FIT Image not working in U-Boot
Freddie
fpidev23 at gmail.com
Wed Aug 16 11:27:53 CEST 2023
Hi,
I am trying to attempt to build a verified boot solution using Flattened
Image Trees on a Raspberry Pi 3B +
I have looked at a couple of guides online about how to do this, however
they seem quite out of date and it hasn't worked.
The two main guides I have looked at:
#3066 <https://github.com/OP-TEE/optee_os/issues/3066>
https://github.com/NVISOsecurity/VerifiedBootRPi3/blob/master/instructions.md
I initially tried building a standard system following the instructions on
the official OP-TEE documentation, which worked. However I have not been
able to boot from a FIT file.
I have very closely followed the instructions from the first link above,
but no matter what I have changed so far, I get the error:
Wrong Image Format for bootm command
ERROR: can't get kernel image!
This error occurs both when trying to autoboot and when trying to manually
boot (using fatload and bootm in the command line).
I have tried for around 2-3 weeks to attempt to solve this error, so I
would really appreciate any advice or suggestions.
I have tried both signed and unsigned FIT images and neither of them have
worked.
I have included the contents of my image.its, uboot.env.txt,
rpi_3_defconfig and rpi.h files below as well as the logs from when I try
and boot my system, please let me know if there is any other information
that could help with solving this.
/fit/image.its:
/ {
description = "RPi FIT Image";
#address-cells = <1>;
images {
kernel-1 {
description = "default kernel";
data = /incbin/("kernel8.img");
type = "kernel";
arch = "arm64";
os = "linux";
compression = "none";
load = <0x12000000>;
entry = <0x12000000>;
hash-1 {
algo = "sha1";
};
};
tee-1 {
description = "atf";
data = /incbin/("armstub8.bin");
type = "standalone";
arch = "arm64";
compression = "none";
load = <0x08400000>;
entry = <0x08400000>;
hash-1 {
algo = "sha1";
};
};
fdt-1 {
description = "device tree";
data = /incbin/("bcm2710-rpi-3-b-plus.dtb");
type = "flat_dt";
arch = "arm64";
compression = "none";
load = <0x01000000>;
entry = <0x01000000>;
hash-1 {
algo = "sha1";
};
};
};
configurations {
default = "config-1";
config-1 {
description = "default configuration";
kernel = "kernel-1";
loadables = "tee-1";
fdt = "fdt-1";
signature-1 {
algo = "sha1,rsa2048";
key-name-hint = "dev";
sign-images = "fdt", "kernel", "loadables";
};
};
};
};
/optee/u-boot/configs/RPI_3_DEFCONFIG:
CONFIG_ARM=y
CONFIG_ARCH_CPU_INIT=y
CONFIG_ARCH_BCM283X=y
CONFIG_SYS_TEXT_BASE=0x00080000
CONFIG_TARGET_RPI_3=y
CONFIG_SYS_MALLOC_F_LEN=0x2000
CONFIG_NR_DRAM_BANKS=1
CONFIG_ENV_SIZE=0x4000
CONFIG_DISTRO_DEFAULTS=y
CONFIG_OF_BOARD_SETUP=y
CONFIG_USE_PREBOOT=y
# CONFIG_DISPLAY_CPUINFO is not set
CONFIG_DEFAULT_DEVICE_TREE="bcm2837-rpi-3-b-plus"
CONFIG_OF_CONTROL=y
CONFIG_FIT=y
CONFIG_FIT_SIGNATURE=y
CONFIG_RSA=y
CONFIG_FIT_VERBOSE=y
CONFIG_OF_LIBFDT=y
# CONFIG_DISPLAY_BOARDINFO is not set
CONFIG_MISC_INIT_R=y
CONFIG_SYS_PROMPT="U-Boot> "
CONFIG_CMD_GPIO=y
CONFIG_CMD_MMC=y
CONFIG_CMD_USB=y
CONFIG_CMD_FS_UUID=y
CONFIG_OF_EMBED=y
CONFIG_ENV_FAT_DEVICE_AND_PART="0:1"
