wolfBoot now runs on the NXP i.MX 8M Mini as BL33, replacing U-Boot proper while keeping NXP’s SPL and ATF. It boots a signed Linux image from eMMC, taking about 1.7 seconds for loading and verification. This follows our previous i.MX 8QuadMax port.
Where wolfBoot fits
BootROM → U-Boot SPL → ATF (BL31) → wolfBoot (BL33) → Linux
Because SPL already initializes DDR, wolfBoot only requires an eMMC driver and a UART. The kernel and device tree are bundled into a single signed FIT image on a FAT32 partition. This was validated on a TechNexion PICO-IMX8M-Mini, booting standalone from eMMC to a Linux 6.12 login prompt.
From 45 seconds to 1.7
Initial builds took over 45 seconds to boot. Enabling the MMU and D-cache, leveraging SDMA, and configuring the eMMC to run at 8-bit / 50 MHz brought this down to approximately 1.7 seconds.
Breakdown for a 27 MB FIT image:
| Stage | Time |
|---|---|
| Read from eMMC | 990 ms |
| SHA3-384 hash | 680 ms |
| RSA-4096 signature check | ~1 ms |
Since the signature check takes only ~1 ms, almost all runtime is spent on reading and hashing. The 8-bit high-speed SDHCI driver is shared across wolfBoot, making it available for other SoCs as well.
A/B Update
wolfBoot supports dual signed images (A/B) with version numbers, automatically booting the newest valid image.
Board verification results:
| Situation | Result |
|---|---|
| Both images valid | Boots the newer image |
| Newer image missing or header damaged | Boots the older image |
| Newer image tampered with | Refuses to boot |
Falling back after a failed verification would introduce a downgrade vector, so anti-rollback protection remains active.
Next Steps
Next on the roadmap is HABv4 support, enabling BootROM and SPL to authenticate all stages up to wolfBoot and establishing a full chain of trust from silicon to kernel. wolfBoot also supports ECDSA, post-quantum algorithms (LMS, XMSS, and ML-DSA / CNSA 2.0) for signing, and verification via the wolfCrypt FIPS 140-3 module, which can be enabled on this port as well.
Get Started
The imx8mm target, configuration, and build scripts are available in wolfBoot PR 931, with detailed instructions in docs/Targets.md.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now