Master Boot Image (MBI)#

Master Boot Image can be used directly (e.g. by using blhost write-memory command) or it can be used for further processing (e.g. used as input to Secure Binary image container). Image is created based on a supplied configuration file, either JSON or YAML is supported.

We can divide divide into two categories based on layout.

eXecute-In-Place (XIP) images
- Plain
- CRC
- Signed
Load-to-RAM images
- Plain
- CRC
- Signed images with HMAC signed header. Since load-to-RAM copies the image from untrusted media to on-chip RAM, the length field in header should be authenticated before copy. Hence HMAC signed headers are used.
- Encrypted (plain header with HMAC + AES-CBC encrypted).

Example of use

nxpimage: nxpimage mbi export -c <path to config file>

Supported devices for MBI#

Supported execution targets are: XIP (Execute in place) and Load to RAM and image authentication types: Plain, CRC, Signed, Encrypted and NXP Signed.

The following table shows the supported image types for each device.

Target in the table represents outputImageExecutionTarget in the configuration file and authentication in the table represents outputImageAuthenticationType.

Supported devices#
Targets	xip	xip	xip	xip	xip	load-to-ram	load-to-ram	load-to-ram	load-to-ram	load-to-ram
Authentication	plain	crc	signed	signed-nxp	signed-encrypted	plain	crc	signed	signed-nxp	signed-encrypted
k32w1xx	✅	✅	✅	✅	❌	❌	❌	❌	❌	❌
kw45xx	✅	✅	✅	✅	❌	❌	❌	❌	❌	❌
lpc550x	✅	✅	❌	❌	❌	❌	✅	❌	❌	❌
lpc551x	✅	✅	❌	❌	❌	❌	✅	❌	❌	❌
lpc552x	✅	✅	❌	❌	❌	❌	✅	❌	❌	❌
lpc553x	✅	✅	❌	❌	❌	✅	✅	❌	❌	❌
lpc55s0x	✅	✅	✅	❌	❌	❌	✅	✅	❌	❌
lpc55s1x	✅	✅	✅	❌	❌	❌	✅	✅	❌	❌
lpc55s2x	✅	✅	✅	❌	❌	❌	✅	✅	❌	❌
lpc55s3x	✅	✅	✅	❌	❌	✅	✅	❌	❌	❌
lpc55s6x	✅	✅	✅	❌	❌	❌	✅	✅	❌	❌
mc56f816xx	✅	✅	❌	❌	❌	❌	❌	❌	❌	❌
mc56f817xx	✅	✅	❌	❌	❌	❌	❌	❌	❌	❌
mc56f818xx	✅	❌	✅	❌	❌	❌	❌	❌	❌	❌
mcxa142	✅	✅	❌	❌	❌	❌	❌	❌	❌	❌
mcxa143	✅	✅	❌	❌	❌	❌	❌	❌	❌	❌
mcxa144	✅	✅	❌	❌	❌	❌	❌	❌	❌	❌
mcxa145	✅	✅	❌	❌	❌	❌	❌	❌	❌	❌
mcxa146	✅	✅	❌	❌	❌	❌	❌	❌	❌	❌
mcxa152	✅	✅	❌	❌	❌	❌	❌	❌	❌	❌
mcxa153	✅	✅	❌	❌	❌	❌	❌	❌	❌	❌
mcxa154	✅	✅	❌	❌	❌	❌	❌	❌	❌	❌
mcxa155	✅	✅	❌	❌	❌	❌	❌	❌	❌	❌
mcxa156	✅	✅	❌	❌	❌	❌	❌	❌	❌	❌
mcxn23x	✅	✅	✅	❌	❌	✅	✅	✅	❌	❌
mcxn54x	✅	✅	✅	❌	❌	✅	✅	❌	❌	❌
mcxn94x	✅	✅	✅	❌	❌	✅	✅	❌	❌	❌
mcxw71xx	✅	✅	✅	✅	❌	❌	❌	❌	❌	❌
mwct2x12	✅	✅	❌	❌	❌	❌	❌	❌	❌	❌
mwct2xd2	✅	❌	✅	❌	❌	❌	❌	❌	❌	❌
nhs52sxx	✅	✅	✅	❌	❌	❌	✅	✅	❌	❌
rt5xx	✅	✅	✅	❌	❌	✅	✅	✅	❌	✅
rt6xx	✅	✅	✅	❌	❌	✅	✅	✅	❌	✅
rw61x	✅	✅	✅	❌	❌	✅	✅	✅	❌	❌

Note

For LPC55xx (except for the LPC55S36 with external flash), MCXN9xx and MCXN23x the load-to-RAM images are intended only for recovery boot from 1-bit SPI flash.

