bootm: fit-image: hash node name too strict

bootm: fit-image: hash node name too strict

[Sebastian Groß]

Hello and a happy new year 2025 dear all,

I happened to have a fit-image which worked fine with u-boot and wanted 
to give it a try with barebox.
Sadly I got yelled at for not having hashes for the kernel-1 `Image` 
provided in the fit-image.

Grepping the source code for the error message pointed to 
`fit_verify_hash` and `of_get_child_by_name` with `hash@1` or `hash-1`.
Neither is required by u-boot as it looks only for `FIT_HASH_NODENAME` 
which is defined as `hash`.

Since the image is build by uboot's mkimage I would expect the itb's to 
be compatible. Or am I missing something?

Changing the following line in the `its`, ie. its build script
```
- hash { algo = "${FIT_HASH_ALG}"; };
+ hash@1 { algo = "${FIT_HASH_ALG}"; };
```
made the fit-image work.

Perhaps another if-clause is required. Or some error message that states 
which property/string was searched for,
since there were hashes in the image, but not where barebox expected them.

Regards

Sebastian Groß

--
Sebastian Groß, B.Sc.

emlix GmbH
Headquarters: Berliner Str. 12, 37073 Goettingen, Germany
Phone +49 (0)551 30664-0, e-mail info@emlix.com
District Court of Goettingen, Registry Number HR B 3160
Managing Directors: Heike Jordan, Dr. Uwe Kracke
VAT ID No. DE 205 198 055
Office Berlin: Panoramastr. 1, 10178 Berlin, Germany
Office Bonn: Bachstr. 6, 53115 Bonn, Germany
http://www.emlix.com

emlix - your embedded Linux partner

Re: bootm: fit-image: hash node name too strict

[Marco Felsch]

Hi Sebastian,

On 25-01-07, Sebastian Groß wrote:
> Hello and a happy new year 2025 dear all,

thank you very much, you too :)

> I happened to have a fit-image which worked fine with u-boot and wanted to
> give it a try with barebox.
> Sadly I got yelled at for not having hashes for the kernel-1 `Image`
> provided in the fit-image.
> 
> Grepping the source code for the error message pointed to `fit_verify_hash`
> and `of_get_child_by_name` with `hash@1` or `hash-1`.
> Neither is required by u-boot as it looks only for `FIT_HASH_NODENAME` which
> is defined as `hash`.

According the spec [1] it should be named hash-<number>. Checking the
U-Boot doc folder it seems like 'hash' was used in the early days of FIT
images since there is only one file 'doc/usage/fit/howto.rst' which is
using the plain 'hash' node name.

[1] https://fitspec.osfw.foundation/#hash-nodes

> Since the image is build by uboot's mkimage I would expect the itb's to be
> compatible. Or am I missing something?
> 
> Changing the following line in the `its`, ie. its build script
> ```
> - hash { algo = "${FIT_HASH_ALG}"; };
> + hash@1 { algo = "${FIT_HASH_ALG}"; };
> ```
> made the fit-image work.

I can't find this line within the U-Boot src code. Can you provide a
link please?

> Perhaps another if-clause is required. Or some error message that states
> which property/string was searched for,
> since there were hashes in the image, but not where barebox expected them.

We could search for the legacy single 'hash' node name as well and print
a warning that this should be changed.

Regards,
  Marco

> 
> Regards
> 
> Sebastian Groß
> 
> --
> Sebastian Groß, B.Sc.
> 
> emlix GmbH
> Headquarters: Berliner Str. 12, 37073 Goettingen, Germany
> Phone +49 (0)551 30664-0, e-mail info@emlix.com
> District Court of Goettingen, Registry Number HR B 3160
> Managing Directors: Heike Jordan, Dr. Uwe Kracke
> VAT ID No. DE 205 198 055
> Office Berlin: Panoramastr. 1, 10178 Berlin, Germany
> Office Bonn: Bachstr. 6, 53115 Bonn, Germany
> http://www.emlix.com
> 
> emlix - your embedded Linux partner
> 
> 
> 

Re: bootm: fit-image: hash node name too strict

[Sebastian Groß]

Hi Marco,


On 2025-01-07 8:37 AM, Marco Felsch wrote:
>> Since the image is build by uboot's mkimage I would expect the itb's to be
>> compatible. Or am I missing something?
>>
>> Changing the following line in the `its`, ie. its build script
>> ```
>> - hash { algo = "${FIT_HASH_ALG}"; };
>> + hash@1 { algo = "${FIT_HASH_ALG}"; };
>> ```
>> made the fit-image work.
> I can't find this line within the U-Boot src code. Can you provide a
> link please?
Sorry for the confusion. I meant the build script within yocto that 
generates the `its` and then the `itb`
>> Perhaps another if-clause is required. Or some error message that states
>> which property/string was searched for,
>> since there were hashes in the image, but not where barebox expected them.
> We could search for the legacy single 'hash' node name as well and print
> a warning that this should be changed.
I concur!

