AM62A7: Uboot booting signed and encrypted Linux fit image

Part Number: AM62A7

Hi,

I am using ti-processor-sdk-linux-edgeai-am62a-evm-11.01.07.05 to build Uboot and I can boot to Uboot on my HS-SE board successfully. I am signing the tiboot, tispl, and u-boot images through binman.

Now when I try to boot my signed and encrypted Linux fit image from U-boot, I get the following error:

fdt_magic(fdt) = d00dfeed
fdt_magic(fdt) = d00dfeed
   Using 'conf-2' configuration
   Verifying Hash Integrity ... OK
   Trying 'kernel' kernel subimage
     Description:  Stella Linux kernel
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x8f0000e4
     Data Size:    8315158 Bytes = 7.9 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x83000000
     Entry :  0x830000P    Hash algo:    crc32
     Hash value:   9ccf37ae
   Verifying Hash Integrity ... crc32+ OK
fdt_magic(fdt) = d00dfeed
fdt_magic(fdt) = d00dfeed
## Loading ramdisk from FIT Image at 8f000000 ...
fdt_magic(fdt) = d00dfeed
fdt_magic(fdt) = d00dfeed
   Using 'conf-2' configuration
   Verifying Hash Integrity ... OK
   Trying 'ramdisk-1' ramdisk subimage
     Description:  Compressed Initramfs
     Type:         RAMDisk Image
     Compression:  zstd compressed
     Data Start:   0x8f7fc688
     Data Size:    50885399 Bytes = 48.5 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x85000000
     Entry Point:  0x85000000
     Hash algo:    sha1
     Hash value:   223eacefa1c1d91c27389fd88c4867640adc55d7
   Verifying Hash Integrity ... sha1+ OK
   Loading ramdisk from 0x8f7fc688 to 0x85000000
WARNING: 'compression' nodes for ramdisks are deprecated, please fix your .its file!
fdt_magic(fdt) = d00dfeed
fdt_magic(fd d00dfeed
fdt_magic(fdt) = d00dfeed
## Loading fdt from FIT Image at 8f000000 ...
fdt_magic(fdt) = d00dfeed
fdt_magic(fdt) = d00dfeed
   Using 'conf-2' configuration
   Verifying Hash Integrity ... OK
   Trying 'fdt-1' fdt subimage
     Description:  Stella Flattened Device Tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x8f7ee2ec
     Data Size:    58070 Bytes = 56.7 KiB
     Architecture: AArch64
     Load Address: 0x82000000
     Hash alg    crc32
     Hash value:   2674846c
   Verifying Hash Integrity ... crc32+ OK
   Loading fdt from 0x8f7ee2ec to 0x82000000
fdt_magic(fdt) = 30820702
  DEBUG IH_TYPE_FLATDT loadbuf address 0000000082000000
 fdt_check_header() return = -9
fdt_magic(fdt) = 30820702
Subimage data is not a FDTCould not find a valid device tree

In an older ti-processor-sdk-linux-am62axx-evm-08.06.00.45 Uboot, I am able to boot the same fit image successfully.

I added some debug and found that in the newer SDK version, CONFIG_FIT_IMAGE_POST_PROCESS is now disabled and has a dependency on CONFIG_SOCFPGA_SECURE_VAB_AUTH. In the older SDK version, CONFIG_FIT_IMAGE_POST_PROCESS is enabled. My understanding is this config is needed to authenticate each image in the fit and even decrypt it.

Why is CONFIG_FIT_IMAGE_POST_PROCESS now disabled and dependent on this specific config? 

Is there a new signing flow for the Linux fit image?

This is my current signing flow for the Linux fit image:

1. Sign and encrypt Image using appimage_x509_cert_gen.py
2. Sign and encrypt rootfs using appimage_x509_cert_gen.py
3. Sign and encrypt fdt using appimage_x509_cert_gen.py
4. Make fit image "mkimage -f config.its fitimage"

Thank you,

Joseph