imx-mkimage: create two separate FIT images for secure boot

Contains:
	1. Package and sign Part Number boot image(SPL/BL31/BL33)
	2. Package and sign OP-TEE FIT boot image

9 files changed, 643 insertions, 1 deletions

diff --git a/iMX8M/csf_fit.txt b/iMX8M/csf_fit.txt
new file mode 100644
index 0000000..db44c63
--- /dev/null
+++ b/iMX8M/csf_fit.txt
@@ -0,0 +1,36 @@
+[Header]
+    Version = 4.3
+    Hash Algorithm = sha256
+    Engine = CAAM
+    Engine Configuration = 0
+    Certificate Format = X509
+    Signature Format = CMS
+
+[Install SRK]
+    # Index of the key location in the SRK table to be installed
+    File = "../../../tools/cst-3.3.1/crts/SRK_1_2_3_4_table.bin"
+    Source index = 0
+
+[Install CSFK]
+    # Key used to authenticate the CSF data
+    File = "../../../tools/cst-3.3.1/crts/CSF1_1_sha256_2048_65537_v3_usr_crt.pem"
+
+[Authenticate CSF]
+
+[Install Key]
+    # Key slot index used to authenticate the key to be installed
+    Verification index = 0
+    # Target key slot in HAB key store where key will be installed
+    Target index = 2
+    # Key to install
+    File = "../../../tools/cst-3.3.1/crts/IMG1_1_sha256_2048_65537_v3_usr_crt.pem"
+
+[Authenticate Data]
+    # Key slot index used to authenticate the image data
+    Verification index = 2
+    # Authenticate Start Address, Offset, Length and file
+    Blocks = 0x401fcdc0 0x57c00 0x1020  "flash.bin", \
+	     0x40200000 0x5AC00 0xD6EC8 "flash.bin", \
+	     0x402D6EC8 0x131AC8 0xCD98 "flash.bin", \
+	     0x910000   0x13E860 0xA0E0   "flash.bin"
+
diff --git a/iMX8M/csf_fit_tee.txt b/iMX8M/csf_fit_tee.txt
new file mode 100644
index 0000000..b5f1f99
--- /dev/null
+++ b/iMX8M/csf_fit_tee.txt
@@ -0,0 +1,33 @@
+[Header]
+    Version = 4.3
+    Hash Algorithm = sha256
+    Engine = CAAM
+    Engine Configuration = 0
+    Certificate Format = X509
+    Signature Format = CMS
+
+[Install SRK]
+    # Index of the key location in the SRK table to be installed
+    File = "../../../tools/cst-3.3.1/crts/SRK_1_2_3_4_table.bin"
+    Source index = 0
+
+[Install CSFK]
+    # Key used to authenticate the CSF data
+    File = "../../../tools/cst-3.3.1/crts/CSF1_1_sha256_2048_65537_v3_usr_crt.pem"
+
+[Authenticate CSF]
+
+[Install Key]
+    # Key slot index used to authenticate the key to be installed
+    Verification index = 0
+    # Target key slot in HAB key store where key will be installed
+    Target index = 2
+    # Key to install
+    File = "../../../tools/cst-3.3.1/crts/IMG1_1_sha256_2048_65537_v3_usr_crt.pem"
+
+[Authenticate Data]
+    # Key slot index used to authenticate the image data
