Hi, I’m the Toradex AI Assistant.
I might make mistakes or occasionally get you wrong. Our support team will step in if needed.
I understand you’re working with secure boot on iMX95 SoM using BSP 7.5.0. Let me address your questions about secure boot implementation without Torizon OS.
1. Device Reflashing After Fusing
Once a device is closed by burning the required fuses, the reflashing capabilities become significantly limited (1). As you correctly understand, Toradex Easy Installer (TEZI) will no longer work because it uses unsigned bootloaders (1).
For NXP devices like your iMX95, once the device is in the closed state, it will only run software signed with the key(s) associated with the programmed fuse values (1). This means:
- Electronic fuses can only be programmed once – the fusing operations cannot be undone (1)
- Once a device is closed, it will only run software signed with the matching keys (1)
- Standard TEZI cannot be used as it contains unsigned bootloaders (1)
For development purposes, you would need to create a signed version of any recovery/flashing tools you plan to use post-fusing.
2. Production Provisioning Without Torizon OS
For production fuse programming without Torizon OS and TorizonCore Builder, you have several options:
Manual U-Boot Console Method
The traditional approach involves burning eFuses via the U-Boot serial console as described in the meta-toradex-security documentation (1). However, this method requires console access and is generally more suitable for development and testing purposes.
Automated Fusing During Installation
While the documentation primarily focuses on Torizon OS implementations, the concept of embedding fuse values into the installation process can be adapted (1). The approach involves:
- Embedding the desired fuse values into the U-Boot environment as part of your image
- Programming the fuses during the first boot of the OS
- Implementing safeguards to prevent bricking the device if errors are detected
Key Management Considerations
It’s critical to manage signing keys with care (1). If you lose the private keys you created to sign your images, you won’t be able to install or update software on devices that are closed (1). You should:
- Store keys in a safe and secure place
- Consider having one or more backups in physically different locations (1)
- For NXP iMX SoMs, you can burn 4 eFuse hashes, giving you effectively four valid signing keys (1)
Reference Implementation
The meta-toradex-security layer provides the foundational implementation for secure boot on Toradex hardware (1). For your BSP-based approach, you would need to:
- Use the
tdx-signed class for BCoT (Boot Chain of Trust) coverage (1)
- Configure HAB/AHAB support as described in the meta-toradex-security documentation (1)
- Implement your own fusing mechanism based on the patterns shown in the Torizon OS implementation
The specific fuse programming commands and procedures would be similar to those generated by the Yocto build process, which creates a fuse-cmds.txt file containing the necessary U-Boot commands (2).
Important Note: Since you’re working with iMX95, ensure you’re following the appropriate procedures for AHAB-based devices rather than HABv4 procedures (1).
Best regards, Toradex AI Assistant.
Did you like my answer? 
If I answered your question, please tick the “Solution” checkbox.
For follow-up questions to me, please use @ToradexAI in your post.
