FIT Image not working in U-Boot

[Freddie]

On Thu, Aug 17, 2023 at 2:19 PM Simon Glass <sjg at chromium.org> wrote:

> Hi Freddie,
>
> On Thu, 17 Aug 2023 at 07:02, Freddie <fpidev23 at gmail.com> wrote:
> >
> > Hi Simon,
> >
> > I'm quite new to this so sorry for asking so many questions but where do
> I run the 'dump_image -l' command and which code should I look into adding
> print statements to?
>
> One thing is to add your reply at the bottom, not the top.
>
> Actually it is 'dumpimage -l file.fit' to list the contents of your
> fit file called 'file.fit'.  The program is built in the tools/
> directory or your build, or you can
>
> I mean if you are completely stumped, go to where the error is
> generated and add lots of debugging around it. This is
> boot_get_kernel() which is in v2021.10 is in common/bootm.c - so just
> add lots of printf() stuff there, rebuild and run on the board and see
> if you can figure out what is wrong. From my side I am really not
> sure.
>
> Feel free to share the FIT through a link if you like.
>
> Also, you could try using a simple FIT without the signature part.
>
> >
> > I have also just looked into my .config file and this is the contents:
> >
> > #
> > # Automatically generated file; DO NOT EDIT.
> > # U-Boot 2021.10 Configuration
> > #
> >
> [..]
>
> > #
> > # Boot images
> > #
> > # CONFIG_ANDROID_BOOT_IMAGE is not set
> > CONFIG_FIT=y
> > CONFIG_FIT_EXTERNAL_OFFSET=0x0
> > CONFIG_FIT_FULL_CHECK=y
> > CONFIG_FIT_SIGNATURE=y
> > CONFIG_FIT_SIGNATURE_MAX_SIZE=0x10000000
> > # CONFIG_FIT_RSASSA_PSS is not set
> > # CONFIG_FIT_CIPHER is not set
> > # CONFIG_FIT_VERBOSE is not set
> > # CONFIG_FIT_BEST_MATCH is not set
> > CONFIG_FIT_PRINT=y
> > # CONFIG_LEGACY_IMAGE_FORMAT is not set
> > CONFIG_SUPPORT_RAW_INITRD=y
> > CONFIG_OF_BOARD_SETUP=y
> > # CONFIG_OF_SYSTEM_SETUP is not set
> > # CONFIG_OF_STDOUT_VIA_ALIAS is not set
> > CONFIG_SYS_EXTRA_OPTIONS=""
> > CONFIG_HAVE_SYS_TEXT_BASE=y
> > CONFIG_ARCH_FIXUP_FDT_MEMORY=y
> > # CONFIG_CHROMEOS is not set
> > # CONFIG_CHROMEOS_VBOOT is not set
> >
> [..]
>
> This has CONFIG_FIT and CONFIG_LEGACY_IMAGE_FORMAT is disabled (since
> you have signature verification on).
>
> Regards,
> Simon
>

Hi Simon,

Thank you for your advice, I'll make sure to reply at the bottom of the
message from now on.

I've run the dumpimage command and this was my output:
root at freddie-pi-dev:/home/fit# ../optee/u-boot/tools/dumpimage -l image.fit
FIT description: RPi FIT Image
Created:         Thu Aug  3 15:47:15 2023
 Image 0 (kernel-1)
  Description:  default kernel
  Created:      Thu Aug  3 15:47:15 2023
  Type:         Kernel Image
  Compression:  uncompressed
  Data Size:    20869632 Bytes = 20380.50 KiB = 19.90 MiB
  Architecture: AArch64
  OS:           Linux
  Load Address: 0x12000000
  Entry Point:  0x12000000
  Hash algo:    sha1
  Hash value:   08d43ed37129fa26e0f5f9d303a211b708c66783
 Image 1 (tee-1)
  Description:  atf
  Created:      Thu Aug  3 15:47:15 2023
  Type:         Standalone Program
  Compression:  uncompressed
  Data Size:    1257464 Bytes = 1227.99 KiB = 1.20 MiB
  Architecture: AArch64
  Load Address: 0x08400000
  Entry Point:  0x08400000
  Hash algo:    sha1
  Hash value:   4907d9c33098b2767cd6bc4bc9836f2f913464c7
 Image 2 (fdt-1)
  Description:  device tree
  Created:      Thu Aug  3 15:47:15 2023
  Type:         Flat Device Tree
  Compression:  uncompressed
  Data Size:    32501 Bytes = 31.74 KiB = 0.03 MiB
  Architecture: AArch64
  Load Address: 0x01000000
  Hash algo:    sha1
  Hash value:   1b5bb266752cb247d89245c63bd041acfa34c7c0
 Default Configuration: 'config-1'
 Configuration 0 (config-1)
  Description:  default configuration
  Kernel:       kernel-1
  FDT:          fdt-1
  Loadables:    tee-1
  Sign algo:    sha1,rsa2048:dev
  Sign value:
22cd61395ae659917626ef88ebf82429d6d592a7975cf48eb1e301f81c8f2a9ae60e203e283b8800971b72cd1b6bf93fb4f5f54d9bc4fb0f49ae0e48115ff087d8638f8080fdc9f72fbfdd2228d60dba33849a75dba6958a134eefb9441b43f6f8319b7885c052c7993a7c791fe0acc577a629b04630060f02e24e82f9e5c8851c0df3d63da45ee5daeeabe198b990c2b8cbe24834763df299d8ed5a25cb90818caa23676e764d4d6e91e852451c1dae8a2946b9741e637b7556b6ebf27fa9e0ad5252909d13da67179b40f5097cc29c4ac1539c0fb89b567e8ee2d56ef92707d2a9d82a090d35c66cf23e8e66e5c8da5e197ec4a0dd771ef4a3246f6f499850
  Timestamp:    Thu Aug  3 15:47:15 2023


I have tried to use an unsigned FIT before, but I also ran into the same
error. In this case, do I simply disable the signature parts of the config,
enable the legacy image format option and make the new image without any of
the signing or are there other changes as well?

Where would be an appropriate place to upload my FIT file to in order to
share a link?

Many thanks,
Freddie