CONFIG_SYS_RELOC_GD_ENV_ADDR=y
CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
CONFIG_TFTP_TSIZE=y
CONFIG_MMC_SDHCI=y
CONFIG_MMC_SDHCI_BCM2835=y
CONFIG_PHYLIB=yONFIG_ARM=y
CONFIG_ARCH_CPU_INIT=y
CONFIG_ARCH_BCM283X=y
CONFIG_SYS_TEXT_BASE=0x00080000
CONFIG_TARGET_RPI_3=y
CONFIG_SYS_MALLOC_F_LEN=0x2000
CONFIG_NR_DRAM_BANKS=1
CONFIG_ENV_SIZE=0x4000
CONFIG_DISTRO_DEFAULTS=y
CONFIG_OF_BOARD_SETUP=y
CONFIG_USE_PREBOOT=y`
CONFIG_DM_ETH=y
CONFIG_PINCTRL=y
# CONFIG_PINCTRL_GENERIC is not set
# CONFIG_REQUIRE_SERIAL_CONSOLE is not set
CONFIG_SYSINFO=y
CONFIG_SYSINFO_SMBIOS=y
CONFIG_USB=y
CONFIG_USB_DWC2=y
CONFIG_USB_KEYBOARD=y
CONFIG_USB_HOST_ETHER=y
CONFIG_USB_ETHER_LAN78XX=y
CONFIG_USB_ETHER_SMSC95XX=y
CONFIG_DM_VIDEO=y
# CONFIG_VIDEO_BPP8 is not set
# CONFIG_VIDEO_BPP16 is not set
CONFIG_SYS_WHITE_ON_BLACK=y
CONFIG_CONSOLE_SCROLL_LINES=10
CONFIG_PHYS_TO_BUS=y
CONFIG_OF_LIBFDT_OVERLAY=y
/optee/build/rpi3/firmware/uboot.env.txt:
# generic params
bootdelay=3
stderr=serial,lcd
stdin=serial,usbkbd
stdout=serial,lcd
# CPU config
cpu=armv8
smp=on
# Console config
baudrate=115200
sttyconsole=ttyS0
ttyconsole=tty0
# Kernel/dtb filenames & load addresses
boot_fit=bootm ${fit_addr}
fdt_addr_r=0x01000000
fit_addr=0x02000000
fdtfile=bcm2710-rpi-3-b-plus.dtb
load_fit=fatload mmc 0:1 ${fit_addr} image.itb
mmcboot=run load_fit; run set_bootargs_tty set_bootargs_mmc
set_common_args; run boot_fit
# NFS/TFTP boot configuraton
gatewayip=192.168.1.1
netmask=255.255.255.0
nfsserverip=192.168.1.100
nfspath=/srv/nfs/rpi
# bootcmd & bootargs configuration
preboot=usb start
bootcmd=run mmcboot
nfsboot=run load_kernel; run set_bootargs_tty set_bootargs_nfs
set_common_args; run boot_it
set_bootargs_tty=setenv bootargs console=${ttyconsole}
console=${sttyconsole},${baudrate}
set_bootargs_nfs=setenv bootargs ${bootargs} root=/dev/nfs rw
rootfstype=nfs nfsroot=${nfsserverip}:${nfspath},udp,vers=3 ip=dhcp
set_bootargs_mmc=setenv bootargs ${bootargs} root=/dev/mmcblk0p2 rw rootfs=ext4
set_common_args=setenv bootargs ${bootargs}
smsc95xx.macaddr=${ethaddr} 'ignore_loglevel dma.dmachans=0x7f35
rootwait 8250.nr_uarts=1 elevator=deadline fsck.repair=yes
bcm2708_fb.fbwidth=1920 bcm2708_fb.fbheight=1080
vc_mem.mem_base=0x3ec00000 vc_mem.mem_size=0x40000000
dwc_otg.fiq_enable=0 dwc_otg.fiq_fsm_enable=0 dwc_otg.nak_holdoff=0'
/optee/u-boot/include/configs/rpi.h:
/* SPDX-License-Identifier: GPL-2.0 */
/*
* (C) Copyright 2012-2016 Stephen Warren
*/
#ifndef __CONFIG_H
#define __CONFIG_H
#include <linux/sizes.h>
#include <asm/arch/timer.h>
#ifndef __ASSEMBLY__
#include <asm/arch/base.h>
#endif
#if defined(CONFIG_TARGET_RPI_2) || defined(CONFIG_TARGET_RPI_3_32B)
#define CONFIG_SKIP_LOWLEVEL_INIT
#endif
/* Architecture, CPU, etc.*/
/* Use SoC timer for AArch32, but architected timer for AArch64 */
#ifndef CONFIG_ARM64
#define CONFIG_SYS_TIMER_RATE 1000000
#define CONFIG_SYS_TIMER_COUNTER \
(&((struct bcm2835_timer_regs *)BCM2835_TIMER_PHYSADDR)->clo)
#endif
/*
* 2835 is a SKU in a series for which the 27```08 is the first or primary SoC,
* so 2708 has historically been used rather than a dedicated 2835 ID.
