U-boot FIT image

[R-Bas]

Hi,

I'm trying to use a FIT image with meta-tegra on a jetson nano dev kit. The goal is to then be able to sign the image for Verified Boot.

I tried manually generating the FIT image and also using Poky's "kernel-fitimage" class. But, either way, I didn't find a way to successfully boot the image on the device.

Has anyone already worked with FIT images and meta-tegra ?
As this involves a lot of things outside meta-tegra is it ok to ask about this here ?
(If yes, I will post more technical details about what I've been trying until now)

Thanks

[ichergui]

Hey @R-Bas
I'm working on it with @madisongh and we will make it available really soon on both platform Jetson nano and TX2.
Which Yocto release are you using ?

[ichergui]

Hey @R-Bas

FIT image support is available, please take a look here and follow the steps.

For now, the complete feature is available in our stable branch dunfell-l4t-r32.4.3 .

Please let me know if you need help.

I will work on it to make it available in the recent Yocto release.

[R-Bas]

Hi,

I just did a minimal image build with the instructions provided and it works perfectly.

I was looking at the code and there is something i don't quite understand.
In this commit, do_deploy() is appended to add bootimg header to the u-boot binary when signature is enabled. Why is it only when signature is enabled that this should be done ?

[ichergui]

Hey @R-Bas

Nice to hear that from you.

The booting header is mandatory when signing process happen because of the uboot dtb concatenation with uboot .

We have to make it compatible with Nvidia tool .e.g. tegrahost

Please take a look into the Yocto class uboot-sign.bbclass to understand well.

The uboot dtb hold the public key that is needed for boot signature verification.

Please me know if you need more clarification.

[R-Bas]

I didn't pay attention at all to this compatibility issue when concatenating the dtb with u-boot. This is most likely why my previous attempts failed.

I've added fitImage with signature support in my own layer based on what you have done in tegrademo and everything is working fine using Poky on the Gatesgarth release.

Thank you very much !

[ichergui]

You can use tegra-demo-distro - branch gatesgarth it will work fine as well