Verdin iMX8MP recovery / re-flash on a HAB-CLOSED device

Technical Support
1

Hello,

we run a custom Torizon OS (Yocto “torizon-docker” base + TorizonCore Builder changes) on Verdin iMX8MP, with HAB secure boot enabled via meta-toradex-security.
We have successfully closed a pilot device.

The device itself works fine. Our questions are about the recovery / re-flashing path once a module is CLOSED.
To be honest before testing Easy Installer on that device we thought Easy Installer can be started but only installing proper signed images will work.
But it seems not so (yes…makes sense if thinking about it).

How is recovery / re-flashing via the Toradex Easy Installer (recovery mode / uuu) intended to work once a Verdin iMX8MP is in the HAB CLOSED state?

Tested running the stock Easy Installer recovery on the closed device:

  • the module enter serial download mode (lsusb: “1fc9:0146 NXP Semiconductors SP Blank”)?
  • recovery-linux.sh / uuu fails at the recovery loader stage:
    SDPS: boot -f ../imx-boot-recoverytezi
    HID(W): LIBUSB_ERROR_NO_DEVICE (-4)
    Success 0 Failure 1
  • the exact same script/package worked while the device was still OPEN.

We also tried the obvious shortcut using our own HAB-signed imx-boot (the same flash.bin that is written to the eMMC) as the SDP loader instead of imx-boot-recoverytezi. On the CLOSED device the BootROM auth it, but the bootloader then simply boots the existing eMMC OS (it finds /boot.scr, loads the signed FIT, boots Torizon OS to the login prompt) instead of entering the Easy Installer. uuu stays at “SDPS: boot -f …” and the Easy Installer never runs.

We have already read related community threads.
From these we see a recovery imx-boot signed with our own SRK is needed, and that a documented method was in progress for ~end of Q2.

  1. Is the documented closed-device recovery method / boot-container signing available? If so, can you point us to it?

  2. On a CLOSED iMX8MP device, must the recovery imx-boot loaded via SDP/uuu be HAB-signed with the device’s SRK?

  3. How do we obtain or build a SIGNED Toradex Easy Installer / signed “imx-boot-recoverytezi” using our own HAB keys?

  • Which Yocto recipe / image / bitbake target produces the recovery (TEZI) imx-boot (is there a Verdin iMX8MP equivalent of the colibri_imx7_tezi_recovery_defconfig? …read about in other thread), and how does meta-toradex-security HAB signing apply to that recovery bootloader?
  • We already TRIED using our production imx-boot as the SDP loader: HAB accepts it, but it boots the eMMC OS instead of the Easy Installer. So we presumably need the recovery-defconfig EI U-Boot signed with our SRK. can you confirm, and tell us exactly how to build/sign that recovery imx-boot for Verdin iMX8MP?
  • Or, if signing the prebuilt loader is the intended path: what is the exact CST procedure (CSF/offsets) to sign the existing imx-boot-recoverytezi?
  1. What is yur recommended procedure for re-flashing / recovering CLOSED iMX8MP devices in production?

Our environment:

  • Module: Verdin iMX8M Plus Quad 4GB
  • Torizon OS base: 7.6.0, meta-toradex-security
  • U-Boot: 2024.07-7.6.0-devel
  • Signing: NXP CST 4.0.1; HAB PKI = SRK (CA) + CSF/IMG
  • Easy Installer: Verdin-iMX8MP_ToradexEasyInstaller_7.6.0+build.11
  • Device state: CLOSED (SEC_CONFIG set), boots our signed image normally, OTA works.

Looking forward and thanks for support.

2

Hi, I’m the Toradex AI Assistant.

I might make mistakes or occasionally get you wrong. Our support team will step in if needed.

You’ve identified a critical challenge: on a HAB-CLOSED Verdin iMX8M Plus, the recovery bootloader (imx-boot-recoverytezi) loaded via Serial Download Protocol (SDP) must also be HAB-signed with your device’s SRK keys, otherwise the BootROM will reject it(1)(2)(3).

The behavior you observed is expected:

  • The stock imx-boot-recoverytezi from Toradex Easy Installer is unsigned, so the CLOSED device’s BootROM refuses to execute it(1).
  • When you used your production imx-boot (which is HAB-signed), the BootROM accepted it, but U-Boot then followed its normal boot flow (loading /boot.scr from eMMC) instead of entering recovery mode(1)(4).

Answers to Your Questions

1. Is the documented closed-device recovery method available?

The meta-toradex-security layer provides comprehensive Secure Boot support, including bootloader signing(3). However, signing the Toradex Easy Installer recovery bootloader for CLOSED devices is not explicitly documented in the standard workflows(1)(2)(3). The recovery process on CLOSED devices requires you to build and sign your own recovery bootloader using your SRK keys.

2. Must the recovery imx-boot be HAB-signed with the device’s SRK?

Yes. On a CLOSED iMX8M Plus, the BootROM enforces HAB authentication for all boot images, including those loaded via SDP(2)(3). If the recovery bootloader is not signed with the correct SRK, the BootROM will refuse to execute it(1)(3).

3. How to obtain or build a SIGNED Toradex Easy Installer recovery imx-boot?

You need to:

A. Build the Recovery U-Boot

The Toradex Easy Installer uses a special U-Boot configuration. For Verdin iMX8M Plus, you must:

  • Use the Yocto BSP with meta-toradex-security enabled(3).
  • Build a U-Boot image configured for recovery mode (the equivalent of the recovery defconfig for your SoM)(1)(4).

