Hello,
I have a Colibri iMX8X module in CLOSED state. I would like the BSP / Easy Installer version with U-Boot compiled with secure-boot enforcement (CONFIG_IMX_HAB=y, CONFIG_FIT_SIGNATURE_STRICT=y) and support for the ahab_status command.
Thank you
Regards
Flavio Gobber
Hi, I’m the Toradex AI Assistant.
I might make mistakes or occasionally get you wrong. Our support team will step in if needed.
Hello Flavio,
I understand you’re looking for a custom Easy Installer with secure boot-enabled U-Boot for your Colibri iMX8X module that’s already in CLOSED state. Based on the available documentation, I can guide you on building a custom U-Boot with secure boot features.
The process involves building a custom U-Boot with the secure boot configurations you mentioned. Here’s what you’ll need to do:
First, install the necessary dependencies and set up your cross-compilation environment (1):
$ sudo apt-get install bc build-essential git wget libncurses5-dev lzop perl libssl-dev bison flex swig libyaml-dev pkg-config python3-dev python3-venv xz-utils xxd device-tree-compiler u-boot-tools
Set up the ARM64 toolchain (1):
$ cd ~
$ wget -O arm-gnu-toolchain-12.3.rel1-x86_64-aarch64-none-linux-gnu.tar.xz "https://developer.arm.com/-/media/Files/downloads/gnu/12.3.rel1/binrel/arm-gnu-toolchain-12.3.rel1-x86_64-aarch64-none-linux-gnu.tar.xz?rev=cf8baa0ef2e54e9286f0409cdda4f66c&hash=4E1BA6BFC2C09EA04DBD36C393C9DD3A"
$ tar xvf arm-gnu-toolchain-12.3.rel1-x86_64-aarch64-none-linux-gnu.tar.xz && rm arm-gnu-toolchain-12.3.rel1-x86_64-aarch64-none-linux-gnu.tar.xz
$ ln -s arm-gnu-toolchain-12.3.rel1-x86_64-aarch64-none-linux-gnu gcc-linaro-aarch64
Create and source the environment setup file (1):
export ARCH=arm64
export PATH=${HOME}/gcc-linaro-aarch64/bin/:${PATH}
export DTC_FLAGS='-@'
export CROSS_COMPILE=aarch64-none-linux-gnu-
Clone the Toradex U-Boot repository (1):
$ mkdir -p ~/workdir
$ cd ~/workdir
$ git clone -b toradex_imx_lf_v2024.04 https://git.toradex.com/u-boot-toradex.git
Configure and compile U-Boot for Colibri iMX8X (1):
$ cd ~/workdir/u-boot-toradex
$ make mrproper
$ make colibri-imx8x_defconfig
At this point, you’ll need to modify the configuration to enable the secure boot features you mentioned (CONFIG_IMX_HAB=y, CONFIG_FIT_SIGNATURE_STRICT=y) and ensure ahab_status command support.
Then compile (1):
$ make -j$(nproc) 2>&1 | tee build.log
You’ll also need to obtain and build the additional firmware components required for the complete boot container, including the SECO firmware, SCU firmware, and ARM-Trusted Firmware as detailed in the documentation (1).
Based on community discussions, implementing secure boot on Toradex modules requires careful attention to the complete build process (2). The process involves not just U-Boot configuration but also proper integration with Yocto builds and signing procedures.
Given the complexity of implementing secure boot with Easy Installer and the specific requirements for your CLOSED state module, I’d recommend using the tdx-info command to get detailed information about your current setup and consider reaching out through the Toradex Community for guidance on your specific secure boot implementation, as this involves advanced customization beyond standard documentation.
You can find more information about system identification at: Getting Device Information with Tdx-Info | Toradex Developer Center
Best regards, Toradex AI Assistant.
Did you like my answer? 
If I answered your question, please tick the “Solution” checkbox.
For follow-up questions to me, please use @ToradexAI in your post.
The problem is that my board provvided by Toradex is already CLOSED and I can not build u-boot because i do not have SRK key. But I need a version which force to load only fitImage.
I understand your situation better now. You have a Colibri iMX8X that’s already in CLOSED state and you need U-Boot that enforces FIT signature verification, but you don’t have access to the SRK keys that were used to close the device.
Once a device is in CLOSED state, it will only boot software signed with the specific keys that were used to program the eFuses(1). This creates a fundamental problem: without the original SRK keys used to close your device, you cannot create new signed U-Boot images that the device will accept.
As the documentation clearly states(1):
If you lose the private keys you have created to sign your images, you won’t be able to install or update the software on devices that are closed.
This is exactly the situation you’re facing - the device was closed with keys that are not available to you.
