Hi Freddie, On Wed, 16 Aug 2023 at 08:25, Freddie <fpide...@gmail.com> wrote: > > Hi, > > I am trying to attempt to build a verified boot solution using Flattened > Image Trees on a Raspberry Pi 3B + > I have looked at a couple of guides online about how to do this, however > they seem quite out of date and it hasn't worked. > > The two main guides I have looked at: > #3066 <https://github.com/OP-TEE/optee_os/issues/3066> > https://github.com/NVISOsecurity/VerifiedBootRPi3/blob/master/instructions.md > > I initially tried building a standard system following the instructions on > the official OP-TEE documentation, which worked. However I have not been > able to boot from a FIT file. > > I have very closely followed the instructions from the first link above, > but no matter what I have changed so far, I get the error: > Wrong Image Format for bootm command > ERROR: can't get kernel image! > > This error occurs both when trying to autoboot and when trying to manually > boot (using fatload and bootm in the command line). > > I have tried for around 2-3 weeks to attempt to solve this error, so I > would really appreciate any advice or suggestions. > > I have tried both signed and unsigned FIT images and neither of them have > worked. > > I have included the contents of my image.its, uboot.env.txt, > rpi_3_defconfig and rpi.h files below as well as the logs from when I try > and boot my system, please let me know if there is any other information > that could help with solving this. > > > > /fit/image.its: > > / { > description = "RPi FIT Image"; > #address-cells = <1>; > images { > kernel-1 { > description = "default kernel"; > data = /incbin/("kernel8.img"); > type = "kernel"; > arch = "arm64"; > os = "linux"; > compression = "none"; > load = <0x12000000>; > entry = <0x12000000>; > hash-1 { > algo = "sha1"; > }; > }; > tee-1 { > description = "atf"; > data = /incbin/("armstub8.bin"); > type = "standalone"; > arch = "arm64"; > compression = "none"; > load = <0x08400000>; > entry = <0x08400000>; > hash-1 { > algo = "sha1"; > }; > }; > fdt-1 { > description = "device tree"; > data = /incbin/("bcm2710-rpi-3-b-plus.dtb"); > type = "flat_dt"; > arch = "arm64"; > compression = "none"; > load = <0x01000000>; > entry = <0x01000000>; > hash-1 { > algo = "sha1"; > }; > }; > }; > configurations { > default = "config-1"; > config-1 { > description = "default configuration"; > kernel = "kernel-1"; > loadables = "tee-1"; > fdt = "fdt-1"; > signature-1 { > algo = "sha1,rsa2048"; > key-name-hint = "dev"; > sign-images = "fdt", "kernel", "loadables"; > }; > }; > }; > }; > > > > > > > /optee/u-boot/configs/RPI_3_DEFCONFIG: > > CONFIG_ARM=y > CONFIG_ARCH_CPU_INIT=y > CONFIG_ARCH_BCM283X=y > CONFIG_SYS_TEXT_BASE=0x00080000 > CONFIG_TARGET_RPI_3=y > CONFIG_SYS_MALLOC_F_LEN=0x2000 > CONFIG_NR_DRAM_BANKS=1 > CONFIG_ENV_SIZE=0x4000 > CONFIG_DISTRO_DEFAULTS=y > CONFIG_OF_BOARD_SETUP=y > CONFIG_USE_PREBOOT=y > # CONFIG_DISPLAY_CPUINFO is not set > CONFIG_DEFAULT_DEVICE_TREE="bcm2837-rpi-3-b-plus" > CONFIG_OF_CONTROL=y > CONFIG_FIT=y > CONFIG_FIT_SIGNATURE=y > CONFIG_RSA=y > CONFIG_FIT_VERBOSE=y > CONFIG_OF_LIBFDT=y > # CONFIG_DISPLAY_BOARDINFO is not set > CONFIG_MISC_INIT_R=y > CONFIG_SYS_PROMPT="U-Boot> " > CONFIG_CMD_GPIO=y > CONFIG_CMD_MMC=y > CONFIG_CMD_USB=y > CONFIG_CMD_FS_UUID=y > CONFIG_OF_EMBED=y > CONFIG_ENV_FAT_DEVICE_AND_PART="0:1" > CONFIG_SYS_RELOC_GD_ENV_ADDR=y > CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y > CONFIG_TFTP_TSIZE=y > CONFIG_MMC_SDHCI=y > CONFIG_MMC_SDHCI_BCM2835=y > CONFIG_PHYLIB=yONFIG_ARM=y > CONFIG_ARCH_CPU_INIT=y > CONFIG_ARCH_BCM283X=y > CONFIG_SYS_TEXT_BASE=0x00080000 > CONFIG_TARGET_RPI_3=y > CONFIG_SYS_MALLOC_F_LEN=0x2000 > CONFIG_NR_DRAM_BANKS=1 > CONFIG_ENV_SIZE=0x4000 > CONFIG_DISTRO_DEFAULTS=y > CONFIG_OF_BOARD_SETUP=y > CONFIG_USE_PREBOOT=y` > CONFIG_DM_ETH=y > CONFIG_PINCTRL=y > # CONFIG_PINCTRL_GENERIC is not set > # CONFIG_REQUIRE_SERIAL_CONSOLE is not set > CONFIG_SYSINFO=y > CONFIG_SYSINFO_SMBIOS=y > CONFIG_USB=y > CONFIG_USB_DWC2=y > CONFIG_USB_KEYBOARD=y > CONFIG_USB_HOST_ETHER=y > CONFIG_USB_ETHER_LAN78XX=y > CONFIG_USB_ETHER_SMSC95XX=y > CONFIG_DM_VIDEO=y > # CONFIG_VIDEO_BPP8 is not set > # CONFIG_VIDEO_BPP16 is not set > CONFIG_SYS_WHITE_ON_BLACK=y > CONFIG_CONSOLE_SCROLL_LINES=10 > CONFIG_PHYS_TO_BUS=y > CONFIG_OF_LIBFDT_OVERLAY=y > > > > > > > /optee/build/rpi3/firmware/uboot.env.txt: > > > # generic params > bootdelay=3 > stderr=serial,lcd > stdin=serial,usbkbd > stdout=serial,lcd > > # CPU config > cpu=armv8 > smp=on > > # Console config > baudrate=115200 > sttyconsole=ttyS0 > ttyconsole=tty0 > > # Kernel/dtb filenames & load addresses > boot_fit=bootm ${fit_addr} > fdt_addr_r=0x01000000 > fit_addr=0x02000000 > fdtfile=bcm2710-rpi-3-b-plus.dtb > load_fit=fatload mmc 0:1 ${fit_addr} image.itb > mmcboot=run load_fit; run set_bootargs_tty set_bootargs_mmc > set_common_args; run boot_fit > > > # NFS/TFTP boot configuraton > gatewayip=192.168.1.1 > netmask=255.255.255.0 > nfsserverip=192.168.1.100 > nfspath=/srv/nfs/rpi > > # bootcmd & bootargs configuration > preboot=usb start > bootcmd=run mmcboot > nfsboot=run load_kernel; run set_bootargs_tty set_bootargs_nfs > set_common_args; run boot_it > set_bootargs_tty=setenv bootargs console=${ttyconsole} > console=${sttyconsole},${baudrate} > set_bootargs_nfs=setenv bootargs ${bootargs} root=/dev/nfs rw > rootfstype=nfs nfsroot=${nfsserverip}:${nfspath},udp,vers=3 ip=dhcp > set_bootargs_mmc=setenv bootargs ${bootargs} root=/dev/mmcblk0p2 rw > rootfs=ext4 > set_common_args=setenv bootargs ${bootargs} > smsc95xx.macaddr=${ethaddr} 'ignore_loglevel dma.dmachans=0x7f35 > rootwait 8250.nr_uarts=1 elevator=deadline fsck.repair=yes > bcm2708_fb.fbwidth=1920 bcm2708_fb.fbheight=1080 > vc_mem.mem_base=0x3ec00000 vc_mem.mem_size=0x40000000 > dwc_otg.fiq_enable=0 dwc_otg.fiq_fsm_enable=0 dwc_otg.nak_holdoff=0' > > > > > > > /optee/u-boot/include/configs/rpi.h: > > /* SPDX-License-Identifier: GPL-2.0 */ > /* > * (C) Copyright 2012-2016 Stephen Warren > */ > > #ifndef __CONFIG_H > #define __CONFIG_H > > #include <linux/sizes.h> > #include <asm/arch/timer.h> > > #ifndef __ASSEMBLY__ > #include <asm/arch/base.h> > #endif > > #if defined(CONFIG_TARGET_RPI_2) || defined(CONFIG_TARGET_RPI_3_32B) > #define CONFIG_SKIP_LOWLEVEL_INIT > #endif > > /* Architecture, CPU, etc.