+    Verification index = 2
+    # Authenticate Start Address, Offset, Length and file
+    Blocks = 0x401fcdc0 0x0 0x1020 "tee-ivt.itb", \ 
+	     0xFE000000 0x3000 0x7EEB0 "tee-ivt.itb" 
diff --git a/iMX8M/csf_spl.txt b/iMX8M/csf_spl.txt
new file mode 100644
index 0000000..30c83f8
--- /dev/null
+++ b/iMX8M/csf_spl.txt
@@ -0,0 +1,37 @@
+[Header]
+    Version = 4.3
+    Hash Algorithm = sha256
+    Engine = CAAM
+    Engine Configuration = 0
+    Certificate Format = X509
+    Signature Format = CMS
+
+[Install SRK]
+    # Index of the key location in the SRK table to be installed
+    File = "../../../tools/cst-3.3.1/crts/SRK_1_2_3_4_table.bin"
+    Source index = 0
+
+[Install CSFK]
+    # Key used to authenticate the CSF data
+    File = "../../../tools/cst-3.3.1/crts/CSF1_1_sha256_2048_65537_v3_usr_crt.pem"
+
+[Authenticate CSF]
+
+[Unlock]
+    # Leave Job Ring and DECO master ID registers Unlocked
+    Engine = CAAM
+    Features = MID
+
+[Install Key]
+    # Key slot index used to authenticate the key to be installed
+    Verification index = 0
+    # Target key slot in HAB key store where key will be installed
+    Target index = 2
+    # Key to install
+    File = "../../../tools/cst-3.3.1/crts/IMG1_1_sha256_2048_65537_v3_usr_crt.pem"
+
+[Authenticate Data]
+    # Key slot index used to authenticate the image data
+    Verification index = 2
+    # Authenticate Start Address, Offset, Length and file
+    Blocks = 0x7e0fc0 0x0 0x35a00 "flash.bin"
diff --git a/iMX8M/mkimage_fit_notee.sh b/iMX8M/mkimage_fit_notee.sh
new file mode 100755
index 0000000..8414b24
--- /dev/null
+++ b/iMX8M/mkimage_fit_notee.sh
@@ -0,0 +1,153 @@
+#!/bin/sh
+#
+# script to generate FIT image source for i.MX8MQ boards with
+# ARM Trusted Firmware and U-Boot without BL32
+#
+# usage: $0 <dtb_name>
+
+[ -z "$BL31" ] && BL31="bl31.bin"
+# keep backward compatibility
+[ -z "$TEE_LOAD_ADDR" ] && TEE_LOAD_ADDR="0xfe000000"
+
+if [ -z "$ATF_LOAD_ADDR" ]; then
+	echo "ERROR: BL31 load address is not set" >&2
+	exit 0
+fi
+
+if [ ! -f $BL31 ]; then
+	echo "ERROR: BL31 file $BL31 NOT found" >&2
+	exit 0
+else
+	echo "bl31.bin size: " >&2
+	ls -lct bl31.bin | awk '{print $5}' >&2
+fi
+
+LOADABLES="\"atf-1\""
+BL33="u-boot-nodtb.bin"
+DEK_BLOB="dek_blob_fit_dummy.bin"
+
+if [ ! -f $DEK_BLOB ]; then
+	DEK_BLOB=/dev/null
+else
+	echo "Building with encrypted boot support, make sure to replace DEK Blob in final image." >&2
+	LOADABLES="\"dek_blob-1\", $LOADABLES"
+fi
+
+if [ ! -f $BL33 ]; then
+	echo "ERROR: $BL33 file NOT found" >&2
+	exit 0
+else
+
+	echo "u-boot-nodtb.bin size: " >&2