Since this involves a device that was provided by Toradex in CLOSED state, this may be a special case that requires direct support assistance. Toradex may have specific procedures for handling pre-closed evaluation units.
First, verify the actual state of your device. You can check the current secure boot status using U-Boot commands to confirm it’s truly in CLOSED state and understand what keys were used.
If you need a version of Easy Installer that enforces FIT signature verification but can work with your existing setup, this would require building a custom Easy Installer image with the specific U-Boot configurations you mentioned (CONFIG_FIT_SIGNATURE_STRICT=y).
The fundamental security principle of secure boot means that a CLOSED device can only run software signed with the original keys. There’s no legitimate way to bypass this without the original signing keys, as this would defeat the entire purpose of secure boot.
I’d recommend reaching out through the Toradex Community with your specific use case, as this appears to be a unique situation involving a pre-closed evaluation device that may require special handling procedures.
Best regards, Toradex AI Assistant.
Did you like my answer?
If I answered your question, please tick the “Solution” checkbox.
For follow-up questions to me, please use @ToradexAI in your post.
Greetings @flavio,
I’m not sure I understand what your use-case here is.
You want an Easy Installer with U-Boot that has the configs enabled for secure boot. But, you said:
The problem is that my board provvided by Toradex is already CLOSED and I can not build u-boot because i do not have SRK key
What do you plan to do with this custom built Easy Installer, if your board is already closed and you do not have the keys/certs?
Best Regards,
Jeremias
Hello Jeremias,
the question is this.
The boards we received have a closed AHAB but with a standard U-Boot that allows loading personal U-Boots. We need an AHAB catalog signed with your keys because the device is locked with your SRK keys, which contains a secure-aware U-Boot that includes the public key of the certificate with which we would sign the fitImage file with the kernel catalog.
How can we request this?
Thank you for help.
Regards
Flavio Gobber.
The boards we received have a closed AHAB
Okay wait, I feel there’s some background that is missing here. Was it prearranged that we provide you boards that are closed?
Normally this is not something that we would do. If this was planned, who in Toradex discussed this with you?
Otherwise, it sounds like there was a mistake and you should return these boards for ones that have not been fused for secure boot.
Best Regards,
Jeremias
Hello Jeremias
I explain the procedure I followed to create the image with Yocto Scarthgap for a Colibri iMX8QXP board. The goal is to produce a configuration that has secure boot functionalities and validates the kernel.
For this, I created the SRK keys and the FIT key and configured my local.conf with these variables:
BBLAYERS += "
${TOPDIR}/../layers/meta-security
${TOPDIR}/../custom-colibri-imx8x/migra/meta-toradex-security \
${TOPDIR}/../custom-colibri-imx8x/migra/meta-secure \
"
DISTRO_FEATURES:append = " security secureboot "
INHERIT += “tdx-signed”
TDX_IMX_HAB_ENABLE = “1”
IMX_BOOT_SOC_TARGET = “ahab”
TDX_IMX_HAB_CST_BIN = “${TOPDIR}/../custom-colibri-imx8x/migra/secure-boot-3.4.1/cst-3.4.1/linux64/bin/cst”
TDX_IMX_HAB_CST_CERTS_DIR = “/opt/yocto/ahab-pki/rsa-ca-no-pwd/crts”
TDX_IMX_HAB_CST_KEY_SIZE = “4096”
TDX_IMX_HAB_CST_DIG_ALGO = “sha256”
TDX_IMX_HAB_CST_SRK_CA = “0”
UBOOT_SIGN_KEYDIR = “/opt/yocto/ahab-pki/fit-keys”
UBOOT_FIT_KEY_NAME = “fit”
TDX_SKIP_BOOTSCRIPT_REVIEW = “1”
BOOT_SCRIPT_STRICT_CHECK = “0”
BBLAYERS += "
${TOPDIR}/../layers/meta-security
${TOPDIR}/../custom-colibri-imx8x/migra/meta-toradex-security \
${TOPDIR}/../custom-colibri-imx8x/migra/meta-secure \
"
DISTRO_FEATURES:append = " security secureboot "
INHERIT += “tdx-signed”
TDX_IMX_HAB_ENABLE = “1”
IMX_BOOT_SOC_TARGET = “ahab”
TDX_IMX_HAB_CST_BIN = “${TOPDIR}/../custom-colibri-imx8x/migra/secure-boot-3.4.1/cst-3.4.1/linux64/bin/cst”
TDX_IMX_HAB_CST_CERTS_DIR = “/opt/yocto/ahab-pki/rsa-ca-no-pwd/crts”
TDX_IMX_HAB_CST_KEY_SIZE = “4096”
TDX_IMX_HAB_CST_DIG_ALGO = “sha256”
TDX_IMX_HAB_CST_SRK_CA = “0”
UBOOT_SIGN_KEYDIR = “/opt/yocto/ahab-pki/fit-keys”
UBOOT_FIT_KEY_NAME = “fit”
TDX_SKIP_BOOTSCRIPT_REVIEW = “1”
BOOT_SCRIPT_STRICT_CHECK = “0”
I then executed “bitbake tdx-reference-minimal-image.”