*/ > > /* Use SoC timer for AArch32, but architected timer for AArch64 */ > #ifndef CONFIG_ARM64 > #define CONFIG_SYS_TIMER_RATE 1000000 > #define CONFIG_SYS_TIMER_COUNTER \ > (&((struct bcm2835_timer_regs *)BCM2835_TIMER_PHYSADDR)->clo) > #endif > > /* > * 2835 is a SKU in a series for which the 27```08 is the first or primary > SoC, > * so 2708 has historically been used rather than a dedicated 2835 ID. > * > * We don't define a machine type for bcm2709/bcm2836 since the RPi Foundation > * chose to use someone else's previously registered machine ID (3139, > MX51_GGC) > * rather than obtaining a valid ID:-/ > * > * For the bcm2837, hopefully a machine type is not needed, since everything > * is DT. > */ > #ifdef CONFIG_BCM2835 > #define CONFIG_MACH_TYPE MACH_TYPE_BCM2708 > #endif > > /* Memory layout */ > #define CONFIG_SYS_SDRAM_BASE 0x00000000 > #define CONFIG_SYS_UBOOT_BASE CONFIG_SYS_TEXT_BASE > /* > * The board really has 256M. However, the VC (VideoCore co-processor) shares > * the RAM, and uses a configurable portion at the top. We tell U-Boot that a > * smaller amount of RAM is present in order to avoid stomping on the area > * the VC uses. > */ > #define CONFIG_SYS_SDRAM_SIZE SZ_128M > #define CONFIG_SYS_INIT_SP_ADDR (CONFIG_SYS_SDRAM_BASE + \ > CONFIG_SYS_SDRAM_SIZE - \ > GENERATED_GBL_DATA_SIZE) > #define CONFIG_SYS_MALLOC_LEN SZ_4M > #define CONFIG_LOADADDR 0x00200000 > > #ifdef CONFIG_ARM64 > #endif > > /* Devices */ > /* GPIO */ > #define CONFIG_BCM2835_GPIO > /* LCD */ > #define CONFIG_LCD_DT_SIMPLEFB > #define CONFIG_VIDEO_BCM2835 > > /* DFU over USB/UDC */ > #ifdef CONFIG_CMD_DFU > #ifdef CONFIG_ARM64 > #define KERNEL_FILENAME "Image" > #else > #define KERNEL_FILENAME "zImage" > #endif > > #define ENV_DFU_SETTINGS \ > "dfu_alt_info=u-boot.bin fat 0 1;uboot.env fat 0 1;" \ > "config.txt fat 0 1;" \ > KERNEL_FILENAME " fat 0 1\0" > #else > #define ENV_DFU_SETTINGS "" > #endif > > /* Console configuration */ > #define CONFIG_SYS_CBSIZE 1024 > > /* Environment */ > #define CONFIG_SYS_LOAD_ADDR 0x1000000 > > /* Shell */ > > /* ATAGs support for bootm/bootz */ > #define CONFIG_SETUP_MEMORY_TAGS > #define CONFIG_CMDLINE_TAG > #define CONFIG_INITRD_TAG > #define CONFIG_SYS_BOOTM_LEN (16 << 20) > > /* Environment */ > #define ENV_DEVICE_SETTINGS \ > "stdin=serial,usbkbd\0" \ > "stdout=serial,vidconsole\0" \ > "stderr=serial,vidconsole\0" > > #ifdef CONFIG_ARM64 > #define FDT_HIGH "ffffffffffffffff" > #define INITRD_HIGH "ffffffffffffffff" > #else > #define FDT_HIGH "ffffffff" > #define INITRD_HIGH "ffffffff" > #endif > > /* > * Memory layout for where various images get loaded by boot scripts: > * > * I suspect address 0 is used as the SMP pen on the RPi2, so avoid this. > * > * Older versions of the boot firmware place the firmware-loaded DTB at 0x100, > * newer versions place it in high memory. So prevent U-Boot from doing its > own > * DTB + initrd relocation so that we won't accidentally relocate the initrd > * over the firmware-loaded DTB and generally try to lay out things starting > * from the bottom of RAM. > * > * kernel_addr_r has different constraints on ARM and Aarch64. For 32-bit > ARM, > * it must be within the first 128M of RAM in order