+	ls -lct u-boot-nodtb.bin | awk '{print $5}' >&2
+fi
+
+for dtname in $*
+do
+	echo "$dtname size: " >&2
+	ls -lct $dtname | awk '{print $5}' >&2
+done
+
+cat << __HEADER_EOF
+/dts-v1/;
+
+/ {
+	description = "Configuration to load ATF before U-Boot";
+
+	images {
+		uboot-1 {
+			description = "U-Boot (64-bit)";
+			data = /incbin/("$BL33");
+			type = "standalone";
+			arch = "arm64";
+			compression = "none";
+			load = <0x40200000>;
+		};
+__HEADER_EOF
+
+cnt=1
+for dtname in $*
+do
+	cat << __FDT_IMAGE_EOF
+		fdt-$cnt {
+			description = "$(basename $dtname .dtb)";
+			data = /incbin/("$dtname");
+			type = "flat_dt";
+			compression = "none";
+		};
+__FDT_IMAGE_EOF
+cnt=$((cnt+1))
+done
+
+cat << __HEADER_EOF
+		atf-1 {
+			description = "ARM Trusted Firmware";
+			data = /incbin/("$BL31");
+			type = "firmware";
+			arch = "arm64";
+			compression = "none";
+			load = <$ATF_LOAD_ADDR>;
+			entry = <$ATF_LOAD_ADDR>;
+		};
+__HEADER_EOF
+
+if [ -f $DEK_BLOB ]; then
+cat << __HEADER_EOF
+		dek_blob-1 {
+			description = "dek_blob";
+			data = /incbin/("$DEK_BLOB");
+			type = "script";
+			compression = "none";
+			load = <$DEK_BLOB_LOAD_ADDR>;
+		};
+__HEADER_EOF
+fi
+
+cat << __CONF_HEADER_EOF
+	};
+	configurations {
+		default = "config-1";
+
+__CONF_HEADER_EOF
+
+cnt=1
+for dtname in $*
+do
+if [ -f $BL32 ]; then
+if [ $ROLLBACK_INDEX_IN_FIT ]; then
+cat << __CONF_SECTION_EOF
+		config-$cnt {
+			description = "$(basename $dtname .dtb)";
+			firmware = "uboot-1";
+			loadables = $LOADABLES;
+			fdt = "fdt-$cnt";
+			rbindex = "$ROLLBACK_INDEX_IN_FIT";
+		};
+__CONF_SECTION_EOF
+else
+cat << __CONF_SECTION_EOF
+		config-$cnt {
+			description = "$(basename $dtname .dtb)";
+			firmware = "uboot-1";
+			loadables = $LOADABLES;
+			fdt = "fdt-$cnt";
+		};
+__CONF_SECTION_EOF
+fi
+else
+cat << __CONF_SECTION1_EOF
+		config-$cnt {
+			description = "$(basename $dtname .dtb)";
+			firmware = "uboot-1";
+			loadables = $LOADABLES;
+			fdt = "fdt-$cnt";
+		};
+__CONF_SECTION1_EOF
+fi
+cnt=$((cnt+1))
+done
+
+cat << __ITS_EOF
+	};
+};
+__ITS_EOF
diff --git a/iMX8M/mkimage_fit_tee.sh b/iMX8M/mkimage_fit_tee.sh
new file mode 100755
index 0000000..8eec0f6
--- /dev/null
+++ b/iMX8M/mkimage_fit_tee.sh
@@ -0,0 +1,78 @@
+#!/bin/sh
+# script to generate FIT image source for i.MX8MQ boards with
+# BL32 image
+#
+# TODO: add fdt_overlay to tee-fit-image for passing config data
+# into P/N components(ATF & UBOOT)
+#
+# usage: $0 ...]
+
+[ -z "$TEE_LOAD_ADDR" ] && TEE_LOAD_ADDR="0xfe000000"
+BL32="tee.bin"
+
+DEK_BLOB="dek_blob_fit_dummy.bin"
+
+if [ ! -f $BL32 ]; then
+	echo "ERROR: BL32 file $BL32 NOT found" >&2
