topic Re: Request for Documentation on Encrypting SquashFS RootFS with Yocto for i.MX93 in i.MX Processors

Request for Documentation on Encrypting SquashFS RootFS with Yocto for i.MX93

udayMouli — Tue, 19 Aug 2025 16:20:37 GMT

I am trying to encrypt my squashfs rootfs for imx93 during build time. I am using yocto
i tried fetching below document but i am unable to
https://community.nxp.com/docs/DOC-342300
can you please help me to point to proper documentation related to encrypting squashfs of rootfs

Re: Request for Documentation on Encrypting SquashFS RootFS with Yocto for i.MX93

AldoG — Tue, 19 Aug 2025 20:22:53 GMT

Hello,

For this you may refer to the Linux Kernel documentation:

https://github.com/nxp-imx/linux-imx/tree/lf-6.12.y/Documentation/security/keys
https://github.com/nxp-imx/linux-imx/blob/lf-6.12.y/Documentation/security/keys/trusted-encrypted.rst
https://github.com/nxp-imx/linux-imx/blob/lf-6.12.y/Documentation/security/keys/ecryptfs.rst

Best regards/Saludos,
Aldo.

Re: Request for Documentation on Encrypting SquashFS RootFS with Yocto for i.MX93

AldoG — Tue, 19 Aug 2025 20:28:19 GMT

Hi,

I forgot to mention that you may also check our Linux documentation, i.MX Linux User's Guide Chapter 10 Security & 10.5.5 DM-Crypt usage on i.MX Platforms without CAAM hardware IP

Since i.MX93 does not have have CAAM hardware IP enabled.

Best regards/Saludos,
Aldo.

Re: Request for Documentation on Encrypting SquashFS RootFS with Yocto for i.MX93

udayMouli — Wed, 20 Aug 2025 02:43:42 GMT

I have reviewed section 10.5.5 and would like to implement a similar encryption approach. Our requirement is to encrypt the production-ready SquashFS image during build time in Yocto. However, using /dev/mapper is not feasible since it requires root privileges.
Is there any method or documentation available for integrating dm-crypt-based encryption directly into a Yocto recipe?

Re: Request for Documentation on Encrypting SquashFS RootFS with Yocto for i.MX93

AldoG — Thu, 21 Aug 2025 19:41:07 GMT

Hello,

We do not have documentation available for this, but you may use as a reference one of our partners implementation for this kind of use case:
https://github.com/toradex/meta-toradex-security/blob/kirkstone-6.x.y/docs/README-encryption.md

You may create the layer the same way they are using it, so it is indeed possible
https://github.com/toradex/meta-toradex-security/tree/kirkstone-6.x.y

Best regards/Saludos,
Aldo.