for the kernel's > * CONFIG_AUTO_ZRELADDR option to work. The kernel itself will be decompressed > * to 0x8000 but the decompressor clobbers 0x4000-0x8000 as well. The > * decompressor also likes to relocate itself to right past the end of the > * decompressed kernel, so in total the sum of the compressed and and > * decompressed kernel needs to be reserved. > * > * For Aarch64, the kernel image is uncompressed and must be loaded at > * text_offset bytes (specified in the header of the Image) into a 2MB > * boundary. The 'booti' command relocates the image if necessary. Linux > uses > * a default text_offset of 0x80000. In summary, loading at 0x80000 > * satisfies all these constraints and reserving memory up to 0x02400000 > * permits fairly large (roughly 36M) kernels. > * > * scriptaddr and pxefile_addr_r can be pretty much anywhere that doesn't > * conflict with something else. Reserving 1M for each of them at > * 0x02400000-0x02500000 and 0x02500000-0x02600000 should be plenty. > * > * On ARM, both the DTB and any possible initrd must be loaded such that they > * fit inside the lowmem mapping in Linux. In practice, this usually means not > * more than ~700M away from the start of the kernel image but this number can > * be larger OR smaller depending on e.g. the 'vmalloc=xxxM' command line > * parameter given to the kernel. So reserving memory from low to high > * satisfies this constraint again. Reserving 1M at 0x02600000-0x02700000 for > * the DTB leaves rest of the free RAM to the initrd starting at 0x02700000. > * Even with the smallest possible CPU-GPU memory split of the CPU getting > * only 64M, the remaining 25M starting at 0x02700000 should allow quite > * large initrds before they start colliding with U-Boot. > */ > #define ENV_MEM_LAYOUT_SETTINGS \ > "fdt_high=" FDT_HIGH "\0" \ > "initrd_high=" INITRD_HIGH "\0" \ > "kernel_addr_r=0x00080000\0" \ > "scriptaddr=0x02400000\0" \ > "pxefile_addr_r=0x02500000\0" \ > "fdt_addr_r=0x02600000\0" \ > "ramdisk_addr_r=0x02700000\0" > > #if CONFIG_IS_ENABLED(CMD_MMC) > #define BOOT_TARGET_MMC(func) \ > func(MMC, mmc, 0) \ > func(MMC, mmc, 1) > #else > #define BOOT_TARGET_MMC(func) > #endif > > #if CONFIG_IS_ENABLED(CMD_USB) > #define BOOT_TARGET_USB(func) func(USB, usb, 0) > #else > #define BOOT_TARGET_USB(func) > #endif > > #if CONFIG_IS_ENABLED(CMD_PXE) > #define BOOT_TARGET_PXE(func) func(PXE, pxe, na) > #else > #define BOOT_TARGET_PXE(func) > #endif > > #if CONFIG_IS_ENABLED(CMD_DHCP) > #define BOOT_TARGET_DHCP(func) func(DHCP, dhcp, na) > #else > #define BOOT_TARGET_DHCP(func) > #endif > > #define BOOT_TARGET_DEVICES(func) \ > BOOT_TARGET_MMC(func) \ > BOOT_TARGET_USB(func) \ > BOOT_TARGET_PXE(func) \ > BOOT_TARGET_DHCP(func) > > #include <config_distro_bootcmd.h> > > #define CONFIG_EXTRA_ENV_SETTINGS \ > "dhcpuboot=usb start; dhcp u-boot.uimg; bootm\0" \ > ENV_DEVICE_SETTINGS \ > ENV_DFU_SETTINGS \ > ENV_MEM_LAYOUT_SETTINGS \ > BOOTENV > > > #endif > > > > * Boot Logs:* > > NOTICE: Booting Trusted Firmware > NOTICE: BL1: v2.6(debug):v2.6 > NOTICE: BL1: Built : 13:06:25, Aug 3 2023 > INFO: BL1: RAM 0x100ee000 - 0x100f7000 > INFO: BL1: cortex_a53: CPU workaround for 843419 was