+	exit 0
+else
+	echo "tee.bin size: " >&2
+	ls -lct $BL32 | awk '{print $5}' >&2
+fi
+
+cat << __HEADER_EOF
+/dts-v1/;
+
+/ {
+	description = "Configuration to load OPTEE";
+
+	images {
+		tee-1 {
+			description = "TEE firmware";
+			data = /incbin/("$BL32");
+			type = "firmware";
+			arch = "arm64";
+			os   = "op-tee";
+			compression = "none";
+			load = <$TEE_LOAD_ADDR>;
+			entry = <$TEE_LOAD_ADDR>;
+		};
+__HEADER_EOF
+
+cat << __CONF_HEADER_EOF
+	};
+	configurations {
+		default = "config-1";
+
+__CONF_HEADER_EOF
+
+if [ -f $BL32 ]; then
+if [ $ROLLBACK_INDEX_IN_FIT ]; then
+cat << __CONF_SECTION_EOF
+		config-1 {
+			description = "OPTEE FDT Configuration";
+			firmware = "tee-1";
+			rbindex = "$ROLLBACK_INDEX_IN_FIT";
+		};
+__CONF_SECTION_EOF
+else
+cat << __CONF_SECTION_EOF
+		config-1 {
+			description = "OPTEE FDT Configuration";
+			firmware = "tee-1";
+		};
+__CONF_SECTION_EOF
+fi
+else
+cat << __CONF_SECTION1_EOF
+		config-1 {
+			description = "OPTEE FDT Configuration";
+			firmware = "tee-1";
+		};
+__CONF_SECTION1_EOF
+fi
+
+cat << __ITS_EOF
+	};
+};
+__ITS_EOF
diff --git a/iMX8M/mkimage_fit_test.sh b/iMX8M/mkimage_fit_test.sh
new file mode 100755
index 0000000..4f2b3f3
--- /dev/null
+++ b/iMX8M/mkimage_fit_test.sh
@@ -0,0 +1,178 @@
+#!/bin/sh
+#
+# script to generate FIT image source for i.MX8MQ boards with
+# ARM Trusted Firmware and multiple device trees (given on the command line)
+#
+# usage: $0 <dt_name> [<dt_name> [<dt_name] ...]
+
+[ -z "$BL31" ] && BL31="bl31.bin"
+# keep backward compatibility
+[ -z "$TEE_LOAD_ADDR" ] && TEE_LOAD_ADDR="0xfe000000"
+
+if [ -z "$ATF_LOAD_ADDR" ]; then
+	echo "ERROR: BL31 load address is not set" >&2
+	exit 0
+fi
+
+if [ ! -f $BL31 ]; then
+	echo "ERROR: BL31 file $BL31 NOT found" >&2
+	exit 0
+else
+	echo "bl31.bin size: " >&2
+	ls -lct bl31.bin | awk '{print $5}' >&2
+fi
+
+BL32="tee.bin"
+LOADABLES="\"atf-1\""
+
+if [ ! -f $BL32 ]; then
+	BL32=/dev/null
+else
+	echo "Building with TEE support, make sure your bl31 is compiled with spd. If you do not want tee, please delete tee.bin" >&2
+	echo "tee.bin size: " >&2
+	ls -lct tee.bin | awk '{print $5}' >&2
+	LOADABLES="$LOADABLES, \"tee-1\""
+fi
+
+BL33="u-boot-nodtb.bin"
+DEK_BLOB="dek_blob_fit_dummy.bin"
+
+if [ ! -f $DEK_BLOB ]; then
+	DEK_BLOB=/dev/null
+else
+	echo "Building with encrypted boot support, make sure to replace DEK Blob in final image." >&2
+	LOADABLES="\"dek_blob-1\", $LOADABLES"
+fi
+
+if [ ! -f $BL33 ]; then
+	echo "ERROR: $BL33 file NOT found" >&2
+	exit 0
+else
+
+	echo "u-boot-nodtb.bin size: " >&2
+	ls -lct u-boot-nodtb.bin | awk '{print $5}' >&2
