[PATCH v2] binman: nxp_imx8mcst: Handle FCFB header during SPI NOR boot

[PATCH v2] binman: nxp_imx8mcst: Handle FCFB header during SPI NOR boot

[Marek Vasut via U-Boot]

In case the image that is wrapped in the nxp_imx8mcst already contains
an FCFB header which is mandatory for SPI NOR boot, then the IVT is at
offset 0x1000 instead of offset 0x0, but the whole image including the
FCFB header must be signed to prevent attacker from tampering with any
of the headers. Add the FCFB handling.

Signed-off-by: Marek Vasut <marex@nabladev.com>
---
Cc: "NXP i.MX U-Boot Team" <uboot-imx@nxp.com>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: Simon Glass <sjg@chromium.org>
Cc: Stefano Babic <sbabic@nabladev.com>
Cc: Tom Rini <trini@konsulko.com>
Cc: u-boot@lists.denx.de
---
V2: Update the block comment to mention the FCFB
---
 tools/binman/etype/nxp_imx8mcst.py | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/tools/binman/etype/nxp_imx8mcst.py b/tools/binman/etype/nxp_imx8mcst.py
index a10f61aa01f..de7032c88f3 100644
--- a/tools/binman/etype/nxp_imx8mcst.py
+++ b/tools/binman/etype/nxp_imx8mcst.py
@@ -20,8 +20,9 @@ from binman import elf
 from dtoc import fdt_util
 from u_boot_pylib import tools
 
-MAGIC_NXP_IMX_IVT = 0x412000d1
-MAGIC_FITIMAGE    = 0xedfe0dd0
+MAGIC_NXP_IMX_IVT  = 0x412000d1
+MAGIC_NXP_IMX_FCFB = 0x42464346
+MAGIC_FITIMAGE     = 0xedfe0dd0
 
 KEY_NAME = 'sha256_4096_65537_v3_usr_crt'
 
@@ -112,6 +113,9 @@ class Entry_nxp_imx8mcst(Entry_mkimage):
         # - If it is mkimage'd imx8mimage, then extract to be signed data size
         #   from imx8mimage header, and calculate CSF blob offset right past
         #   the SPL from this information.
+        # - If it is mkimage'd imx8mimage wrapped in FCFB, then extract to be
+        #   signed data size from imx8mimage header past the FCFB header, and
+        #   calculate CSF blob offset right past the SPL from this information.
         # - If it is fitImage, then pad the image to 4k, add generated IVT and
         #   sign the whole payload, then append CSF blob at the end right past
         #   the IVT.
@@ -125,6 +129,13 @@ class Entry_nxp_imx8mcst(Entry_mkimage):
             signsize = struct.unpack('<I', data[24:28])[0] - signbase
             # Remove mkimage generated padding from the end of data
             data = data[:signsize]
+        elif signtype == MAGIC_NXP_IMX_FCFB: # SPL/imx8mimage with FCFB
+            # Sign the payload including FCFB and imx8mimage headers
+            # (extra 0x1000 and 0x40 bytes before the payload)
+            signbase -= 0x1040
+            signsize = struct.unpack('<I', data[4120:4124])[0] - signbase
+            # Remove mkimage generated padding from the end of data
+            data = data[:signsize]
         elif signtype == MAGIC_FITIMAGE: # fitImage
             # Align fitImage to 4k
             signsize = tools.align(len(data), 0x1000)
-- 
2.53.0

Re: [PATCH v2] binman: nxp_imx8mcst: Handle FCFB header during SPI NOR boot

[Simon Glass]

Hi Marek,

On 2026-07-21T02:09:14, Marek Vasut <marex@nabladev.com> wrote:
> binman: nxp_imx8mcst: Handle FCFB header during SPI NOR boot
>
> In case the image that is wrapped in the nxp_imx8mcst already contains
> an FCFB header which is mandatory for SPI NOR boot, then the IVT is at
> offset 0x1000 instead of offset 0x0, but the whole image including the
> FCFB header must be signed to prevent attacker from tampering with any
> of the headers. Add the FCFB handling.
>
> Signed-off-by: Marek Vasut <marex@nabladev.com>
>
> tools/binman/etype/nxp_imx8mcst.py | 15 +++++++++++++--
>  1 file changed, 13 insertions(+), 2 deletions(-)

> diff --git a/tools/binman/etype/nxp_imx8mcst.py b/tools/binman/etype/nxp_imx8mcst.py
> @@ -101,6 +102,9 @@ class Entry_nxp_imx8mcst(Entry_mkimage):
>          # - If it is mkimage'd imx8mimage, then extract to be signed data size
>          #   from imx8mimage header, and calculate CSF blob offset right past
>          #   the SPL from this information.
> +        # - If it is mkimage'd imx8mimage wrapped in FCFB, then extract to be
> +        #   signed data size from imx8mimage header past the FCFB header, and
> +        #   calculate CSF blob offset right past the SPL from this information.

Thanks for updating the block comment.

> diff --git a/tools/binman/etype/nxp_imx8mcst.py b/tools/binman/etype/nxp_imx8mcst.py
> @@ -114,6 +118,13 @@ class Entry_nxp_imx8mcst(Entry_mkimage):
> +        elif signtype == MAGIC_NXP_IMX_FCFB: # SPL/imx8mimage with FCFB
> +            # Sign the payload including FCFB and imx8mimage headers
> +            # (extra 0x1000 and 0x40 bytes before the payload)
> +            signbase -= 0x1040
> +            signsize = struct.unpack('<I', data[4120:4124])[0] - signbase
> +            # Remove mkimage generated padding from the end of data
> +            data = data[:signsize]

This part is not tested:

tools/binman/etype/nxp_imx8mcst.py                         94      3    97%

Also 4120 is still an unexplained decimal literal rather than the FCFB
offset plus the IVT csf-pointer offset. If you don't want to change
that, perhaps add a comment as to where 4120 comes from?

Regards,
Simon