The meta-toradex-security layer supports HAB signing via the tdx-signed or tdxref-signed classes(3). When enabled, these classes automatically sign the bootloader and kernel images during the build(2)(3).

B. Sign the Recovery Bootloader

Once you have built the recovery U-Boot image, you must sign it using the same SRK keys and CST procedures you used for your production image(2)(4):

  1. Generate the PKI tree (if not already done) using the NXP CST tool(2)(4).
  2. Create CSF files (csf_spl.txt and csf_fit.txt) referencing your SRK certificates(2)(4).
  3. Sign the boot container using the CST tool to produce signed imx-boot binaries(2)(4).

The signing procedure is the same as for your production image. Refer to the CST documentation and the examples in the U-Boot source tree(4).

C. Use the Signed Recovery Bootloader

Replace the stock imx-boot-recoverytezi in your Easy Installer package with your signed recovery bootloader, then run the recovery script(1).

4. Recommended procedure for re-flashing CLOSED iMX8MP devices in production?

For CLOSED devices, the recommended workflow is:

  1. Build and sign a dedicated recovery U-Boot configured to enter Toradex Easy Installer mode (not boot from eMMC)(1)(3).
  2. Load the signed recovery bootloader via SDP/uuu on CLOSED devices(1).
  3. Flash the production image using Toradex Easy Installer as usual(1).

Alternatively, you can:

  • Use OTA updates via Torizon Cloud for field updates, avoiding the need for physical recovery(3).
  • Implement a fallback boot partition strategy in your production image to enable recovery without SDP.

Key Takeaway

The core issue is that Toradex Easy Installer’s stock recovery bootloader is unsigned. On CLOSED devices, you must build and sign your own recovery bootloader using meta-toradex-security and your SRK keys(2)(3). The exact Yocto recipe and build target for the recovery bootloader may require consulting the meta-toradex-security repository or reaching out to Toradex support for SoM-specific guidance.

For further details on HSM-backed signing and the full Secure Boot workflow, refer to the Secure Boot documentation for NXP i.MX SoMs(2)(3).

Best regards,
Toradex AI Assistant.

Did you like my answer? :+1: :-1:

If I answered your question, please tick the “Solution” checkbox.

For follow-up questions to me, please use @ToradexAI in your post.

3

Greetings @sol_ad,

Our team is actually in the middle of developing a tool that can be used to re-flash closed devices such as yours. An initial version of this tool should soon be available. I would recommending waiting for this tool if your need here isn’t too urgent.

Best Regards,
Jeremias

5

Hi @jeremias.tx ,

many thanks for quick response!
Do you have a time schedule for such tool that we can communicate to our internal and external customers?

6

We do have an early/initial version of the tool that is currently undergoing some limited customer validation. I’ve brought your case here to the attention of our team. They will be in touch with you shortly regarding this.

Best Regards,
Jeremias

7

We just ran into this same scenario late last week. We were about to head down the path of building and signing our own recovery bootloader, but this new tool sounds intriguing. Are you able to provide a more firm estimate on when this new tool would be available for us to use?

8

Hi @kevin_walker,

Could you share what specific hardware you are working on for HAB/secure-boot? The initial version of this tool may not have full support for every hardware. But, of course support for the remaining hardware will come incrementally.

Which is why it’s good to know what hardware you are working with.

Best Regards,
Jeremias

9

Hi @jeremias.tx ,

We are using the Verdin iMX8M Plus on the Dahlia carrier board.

Thanks,

Kevin

10

We are using the Verdin iMX8M Plus on the Dahlia carrier board.

Thank you for sharing that. I will take this information back to our team and get back to you.

Best Regards,
Jeremias

11

Hi @kevin_walker, I’ll reach out to you in private to schedule a demo call. We are in a closed beta stage, looking for feedback from a smaller audience before rolling this feature out.

12

Hi @leo.tx,
I’m currently working on a secure boot implementation for one of our customers, and we’re in a very similar situation (i.MX8M Plus + Verdin carrier). I’m very interested in the recovery tool you mentioned earlier.
If there are any updates or if there’s a preview/beta version available for evaluation, I’d be happy to test it and provide feedback. Also, if it’s easier to discuss the details directly, I’d appreciate it if you could reach out to me as well. I’d be glad to share additional information about my use case.
Thank you!

13

Hi @l-krstic,

By now, we do have a closed preview that you can test. Either my colleague Lucas Lungareze or I will reach out to you and share the instructions so you can validate it.

Thanks for reaching out

1 Like
14

Hello @leo.tx,

I have reached the same state, as I cannot load the easy installer on a closed system. I am using the imx8m plus on a verdin development board. Is the new tool still in a closed preview? And if so, is it possible to receive a test version?

Thank you :slight_smile:

15

Hello Max,

Please refer to this repo https://github.com/rborn-tx/meta-toradex-flasher
As you will notice, this project has not been moved to the official Toradex repo, as some minor details have to be reviewed.
However, the tool is functional and should help you to recover your closed device

Let us know if you have questions
Best regards

Maximiliano Zapata
Toradex

16

@max, precisely what @Maximiliano.tx has written. It’s an open preview under the GitHub of Rogerio, the main developer working on this, and soon will be moved to an official namespace.

Additional resources that make be useful in supporting you going through it:

* Layer meta-toradex-security:
https://github.com/toradex/meta-toradex-security/

* Article Secure Boot on Torizon OS:
https://developer.toradex.com/torizon/security/secure-boot-on-torizoncore/

Please let us know your findings, that’s how we can improve the tool further