+fi
+
+for dtname in $*
+do
+	echo "$dtname size: " >&2
+	ls -lct $dtname | awk '{print $5}' >&2
+done
+
+cat << __HEADER_EOF
+/dts-v1/;
+
+/ {
+	description = "Configuration to load ATF before U-Boot";
+
+	images {
+		uboot-1 {
+			description = "U-Boot (64-bit)";
+			data = /incbin/("$BL33");
+			type = "standalone";
+			arch = "arm64";
+			compression = "none";
+			load = <0x40200000>;
+		};
+__HEADER_EOF
+
+cnt=1
+for dtname in $*
+do
+	cat << __FDT_IMAGE_EOF
+		fdt-$cnt {
+			description = "$(basename $dtname .dtb)";
+			data = /incbin/("$dtname");
+			type = "flat_dt";
+			compression = "none";
+		};
+__FDT_IMAGE_EOF
+cnt=$((cnt+1))
+done
+
+cat << __HEADER_EOF
+		atf-1 {
+			description = "ARM Trusted Firmware";
+			data = /incbin/("$BL31");
+			type = "firmware";
+			arch = "arm64";
+			compression = "none";
+			load = <$ATF_LOAD_ADDR>;
+			entry = <$ATF_LOAD_ADDR>;
+		};
+__HEADER_EOF
+
+if [ -f $BL32 ]; then
+cat << __HEADER_EOF
+		tee-1 {
+			description = "TEE firmware";
+			data = /incbin/("$BL32");
+			type = "firmware";
+			arch = "arm64";
+			compression = "none";
+			load = <$TEE_LOAD_ADDR>;
+			entry = <$TEE_LOAD_ADDR>;
+		};
+__HEADER_EOF
+fi
+
+if [ -f $DEK_BLOB ]; then
+cat << __HEADER_EOF
+		dek_blob-1 {
+			description = "dek_blob";
+			data = /incbin/("$DEK_BLOB");
+			type = "script";
+			compression = "none";
+			load = <$DEK_BLOB_LOAD_ADDR>;
+		};
+__HEADER_EOF
+fi
+
+cat << __CONF_HEADER_EOF
+	};
+	configurations {
+		default = "config-1";
+
+__CONF_HEADER_EOF
+
+cnt=1
+for dtname in $*
+do
+if [ -f $BL32 ]; then
+if [ $ROLLBACK_INDEX_IN_FIT ]; then
+cat << __CONF_SECTION_EOF
+		config-$cnt {
+			description = "$(basename $dtname .dtb)";
+			firmware = "uboot-1";
+			loadables = $LOADABLES;
+			fdt = "fdt-$cnt";
+			rbindex = "$ROLLBACK_INDEX_IN_FIT";
+		};
+__CONF_SECTION_EOF
+else
+cat << __CONF_SECTION_EOF
+		config-$cnt {
+			description = "$(basename $dtname .dtb)";
+			firmware = "uboot-1";
+			loadables = $LOADABLES;
+			fdt = "fdt-$cnt";
+		};
+__CONF_SECTION_EOF
+fi
+else
+cat << __CONF_SECTION1_EOF
+		config-$cnt {
+			description = "$(basename $dtname .dtb)";
+			firmware = "uboot-1";
+			loadables = $LOADABLES;
+			fdt = "fdt-$cnt";
+		};
+__CONF_SECTION1_EOF
+fi
+cnt=$((cnt+1))
+done
+
+cat << __ITS_EOF
+	};
+};
+__ITS_EOF
diff --git a/iMX8M/print_fit_hab_notee.sh b/iMX8M/print_fit_hab_notee.sh
new file mode 100755
index 0000000..c53b3db
--- /dev/null
+++ b/iMX8M/print_fit_hab_notee.sh
@@ -0,0 +1,71 @@
+#!/bin/bash
+
+let fit_off=$1
+
+# keep backward compatibility
+[ -z "$TEE_LOAD_ADDR" ] && TEE_LOAD_ADDR="0xfe000000"
