Hi!
I am working on a secure industrial platform for one of our projects, based on the Apalis iMX8QM 4GB IT V1.1B and an Ixora carrier board. The image I’m working on is based on the txd-reference-minimal-image. The modifications are made via local.conf changes and additional layers.
So far, I have used the BSP 5.3.0 quarterly version and integrated secure boot and a few other features into our image. It worked great until I ported our image to the latest quarterly BSP 5.5.0 reference image, which broke the boot process because it says it cannot find the configuration node in the fitImage (log at the bottom).
If I load the fitImage into memory with fatload in U-Boot and boot it using bootm, it verifies the fitImage and boots (with a few minor hiccups that I believe happen due to the “raw” booting and a few unset variables). However, If I just let it boot after powerup, it hangs.
For the secure boot I
- created an apalis-imx8_defconfig.patch file to enable
CONFIG_AHAB_BOOTin the U-Boot (required for enforcing secure boot in NXP chip level) - set up the U-Boot fitImage with the local.conf modifications, seen at the bottom.
Apart from these changes, I did not make modifications to the U-Boot.
With BSP 5.3.0 it worked great. I verified every stage by modifying different parts of the imx-boot and the fitImage images. With BSP 5.5.0 it does not work; however, I can see that TEZI still uses fitImages, so I believe the fitImage feature itself is still supported.
I compared the Tezi U-Boot defconfig, and the used settings, with the ones the minimal image provides; I compared the BSP 5.3.0 and the BSP 5.5.0; I compared the boot logs, U-Boot env vars, etc., but I cannot seem to locate the changes that broke the fitImage boot process for me. The only difference I can see in the fitImage config is that now instead of @ the image uses - as in kernel-1 instead of kernel@1.
I tried to use BSP 5.5.0, BSP 5.5.0-devel-202112, BSP 5.4.0, dunfell-5.x.y, but the U-Boot will only load the fitImage properly if I use the “original” BSP 5.3.0 reference image.
I also tried clean building the whole project several times (completely removed sstate too), but it did not help.
Could you please help me find what I should change in the image to fix the fitImage boot process? We need to use the BSP 5.5.0 because it contains an updated SCFW, required for enforcing the Secure Boot on the chip level.
Many thanks,
Csongor
U-Boot log with hang fitImage
U-Boot 2020.04-5.5.0-devel+git.81bc8894031d (Nov 30 2021 - 11:36:12 +0000)
CPU: NXP i.MX8QM RevB A53 at 1200 MHz
DRAM: 4 GiB
MMC: FSL_SDHC: 0, FSL_SDHC: 1, FSL_SDHC: 2
Loading Environment from MMC... OK
In: serial
Out: serial
Err: serial
Model: Toradex Apalis iMX8 QuadMax 4GB IT V1.1C, Serial# 06852556
BuildInfo:
- SCFW 778670e2, SECO-FW d63fdb21, IMX-MKIMAGE 8947fea3, ATF 835a8f6
- U-Boot 2020.04-5.5.0-devel+git.81bc8894031d
switch to partitions #0, OK
mmc0(part 0) is current device
flash target is MMC:0
Net: eth0: ethernet@5b040000
Fastboot: Normal
Normal Boot
Hit any key to stop autoboot: 0
MMC: no card present
MMC: no card present
switch to partitions #0, OK
mmc0(part 0) is current device
Scanning mmc 0:1...
Found U-Boot script /boot.scr
5754 bytes read in 22 ms (254.9 KiB/s)
## Executing script at 83100000
** Bad device specification ${boot_devtype} ${boot_devnum} **
** Bad device specification ${boot_devtype} ${boot_devnum} **
Loading hdp firmware from 0x000000009c000000 offset 0x0000000000002000
Loading hdp firmware Complete
43 bytes read in 12 ms (2.9 KiB/s)
13582914 bytes read in 422 ms (30.7 MiB/s)
Bootargs: pci=nomsi root=PARTUUID=f1045e45-02 ro rootwait
## Loading kernel from FIT Image at 8a000000 ...
Could not find configuration node
ERROR: can't get kernel image!
Booting from mmc failed!
SCRIPT FAILED: continuing...
starting USB...
Bus usb@5b0d0000: usb dr_mode not found
Port not available.
Bus usbh3: XHCI-imx8 init hccr 0x000000005b130000 and hcor 0x000000005b130080 hc_length 128
Register 2000820 NbrPorts 2
Starting the controller
USB XHCI 1.00
scanning bus usbh3 for devices... 1 USB Device(s) found
scanning usb for storage devices... 0 Storage Device(s) found
Device 0: unknown device
BOOTP broadcast 1
DHCP client bound to address 10.85.10.100 (2 ms)
Using ethernet@5b040000 device
TFTP from server 10.85.15.254; our IP address is 10.85.10.100
Filename 'boot.scr'.
Load address: 0x83100000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
BOOTP broadcast 1
DHCP client bound to address 10.85.10.100 (3 ms)
Using ethernet@5b040000 device
TFTP from server 10.85.15.254; our IP address is 10.85.10.100
Filename 'pxelinux.0'.
Load address: 0x80280000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
Apalis iMX8 #
U-Boot fitImage related local.conf modifications
# Enable fitimage kernel creation and thus kernel signing
KERNEL_CLASSES_append = " toradex-fitimage"
KERNEL_IMAGETYPE_forcevariable = "${@'zImage' if d.getVar('TORADEX_FLASH_TYPE') == 'rawnand' else 'fitImage'}"
# Enable kernel signing for uboot
UBOOT_SIGN_KEYDIR = "/workdir/keys/fitimage-signing-keys/active_key/"
UBOOT_SIGN_KEYNAME = "fitimage"
UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb -p 2000"
UBOOT_SIGN_ENABLE = "1"