FIT Image not working in U-Boot

[Simon Glass]

Hi Freddie,

On Thu, 17 Aug 2023 at 07:39, Freddie <fpidev23 at gmail.com> wrote:
>
>
>
> On Thu, Aug 17, 2023 at 2:19 PM Simon Glass <sjg at chromium.org> wrote:
>>
>> Hi Freddie,
>>
>> On Thu, 17 Aug 2023 at 07:02, Freddie <fpidev23 at gmail.com> wrote:
>> >
>> > Hi Simon,
>> >
>> > I'm quite new to this so sorry for asking so many questions but where do I run the 'dump_image -l' command and which code should I look into adding print statements to?
>>
>> One thing is to add your reply at the bottom, not the top.
>>
>> Actually it is 'dumpimage -l file.fit' to list the contents of your
>> fit file called 'file.fit'.  The program is built in the tools/
>> directory or your build, or you can
>>
>> I mean if you are completely stumped, go to where the error is
>> generated and add lots of debugging around it. This is
>> boot_get_kernel() which is in v2021.10 is in common/bootm.c - so just
>> add lots of printf() stuff there, rebuild and run on the board and see
>> if you can figure out what is wrong. From my side I am really not
>> sure.
>>
>> Feel free to share the FIT through a link if you like.
>>
>> Also, you could try using a simple FIT without the signature part.
>>
>> >
>> > I have also just looked into my .config file and this is the contents:
>> >
>> > #
>> > # Automatically generated file; DO NOT EDIT.
>> > # U-Boot 2021.10 Configuration
>> > #
>> >
>> [..]
>>
>> > #
>> > # Boot images
>> > #
>> > # CONFIG_ANDROID_BOOT_IMAGE is not set
>> > CONFIG_FIT=y
>> > CONFIG_FIT_EXTERNAL_OFFSET=0x0
>> > CONFIG_FIT_FULL_CHECK=y
>> > CONFIG_FIT_SIGNATURE=y
>> > CONFIG_FIT_SIGNATURE_MAX_SIZE=0x10000000
>> > # CONFIG_FIT_RSASSA_PSS is not set
>> > # CONFIG_FIT_CIPHER is not set
>> > # CONFIG_FIT_VERBOSE is not set
>> > # CONFIG_FIT_BEST_MATCH is not set
>> > CONFIG_FIT_PRINT=y
>> > # CONFIG_LEGACY_IMAGE_FORMAT is not set
>> > CONFIG_SUPPORT_RAW_INITRD=y
>> > CONFIG_OF_BOARD_SETUP=y
>> > # CONFIG_OF_SYSTEM_SETUP is not set
>> > # CONFIG_OF_STDOUT_VIA_ALIAS is not set
>> > CONFIG_SYS_EXTRA_OPTIONS=""
>> > CONFIG_HAVE_SYS_TEXT_BASE=y
>> > CONFIG_ARCH_FIXUP_FDT_MEMORY=y
>> > # CONFIG_CHROMEOS is not set
>> > # CONFIG_CHROMEOS_VBOOT is not set
>> >
>> [..]
>>
>> This has CONFIG_FIT and CONFIG_LEGACY_IMAGE_FORMAT is disabled (since
>> you have signature verification on).
>>
>> Regards,
>> Simon
>
>
> Hi Simon,
>
> Thank you for your advice, I'll make sure to reply at the bottom of the message from now on.
>
> I've run the dumpimage command and this was my output:
> root at freddie-pi-dev:/home/fit# ../optee/u-boot/tools/dumpimage -l image.fit
> FIT description: RPi FIT Image
> Created:         Thu Aug  3 15:47:15 2023
>  Image 0 (kernel-1)
>   Description:  default kernel
>   Created:      Thu Aug  3 15:47:15 2023
>   Type:         Kernel Image
>   Compression:  uncompressed
>   Data Size:    20869632 Bytes = 20380.50 KiB = 19.90 MiB
>   Architecture: AArch64
>   OS:           Linux
>   Load Address: 0x12000000
>   Entry Point:  0x12000000
>   Hash algo:    sha1
>   Hash value:   08d43ed37129fa26e0f5f9d303a211b708c66783
>  Image 1 (tee-1)
>   Description:  atf
>   Created:      Thu Aug  3 15:47:15 2023
>   Type:         Standalone Program
>   Compression:  uncompressed
>   Data Size:    1257464 Bytes = 1227.99 KiB = 1.20 MiB
>   Architecture: AArch64
>   Load Address: 0x08400000
>   Entry Point:  0x08400000
>   Hash algo:    sha1
>   Hash value:   4907d9c33098b2767cd6bc4bc9836f2f913464c7
>  Image 2 (fdt-1)
>   Description:  device tree
>   Created:      Thu Aug  3 15:47:15 2023
>   Type:         Flat Device Tree
>   Compression:  uncompressed
>   Data Size:    32501 Bytes = 31.74 KiB = 0.03 MiB
>   Architecture: AArch64
>   Load Address: 0x01000000
>   Hash algo:    sha1
>   Hash value:   1b5bb266752cb247d89245c63bd041acfa34c7c0
>  Default Configuration: 'config-1'
>  Configuration 0 (config-1)
>   Description:  default configuration
>   Kernel:       kernel-1
>   FDT:          fdt-1
>   Loadables:    tee-1
>   Sign algo:    sha1,rsa2048:dev
>   Sign value:   22cd61395ae659917626ef88ebf82429d6d592a7975cf48eb1e301f81c8f2a9ae60e203e283b8800971b72cd1b6bf93fb4f5f54d9bc4fb0f49ae0e48115ff087d8638f8080fdc9f72fbfdd2228d60dba33849a75dba6958a134eefb9441b43f6f8319b7885c052c7993a7c791fe0acc577a629b04630060f02e24e82f9e5c8851c0df3d63da45ee5daeeabe198b990c2b8cbe24834763df299d8ed5a25cb90818caa23676e764d4d6e91e852451c1dae8a2946b9741e637b7556b6ebf27fa9e0ad5252909d13da67179b40f5097cc29c4ac1539c0fb89b567e8ee2d56ef92707d2a9d82a090d35c66cf23e8e66e5c8da5e197ec4a0dd771ef4a3246f6f499850
>   Timestamp:    Thu Aug  3 15:47:15 2023
>

That looks fine

>
> I have tried to use an unsigned FIT before, but I also ran into the same error. In this case, do I simply disable the signature parts of the config, enable the legacy image format option and make the new image without any of the signing or are there other changes as well?

Well no point in trying it then...you can normally just omit the signing step.

>
> Where would be an appropriate place to upload my FIT file to in order to share a link?
>

Google drive? Anything that allows public links.

At this point, I think debugging it is the only option, as I mentioned
earlier. I don't know what rpi doesn't enable FIT by default, but
perhaps there is some reason.

Regards,
Simon