At the end, I uploaded the file “imx-boot-colibri-imx8x-sd.bin-flash” onto an SD card.
I then transferred this file to the eMMC with these commands:
load mmc 1:1 ${loadaddr} /image/boot/colibri-imx8x/imx-boot-colibri-imx8x-sd.bin-flash
setexpr blks ${filesize} + 0x1FF
setexpr blks ${blks} / 0x200
mmc dev 0
mmc partconf 0 1 1 1
mmc write ${loadaddr} 0x0 ${blks}
I performed the reset and gave the command:
Colibri iMX8X # ahab_status
Lifecycle: 0x0020, NXP closed
SECO Event[0] = 0x0087FA00
CMD = AHAB_AUTH_CONTAINER_REQ (0x87)
IND = AHAB_BAD_KEY_HASH_IND (0xFA)
sc_seco_get_event: idx: 1, res:3
So it seems that the board is locked with an invalid key hash.
I may have made various mistakes but I would need help to proceed with the activation of secure boot.
Thank for your help.
Regards
Flavio Gobber
I think you have a lot of misconceptions here.
First of all your device is not “closed”. If your device was actually closed and the keys/certs did not match as you claim, then the device would not boot. That’s the whole purpose of AHAB to prevent an improperly signed U-Boot from booting at all.
Colibri iMX8X # ahab_status
Lifecycle: 0x0020, NXP closed
SECO Event[0] = 0x0087FA00
CMD = AHAB_AUTH_CONTAINER_REQ (0x87)
IND = AHAB_BAD_KEY_HASH_IND (0xFA)
sc_seco_get_event: idx: 1, res:3
To actually close your device you would need to have executed ahab_close in U-Boot (do not do this unless you’re sure, it’s irreversible). Once you do this the lifecycle status would be OEM closed not NXP closed. Also again, the fact the device is even booting U-Boot despite not having proper keys/certs means it’s not closed.
It’s more likely there was some user error that is causing this SECO event you see printed. This error roughly means that the currently running U-Boot and whatever key values were programmed into this device’s fuses do not match.
Our documentation in meta-toardex-security is fairly straightforward on how this should all be done: meta-toradex-security/docs/README-secure-boot-imx.md at scarthgap-7.x.y · toradex/meta-toradex-security · GitHub
Also your Yocto configuration is confusing as well.
IMX_BOOT_SOC_TARGET = “ahab”
TDX_SKIP_BOOTSCRIPT_REVIEW = “1” & BOOT_SCRIPT_STRICT_CHECK = “0”
DISTRO_FEATURES:append = " security secureboot "
I would recommend just starting from scratch and follow our documentation exactly as is. Do not set random variables, or do things that are not documented.
Best Regards,
Jeremias
Hello Jeremias,
now i have closed the device and now the is no more available the stop boot process and i get this error:
## WARNING: Required node “/chosen/toradex,secure-boot” could not be found in device-tree.
ERROR: /chosen node create failed
How can i solve this issue ?.
Thank you
Regards
Flavio Gobber
How can i solve this issue ?.
That’s very odd, that issue you showed is complaining about a missing node in the device tree. However, this node should be automatically added by meta-toradex-security, at least in the default settings. You didn’t drastically change any of the settings related to meta-toradex-security did you?
Also, did these error/warning messages not appear before you closed the device? If they did, then you really should not have closed the device until all error/warning messages have been cleared.
Best Regards,
Jeremias
Hello Jeremias,
I put into my imx8qxp-colibri-eval-v3.dts patched this :
chosen {
toradex,secure-boot;
};
I retrieved from fitImage the dtb fdt-freescale_imx8qxp-colibri-eval-v3.dtb and from the conversion into dts I find in it:
chosen {
stdout-path = "/bus@5a000000/serial@5a090000";
toradex,secure-boot;
};
could be that i need to change the patch as:
chosen {
toradex,secure-boot {
};
witch this change toradex,secure boot to node instead as property ?.
