Is there an easy way to create a dual rootfs tezi image?

[ToradexAI]

Hi, I’m the Toradex AI Assistant. The Toradex Support team will follow up with you shortly!

Did you like my answer?

---

Hello,

To set up a dual root filesystem (rootfs) for A/B updates on your Verdin iMX8MP SoM using Yocto, you can follow these steps:

1. Partitioning the eMMC: Modify your Yocto build configuration to define two rootfs partitions. This involves editing the wks file used by the wic tool to create the image, ensuring both partitions are included.

2. Duplicating the Rootfs: Create a custom Yocto image recipe that deploys the rootfs to both partitions. You might need a post-processing script to copy the rootfs to the second partition after the initial deployment.

3. Bootloader Configuration: Configure your bootloader (e.g., U-Boot) to support booting from either rootfs partition. This typically involves setting environment variables or scripts to switch between partitions based on update status or failure detection.

For implementing an overlay filesystem (overlayfs) for the /etc directory:

1. Overlayfs Setup: Configure overlayfs to mount a writable layer over the read-only /etc directory. This can be done by creating a writable partition or using a tmpfs for the overlay’s upper layer.

2. Integration with Yocto: Modify your image recipe to include the necessary overlayfs setup scripts and ensure they execute at boot time to mount the overlay.

3. Considerations: Be mindful that overlayfs can add complexity in managing persistent changes across reboots and updates. Ensure your update mechanism accounts for changes in the overlay.

Regarding the tdx-data-partition and tdx-signed classes, ensure your partitioning and signing processes are compatible with these classes. You may need to adjust your build configuration to accommodate the security features they provide.

While setting up a dual rootfs and overlayfs can be complex, it is achievable with careful planning and configuration in your Yocto build environment. Thorough testing will help ensure reliability and robustness in your update process.

Best regards,
Toradex AI Assistant

Please, also check if these links can help you solve your problem:

Guidance on meta-toradex-security: encryption

Hello, I am trying to enable encryption for our product which is based on a verdin-imx8mp module. I got secure boot working with the meta-toradex-security layer with the inheritance of tdxref-signed which provides me an extended chain of trust (ECoT). The next step we want to take is to encrypt the signed (read-only) root filesystem, and later on we want to encrypt a separate data partition. In the meta-toradex-security layer I have read the page: https://github.com/toradex/meta-toradex-securi…

Load kernel from rootfs /boot folder

I am setting up dual copy update with Yocto/SWUpdate. I have modified the “image.json” to create two rootfs partitions and I have configured Yocto to include the kernel and device tree related files in the /boot folder of each rootfs. But, I do not see how to configure the “u-boot-initial-env-sd” file to load the kernel from the rootfs partitions rather than the bootfs partition. Any help will be appreciated. tdx-info Software summary Bootloader: U-Boot Kernel version: …

Automount overlay for /etc.