*
* We don't define a machine type for bcm2709/bcm2836 since the RPi Foundation
* chose to use someone else's previously registered machine ID (3139, MX51_GGC)
* rather than obtaining a valid ID:-/
*
* For the bcm2837, hopefully a machine type is not needed, since everything
* is DT.
*/
#ifdef CONFIG_BCM2835
#define CONFIG_MACH_TYPE MACH_TYPE_BCM2708
#endif
/* Memory layout */
#define CONFIG_SYS_SDRAM_BASE 0x00000000
#define CONFIG_SYS_UBOOT_BASE CONFIG_SYS_TEXT_BASE
/*
* The board really has 256M. However, the VC (VideoCore co-processor) shares
* the RAM, and uses a configurable portion at the top. We tell U-Boot that a
* smaller amount of RAM is present in order to avoid stomping on the area
* the VC uses.
*/
#define CONFIG_SYS_SDRAM_SIZE SZ_128M
#define CONFIG_SYS_INIT_SP_ADDR (CONFIG_SYS_SDRAM_BASE + \
CONFIG_SYS_SDRAM_SIZE - \
GENERATED_GBL_DATA_SIZE)
#define CONFIG_SYS_MALLOC_LEN SZ_4M
#define CONFIG_LOADADDR 0x00200000
#ifdef CONFIG_ARM64
#endif
/* Devices */
/* GPIO */
#define CONFIG_BCM2835_GPIO
/* LCD */
#define CONFIG_LCD_DT_SIMPLEFB
#define CONFIG_VIDEO_BCM2835
/* DFU over USB/UDC */
#ifdef CONFIG_CMD_DFU
#ifdef CONFIG_ARM64
#define KERNEL_FILENAME "Image"
#else
#define KERNEL_FILENAME "zImage"
#endif
#define ENV_DFU_SETTINGS \
"dfu_alt_info=u-boot.bin fat 0 1;uboot.env fat 0 1;" \
"config.txt fat 0 1;" \
KERNEL_FILENAME " fat 0 1\0"
#else
#define ENV_DFU_SETTINGS ""
#endif
/* Console configuration */
#define CONFIG_SYS_CBSIZE 1024
/* Environment */
#define CONFIG_SYS_LOAD_ADDR 0x1000000
/* Shell */
/* ATAGs support for bootm/bootz */
#define CONFIG_SETUP_MEMORY_TAGS
#define CONFIG_CMDLINE_TAG
#define CONFIG_INITRD_TAG
#define CONFIG_SYS_BOOTM_LEN (16 << 20)
/* Environment */
#define ENV_DEVICE_SETTINGS \
"stdin=serial,usbkbd\0" \
"stdout=serial,vidconsole\0" \
"stderr=serial,vidconsole\0"
#ifdef CONFIG_ARM64
#define FDT_HIGH "ffffffffffffffff"
#define INITRD_HIGH "ffffffffffffffff"
#else
#define FDT_HIGH "ffffffff"
#define INITRD_HIGH "ffffffff"
#endif
/*
* Memory layout for where various images get loaded by boot scripts:
*
* I suspect address 0 is used as the SMP pen on the RPi2, so avoid this.
*
* Older versions of the boot firmware place the firmware-loaded DTB at 0x100,
* newer versions place it in high memory. So prevent U-Boot from doing its own
* DTB + initrd relocation so that we won't accidentally relocate the initrd
* over the firmware-loaded DTB and generally try to lay out things starting
* from the bottom of RAM.