Now when boot with device closed the stop boot is disabled, can i enable it almost now in debug mode with:
chosen {
toradex,secure-boot {
enable-cli-when-closed;
};
};
local.conf defintions:
BBLAYERS += " \
${TOPDIR}/../layers/meta-security \
${TOPDIR}/../custom-colibri-imx8x/migra/meta-toradex-security \
${TOPDIR}/../custom-colibri-imx8x/migra/meta-secure \
"
DISTRO_FEATURES:append = " security secureboot "
INHERIT += "tdx-signed"
TDX_IMX_HAB_ENABLE = "1"
TDX_IMX_HAB_CST_DIR = "/opt/yocto/ahab-pki/cst-4.0.1"
TDX_IMX_HAB_CST_BIN = "${TDX_IMX_HAB_CST_DIR}/linux64/bin/cst"
TDX_IMX_HAB_CST_CERTS_DIR ="${TDX_IMX_HAB_CST_DIR}/crts"
TDX_IMX_HAB_CST_KEY_SIZE = "3072"
TDX_IMX_HAB_CST_DIG_ALGO = "sha384"
TDX_IMX_HAB_CST_SRK_CA = "1"
UBOOT_SIGN_KEYDIR = "/opt/yocto/ahab-pki/fit-keys"
UBOOT_FIT_KEY_NAME = "dev"
FIT_HASH_ALG = "sha384"
FIT_SIGN_ALG = "rsa3072"
FIT_ALIGN_SEPARATOR = "1"
Thank you
Regards
Flavio Gobber
I put into my imx8qxp-colibri-eval-v3.dts patched this
Wait, I’m not sure if you’re understanding me. I’m saying by default meta-toradex-security should have done this configuration for you. It’s not expected that you patch and add this node in the device-tree yourself.
It’s not clear what you did here to cause this node to be missing in the final build. Could you do a completely default build with nothing else but, the following minimal configuration:
INHERIT += "tdx-signed"
TDX_IMX_HAB_CST_DIR = "/opt/yocto/ahab-pki/cst-4.0.1"
TDX_IMX_HAB_CST_KEY_SIZE = "3072"
TDX_IMX_HAB_CST_DIG_ALGO = "sha384"
TDX_IMX_HAB_CST_SRK_CA = "1"
UBOOT_SIGN_KEYDIR = "/opt/yocto/ahab-pki/fit-keys"
With this do you still get the error where /chosen/toradex,secure-boot is missing?
Also, you didn’t answer my previous question. Were these error/warning messages present before you closed this device?
Best Regards,
Jeremias
Hello Jeremias,
I performed the build as indicated, I only had to add the configuration for managing the fit key, which is rsa3072 and sha384.
local.conf:
BBLAYERS += "
${TOPDIR}/../layers/meta-security
${TOPDIR}/../custom-colibri-imx8x/migra/meta-toradex-security \
${TOPDIR}/../custom-colibri-imx8x/migra/meta-secure \
"
INHERIT += “tdx-signed”
TDX_IMX_HAB_CST_DIR = “/opt/yocto/ahab-pki/cst-4.0.1”
TDX_IMX_HAB_CST_KEY_SIZE = “3072”
TDX_IMX_HAB_CST_DIG_ALGO = “sha384”
TDX_IMX_HAB_CST_SRK_CA = “1”
UBOOT_SIGN_KEYDIR = “/opt/yocto/ahab-pki/fit-keys”
FIT_HASH_ALG = “sha384”
FIT_SIGN_ALG = “rsa3072”
and add the fragment to u-boot .config
CONFIG_RSA3072=y
CONFIG_SHA384=y
I then tried to program a board that is not yet closed to perform verifications more easily. Here is the result at boot:
U-Boot 2024.04-7.6.0-devel+git.c7a5b4be5e0d (Feb 19 2026 - 16:25:53 +0000)
CPU: NXP i.MX8QXP RevC A35 at 1200 MHz at 42C
DRAM: 2 GiB
Core: 247 devices, 25 uclasses, devicetree: separate
MMC: FSL_SDHC: 0, FSL_SDHC: 1
Loading Environment from MMC… OK
In: serial
Out: serial
Err: serial
Model: Toradex 0050 Colibri iMX8QXP 2GB IT V1.0D
Serial#: 14791003
Boot: MMC0
Reset cause: POR
BuildInfo:
flash target is MMC:0
Net: eth0: ethernet@5b040000
Fastboot: Normal
Normal Boot
Hit any key to stop autoboot: 0
image_upgrade:
fatload mmc 0:1 0x80200000....9198813 bytes read in 212 ms (41.4 MiB/s)
Using ‘conf-freescale_imx8qxp-colibri-eval-v3.dtb’ configuration
Verifying Hash Integrity … sha384,rsa3072:dev+ OK
Trying ‘kernel-1’ kernel subimage
Description: Linux kernel
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x80200100
Data Size: 8169504 Bytes = 7.8 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x96000000
Entry Point: 0x96000000
Hash algo: sha384
Hash value: d28acce7603ca340a970d1aa5519b4e23f0c695346d2a661b76fdb723643a314dd20e0cd0ba5ce1762078dad6ed38d6a
Verifying Hash Integrity … sha384+ OK
Using ‘conf-freescale_imx8qxp-colibri-eval-v3.dtb’ configuration
Verifying Hash Integrity … sha384,rsa3072:dev+ OK
