Re: FIT image verification not working on imx8mm

Hi Slava,

Thanks a lot for having a look at this issue!

On 2/22/26 2:50 PM, Vyacheslav Yurkov wrote:
> Hi Michael,
> I believe the message is correct:
>
> > Verifying Hash Integrity ... sha256+ OK
>
> The "+" sign means the signature verification succeeded. The "-" would 
> mean otherwise.
>
> I've just tried again to boot a fit image built without 
> UBOOT_SIGN_ENABLE and got:
>
> > No 'signature' subnode found for '<NULL>' hash node in 'conf-my-dtb' 
> config node

I don't think that's the case, because if I replace my "fitImage" file 
by an unsigned one, it is still gladly accepted by U-Boot:

Verdin iMX8MM # load mmc 0:2 40000000 boot/fitImage
8426099 bytes read in 50 ms (160.7 MiB/s)
Verdin iMX8MM # bootm 40000000
## Loading kernel from FIT Image at 40000000 ...
    Using 'conf-imx8mm-syk-ccu.dtb' configuration
    Verifying Hash Integrity ... OK
    Trying 'kernel-1' kernel subimage
      Description:  Linux kernel
      Type:         Kernel Image
      Compression:  gzip compressed
      Data Start:   0x400000e8
      Data Size:    8347434 Bytes = 8 MiB
      Architecture: AArch64
      OS:           Linux
      Load Address: 0x48200000
      Entry Point:  0x48200000
      Hash algo:    sha256
      Hash value: 
  2dc1e494faaefa209b46b1b7aed7dbbbdb61de81b2770705e6cb9ef36c886435
    Verifying Hash Integrity ... sha256+ OK
## Loading fdt from FIT Image at 40000000 ...
    Using 'conf-imx8mm-syk-ccu.dtb' configuration
    Verifying Hash Integrity ... OK
    Trying 'fdt-imx8mm-syk-ccu.dtb' fdt subimage
      Description:  Flattened Device Tree blob
      Type:         Flat Device Tree
      Compression:  uncompressed
      Data Start:   0x407f6128
      Data Size:    76717 Bytes = 74.9 KiB
      Architecture: AArch64
      Load Address: 0x50200000
      Hash algo:    sha256
      Hash value: 
  3378b4f94a993a9bba8c60c50dd58acb57df6833926be34bfbcedd789687a436
    Verifying Hash Integrity ... sha256+ OK
    Loading fdt from 0x407f6128 to 0x50200000
    Booting using the fdt blob at 0x50200000
Working FDT set to 50200000
    Uncompressing Kernel Image to 48200000
    Loading Device Tree to 00000000bced4000, end 00000000bcee9bac ... OK
Working FDT set to bced4000

Starting kernel ...

>
> Do you use the u-boot as SPL by any chance?

Yes, U-Boot SPL runs right before U-Boot.
Cheers
Michael.

-- 
Root Commit
Embedded Linux Training and Consulting
https://rootcommit.com