Secure Boot on Apalis iMX8: Recovery and Reflashing After Enabling

Technical Support
, ,
1

Hi,
I am currently working on enabling Secure Boot on an Apalis iMX8 module.

I would like to understand what happens after Secure Boot is fully enabled, specifically regarding recovery and re-flashing.

Once Secure Boot is activated, is it still possible to completely reset the SoM and install a new image?

In particular, would it still be possible to boot or install standard Toradex images (e.g. via Easy Installer), or will the device only accept images signed with my own keys from that point on?

2

Hi, I’m the Toradex AI Assistant.

I might make mistakes or occasionally get you wrong. Our support team will step in if needed.

To guide you properly regarding Secure Boot on your Apalis iMX8, could you specify which OS and version you are running? This will help me provide the most accurate guidance for your specific setup.

For reference, here are some common platforms:

Hardware: Verdin i.MX8M Plus, Verdin AM62, Aquila AM69, Apalis i.MX8QP, Colibri i.MX8X, Ivy Carrier Board, Ixora Carrier Board, Mallow Carrier Board

Operating System: Yocto 7.2.0, Torizon 6.8.2, Torizon OS 6, BSP 7, BSP 6, Torizon OS 7.2.0-build.13

You can use the tdx-info command to get detailed information about your system configuration. More details are available at: Getting Device Information with Tdx-Info | Toradex Developer Center

However, I can share some general information about Secure Boot behavior. Once Secure Boot fuses are programmed and the device is “closed,” the behavior changes significantly (1). The device will only boot bootloaders that have been signed with matching credentials (2). This also means you can’t run standard Toradex Easy Installer, making it difficult to work with such a fused device (2).

The fuse programming operations are one-time only and irreversible (2). Once you set the final closing fuse, the device will only accept signed images that match your keys.

Best regards, Toradex AI Assistant.

Did you like my answer? :+1: :-1:

If I answered your question, please tick the “Solution” checkbox.

For follow-up questions to me, please use @ToradexAI in your post.

3

Hello @Stefano,

After the SoM is closed for secure boot, the device will only accept images signed with your own keys.

Therefore, loading Toradex-provided images will no longer be possible unless you sign them with your keys.

We are currently working on documenting a method to recover closed devices.
It will involve signing a boot container that will allow for installing new images to the device.
At the moment this is not documented, and while possible would require some work to enable.
By the end of this quarter (Q2), the work should be done to make this easier.

How soon would you need such a feature?

Best Regards,
Bruno

4

Hi,

I would also be very interested in the possibility of being able to recover old closed devices.

Is there anything I could help with to speed up the documentation or implementation of this ability?

We currently have around a thousand SoMs we currently cannot use from all the testing and verification we have done with our custom images.

It would be nice to be able to recover some of those.

Regards,

Izzy

5

Hello @izzycoding,

At the moment, there is not much to be done to help speed this up, expressing your interest is a good input that I have relayed internally already.

I hope “a thousand” is figure of speech, if not, please let me know as discussing how so many modules got locked away could be important.

Best Regards,
Bruno

6

Hi @bruno.tx,

Sadly a thousand is not far off the real number.

We have done around 10-20 while testing various changes that did not work.

However we are currently on our 3rd batch of 300. Out of these we currently have 40 that are unused and 120 that are in production units.

The rest have been blown due to badly planned delivery schedules with our customer. We have needed our deliverables ready for the last year. However, it has only been a recent change within our custom image build that now allows us to perform full system updates.

The recent update cannot be manually put on the old SoMs either due to needing a fundamental change to the partitions and a migration from MBR to GPT allocation tables.

Anyway, long story short, we are left with several boxes that we currently cannot use for anything and we cannot get rid of due to our company policies and customer requirements. They make great paperweights though. LOL.

Regards,

Izzy

7

Thanks for the clarification.

Recovering those devices should soon be documented, but I also sent some general information about the possible solutions in case you want to do this earlier.

Best Regards,
Bruno

8

Thanks,

I will take a look. I may not be able to recover all of our old SoMs as we originally had a security report that said we had to disable SDP. But there should be some we can recover that don’t have that fuse blown.

Will let you know how it goes when I get a chance to try it all out.

Regards, Izzy