Trying ‘fdt-freescale_imx8qxp-colibri-eval-v3.dtb’ fdt subimage
Description: Flattened Device Tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x80a5ff28
Data Size: 123560 Bytes = 120.7 KiB
Architecture: AArch64
Load Address: 0x83100000
Hash algo: sha384
Hash value: b7192fa7d98d3fa0fec9519274ead36b9d0334c9af2d79261a017c3eeba1d7298763037e6eddd71bcf09b483c62dbde1
Verifying Hash Integrity … sha384+ OK
Loading fdt from 0x80a5ff28 to 0x83100000
Booting using the fdt blob at 0x83100000
Working FDT set to 83100000
Uncompressing Kernel Image to 96000000
Loading Device Tree to 00000000fd646000, end 00000000fd6672a7 … OK
Working FDT set to fd646000
/bus@59000000/dma-controller@591f0000, 43504
/bus@59000000/dma-controller@599f0000, 44740
/bus@5a000000/dma-controller@5a1f0000, 60688
/bus@5a000000/dma-controller@5a1f0000, 60688
/bus@5a000000/dma-controller@5a9f0000, 61800
so I still receive the warning at boot.
What i have to do to solve the problem.
Thank you for help.
Regards.
Flavio Gobber
Our team couldn’t reproduce this issue regarding /chosen/toradex,secure-boot.
Looking at your boot logs I noticed something even odder. First of all, the boot logs should look something like this:
## Loading kernel from FIT Image at 9d500000 ...
Using 'conf-freescale_imx8qxp-colibri-eval-v3.dtb' configuration
Verifying Hash Integrity ... sha256,rsa2048:dev+ OK
Trying 'kernel-1' kernel subimage
Description: Linux kernel
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x9d5000f8
Data Size: 8428738 Bytes = 8 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x96000000
Entry Point: 0x96000000
Hash algo: sha256
Hash value: 8c3cbb88e6330845032b5257637203d79ed71f0dcc8d1e51f54f82406e37d309
Verifying Hash Integrity ... sha256+ OK
## Loading fdt from FIT Image at 9d500000 ...
Using 'conf-freescale_imx8qxp-colibri-eval-v3.dtb' configuration
Verifying Hash Integrity ... sha256,rsa2048:dev+ OK
Trying 'fdt-freescale_imx8qxp-colibri-eval-v3.dtb' fdt subimage
Description: Flattened Device Tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x9dd9e5e4
Data Size: 121871 Bytes = 119 KiB
Architecture: AArch64
Load Address: 0x83100000
Hash algo: sha256
Hash value: a8841b6497e38063896d04bc864b18848ef3c91246c3983ceec220141f3fcceb
Verifying Hash Integrity ... sha256+ OK
Loading fdt from 0x9dd9e5e4 to 0x83100000
## Loading fdt from FIT Image at 9d500000 ...
Using 'conf-colibri-imx8x-secboot-kargs_overlay.dtbo' configuration
Verifying Hash Integrity ... sha256,rsa2048:dev+ OK
Trying 'fdt-colibri-imx8x-secboot-kargs_overlay.dtbo' fdt subimage
Description: Flattened Device Tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x9ddfdb60
Data Size: 390 Bytes = 390 Bytes
Architecture: AArch64
Load Address: 0x83200000
Hash algo: sha256
Hash value: 0f1309711ff80bb55ca57c54395e889e8b21bb5ea6c117b857c9a5de7b8b362e
Verifying Hash Integrity ... sha256+ OK
## Loading fdt from FIT Image at 9d500000 ...
Using 'conf-colibri-imx8x_vga-640x480_overlay.dtbo' configuration
Verifying Hash Integrity ... sha256,rsa2048:dev+ OK
Trying 'fdt-colibri-imx8x_vga-640x480_overlay.dtbo' fdt subimage
Description: Flattened Device Tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x9ddfe120
Data Size: 2222 Bytes = 2.2 KiB
Architecture: AArch64
Load Address: 0x83200000
Hash algo: sha256
Hash value: 597fa4d7b36a8b38e789c036574f9dbcd4adfd0e536cc60ded54d3f08284a5f4
Verifying Hash Integrity ... sha256+ OK
Booting using the fdt blob at 0x83100000
Working FDT set to 83100000
Uncompressing Kernel Image to 96000000
Loading Device Tree to 00000000fd645000, end 00000000fd665ffa ... OK
Working FDT set to fd645000
/bus@59000000/dma-controller@591f0000, 43308
/bus@59000000/dma-controller@599f0000, 44544
/bus@5a000000/dma-controller@5a1f0000, 60352
/bus@5a000000/dma-controller@5a1f0000, 60352
/bus@5a000000/dma-controller@5a9f0000, 61464
Starting kernel ...
