1MKIMAGE(1) General Commands Manual MKIMAGE(1)
2
6 mkimage - Generate image for U-Boot
7
9 mkimage [-T type] -l [uimage file name]
10 mkimage [options] -f [image tree source file] [uimage file name]
12 mkimage [options] -F [uimage file name]
14 mkimage [options] (legacy mode)
16
19 The mkimage command is used to create images for use with the U-Boot
20 boot loader. These images can contain the linux kernel, device tree
21 blob, root file system image, firmware images etc., either separate or
22 combined.
23 mkimage supports two different formats:
25 The old legacy image format concatenates the individual parts (for ex‐
27 ample, kernel image, device tree blob and ramdisk image) and adds a 64
28 bytes header containing information about target architecture, operat‐
29 ing system, image type, compression method, entry points, time stamp,
30 checksums, etc.
31 The new FIT (Flattened Image Tree) format allows for more flexibility
33 in handling images of various types and also enhances integrity protec‐
34 tion of images with stronger checksums. It also supports verified boot.
35
38 List image information:
39 -l [uimage file name]
42 mkimage lists the information contained in the header of an ex‐
43 isting U-Boot image.
44 -T [image type]
47 Parse image file as type. Pass -h as the image to see the list
48 of supported image type. Without this option image type is au‐
49 todetected.
50 Create old legacy image:
53 -A [architecture]
56 Set architecture. Pass -h as the architecture to see the list of
57 supported architectures.
58 -O [os]
61 Set operating system. bootm command of u-boot changes boot
62 method by os type. Pass -h as the OS to see the list of sup‐
63 ported OS.
64 -T [image type]
67 Set image type. Pass -h as the image to see the list of sup‐
68 ported image type.
69 -C [compression type]
72 Set compression type. Pass -h as the compression to see the
73 list of supported compression type.
74 -a [load address]
77 Set load address with a hex number.
78 -e [entry point]
81 Set entry point with a hex number.
82 -l List the contents of an image.
85 -n [image name]
88 Set image name to 'image name'.
89 -d [image data file]
92 Use image data from 'image data file'.
93 -x Set XIP (execute in place) flag.
96 Create FIT image:
99 -b [device tree file]
102 Appends the device tree binary file (.dtb) to the FIT.
103 -c [comment]
106 Specifies a comment to be added when signing. This is typically
107 a useful message which describes how the image was signed or
108 some other useful information.
109 -D [dtc options]
112 Provide special options to the device tree compiler that is used
113 to create the image.
114 -E After processing, move the image data outside the FIT and store
117 a data offset in the FIT. Images will be placed one after the
118 other immediately after the FIT, with each one aligned to a
119 4-byte boundary. The existing 'data' property in each image will
120 be replaced with 'data-offset' and 'data-size' properties. A
121 'data-offset' of 0 indicates that it starts in the first (4-byte
122 aligned) byte after the FIT.
123 -f [image tree source file | auto]
126 Image tree source file that describes the structure and contents
127 of the FIT image.
128 This can be automatically generated for some simple cases. Use
130 "-f auto" for this. In that case the arguments -d, -A, -O, -T,
131 -C, -a and -e are used to specify the image to include in the
132 FIT and its attributes. No .its file is required.
133 -F Indicates that an existing FIT image should be modified. No dtc
136 compilation is performed and the -f flag should not be given.
137 This can be used to sign images with additional keys after ini‐
138 tial image creation.
139 -i [ramdisk_file]
142 Appends the ramdisk file to the FIT.
143 -k [key_directory]
146 Specifies the directory containing keys to use for signing. This
147 directory should contain a private key file <name>.key for use
148 with signing and a certificate <name>.crt (containing the public
149 key) for use with verification.
150 -K [key_destination]
153 Specifies a compiled device tree binary file (typically .dtb) to
154 write public key information into. When a private key is used to
155 sign an image, the corresponding public key is written into this
156 file for for run-time verification. Typically the file here is
157 the device tree binary used by CONFIG_OF_CONTROL in U-Boot.
158 -o [signing algorithm]
161 Specifies the algorithm to be used for signing a FIT image. The
162 default is taken from the signature node's 'algo' property.
163 -p [external position]
166 Place external data at a static external position. See -E. In‐
167 stead of writing a 'data-offset' property defining the offset
168 from the end of the FIT, -p will use 'data-position' as the ab‐
169 solute position from the base of the FIT.
170 -r Specifies that keys used to sign the FIT are required. This
173 means that they must be verified for the image to boot. Without
174 this option, the verification will be optional (useful for test‐
175 ing but not for release).
176 -t Update the timestamp in the FIT.
179 Normally the FIT timestamp is created the first time mkimage is
181 run on a FIT, when converting the source .its to the binary .fit
182 file. This corresponds to using the -f flag. But if the original
183 input to mkimage is a binary file (already compiled) then the
184 timestamp is assumed to have been set previously.
185
188 List image information:
189 mkimage -l uImage
190 Create legacy image with compressed PowerPC Linux kernel:
192 mkimage -A powerpc -O linux -T kernel -C gzip \
193 -a 0 -e 0 -n Linux -d vmlinux.gz uImage
194 Create FIT image with compressed PowerPC Linux kernel:
196 mkimage -f kernel.its kernel.itb
197 Create FIT image with compressed kernel and sign it with keys in the
199 /public/signing-keys directory. Add corresponding public keys into u-
200 boot.dtb, skipping those for which keys cannot be found. Also add a
201 comment.
202 mkimage -f kernel.its -k /public/signing-keys -K u-boot.dtb \
203 -c "Kernel 3.8 image for production devices" kernel.itb
204 Update an existing FIT image, signing it with additional keys. Add
207 corresponding public keys into u-boot.dtb. This will resign all images
208 with keys that are available in the new directory. Images that request
209 signing with unavailable keys are skipped.
210 mkimage -F -k /secret/signing-keys -K u-boot.dtb \
211 -c "Kernel 3.8 image for production devices" kernel.itb
212 Create a FIT image containing a kernel, using automatic mode. No .its
215 file is required.
216 mkimage -f auto -A arm -O linux -T kernel -C none -a 43e00000 -e 0 \
217 -c "Kernel 4.4 image for production devices" -d vmlinuz kernel.itb
218 Create a FIT image containing a kernel and some device tree files, us‐
220 ing automatic mode. No .its file is required.
221 mkimage -f auto -A arm -O linux -T kernel -C none -a 43e00000 -e 0 \
222 -c "Kernel 4.4 image for production devices" -d vmlinuz \
223 -b /path/to/rk3288-firefly.dtb -b /path/to/rk3288-jerry.dtb kernel.itb
224
227 http://www.denx.de/wiki/U-Boot/WebHome
228
230 This manual page was written by Nobuhiro Iwamatsu <iwamatsu@ni‐
231 gauri.org> and Wolfgang Denk <wd@denx.de>. It was updated for image
232 signing by Simon Glass <sjg@chromium.org>.
233 2022-02-07 MKIMAGE(1)