Hi, I’m the Toradex AI Assistant.
I might make mistakes or occasionally get you wrong. Our support team will step in if needed.
Hello Flavio,
I understand you’re looking for a custom Easy Installer with secure boot-enabled U-Boot for your Colibri iMX8X module that’s already in CLOSED state. Based on the available documentation, I can guide you on building a custom U-Boot with secure boot features.
Building Secure Boot U-Boot for Colibri iMX8X
The process involves building a custom U-Boot with the secure boot configurations you mentioned. Here’s what you’ll need to do:
Prerequisites and Environment Setup
First, install the necessary dependencies and set up your cross-compilation environment (1):
$ sudo apt-get install bc build-essential git wget libncurses5-dev lzop perl libssl-dev bison flex swig libyaml-dev pkg-config python3-dev python3-venv xz-utils xxd device-tree-compiler u-boot-tools
Set up the ARM64 toolchain (1):
$ cd ~
$ wget -O arm-gnu-toolchain-12.3.rel1-x86_64-aarch64-none-linux-gnu.tar.xz "https://developer.arm.com/-/media/Files/downloads/gnu/12.3.rel1/binrel/arm-gnu-toolchain-12.3.rel1-x86_64-aarch64-none-linux-gnu.tar.xz?rev=cf8baa0ef2e54e9286f0409cdda4f66c&hash=4E1BA6BFC2C09EA04DBD36C393C9DD3A"
$ tar xvf arm-gnu-toolchain-12.3.rel1-x86_64-aarch64-none-linux-gnu.tar.xz && rm arm-gnu-toolchain-12.3.rel1-x86_64-aarch64-none-linux-gnu.tar.xz
$ ln -s arm-gnu-toolchain-12.3.rel1-x86_64-aarch64-none-linux-gnu gcc-linaro-aarch64
Create and source the environment setup file (1):
export ARCH=arm64
export PATH=${HOME}/gcc-linaro-aarch64/bin/:${PATH}
export DTC_FLAGS='-@'
export CROSS_COMPILE=aarch64-none-linux-gnu-
Get U-Boot Sources
Clone the Toradex U-Boot repository (1):
$ mkdir -p ~/workdir
$ cd ~/workdir
$ git clone -b toradex_imx_lf_v2024.04 https://git.toradex.com/u-boot-toradex.git
Build Process for Colibri iMX8X
Configure and compile U-Boot for Colibri iMX8X (1):
$ cd ~/workdir/u-boot-toradex
$ make mrproper
$ make colibri-imx8x_defconfig
At this point, you’ll need to modify the configuration to enable the secure boot features you mentioned (CONFIG_IMX_HAB=y, CONFIG_FIT_SIGNATURE_STRICT=y) and ensure ahab_status command support.
Then compile (1):
$ make -j$(nproc) 2>&1 | tee build.log
Additional Components Required
You’ll also need to obtain and build the additional firmware components required for the complete boot container, including the SECO firmware, SCU firmware, and ARM-Trusted Firmware as detailed in the documentation (1).
Important Considerations
Based on community discussions, implementing secure boot on Toradex modules requires careful attention to the complete build process (2). The process involves not just U-Boot configuration but also proper integration with Yocto builds and signing procedures.
Recommendation
Given the complexity of implementing secure boot with Easy Installer and the specific requirements for your CLOSED state module, I’d recommend using the tdx-info command to get detailed information about your current setup and consider reaching out through the Toradex Community for guidance on your specific secure boot implementation, as this involves advanced customization beyond standard documentation.
You can find more information about system identification at: Getting Device Information with Tdx-Info | Toradex Developer Center
Best regards, Toradex AI Assistant.
Did you like my answer? 
If I answered your question, please tick the “Solution” checkbox.
For follow-up questions to me, please use @ToradexAI in your post.