applied > INFO: BL1: cortex_a53: CPU workaround for 855873 was applied > WARNING: BL1: cortex_a53: CPU workaround for 1530924 was missing! > NOTICE: rpi3: Detected: Raspberry Pi 3 Model B+ (1GB, Sony, UK) [0x00a020d3] > INFO: BL1: Loading BL2 > INFO: Loading image id=1 at address 0x100b4000 > INFO: Image id=1 loaded: 0x100b4000 - 0x100bc419 > NOTICE: BL1: Booting BL2 > INFO: Entry point address = 0x100b4000 > INFO: SPSR = 0x3c5 > NOTICE: BL2: v2.6(debug):v2.6 > NOTICE: BL2: Built : 13:06:25, Aug 3 2023 > INFO: BL2: Doing platform setup > INFO: BL2: Loading image id 3 > INFO: Loading image id=3 at address 0x100e0000 > INFO: Image id=3 loaded: 0x100e0000 - 0x100ea073 > INFO: BL2: Loading image id 4 > INFO: Loading image id=4 at address 0x10100000 > INFO: Image id=4 loaded: 0x10100000 - 0x1010001c > INFO: OPTEE ep=0x10100000 > INFO: OPTEE header info: > INFO: magic=0x4554504f > INFO: version=0x2 > INFO: arch=0x1 > INFO: flags=0x0 > INFO: nb_images=0x1 > INFO: BL2: Loading image id 21 > INFO: Loading image id=21 at address 0x10100000 > INFO: Image id=21 loaded: 0x10100000 - 0x1017be98 > INFO: BL2: Skip loading image id 22 > INFO: BL2: Loading image id 5 > INFO: Loading image id=5 at address 0x11000000 > INFO: Image id=5 loaded: 0x11000000 - 0x11084b90 > NOTICE: BL1: Booting BL31 > INFO: Entry point address = 0x100e0000 > INFO: SPSR = 0x3cd > NOTICE: BL31: v2.6(debug):v2.6 > NOTICE: BL31: Built : 13:06:26, Aug 3 2023 > INFO: rpi3: Checking DTB... > INFO: BL31: Initializing runtime services > INFO: BL31: cortex_a53: CPU workaround for 843419 was applied > INFO: BL31: cortex_a53: CPU workaround for 855873 was applied > WARNING: BL31: cortex_a53: CPU workaround for 1530924 was missing! > INFO: BL31: Initializing BL32 > D/TC:0 plat_get_aslr_seed:118 Warning: no ASLR seed > D/TC:0 add_phys_mem:665 VCORE_UNPG_RX_PA type TEE_RAM_RX 0x10100000 > size 0x00078000 > D/TC:0 add_phys_mem:665 VCORE_UNPG_RW_PA type TEE_RAM_RW 0x10178000 > size 0x00688000 > D/TC:0 add_phys_mem:665 ta_base type TA_RAM 0x10800000 size 0x00800000 > D/TC:0 add_phys_mem:665 CONSOLE_UART_BASE type IO_NSEC 0x3f200000 > size 0x00200000 > D/TC:0 add_phys_mem:665 TEE_SHMEM_START type NSEC_SHM 0x08000000 > size 0x00400000 > D/TC:0 add_va_space:705 type RES_VASPACE size 0x00a00000 > D/TC:0 add_va_space:705 type SHM_VASPACE size 0x02000000 > D/TC:0 dump_mmap_table:831 type TEE_RAM_RX va > 0x10100000..0x10177fff pa 0x10100000..0x10177fff size 0x00078000 > (smallpg) > D/TC:0 dump_mmap_table:831 type TEE_RAM_RW va > 0x10178000..0x107fffff pa 0x10178000..0x107fffff size 0x00688000 > (smallpg) > D/TC:0 dump_mmap_table:831 type RES_VASPACE va > 0x10800000..0x111fffff pa 0x00000000..0x009fffff size 0x00a00000 > (pgdir) > D/TC:0 dump_mmap_table:831 type SHM_VASPACE va > 0x11200000..0x131fffff pa 0x00000000..0x01ffffff size 0x02000000 > (pgdir) > D/TC:0 dump_mmap_table:831 type NSEC_SHM va > 0x13200000..0x135fffff pa 0x08000000..0x083fffff size 0x00400000 > (pgdir) > D/TC:0 dump_mmap_table:831 type TA_RAM va > 0x13600000..0x13dfffff pa 0x10800000..0x10ffffff size 0x00800000 > (pgdir) > D/TC:0 dump_mmap_table:831 type IO_NSEC va > 0x13e00000..0x13ffffff pa 0x3f200000..0x3f3fffff size 0x00200000 > (pgdir) > D/TC:0 core_mmu_xlat_table_alloc:526 xlat tables used 1 / 8 > D/TC:0 core_mmu_xlat_table_alloc:526 xlat tables used 2 / 8 > I/TC: > I/TC: OP-TEE version: 3.22.0 (gcc version 11.3.1 20220712 (Arm GNU > Toolchain 11.3.Rel1)) #1 Thu Aug 3 11:35:50 UTC 2023 aarch64 > I/TC: WARNING: This OP-TEE configuration might be insecure! > I/TC: WARNING: Please check > https://optee.readthedocs.io/en/latest/architecture/porting_guidelines.html > I/TC: Primary CPU initializing > D/TC:0 0 boot_init_primary_late:1478 Executing at offset 0 with > virtual load address 0x10100000 > D/TC:0 0 call_preinitcalls:21 level 2 mobj_mapped_shm_init() > D/TC:0 0 mobj_mapped_shm_init:470 Shared memory address range: > 11200000, 13200000 > D/TC:0 0 call_initcalls:40 level 1 register_time_source() > D/TC:0 0 call_initcalls:40 level 1 teecore_init_pub_ram() > D/TC:0 0 call_initcalls:40 level 3 check_ta_store() > D/TC:0 0 check_ta_store:417 TA store: "early TA" > D/TC:0 0 check_ta_store:417 TA store: "Secure Storage TA" > D/TC:0 0 check_ta_store:417 TA store: "REE" > D/TC:0 0 call_initcalls:40 level 3 early_ta_init() > D/TC:0 0 early_ta_init:56 Early TA > f04a0fe7-1f5d-4b9b-abf7-619b85b4ce8c size 47637 (compressed, > uncompressed 109256) > D/TC:0 0 call_initcalls:40 level 3 verify_pseudo_tas_conformance() > D/TC:0 0 call_initcalls:40 level 3 tee_cryp_init() > D/TC:0 0 call_initcalls:40 level 4 tee_fs_init_key_manager() > D/TC:0 0 call_initcalls:40 level 6 mobj_init() > D/TC:0 0 call_initcalls:40 level 6 default_mobj_init() > D/TC:0 0 call_initcalls:40 level 6 ftmn_boot_tests() > D/TC:0 0 ftmn_boot_tests:198 Calling simple_call() > D/TC:0 0 ftmn_boot_tests:198 Return from simple_call() > D/TC:0 0 ftmn_boot_tests:199 Calling two_level_call() > D/TC:0 0 ftmn_boot_tests:199 Return from two_level_call() > D/TC:0 0 ftmn_boot_tests:200 Calling chained_calls() > D/TC:0 0 ftmn_boot_tests:200 Return from chained_calls() > D/TC:0 0 ftmn_boot_tests:202 ************************************************* > D/TC:0 0 ftmn_boot_tests:203 ************** Tests complete ***************** > D/TC:0 0 ftmn_boot_tests:204 ************************************************* > I/TC: Primary CPU switching to normal world boot > INFO: BL31: Preparing for EL3 exit to normal world > INFO: Entry point address = 0x11000000 > INFO: SPSR = 0x3c9 > > > U-Boot 2021.10 (Aug 03 2023 - 13:51:18 +0100) > > DRAM: 948 MiB > RPI 3 Model B+ (0xa020d3) > MMC: mmc@7e202000: 0, sdhci@7e300000: 1 > Loading Environment from FAT... OK > In: serial > Out: serial > Err: serial > Net: No ethernet found. > starting USB... > Bus usb@7e980000: USB DWC2 > scanning bus usb@7e980000 for devices... > Error: lan78xx_eth address not set. > 3 USB Device(s) found > scanning usb for storage devices... 0 Storage Device(s) found > Hit any key to stop autoboot: 3 ��� 2 ��� 1 ��� 0 > 22161708 bytes read in 920 ms (23 MiB/s) > Wrong Image Format for bootm command > ERROR: can't get kernel image! > U-Boot>
I don't think those instructions are right. You need to enabled CONFIG_FIT in the defconfig That message is printed by boot_get_kernel() when it doesn't use one of the enabled formats (Legacy uImage, FIT, Android). Regards, Simon