+
+if [ -z "$ATF_LOAD_ADDR" ]; then
+	echo "ERROR: BL31 load address is not set" >&2
+	exit 0
+fi
+
+if [ "$VERSION" = "v1" ]; then
+	let ivt_off=0x400
+else
+	let ivt_off=0x0
+fi
+
+if [ "$BOOT_DEV" = "flexspi" ] || [ ${fit_off} == 0 ]; then
+	# We dd flash.bin to 0 offset for flexspi
+	let uboot_sign_off=$((fit_off + 0x3000))
+else
+	# We dd flash.bin to 33KB "0x8400" offset, so need minus 0x8400
+	let uboot_sign_off=$((fit_off - 0x8000 - ivt_off + 0x3000))
+fi
+
+let uboot_size=$(ls -lct u-boot-nodtb.bin | awk '{print $5}')
+let uboot_load_addr=0x40200000
+
+let last_sign_off=$(((uboot_sign_off + uboot_size + 3) & ~3))
+let last_load_addr=$((uboot_load_addr + uboot_size))
+
+uboot_size=`printf "0x%X" ${uboot_size}`
+uboot_sign_off=`printf "0x%X" ${uboot_sign_off}`
+uboot_load_addr=`printf "0x%X" ${uboot_load_addr}`
+
+echo ${uboot_load_addr} ${uboot_sign_off} ${uboot_size}
+
+cnt=0
+for dtname in $*
+do
+	if [ ${cnt} != 0 ]
+	then
+		let fdt${cnt}_size=$(ls -lct $dtname | awk '{print $5}')
+
+		let fdt${cnt}_sign_off=$((last_sign_off))
+		let fdt${cnt}_load_addr=$((last_load_addr))
+		let last_size=$((fdt${cnt}_size))
+
+		fdt_size=`printf "0x%X" ${last_size}`
+		fdt_sign_off=`printf "0x%X" ${last_sign_off}`
+		fdt_load_addr=`printf "0x%X" ${last_load_addr}`
+
+		let last_sign_off=$(((last_sign_off + fdt${cnt}_size + 3) & ~3))
+		let last_load_addr=$((last_load_addr + fdt${cnt}_size))
+
+		echo ${fdt_load_addr} ${fdt_sign_off} ${fdt_size}
+	fi
+
+	cnt=$((cnt+1))
+done
+
+let atf_sign_off=$((last_sign_off))
+let atf_load_addr=$ATF_LOAD_ADDR
+let atf_size=$(ls -lct bl31.bin | awk '{print $5}')
+
+atf_size=`printf "0x%X" ${atf_size}`
+atf_sign_off=`printf "0x%X" ${atf_sign_off}`
+atf_load_addr=`printf "0x%X" ${atf_load_addr}`
+
+echo ${atf_load_addr} ${atf_sign_off} ${atf_size}
diff --git a/iMX8M/print_fit_hab_tee.sh b/iMX8M/print_fit_hab_tee.sh
new file mode 100755
index 0000000..01a307b
--- /dev/null
+++ b/iMX8M/print_fit_hab_tee.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+BL32="tee.bin"
+let fit_off=$1
+[ -z "$TEE_LOAD_ADDR" ] && TEE_LOAD_ADDR="0xfe000000"
+
+let last_sign_off=$((fit_off + 0x3000))
+let last_load_addr=0x40200000
+
+let tee_size=$(ls -lct $BL32 | awk '{print $5}')
+let tee_sign_off=$((last_sign_off))
+let tee_load_addr=$TEE_LOAD_ADDR
+
+tee_size=`printf "0x%X" ${tee_size}`
+tee_sign_off=`printf "0x%X" ${tee_sign_off}`
+tee_load_addr=`printf "0x%X" ${tee_load_addr}`
+
+if [ ${tee_size} != 0x0 ]
+then
+	echo ${tee_load_addr} ${tee_sign_off} ${tee_size}
+fi
diff --git a/iMX8M/soc.mak b/iMX8M/soc.mak
index 4bfdc37..42f9ed6 100644
--- a/iMX8M/soc.mak