Looking at `fit_image_verify_signature` this change might be necessary 
too for `signature`

Regards,

Sebastian

-- 
Sebastian Groß, B.Sc.

emlix GmbH
Headquarters: Berliner Str. 12, 37073 Goettingen, Germany
Phone +49 (0)551 30664-0, e-mail info@emlix.com
District Court of Goettingen, Registry Number HR B 3160
Managing Directors: Heike Jordan, Dr. Uwe Kracke
VAT ID No. DE 205 198 055
Office Berlin: Panoramastr. 1, 10178 Berlin, Germany
Office Bonn: Bachstr. 6, 53115 Bonn, Germany
http://www.emlix.com

emlix - your embedded Linux partner

Re: bootm: fit-image: hash node name too strict

[Marco Felsch]

On 25-01-07, Sebastian Groß wrote:
> Hi Marco,
> 
> On 2025-01-07 8:37 AM, Marco Felsch wrote:
> > > Since the image is build by uboot's mkimage I would expect the itb's to be
> > > compatible. Or am I missing something?
> > > 
> > > Changing the following line in the `its`, ie. its build script
> > > ```
> > > - hash { algo = "${FIT_HASH_ALG}"; };
> > > + hash@1 { algo = "${FIT_HASH_ALG}"; };
> > > ```
> > > made the fit-image work.
> > I can't find this line within the U-Boot src code. Can you provide a
> > link please?
> Sorry for the confusion. I meant the build script within yocto that
> generates the `its` and then the `itb`

Can you give me some pointers please? I've checked the
kernel-fitimage.bbclass in oe-core and which used hash@1 during the
initial commit which was changed to hash-1 later on.

> > > Perhaps another if-clause is required. Or some error message that states
> > > which property/string was searched for,
> > > since there were hashes in the image, but not where barebox expected them.
> > We could search for the legacy single 'hash' node name as well and print
> > a warning that this should be changed.
> I concur!

If we can find a valid source which still uses the old style :)

> Looking at `fit_image_verify_signature` this change might be necessary too
> for `signature`

Same here.

Regards,
  Marco

Re: bootm: fit-image: hash node name too strict

[Sebastian Groß]

On 2025-01-07 12:13 PM, Marco Felsch wrote:
> On 25-01-07, Sebastian Groß wrote:
>> Hi Marco,
>>
>> On 2025-01-07 8:37 AM, Marco Felsch wrote:
>>>> Since the image is build by uboot's mkimage I would expect the itb's to be
>>>> compatible. Or am I missing something?
>>>>
>>>> Changing the following line in the `its`, ie. its build script
>>>> ```
>>>> - hash { algo = "${FIT_HASH_ALG}"; };
>>>> + hash@1 { algo = "${FIT_HASH_ALG}"; };
>>>> ```
>>>> made the fit-image work.
>>> I can't find this line within the U-Boot src code. Can you provide a
>>> link please?
>> Sorry for the confusion. I meant the build script within yocto that
>> generates the `its` and then the `itb`
> Can you give me some pointers please? I've checked the
> kernel-fitimage.bbclass in oe-core and which used hash@1 during the
> initial commit which was changed to hash-1 later on.
Maybe that was my mistake in the first place. I used some custom class I 
found from an older BSP that used u-boot as bootloader.
I should switch to kernel-fitimage or the pengutronix fitimage class.
>
>>>> Perhaps another if-clause is required. Or some error message that states
>>>> which property/string was searched for,
>>>> since there were hashes in the image, but not where barebox expected them.
>>> We could search for the legacy single 'hash' node name as well and print
>>> a warning that this should be changed.
>> I concur!
> If we can find a valid source which still uses the old style :)
Agreed. But I find it likely to stumble upon such old thingis in the 
wild and would appreciate a warning in this case.
This would spare future-me and other devs the trouble =)
Plus the fix would not increase the complexity of the code.

I could provide a patch and you might decide on this basis
>
>> Looking at `fit_image_verify_signature` this change might be necessary too
>> for `signature`
> Same here.
>
> Regards,
>    Marco

Regards

Sebastian

-- 
Sebastian Groß, B.Sc.

emlix GmbH
Headquarters: Berliner Str. 12, 37073 Goettingen, Germany
Phone +49 (0)551 30664-0, e-mail info@emlix.com
District Court of Goettingen, Registry Number HR B 3160
Managing Directors: Heike Jordan, Dr. Uwe Kracke
VAT ID No. DE 205 198 055
Office Berlin: Panoramastr. 1, 10178 Berlin, Germany
Office Bonn: Bachstr. 6, 53115 Bonn, Germany
http://www.emlix.com

emlix - your embedded Linux partner