Understanding the Flattened Image Tree (FIT) 1.0 Specification for Embedded Linux

Introduction

Embedded Linux systems often rely on the U-Boot bootloader to launch the operating system. Traditionally, boot components like the kernel, device tree blobs (DTBs), and initial RAM disks are stored separately, complicating deployment and version management. The Flattened Image Tree (FIT) 1.0 specification standardizes a container format that bundles these components into a single file, simplifying boot configuration and increasing reliability. This article explores the FIT specification, its key features, and how it benefits embedded Linux development.

What is the Flattened Image Tree?

The Flattened Image Tree (FIT) is a flexible container format designed for the U-Boot bootloader. It encapsulates multiple binary images—such as the Linux kernel, device tree blobs, initial RAM file systems, and even boot scripts—into one file. The format uses a device tree-like structure (hence “flattened”) to describe the images and their relationships. Each image is identified by a node, and the tree can include hash values or digital signatures for integrity and authentication. The 1.0 specification finalizes the structure and rules, making it a stable target for embedded projects.

Why FIT Matters for Embedded Linux Development

FIT addresses common pain points in embedded boot chain management. Instead of juggling multiple files that can fall out of sync, developers handle a single container. The specification also supports configurations, which define which images to load for a given hardware variant. This is especially valuable for multiproduct lines where a single kernel image works with different device trees.

Simplifying Boot Configuration

With FIT, the bootloader can automatically select the correct device tree and kernel based on the board's compatible string. The configuration node in the FIT file lists the required images, removing the need for manual environment variables or complex scripting. Updating a system becomes as simple as replacing one FIT file instead of multiple separate binaries.

Enhancing Security and Verification

FIT supports hash verification (e.g., SHA-256) and digital signatures (e.g., RSA). The bootloader can verify each image before loading, ensuring that no component has been tampered with or corrupted. This is crucial for secure boot implementations in industrial, automotive, or IoT devices. The specification also allows chaining multiple signatures for multi-stage verification.

Key Features of the FIT 1.0 Specification

The FIT format is defined by the image-tree structure, which is essentially a device tree source (DTS) file compiled to a binary dtb. The root node contains two main types of child nodes: image nodes and configuration nodes.

Image Nodes

Each image node describes a binary payload. Common types include:

• kernel – the Linux kernel image (zImage, bzImage, or Image)
• fdt – a device tree blob
• ramdisk – an initial RAM disk or filesystem image
• script – a U-Boot boot script

Each node can also contain a hash subnode for integrity checking and a signature subnode for authentication. Image nodes are referenced by configuration nodes.

Configuration Nodes

Configuration nodes define how images are combined to boot a specific system. For example, a configuration might select kernel@1, fdt@boardA, and ramdisk@1. The bootloader finds the configuration that matches the board's compatible string, loads the listed images, and boots. This makes FIT ideal for supporting multiple hardware variants with a single binary distribution.

How to Create and Use a FIT Image

Creating a FIT file requires an image tree source (.its) file describing the container. The mkimage tool from U-Boot compiles this source into a binary .itb file. A typical workflow:

1. Write an .its file that enumerates all images, their types, and configurations.
2. Place the actual binary files (kernel, DTBs, initrd) in the same directory.
3. Run mkimage -f myimage.its myimage.itb.
4. Copy the .itb file to the boot media (SD card, eMMC, etc.).
5. Configure U-Boot to load myimage.itb and pass the kernel arguments via its bootm command.

For secure boot, you can additionally sign the FIT file using a private key. The public key is embedded in U-Boot, which verifies the signature before booting.

Conclusion

The Flattened Image Tree 1.0 specification provides a robust, standardized way to manage boot components in embedded Linux systems. By bundling the kernel, device trees, and ramdisks into a single container with built-in verification, it reduces complexity, enhances security, and simplifies lifecycle management. With widespread support in U-Boot and growing adoption in embedded Linux distributions, FIT is becoming a de facto standard for modern embedded boot chains.

For further reading, see the Key Features and How to Create sections. To implement FIT in your project, start by exploring the U-Boot documentation on FIT usage.