+++ b/iMX8M/soc.mak
@@ -67,7 +67,7 @@ LPDDR_FW_VERSION = _202006
 DDR_FW_VERSION = _202006
 else
 PLAT = imx8mq
-HDMI = yes
+HDMI = no
 SPL_LOAD_ADDR = 0x7E1000
 TEE_LOAD_ADDR = 0xfe000000
 ATF_LOAD_ADDR = 0x00910000
@@ -151,6 +151,19 @@ u-boot.itb: $(dtb)
 	./mkimage_uboot -E -p 0x3000 -f u-boot.its u-boot.itb
 	@rm -f u-boot.its $(dtb)
 
+u-boot-notee.itb: $(dtb)
+	./$(PAD_IMAGE) bl31.bin
+	./$(PAD_IMAGE) u-boot-nodtb.bin $(dtb)
+	DEK_BLOB_LOAD_ADDR=$(DEK_BLOB_LOAD_ADDR) ATF_LOAD_ADDR=$(ATF_LOAD_ADDR) ./mkimage_fit_notee.sh $(dtb) > u-boot-notee.its
+	./mkimage_uboot -E -p 0x3000 -f u-boot-notee.its u-boot-notee.itb
+	@rm -f u-boot-notee.its $(dtb)
+
+tee.itb:
+	./$(PAD_IMAGE) tee.bin
+	DEK_BLOB_LOAD_ADDR=$(DEK_BLOB_LOAD_ADDR) TEE_LOAD_ADDR=$(TEE_LOAD_ADDR) ./mkimage_fit_tee.sh > tee.its
+	./mkimage_uboot -E -p 0x3000 -f tee.its tee.itb
+	#@rm -f tee.its
+
 dtb_ddr3l = valddr3l.dtb
 $(dtb_ddr3l):
 	./$(DTB_PREPROC) $(PLAT)-ddr3l-$(VAL_BOARD).dtb $(dtb_ddr3l) $(dtbs)
@@ -232,11 +245,19 @@ flash_ddr3l_val: flash_ddr3l_val_no_hdmi
 
 flash_ddr4_val: flash_ddr4_val_no_hdmi
 
+flash_evk_notee: flash_evk_notee_no_hdmi
+
 endif
 
 flash_evk_no_hdmi: $(MKIMG) u-boot-spl-ddr.bin u-boot.itb
 	./mkimage_imx8 -version $(VERSION) -fit -loader u-boot-spl-ddr.bin $(SPL_LOAD_ADDR) -second_loader u-boot.itb 0x40200000 0x60000 -out $(OUTIMG)
 
+flash_evk_notee_no_hdmi: $(MKIMG) u-boot-spl-ddr.bin u-boot-notee.itb
+	./mkimage_imx8 -version $(VERSION) -fit -loader u-boot-spl-ddr.bin $(SPL_LOAD_ADDR) -second_loader u-boot-notee.itb 0x40200000 0x60000 -out $(OUTIMG)
+
+flash_tee: $(MKIMG) tee.itb
+	./mkimage_imx8 -fit_ivt tee.itb 0x40200000 0x0 -out tee-ivt.itb
+
 flash_evk_no_hdmi_dual_bootloader: $(MKIMG) u-boot-spl-ddr.bin u-boot.itb
 	./mkimage_imx8 -version $(VERSION) -fit -loader u-boot-spl-ddr.bin $(SPL_LOAD_ADDR) -out $(OUTIMG)
 	./mkimage_imx8 -fit_ivt u-boot.itb 0x40200000 0x0 -out u-boot-ivt.itb
@@ -278,6 +299,20 @@ flash_dp_spl_uboot: flash_dp_evk
 
 flash_spl_uboot: flash_evk_no_hdmi
 
+#print_fit_hab_tee:
+#	./$(PAD_IMAGE) tee.bin
+#	TEE_LOAD_ADDR=$(TEE_LOAD_ADDR) VERSION=$(VERSION) ./print_fit_hab_tee.sh
+
+print_fit_hab_tee:
+	./$(PAD_IMAGE) tee.bin
+	TEE_LOAD_ADDR=$(TEE_LOAD_ADDR) VERSION=$(VERSION) ./print_fit_hab_tee.sh 0
+
+print_fit_hab_notee: u-boot-nodtb.bin bl31.bin $(dtb)
+	./$(PAD_IMAGE) bl31.bin
+	./$(PAD_IMAGE) u-boot-nodtb.bin $(dtb)
+	ATF_LOAD_ADDR=$(ATF_LOAD_ADDR) VERSION=$(VERSION) ./print_fit_hab_notee.sh $(PRINT_FIT_HAB_OFFSET) $(dtb)
+	@rm -f $(dtb)
+
 print_fit_hab: u-boot-nodtb.bin bl31.bin $(dtb)
 	./$(PAD_IMAGE) tee.bin
 	./$(PAD_IMAGE) bl31.bin