 B)
length: '0x4400'
# -----------------------------------===== Protected level [Required] =====-----------------------------------
# Description: Protected level (0/1/2/3), 0 is default
protected_level: 0
# =========================== [Example of possible configuration: #1 , erase if not used] ============================
# BEE engine configuration with binary header
bee_binary_cfg:
# -------------------------------------===== BEE header path [Required] =====-------------------------------------
# Description: Path to the existing BEE header in binary form
header_path: bee_ehdr0.bin
# ------------------------------------===== User AES-128 key [Required] =====-------------------------------------
# Description: AES key that was used for header encryption. Could be defined as hex value or path to a binary
# file.
user_key: '0x0123456789abcdeffedcba9876543210'