Hi, I’m the Toradex AI Assistant.
I might make mistakes or occasionally get you wrong. Our support team will step in if needed.
Flashing Custom U-Boot with OP-TEE on Verdin iMX8M Plus
I can help you flash your custom imx-boot file containing U-Boot SPL, U-Boot proper, OP-TEE, and BL31 onto your Verdin iMX8M Plus module.
Recommended Approach: Toradex Easy Installer
The officially supported method is to use the Toradex Easy Installer to deploy your custom U-Boot binary(1). Here’s how:
1. Prepare Your Custom Image Package
Start from an existing Toradex prebuilt image and modify it to include your custom bootloader(1):
- Download a reference image for the Verdin iMX8M Plus from the Toradex software downloads page(1)
- Replace the bootloader binaries with your custom
imx-boot file(1)
- Adjust the
image.json file to ensure your bootloader binaries are loaded correctly(1)
For the Verdin iMX8M Plus, the image.json configuration should look like this(1):
"name": "mmcblk0boot0",
"erase": true,
"content": {
"filesystem_type": "raw",
"rawfiles": [
{
"filename": "u-boot.imx",
"dd_options": "seek=2"
}
]
}
Alternative: Using UUU Tool
While not officially supported for flashing to eMMC, you can use the uuu tool for development purposes(2). Here’s what’s involved:
UUU Script Approach
You can create a custom uuu script based on the Toradex Easy Installer’s approach(2). The process involves:
- Loading U-Boot to RAM first using the existing Easy Installer U-Boot
- Using fastboot commands to write to eMMC from within U-Boot(2)
A basic uuu.auto script structure would be(2):
uuu_version 1.4.127
SDPS: boot -f ../imx-boot
CFG: FB: -vid 0x0525 -pid 0x4000
CFG: FB: -vid 0x0525 -pid 0x4025
CFG: FB: -vid 0x0525 -pid 0x402F
CFG: FB: -vid 0x0525 -pid 0x4030
CFG: FB: -vid 0x0525 -pid 0x4031
CFG: FB: -vid 0x0525 -pid 0x4043
FB: ucmd setenv fastboot_buffer 0x82e00000
FB: download -f ../boot-tezi.scr
FB: ucmd setenv fastboot_buffer <imx-boot address>
FB: download -f <imx-boot>
FB: acmd source 0x82e00000
FB: done
Recovery Mode Connection
For recovery mode on the Verdin iMX8M Plus:
- Use the USB OTG connector on your carrier board
- The module needs to be put into recovery mode (specific procedure depends on your carrier board)
- Connect to your host PC via USB
Important Considerations
Security Integration
For your OP-TEE and secure boot implementation, Toradex provides the meta-toradex-security layer which includes:
- HAB (High Assurance Boot) support for bootloader signing
- FIT image verification keys
- OP-TEE integration with fTPM support
- PKCS#11 cryptographic token standard
Config Block Protection
When manually flashing, be careful not to destroy the Toradex config block (512 bytes at the end of the first boot partition)(2). This contains important module identification and configuration data.
Build Process for Signed Bootloader
Since you’re working with OP-TEE and secure boot, consider using Toradex’s containerized build environment for signed bootloaders. This leverages the Yocto Project/OpenEmbedded with the meta-toradex-security layer to build properly signed bootloader images with OP-TEE integration.
The build process supports:
- OP-TEE (Trusted Execution Environment)
- fTPM (Firmware-based TPM)
- PKCS#11 (Cryptographic token standard)
- HAB signing for secure boot
Would you like me to provide more specific guidance on any of these approaches, or do you need help with the security layer configuration for your use case?
Best regards, Toradex AI Assistant.
Did you like my answer? 
If I answered your question, please tick the “Solution” checkbox.
For follow-up questions to me, please use @ToradexAI in your post.