*
* kernel_addr_r has different constraints on ARM and Aarch64. For 32-bit ARM,
* it must be within the first 128M of RAM in order for the kernel's
* CONFIG_AUTO_ZRELADDR option to work. The kernel itself will be decompressed
* to 0x8000 but the decompressor clobbers 0x4000-0x8000 as well. The
* decompressor also likes to relocate itself to right past the end of the
* decompressed kernel, so in total the sum of the compressed and and
* decompressed kernel needs to be reserved.
*
* For Aarch64, the kernel image is uncompressed and must be loaded at
* text_offset bytes (specified in the header of the Image) into a 2MB
* boundary. The 'booti' command relocates the image if necessary. Linux uses
* a default text_offset of 0x80000. In summary, loading at 0x80000
* satisfies all these constraints and reserving memory up to 0x02400000
* permits fairly large (roughly 36M) kernels.
*
* scriptaddr and pxefile_addr_r can be pretty much anywhere that doesn't
* conflict with something else. Reserving 1M for each of them at
* 0x02400000-0x02500000 and 0x02500000-0x02600000 should be plenty.
*
* On ARM, both the DTB and any possible initrd must be loaded such that they
* fit inside the lowmem mapping in Linux. In practice, this usually means not
* more than ~700M away from the start of the kernel image but this number can
* be larger OR smaller depending on e.g. the 'vmalloc=xxxM' command line
* parameter given to the kernel. So reserving memory from low to high
* satisfies this constraint again. Reserving 1M at 0x02600000-0x02700000 for
* the DTB leaves rest of the free RAM to the initrd starting at 0x02700000.
* Even with the smallest possible CPU-GPU memory split of the CPU getting
* only 64M, the remaining 25M starting at 0x02700000 should allow quite
* large initrds before they start colliding with U-Boot.
*/
#define ENV_MEM_LAYOUT_SETTINGS \
"fdt_high=" FDT_HIGH "\0" \
"initrd_high=" INITRD_HIGH "\0" \
"kernel_addr_r=0x00080000\0" \
"scriptaddr=0x02400000\0" \
"pxefile_addr_r=0x02500000\0" \
"fdt_addr_r=0x02600000\0" \
"ramdisk_addr_r=0x02700000\0"
#if CONFIG_IS_ENABLED(CMD_MMC)
#define BOOT_TARGET_MMC(func) \
func(MMC, mmc, 0) \
func(MMC, mmc, 1)
#else
#define BOOT_TARGET_MMC(func)
#endif
#if CONFIG_IS_ENABLED(CMD_USB)
#define BOOT_TARGET_USB(func) func(USB, usb, 0)
#else
#define BOOT_TARGET_USB(func)
#endif
#if CONFIG_IS_ENABLED(CMD_PXE)
#define BOOT_TARGET_PXE(func) func(PXE, pxe, na)
#else
#define BOOT_TARGET_PXE(func)
#endif
#if CONFIG_IS_ENABLED(CMD_DHCP)
#define BOOT_TARGET_DHCP(func) func(DHCP, dhcp, na)
#else
#define BOOT_TARGET_DHCP(func)
#endif
#define BOOT_TARGET_DEVICES(func) \
BOOT_TARGET_MMC(func) \
BOOT_TARGET_USB(func) \
BOOT_TARGET_PXE(func) \
BOOT_TARGET_DHCP(func)
#include <config_distro_bootcmd.h>
#define CONFIG_EXTRA_ENV_SETTINGS \
"dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \
ENV_DEVICE_SETTINGS \
ENV_DFU_SETTINGS \
ENV_MEM_LAYOUT_SETTINGS \
BOOTENV
#endif
* Boot Logs:*
NOTICE: Booting Trusted Firmware
NOTICE: BL1: v2.6(debug):v2.6
NOTICE: BL1: Built : 13:06:25, Aug 3 2023
INFO: BL1: RAM 0x100ee000 - 0x100f7000
INFO: BL1: cortex_a53: CPU workaround for 843419 was applied
INFO: BL1: cortex_a53: CPU workaround for 855873 was applied
WARNING: BL1: cortex_a53: CPU workaround for 1530924 was missing!
