Hi @Srimoki,
During my tests, I tried creating a new partition called mmcblk2p3, but it failed (as shown in the earlier logs) unless I removed the secure boot config from local.conf. Once I did that, everything worked as expected, and I was able to modify mmcblk2p2 or create a new mmcblk2p3 without any issues.
Just to clarify are you creating this mmcblk2p3 partition manually? In your most recent configuration you shared I didn’t see any mention of a mmcblk2p3. Could you describe in more detail how exactly how you are creating this new partition?
On my side if I create a partition via tdx-tezi-data-partition then everything works as expected. For reference I have the following config:
INHERIT += "tdx-signed"
TDX_IMX_HAB_CST_DIR = "/workdir/torizon/layers/cst"
INHERIT += "tdx-tezi-data-partition tdx-encrypted"
TDX_ENC_STORAGE_LOCATION = "/dev/mmcblk2p2"
The resulting image has the expected mmcblk2p2 partition and the tdx-enc-handler was succesful:
torizon@verdin-imx8mp-06849059:~$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 1 29.1G 0 disk
`-sda1 8:1 1 29.1G 0 part /var/rootdirs/media/COSTCO_USB
mmcblk2 179:0 0 14.8G 0 disk
|-mmcblk2p1 179:1 0 7.4G 0 part /var
| /usr
| /boot
| /
| /sysroot
`-mmcblk2p2 179:2 0 7.4G 0 part
`-encdata 251:0 0 7.4G 0 dm /run/encdata
mmcblk2boot0 179:32 0 31.5M 1 disk
mmcblk2boot1 179:64 0 31.5M 1 disk
zram0 253:0 0 0B 0 disk
torizon@verdin-imx8mp-06849059:~$ journalctl -f -u tdx-enc-handler.service
Jan 24 00:26:30 verdin-imx8mp-06849059 tdx-enc.sh[472]: Tables present: LIVE
Jan 24 00:26:30 verdin-imx8mp-06849059 tdx-enc.sh[472]: Open count: 0
Jan 24 00:26:30 verdin-imx8mp-06849059 tdx-enc.sh[472]: Event number: 0
Jan 24 00:26:30 verdin-imx8mp-06849059 tdx-enc.sh[472]: Major, minor: 251, 0
Jan 24 00:26:30 verdin-imx8mp-06849059 tdx-enc.sh[472]: Number of targets: 1
Jan 24 00:26:30 verdin-imx8mp-06849059 tdx-enc.sh[453]: caam: Mounting encrypted partition...
Jan 24 00:26:30 verdin-imx8mp-06849059 tdx-enc.sh[490]: /dev/mapper/encdata: UUID="2c4f97ea-3ecc-4be5-a6e6-5589f4c8f6a4" BLOCK_SIZE="4096" TYPE="ext4"
Jan 24 00:26:31 verdin-imx8mp-06849059 tdx-enc.sh[453]: caam: Data preservation is not enabled
Jan 24 00:26:31 verdin-imx8mp-06849059 tdx-enc.sh[453]: caam: Success!
Jan 24 00:26:31 verdin-imx8mp-06849059 systemd[1]: Finished Encryption handler for Toradex modules.
I’ll need more info about how you’re creating this mmcblk2p3 partition so I can try to recreate/investigate further.
Is there a way to include specific files in the encrypted partition during the Yocto build process?
There might be a path here you can try with Toradex Easy Installer. As you know our Easy Installer tool is our main method of flashing software to our modules. If you look in the folder that is used for installation you should see an image.json file. This is the configuration file that tells Easy Installer how to flash the eMMC of the module. Here’s a snippet of the file:
"blockdevs": [
{
"name": "emmc",
"partitions": [
{
"partition_size_nominal": "512",
"want_maximised": true,
"content": {
"label": "otaroot",
"filesystem_type": "ext4",
"mkfs_options": "-E nodiscard",
"filename": "torizon-docker-verdin-imx8mp.ota.tar.zst",
"uncompressed_size": 669.9140625
}
},
{
"partition_size_nominal": "512",
"partition_type": "83",
"want_maximised": true,
"content": {
"label": "DATA",
"filesystem_type": "ext4",
"mkfs_options": "-E nodiscard",
"filename": ""
}
}
]
},
You can see here this is creating 2 partitions in eMMC one is for the main rootfs and the other is the data partition. The initial contents of each partition is dictated by the filename field. You can see the first partition will contain the contents of torizon-docker-verdin-imx8mp.ota.tar.zst, which contains the main root filesystem of the image. The 2nd partition has nothing for filename which is why there’s nothing in it at the start.
So if you populate this and provide a respective file/tar archive then the contents of that will be flashed to the extra data partition. In yocto you can populate this field via the TEZI_DATA_FILES variable: image_type_tezi.bbclass « classes - meta-toradex-bsp-common.git - Toradex BSP layer, recipes common to all modules
However, you still need a recipe of some kind to create the files/archive that you will be set to this variable. Then as @izzycoding suggested you’ll need to set TDX_ENC_PRESERVE_DATA to prevent your initial data from being deleted upon setup of the encrypted partition.
Best Regards,
Jeremias
.
.