Notice how this FIT image loads kernel, device-tree, and some device-tree overlays. Especially fdt-colibri-imx8x-secboot-kargs_overlay.dtbo this is a particularly important device-tree overlay related to our secure-boot process. Your FIT image does not load device tree overlays, why? The default configuration for our images does this, so you must have changed or done something in your build.
Furthermore, where is this coming from in your boot logs?:
WARNING: Command execution WOULD BE DENIED in closed state (blocked by category) for fatload mmc 0:1 0x80200000....
Our default boot process does not use fatload for anything.
Based on these discrepancies, it’s looking like you customized your Yocto image. I can only assume the issues you are facing are related to your customization. Have you tried to build a standard Toradex secure-boot image in Yocto with just our default settings, and no further customizations?
By our own tests the default configuration should work. Which would mean something else in your build outside of our default configurations is causing this issue for you.
Best Regards,
Jeremias
Hello Jeremias,
In order to have a basic starting point, I set up a new build environment.
In this environment i have to add only a layer to configure in u-boot the support of rsa3072 and sha384 because the fit key is created with this configuration.
cat ../meta-secure/recipes-bsp/u-boot/u-boot-toradex/ahab_enable.cfg
CONFIG_RSA3072=y
CONFIG_SHA384=y
lavio@simde:/opt/yocto/scarthgap-7.x.y/TST_AHAB$ cat ../meta-secure/recipes-bsp/u-boot/u-boot-toradex_%.bbappend
FILESEXTRAPATHS:prepend := “${THISDIR}/${PN}:”
SRC_URI:append = "
file://ahab_enable.cfg
"
Then in local.conf I added this definitions:
INHERIT += “tdx-signed”
TDX_IMX_HAB_CST_DIR = “/opt/yocto/ahab-pki/cst-4.0.1”
TDX_IMX_HAB_CST_KEY_SIZE = “3072”
TDX_IMX_HAB_CST_DIG_ALGO = “sha384”
TDX_IMX_HAB_CST_SRK_CA = “1”
UBOOT_SIGN_KEYDIR = “/opt/yocto/ahab-pki/fit-keys”
FIT_HASH_ALG = “sha384”
FIT_SIGN_ALG = “rsa3072”
and select machine:
MACHINE ?= “colibri-imx8x”
and in bblayers.conf added this layers, meta-toradex-security is the layer download from Toradex github:
${TOPDIR}/../layers/meta-security
${TOPDIR}/../custom-colibri-imx8x/migra/meta-toradex-security
${TOPDIR}/../meta-secure \
Run the “bitbake tdx-reference-minimal-image”, flashed "imx-boot-colibri-imx8x-sd.bin-flash " and executed “gzwrite” of the file “Colibri-iMX8X_Reference-Minimal-Image.wic.gz”
Now at boot get this messages with the warning:
9192297 bytes read in 213 ms (41.2 MiB/s)
Using ‘conf-freescale_imx8qxp-colibri-eval-v3.dtb’ configuration
Verifying Hash Integrity … sha384,rsa3072:dev+ OK
Trying ‘kernel-1’ kernel subimage
Description: Linux kernel
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x80200100
Data Size: 8169504 Bytes = 7.8 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x96000000
Entry Point: 0x96000000
Hash algo: sha384
Hash value: 34f3f4cecd087571496eca8624df65bd45cc5ffbcab281c123645112f0f8dccc08f62aa0c851fc478e3ae9b4aa890b47
Verifying Hash Integrity … sha384+ OK
Using ‘conf-freescale_imx8qxp-colibri-eval-v3.dtb’ configuration
Verifying Hash Integrity … sha384,rsa3072:dev+ OK
Trying ‘fdt-freescale_imx8qxp-colibri-eval-v3.dtb’ fdt subimage
Description: Flattened Device Tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x80a5f1a8
Data Size: 121871 Bytes = 119 KiB
Architecture: AArch64
Load Address: 0x83100000
Hash algo: sha384
Hash value: d457b9c3fed15c54341a0e98146aa2bc2af7e9a17a0cf2a0a7a3c5cdda3e08d84479a927fbd238a34c9dbedced45b9d6
Verifying Hash Integrity … sha384+ OK
Loading fdt from 0x80a5f1a8 to 0x83100000
Booting using the fdt blob at 0x83100000
Working FDT set to 83100000
Uncompressing Kernel Image to 96000000
Loading Device Tree to 00000000fd646000, end 00000000fd666c0e … OK
Working FDT set to fd646000
Whath is wrong ?