NOTICE: rpi3: Detected: Raspberry Pi 3 Model B+ (1GB, Sony, UK) [0x00a020d3]
INFO: BL1: Loading BL2
INFO: Loading image id=1 at address 0x100b4000
INFO: Image id=1 loaded: 0x100b4000 - 0x100bc419
NOTICE: BL1: Booting BL2
INFO: Entry point address = 0x100b4000
INFO: SPSR = 0x3c5
NOTICE: BL2: v2.6(debug):v2.6
NOTICE: BL2: Built : 13:06:25, Aug 3 2023
INFO: BL2: Doing platform setup
INFO: BL2: Loading image id 3
INFO: Loading image id=3 at address 0x100e0000
INFO: Image id=3 loaded: 0x100e0000 - 0x100ea073
INFO: BL2: Loading image id 4
INFO: Loading image id=4 at address 0x10100000
INFO: Image id=4 loaded: 0x10100000 - 0x1010001c
INFO: OPTEE ep=0x10100000
INFO: OPTEE header info:
INFO: magic=0x4554504f
INFO: version=0x2
INFO: arch=0x1
INFO: flags=0x0
INFO: nb_images=0x1
INFO: BL2: Loading image id 21
INFO: Loading image id=21 at address 0x10100000
INFO: Image id=21 loaded: 0x10100000 - 0x1017be98
INFO: BL2: Skip loading image id 22
INFO: BL2: Loading image id 5
INFO: Loading image id=5 at address 0x11000000
INFO: Image id=5 loaded: 0x11000000 - 0x11084b90
NOTICE: BL1: Booting BL31
INFO: Entry point address = 0x100e0000
INFO: SPSR = 0x3cd
NOTICE: BL31: v2.6(debug):v2.6
NOTICE: BL31: Built : 13:06:26, Aug 3 2023
INFO: rpi3: Checking DTB...
INFO: BL31: Initializing runtime services
INFO: BL31: cortex_a53: CPU workaround for 843419 was applied
INFO: BL31: cortex_a53: CPU workaround for 855873 was applied
WARNING: BL31: cortex_a53: CPU workaround for 1530924 was missing!
INFO: BL31: Initializing BL32
D/TC:0 plat_get_aslr_seed:118 Warning: no ASLR seed
D/TC:0 add_phys_mem:665 VCORE_UNPG_RX_PA type TEE_RAM_RX 0x10100000
size 0x00078000
D/TC:0 add_phys_mem:665 VCORE_UNPG_RW_PA type TEE_RAM_RW 0x10178000
size 0x00688000
D/TC:0 add_phys_mem:665 ta_base type TA_RAM 0x10800000 size 0x00800000
D/TC:0 add_phys_mem:665 CONSOLE_UART_BASE type IO_NSEC 0x3f200000
size 0x00200000
D/TC:0 add_phys_mem:665 TEE_SHMEM_START type NSEC_SHM 0x08000000
size 0x00400000
D/TC:0 add_va_space:705 type RES_VASPACE size 0x00a00000
D/TC:0 add_va_space:705 type SHM_VASPACE size 0x02000000
D/TC:0 dump_mmap_table:831 type TEE_RAM_RX va
0x10100000..0x10177fff pa 0x10100000..0x10177fff size 0x00078000
(smallpg)
D/TC:0 dump_mmap_table:831 type TEE_RAM_RW va
0x10178000..0x107fffff pa 0x10178000..0x107fffff size 0x00688000
(smallpg)
D/TC:0 dump_mmap_table:831 type RES_VASPACE va
0x10800000..0x111fffff pa 0x00000000..0x009fffff size 0x00a00000
(pgdir)
D/TC:0 dump_mmap_table:831 type SHM_VASPACE va
0x11200000..0x131fffff pa 0x00000000..0x01ffffff size 0x02000000
(pgdir)
D/TC:0 dump_mmap_table:831 type NSEC_SHM va
0x13200000..0x135fffff pa 0x08000000..0x083fffff size 0x00400000
(pgdir)
D/TC:0 dump_mmap_table:831 type TA_RAM va
0x13600000..0x13dfffff pa 0x10800000..0x10ffffff size 0x00800000
(pgdir)
D/TC:0 dump_mmap_table:831 type IO_NSEC va
0x13e00000..0x13ffffff pa 0x3f200000..0x3f3fffff size 0x00200000
(pgdir)
D/TC:0 core_mmu_xlat_table_alloc:526 xlat tables used 1 / 8
D/TC:0 core_mmu_xlat_table_alloc:526 xlat tables used 2 / 8
I/TC:
I/TC: OP-TEE version: 3.22.0 (gcc version 11.3.1 20220712 (Arm GNU
Toolchain 11.3.Rel1)) #1 Thu Aug 3 11:35:50 UTC 2023 aarch64
I/TC: WARNING: This OP-TEE configuration might be insecure!
