Imx7d 1gb emmc secure boot using torizon-signed and custom device tree

Technical Support
2

Hi, I’m the Toradex AI Assistant.

I might make mistakes. Our support team will step in if needed. If I answered your question, please tick the “Solution” checkbox. For follow-up questions to me, please use @ToradexAI in your post.

Did you like my answer? :+1: :-1:

Secure Boot Configuration with OSTree and Custom Device Tree

Based on your symptoms, you’re encountering the expected behavior of hardened U-Boot which is designed to prevent execution of non-FIT images and restrict certain commands for security(1). The issue appears to be related to configuration rather than fundamental incompatibility.

Understanding the Problem

Your hardened U-Boot is correctly blocking raw kernel execution with the message "ERROR: can't boot from non-FIT images with hardening enabled"(1). This is intentional security behavior where the hardening modifications prevent execution of unsigned software and tampering of the running software(1).

Required Yocto Configuration

For secure boot with Torizon OS 7, you need to use the appropriate BitBake class in your conf/local.conf file(2):

INHERIT += "torizon-signed"

(2)

The torizon-signed class provides Extended Chain of Trust (ECoT) coverage, which includes root filesystem protection through composefs integration(2). This class automatically includes tdx-signed functionality, so you get both Basic Chain of Trust (BCoT) and Extended Chain of Trust (ECoT) protections(2).

Custom Device Tree Integration Limitations

Important limitation: TorizonCore Builder cannot be used with secure boot enabled images(3). As confirmed in the community discussions, TorizonCore Builder was designed to work with standard images and doesn’t yet support FIT images that are signed(3).

For secure boot implementations, all modifications including custom device trees must be done at the Yocto level(3). You cannot use TorizonCore Builder’s device tree functionality when secure boot is enabled.

Root Filesystem Protection Considerations

When using torizon-signed, the root filesystem protection uses composefs, which significantly changes OSTree behavior(2). Most notably, changes to /etc are stored on an overlay and lost upon reboot(2). You may need to configure persistent storage for critical configuration files.

The following variables control composefs behavior(2):

Variable Description Default value
CFS_GENERATE_KEYS Enable ("1") or disable ("0") composefs key pair generation at build time "1"
CFS_SIGN_KEYDIR Directory where the composefs keys are stored ${TOPDIR}/keys/ostree
CFS_SIGN_KEYNAME Base name of the key files cfs-dev

Command Restrictions in Hardened U-Boot

The command restrictions you’re seeing (USB commands being blocked) are part of the command whitelisting feature(1). In closed state, only a small set of commands required for booting plus a few considered safe are permitted(1). This is normal behavior for hardened U-Boot.

Next Steps

  1. Verify your Yocto configuration uses INHERIT += "torizon-signed" in local.conf(2)
  2. Integrate your custom device tree directly into your Yocto build rather than using TorizonCore Builder(3)
  3. Ensure proper HAB/AHAB configuration for your iMX7 platform as described in the meta-toradex-security documentation(2)
  4. Configure FIT image signing as outlined in the meta-toradex-security documentation(2)

The error "Could not find configuration node" suggests the FIT image configuration may not be properly set up for your custom device tree within the secure boot context.

Best regards,
Toradex AI Assistant.