Now there are no other personal configuration, perhaps it is necessary to do something else?
Thank you for help.
Regards
Flavio Gobber
You must still be doing something non-standard. I just did a build myself from scratch and it worked as expected. This is the git hashes for each meta-layer used in my build:
Build Configuration:
BB_VERSION = "2.8.1"
BUILD_SYS = "x86_64-linux"
NATIVELSBSTRING = "debian-12"
TARGET_SYS = "aarch64-tdx-linux"
MACHINE = "colibri-imx8x"
DISTRO = "tdx-xwayland"
DISTRO_VERSION = "7.6.1-devel-20260521185307+build.0"
TUNE_FEATURES = "aarch64 armv8a crypto"
TARGET_FPU = ""
meta-toradex-nxp = "HEAD:60b01a180f192796a5c4a47fee4860f6ec6c130c"
meta-freescale = "HEAD:0c27c21cab57876474bb572e5d378b6707e41224"
meta-freescale-3rdparty = "HEAD:ce10c065119c2d4e359235c77aae7e0d843533ef"
meta-toradex-ti = "HEAD:eb078c659fa9326a78ab2d3d88e99f9101e51a55"
meta-arm-toolchain
meta-arm = "HEAD:a81c19915b5b9e71ed394032e9a50fd06919e1cd"
meta-ti-bsp
meta-ti-extras = "HEAD:a444d3137a527d4a405986a5ffa143ed7dfc0961"
meta-toradex-bsp-common = "HEAD:b575b723899e421086ffede532f0717012e088ba"
meta-oe
meta-filesystems
meta-networking
meta-multimedia
meta-python = "HEAD:ae7dfb12245c7f9b9a353499e2688015bd4e6413"
meta-freescale-distro = "HEAD:b9d6a5d9931922558046d230c1f5f4ef6ee72345"
meta-toradex-demos = "HEAD:28b67de839fd5cb32da42b65a8a700781fb72144"
meta-qt5 = "HEAD:227cf5e7b64c93dfc1a45f235c466db8c3fd8707"
meta-tpm = "HEAD:b13f1705d723650de61277670c8a76aadea4cfdd"
meta-toradex-distro = "HEAD:024f1bbf16d480c25f90387a0f2cac2d071c2b18"
meta-poky = "HEAD:ca5a51aadaf651881d640688dc3e1e123aa30bf6"
meta = "HEAD:ece80784b493c8b7493478fa2ba0dc1d6d80aa79"
meta-security = "HEAD:b13f1705d723650de61277670c8a76aadea4cfdd"
meta-toradex-security = "scarthgap-7.x.y:ecb94fd199ffe2f3bbc17740d9d0ad90ef463006"
And my configuration is simply just:
INHERIT += "tdx-signed"
TDX_IMX_HAB_CST_DIR = "/build/coj/BSP/layers/cst"
Every other configuration not explicitly set by me, is using its default setting, as documented. The image produced by my build was flashed using Toradex Easy Installer, which is the supported method for flashing by Toradex. After flashing this was my boot logs looked like:
flash target is MMC:0
Net: eth0: ethernet@5b040000 [PRIME]
Fastboot: Normal
Normal Boot
## U-Boot CLI access is enabled
Hit any key to stop autoboot: 0
MMC: no card present
switch to partitions #0, OK
mmc0(part 0) is current device
Scanning mmc 0:1...
Found U-Boot script /boot.scr
5412 bytes read in 4 ms (1.3 MiB/s)
## Executing script at 9d480000
52 bytes read in 3 ms (16.6 KiB/s)
9347877 bytes read in 226 ms (39.4 MiB/s)
Bootargs: ro rootwait console=tty1 console=ttyLP3,115200 root=PARTUUID=89f2cb71-02
## Loading kernel from FIT Image at 9d500000 ...
Using 'conf-freescale_imx8qxp-colibri-eval-v3.dtb' configuration
Verifying Hash Integrity ... sha256,rsa2048:dev+ OK
Trying 'kernel-1' kernel subimage
Description: Linux kernel
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x9d5000f8
Data Size: 8327457 Bytes = 7.9 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x96000000