I/TC: WARNING: Please check
https://optee.readthedocs.io/en/latest/architecture/porting_guidelines.html
I/TC: Primary CPU initializing
D/TC:0 0 boot_init_primary_late:1478 Executing at offset 0 with
virtual load address 0x10100000
D/TC:0 0 call_preinitcalls:21 level 2 mobj_mapped_shm_init()
D/TC:0 0 mobj_mapped_shm_init:470 Shared memory address range:
11200000, 13200000
D/TC:0 0 call_initcalls:40 level 1 register_time_source()
D/TC:0 0 call_initcalls:40 level 1 teecore_init_pub_ram()
D/TC:0 0 call_initcalls:40 level 3 check_ta_store()
D/TC:0 0 check_ta_store:417 TA store: "early TA"
D/TC:0 0 check_ta_store:417 TA store: "Secure Storage TA"
D/TC:0 0 check_ta_store:417 TA store: "REE"
D/TC:0 0 call_initcalls:40 level 3 early_ta_init()
D/TC:0 0 early_ta_init:56 Early TA
f04a0fe7-1f5d-4b9b-abf7-619b85b4ce8c size 47637 (compressed,
uncompressed 109256)
D/TC:0 0 call_initcalls:40 level 3 verify_pseudo_tas_conformance()
D/TC:0 0 call_initcalls:40 level 3 tee_cryp_init()
D/TC:0 0 call_initcalls:40 level 4 tee_fs_init_key_manager()
D/TC:0 0 call_initcalls:40 level 6 mobj_init()
D/TC:0 0 call_initcalls:40 level 6 default_mobj_init()
D/TC:0 0 call_initcalls:40 level 6 ftmn_boot_tests()
D/TC:0 0 ftmn_boot_tests:198 Calling simple_call()
D/TC:0 0 ftmn_boot_tests:198 Return from simple_call()
D/TC:0 0 ftmn_boot_tests:199 Calling two_level_call()
D/TC:0 0 ftmn_boot_tests:199 Return from two_level_call()
D/TC:0 0 ftmn_boot_tests:200 Calling chained_calls()
D/TC:0 0 ftmn_boot_tests:200 Return from chained_calls()
D/TC:0 0 ftmn_boot_tests:202 *************************************************
D/TC:0 0 ftmn_boot_tests:203 ************** Tests complete *****************
D/TC:0 0 ftmn_boot_tests:204 *************************************************
I/TC: Primary CPU switching to normal world boot
INFO: BL31: Preparing for EL3 exit to normal world
INFO: Entry point address = 0x11000000
INFO: SPSR = 0x3c9
U-Boot 2021.10 (Aug 03 2023 - 13:51:18 +0100)
DRAM: 948 MiB
RPI 3 Model B+ (0xa020d3)
MMC: mmc at 7e202000: 0, sdhci at 7e300000: 1
Loading Environment from FAT... OK
In: serial
Out: serial
Err: serial
Net: No ethernet found.
starting USB...
Bus usb at 7e980000: USB DWC2
scanning bus usb at 7e980000 for devices...
Error: lan78xx_eth address not set.
3 USB Device(s) found
scanning usb for storage devices... 0 Storage Device(s) found
Hit any key to stop autoboot: 3 ��� 2 ��� 1 ��� 0
22161708 bytes read in 920 ms (23 MiB/s)
Wrong Image Format for bootm command
ERROR: can't get kernel image!
U-Boot>
More information about the U-Boot
mailing list