Re: [yocto] FIT image verification not working on imx8mm

[Michael Opdenacker <michael.opdenacker@rootcommit.com>]

Hi Francesco, Quentin,

Thanks again for your help with this issue!

Some updates...

On 2/24/26 7:06 PM, Michael Opdenacker wrote:
> Hi Francesco
>
> Thanks for having a look at this issue and the corresponding code, 
> much appreciated!
>
> On 2/22/26 11:33 PM, Francesco Valla wrote:
>>
>> If it is 1 (as it might be, as meta-freescale sets it to 1 for imx8m*
>> SoCs if the bootloader is not u-boot-imx [0]), the imx-boot container
>> is generated by U-Boot using binman, which however iis / should not be
>> able to use the u-boot.dtb binary with the signature. The injection of
>> the signature in fact happens on the u-boot.dtb binary only after this
>> has been deployed [1], which in this case would be *after* the imx-boot
>> blob has been generated.


What you found out really helped, and I ultimately found that I'm 
supported to use the meta-toradex-security layer [1] which addresses 
this need [2], along with other aspects of secure boot.

So, I tried to use its "main" branch together with the latest OE layers. 
However, it turns out that Toradex only maintains their 
"scarthgap-7.x.y" branch at the moment [3]. So, I'll switch back to my 
original project on Scarthgap. If I understood correctly, I will have to:

- Inherit the "tdx-signed" global class
- Add this to my U-Boot recipe:

require recipes-bsp/u-boot/u-boot-fit-signature.inc

See 
https://github.com/toradex/meta-toradex-security/blob/scarthgap-7.x.y/recipes-bsp/u-boot/u-boot-fit-signature.inc 
for details.

This also automatically adds the needed config options to U-Boot:
https://github.com/toradex/meta-toradex-security/blob/scarthgap-7.x.y/recipes-bsp/u-boot/files/fit-signature.cfg

This corresponds to what you suggested, Quentin :)

I'll keep you posted.
Thanks again
Michael.

[1] https://github.com/toradex/meta-toradex-security
[2] 
https://github.com/toradex/meta-toradex-security/blob/scarthgap-7.x.y/docs/README-secure-boot.md
[3] https://github.com/toradex/meta-toradex-security/pull/161

-- 
Root Commit
Embedded Linux Training and Consulting
https://rootcommit.com