Entry Point: 0x96000000
Hash algo: sha256
Hash value: 10c271a300edd1822acf8f9bed02d8d0867c1cfa1ad4c3ae0910087e99de8829
Verifying Hash Integrity ... sha256+ OK
## Loading fdt from FIT Image at 9d500000 ...
Using 'conf-freescale_imx8qxp-colibri-eval-v3.dtb' configuration
Verifying Hash Integrity ... sha256,rsa2048:dev+ OK
Trying 'fdt-freescale_imx8qxp-colibri-eval-v3.dtb' fdt subimage
Description: Flattened Device Tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x9dd85a44
Data Size: 121871 Bytes = 119 KiB
Architecture: AArch64
Load Address: 0x83100000
Hash algo: sha256
Hash value: a8841b6497e38063896d04bc864b18848ef3c91246c3983ceec220141f3fcceb
Verifying Hash Integrity ... sha256+ OK
Loading fdt from 0x9dd85a44 to 0x83100000
## Loading fdt from FIT Image at 9d500000 ...
Using 'conf-colibri-imx8x-secboot-kargs_overlay.dtbo' configuration
Verifying Hash Integrity ... sha256,rsa2048:dev+ OK
Trying 'fdt-colibri-imx8x-secboot-kargs_overlay.dtbo' fdt subimage
Description: Flattened Device Tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x9dde4fc0
Data Size: 390 Bytes = 390 Bytes
Architecture: AArch64
Load Address: 0x83200000
Hash algo: sha256
Hash value: 0f1309711ff80bb55ca57c54395e889e8b21bb5ea6c117b857c9a5de7b8b362e
Verifying Hash Integrity ... sha256+ OK
## Loading fdt from FIT Image at 9d500000 ...
Using 'conf-colibri-imx8x_vga-640x480_overlay.dtbo' configuration
Verifying Hash Integrity ... sha256,rsa2048:dev+ OK
Trying 'fdt-colibri-imx8x_vga-640x480_overlay.dtbo' fdt subimage
Description: Flattened Device Tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x9dde5580
Data Size: 2222 Bytes = 2.2 KiB
Architecture: AArch64
Load Address: 0x83200000
Hash algo: sha256
Hash value: 597fa4d7b36a8b38e789c036574f9dbcd4adfd0e536cc60ded54d3f08284a5f4
Verifying Hash Integrity ... sha256+ OK
Booting using the fdt blob at 0x83100000
Working FDT set to 83100000
Uncompressing Kernel Image to 96000000
Loading Device Tree to 00000000fd645000, end 00000000fd665ffa ... OK
Working FDT set to fd645000
## Validation of bootargs succeeded.
/bus@59000000/dma-controller@591f0000, 43308
/bus@59000000/dma-controller@599f0000, 44544
/bus@5a000000/dma-controller@5a1f0000, 60352
/bus@5a000000/dma-controller@5a1f0000, 60352
/bus@5a000000/dma-controller@5a9f0000, 61464
Starting kernel ...
Again notice how my FIT image is loading additional device-tree overlays that yours is not. This difference makes it clear that you’re build is still deviating from our standard default build in some way.
Unless you provide more information on what else is different about your build, it’s difficult for us to say anything else, as we can’t reproduce your issue. As far as we can see our standard default build works as expected.
Maybe try replicating exactly what I just did here and nothing else. That way our comparisons can be as close to the same as possible.
Best Regards,
Jeremias
I re-downloaded the Yocto environment from the official Toradex repo with the command repo init -u git://git.toradex.com/toradex-manifest.git -b scarthgap-7.x.y -m tdxref/default.xml
I configured a new build environment, I recreated the fit key to rsa2048 and sha256 so as not to insert other defines except for those I included in my local.conf
INHERIT += “tdx-signed”
TDX_IMX_HAB_CST_DIR = “/opt/yocto/ahab-pki/cst-4.0.1”
TDX_IMX_HAB_CST_KEY_SIZE = “3072”
TDX_IMX_HAB_CST_DIG_ALGO = “sha384”
TDX_IMX_HAB_CST_SRK_CA = “1”
UBOOT_SIGN_KEYDIR = “/opt/yocto/ahab-pki/fit-keys”
Now I am thinking that my problem could be related to the meta-toradex-security layer, the layer is not present among the layers downloaded with
repo init -u git://git.toradex.com/toradex-manifest.git -b scarthgap-7.x.y -m tdxref/default.xml
I found instructions to download it from GitHub, but I am not sure.
Could you please provide me the link to download meta-toradex-security layer, so I can be certain that it is the official one?
Could you also please provide me with the variables present in your environment?
Thank you for help.
Regards
Flavio Gobber
Hello Jeremias,
I solved the problem of boot with secure boot, I have done error on loading boot.scr.
Thank you very much for your help.
Regards
Flavio Gobber
I solved the problem of boot with secure boot, I have done error on loading boot.scr.
Glad you were able to locate your issue, and resolve your problem.
Best Regards,
Jeremias