USB boot Feature not working after addition of Secure Boot Verdin iMX8MP

vishalborle92 · September 1, 2026, 9:13am

Hello All,
Recently we implemented Secure boot for our custom carrier board with Verdin iMX8MP, and below our current software configuration:
Torizon OS : Reference Minimal Image
Toradex BSP : Toradex BSP version 7.4.0
Linux Kernel : Linux Kernel version 6.6.94 LTS
Machine : verdin-imx8mp
Yocto Release : Yocto 5.0 (Scarthgap)
Distro (Distribution) : tdx-xwayland
Architecture : ARM64

When we enabled the secure boot in local.conf file as below configuration:

# 1. Enable Full Chain of Trust (HAB + signed FIT + dm-verity rootfs)
INHERIT += "tdxref-signed"
TDX_IMX_HAB_ENABLE = "1"

# Note: Replace below it with your custom image name.
DM_VERITY_IMAGE = "tdx-reference-minimal-image"
DM_VERITY_IMAGE_TYPE = "ext4"

# 2. NXP Code Signing Tool location
TDX_IMX_HAB_CST_DIR = "/home/vishal/IMX_CST_TOOL_NEW/cst-4.0.1"
TDX_IMX_HAB_CST_BIN = "${TDX_IMX_HAB_CST_DIR}/linux64/bin/cst"

# 3. PKI tree parameters - these MUST match the answers given to hab4_pki_tree.sh.
# The certificate/table file names are derived from these; do not hardcode paths.
# SRK_CA=1 because SRK_1_2_3_4_table.bin was built from the *_ca_crt.pem certs.
TDX_IMX_HAB_CST_CRYPTO    = "rsa"
TDX_IMX_HAB_CST_KEY_SIZE  = "2048"
TDX_IMX_HAB_CST_KEY_EXP   = "65537"
TDX_IMX_HAB_CST_DIG_ALGO  = "sha256"
TDX_IMX_HAB_CST_SRK_CA    = "1"
TDX_IMX_HAB_CST_SRK_INDEX = "1"

# 4. Sign the kernel/DTB FIT image (required for a real chain of trust)
# TEMPORARY: "0" while validating HAB/hab_status. Setting this to "0" also
# auto-disables TDX_UBOOT_HARDENING_ENABLE, keeping the USB/TEZI update flow
# working. MUST be set back to "1" before production - see notes below.
UBOOT_SIGN_ENABLE = "1"

# Prevent Yocto from auto-generating random keys in ${TOPDIR}/keys/fit
FIT_GENERATE_KEYS = "0"

# Point directly to your static CST fit_keys directory and key basename
UBOOT_SIGN_KEYDIR = "${TDX_IMX_HAB_CST_DIR}/keys/fit_keys"
UBOOT_SIGN_KEYNAME = "prod_fit_key"

# 5. Boot container is produced by U-Boot, not imx-boot (mandatory on BSP 7.x)
UBOOT_PROVIDES_BOOT_CONTAINER = "1"

Initially I got the errors and we resolved all of them and build and flashed with above configuration in to our device. When device powerup the startup boot log attached here for review and reference.

Start_Up_Secure_boot_ECoT.txt (41.7 KB)

Currently the main problem we are facing is the USB boot feature for SoM FW upgrade using TEZI not working. When I ran USB boot and start FW Upgrade command in u-boot then we are getting the ERROR “Failed to verify required signature ‘key-prod_fit_key’
Bad Data Hash”:

## U-Boot CLI access is enabled
Hit any key to stop autoboot:  0
Verdin iMX8MP # setenv bootargs "quiet rootfstype=squashfs root=/dev/ram autoinstall console=ttymxc2,115200" && usb start && load usb 0:1 0x44200000 tezi.itb && bootm 0x44200000#conf-freescale_imx8mp-verdin-nonwifi-dev.dtb
## WARNING: Command execution WOULD BE DENIED in closed state (blocked by category) for `usb start`.
starting USB...
Bus usb@38100000: Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.10
scanning bus usb@38100000 for devices... 2 USB Device(s) found
       scanning usb for storage devices... 1 Storage Device(s) found
42800795 bytes read in 1014 ms (40.3 MiB/s)
## Loading kernel from FIT Image at 44200000 ...
   Using 'conf-freescale_imx8mp-verdin-nonwifi-dev.dtb' configuration
   Verifying Hash Integrity ...  error!
No 'signature' subnode found for '<NULL>' hash node in 'conf-freescale_imx8mp-verdin-nonwifi-dev.dtb' config node
Failed to verify required signature 'key-prod_fit_key'
Bad Data Hash
ERROR -2: can't get kernel image!
Verdin iMX8MP #

Could you please help me how to resolve this SoM FW upgrade using USB boot via TEZI?

Thanks in advanced..!!

ToradexAI · September 1, 2026, 9:14am

Hi, I’m the Toradex AI Assistant.

I might make mistakes or occasionally get you wrong. Our support team will step in if needed.

The issue you’re experiencing is expected behavior when Secure Boot is enabled. The TEZI (Toradex Easy Installer) image loaded via USB must be signed with the same keys used in your Secure Boot configuration for U-Boot to verify and boot it(1).

Root Cause

When you enable Secure Boot with UBOOT_SIGN_ENABLE = "1", U-Boot’s hardening features are activated(1). The bootloader will only execute signed FIT images that can be verified with the public key embedded in U-Boot(2). Your error message indicates that the TEZI image (tezi.itb) either:

Is not signed at all, or
Is signed with a different key than prod_fit_key

The error “Failed to verify required signature ‘key-prod_fit_key’” confirms that U-Boot is looking for a signature from your production key but cannot verify it(2).

Solution Approaches

Option 1: Sign the TEZI Image (Recommended for Production)

You need to sign the TEZI FIT image with your production keys. The kernel FIT image signing process uses the same key directory and key name you specified(2):

UBOOT_SIGN_KEYDIR = "${TDX_IMX_HAB_CST_DIR}/keys/fit_keys"
UBOOT_SIGN_KEYNAME = "prod_fit_key"

The TEZI image must be signed using the same prod_fit_key key pair located in your fit_keys directory(2).

Option 2: Temporarily Disable Hardening for Development

For development and testing purposes only, you can temporarily work around this by disabling the signature verification. However, note that the hardening features are designed to prevent execution of unsigned software(1), so this should only be used during development.

Important Security Considerations

The hardening modifications in U-Boot are specifically designed to prevent execution of unsigned software and prevent modification to the running software(1). When the device is in a closed state (after fusing), only signed and verified software should be bootable(1).

For production deployment, all bootable images—including recovery/installer images like TEZI—must be properly signed with your production keys(2).

Best regards,
Toradex AI Assistant

Did you like my answer?

If I answered your question, please tick the “Solution” checkbox.

For follow-up questions to me, please use @ToradexAI in your post.

sahil.tx · September 1, 2026, 2:33pm

Hii Vishal,

I think there may be a mix-up between two different scenarios.

For production programming, Toradex Easy Installer can be used to flash the final Secure Boot-enabled image onto the module.
This is different from the current scenario, where my understanding is that the module already has a Secure Boot-enabled image with hardened U-Boot.

In the current case, when you manually load and boot tezi.itb from USB, the already-running hardened U-Boot verifies the image and rejects it because it is not signed with the expected key.

For development and validation, setting UBOOT_SIGN_ENABLE = "0" temporarily disables U-Boot hardening, which is why the USB/TEZI workflow continues to work. Before production, it should be set back to "1" to maintain the complete Chain of Trust.

Please refer to the following documentation for more details:
https://developer.toradex.com/torizon/security/u-boot-hardening-for-secure-boot
https://developer.toradex.com/torizon/security/secure-boot-on-torizoncore

Sahil Malian
Toradex