[PATCH 1/1] tools: mkimage: validate image references in FIT configurations

[Aristo Chen]

Hi all,

Alexander Dahl <ada at thorsis.com> 於 2025年5月15日 週四 下午12:44寫道：
>
> Hei hei,
>
> Am Thu, May 15, 2025 at 09:35:34AM +0200 schrieb Quentin Schulz:
> > Hi Simon,
> >
> > On 5/14/25 9:44 PM, Simon Glass wrote:
> > > Hi,
> > >
> > > On Tue, 13 May 2025 at 17:28, Quentin Schulz <quentin.schulz at cherry.de> wrote:
> > > >
> > > > Hi Aristo,
> > > >
> > > > On 5/5/25 12:08 PM, Aristo Chen wrote:
> > > > > When parsing a FIT image source (ITS), mkimage does not currently check
> > > > > whether the image names referenced in the /configurations section (e.g.
> > > > > "kernel", "fdt", "ramdisk", "loadables") actually exist in the /images
> > > > > node.
> > > > >
> > > > > This patch introduces a validation step during FIT import that iterates
> > > > > over each configuration and verifies that all referenced image names are
> > > > > defined under /images. If a missing image is detected, an appropriate
> > > > > error is reported and mkimage exits with FDT_ERR_NOTFOUND.
> > > > >
> > >
> > > One option (for boards which use Binman) would be to put these sorts
> > > of checks in there, since it might be easier to code? But having it in
> > > mkimage as well seems reasonable to me.
> > >
> >
> > mkimage can be used to generate images from outside of U-Boot. I believe
> > this is what Yocto does for example to generate kernel FIT (see
> > UBOOT_MKIMAGE and others), so having an additional check in mkimage is
> > probably a good idea.
>
> Not sure about Yocto, but ptxdist [1] does exactly this: using mkimage
> to build signed FIT images, even if U-Boot is not used as bootloader.
>
> (ptxdist also uses mkimage when optionally packing U-Boot scripts.
> Those need to be put into an image so U-Boot can execute it.)
>
> Greets
> Alex
>
> [1] https://www.ptxdist.org/

Thank you very much for the reviews and all the helpful suggestions!

Previously, I verified my patch using `./test/py/test.py -ra --bd
sandbox --build`, and AFAICT everything looked fine. However, I just
ran `make tests` and noticed that my patch causes some binman related
test failures.

I'll take some time to investigate the root cause before sending out
the v2 patch.

Best regards,
Aristo