Implementation details#

To handle the small differences between the MBI types. Mixin classes were used to define the common parts of the MBI. This definition of required mixins is stored in database for each family of devices. When you click on the supported MBI type in the table above, you will be pointed to the documentation of the specific MBI type. Naming convention for each MBI type is used here just for documentation purposes. For example: “MBI-A-IV-I-TZM-LA-EATZ-ECS” contains first letters of mixins used in the MBI, like App, ImageVersion, IVT, TrustZoneMandatory and ohters…

If you want to create MBI class directly you might use create_mbi_class function. The function takes two arguments, the first one is the MBI type and the second one is the device family. The method returns the class that can be used to create MBI image.

from spsdk.image.mbi.mbi import create_mbi_class

MbiClass = create_mbi_class("plain", "k32w1xx")

Exporting the image is done in six steps.

Validating the input data by calling the validate method.
Collecting the data by calling the collect_data method.
Optionally encrypting the image by calling the encrypt method.
Optionally do post encrypt update by calling the post_encrypt method.
Optionally sign the image by calling the sign method.
Finalize the image by calling the finalize method.

Supported configuration options#

Refer to the documentation below for the supported configuration options for each image type. Please note that the outputImageExecutionTarget and outputImageAuthenticationType must be filled in addition to the basic settings according to the table with supported devices.

outputImageExecutionTarget: xip # Application target., Definition if application is Execute in Place(XiP) or loaded to RAM during reset sequence.
outputImageAuthenticationType: signed # Type of boot image authentication., Specification of final master boot image authentication.

MBI-A-IZTL-LA-TZM-IST-EATZ#

MBI Mixins

Class name: plain

MasterBootImage
Mbi_MixinApp
Mbi_MixinIvtZeroTotalLength
Mbi_MixinLoadAddress
Mbi_MixinTrustZoneMandatory
Mbi_MixinImageSubType
Mbi_ExportMixinAppTrustZone

MBI-A-IZTL-LA-TZM-IST-EATZ JSON schema

Master Boot Image (MBI)

Contents

Master Boot Image (MBI)#

Supported devices for MBI#

Implementation details#

Supported configuration options#

MBI-A-IZTL-LA-TZM-IST-EATZ#

MBI-A-I-LA-TZM-IST-EATZ-ECS#

MBI-A-I-LA-CBV-MD-EACBM-EES#

MBI-A-I-LA-CBV-MD-IST-EACBM-EES#

MBI-A-IZTL-EA#

MBI-A-I-EA-ECS#

MBI-A-I-LA-EA-ECS#

MBI-A-IV-IZTL-LA-EA#

MBI-A-IV-I-LA-EA#

MBI-A-IV-I-LA-EA-ECS#

MBI-A-IZTL-TZ-HK-EATZ#

MBI-A-I-TZ-LA-EATZ-ECS#

MBI-A-I-LA-TZ-HK-EATZ-ECS#

MBI-A-I-TZ-LA-CBV-EATZCB-ERS#

MBI-A-I-LA-TZ-CBV-HK-EATZCB-ERS#

MBI-A-IZTL-TZ-EATZ#

MBI-A-I-TZ-EATZ-ECS#

MBI-A-I-TZ-CBV-EATZCB-ERS#

MBI-A-IV-IZTL-TZM-LA-EATZ#

MBI-A-IV-I-TZM-LA-EATZ#

MBI-A-IV-I-TZM-LA-EATZ-ECS#

MBI-A-IV-I-CBV-MD-LA-FV-EACBM-EES#

MBI-A-BT-F-EAF#

MBI-A-BT-F-ECSB-EAF#

MBI-A-BT-B-F-CBV-EABF-EESV#

MBI-A-IZTL-IV-EA#

MBI-A-I-IV-EA-ECS#

MBI-A-I-IV-EA#

MBI-A-IZTL-TZM-LA-IV-EATZ#

MBI-A-I-TZM-LA-IV-EATZ#

MBI-A-I-TZM-LA-IV-EATZ-ECS#

MBI-A-I-LA-CBV-MC-IST-IV-FV-EACBM-EES#

MBI-A-I-CBV-MC-IST-LA-IV-FV-EACBM-EES#

MBI-A-IZTL-TZM-IV-EATZ#

MBI-A-I-LA-TZM-IV-EATZ-ECS#

MBI-A-I-LAO-TZ-EATZ#

MBI-A-I-TZ-LA-HK-EATZ#

MBI-A-RT-LA-I-TZ-CBV-HM-KS-HK-EATZCB-ERS-EHKSF#

MBI-A-RT-LA-I-TZ-HK-EATZ-ECS#

MBI-A-RT-LA-I-TZ-CBV-HK-KS-HM-CIV-EATZCBE-ERS-EHKSF#

MBI-A-IZTL-LAO-TZ-HK-EATZ#

MBI-A-I-CBV-MD-LA-FV-IV-EACBM-EES#