OpenWrt's custom uImage magic patch makes legacy image verification use
params.magic instead of IH_MAGIC.
mkimage initializes this field, while dumpimage leaves it zeroed. This
causes dumpimage to reject valid legacy uImages using the standard
IH_MAGIC with FDT_ERR_BADMAGIC.
Initialize dumpimage's magic to IH_MAGIC so the normal verification path
works by default. Also add -M handling matching mkimage, allowing
dumpimage to verify and extract uImages built with a custom magic.
Tested with the patched U-Boot 2026.07 host tools. Standard-magic images
list and extract correctly, custom-magic images are accepted with the
matching -M value, and are rejected without it or with an incorrect
magic. Extracted payloads were verified byte-for-byte.
Fixes: #25287
Signed-off-by: Massimo Mazzariol <mazzariol.massimo@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25288
Signed-off-by: Robert Marko <robimarko@gmail.com>
host-build.mk clears MAKEFLAGS, so a custom Host/Compile that runs a bare
$(MAKE) builds with one job, whatever HOST_BUILD_PARALLEL says. mtools
sets the flag, but its compile step never used it.
Each of the three now passes $(HOST_JOBS), and mkimage and lzma set
HOST_BUILD_PARALLEL:
mkimage 11.7 s -> 7.2 s
mtools 8.3 s -> 4.8 s
lzma 4.0 s -> 1.8 s
Each one builds five times out of five with the job server, and each
build installs files that are identical to those of a serial build.
Signed-off-by: John Crispin <john@phrozen.org>
Switch http:// (and redundant ftp://) PKG_SOURCE_URL entries to https://
across tools/ and package/. PKG_HASH alone does not protect against an
attacker tampering with insecure downloads when a maintainer regenerates
the hash via `make ... FIXUP=1`: HTTPS authenticates the upstream so the
captured hash reflects real upstream content.
In-place http -> https (HTTPS reachability verified per host):
- tools/elftosb, tools/lzop, tools/liblzo, tools/mpfr, tools/dosfstools,
tools/libressl, tools/xz
- package/libs/mpfr, package/libs/libmnl, package/libs/libnfnetlink
Replaced with @OPENWRT (HTTPS-only mirror) where the upstream HTTPS host
is dead or has a broken certificate:
- package/libs/popt (ftp.rpm.org cert mismatch)
- package/firmware/ixp4xx-microcode (was http://downloads.openwrt.org)
- package/boot/imx-bootlets (trabant.uid0.hu cert mismatch)
- package/boot/kobs-ng (freescale.com URL is dead, redirects to nxp.com root)
Dropped redundant ftp://ftp.denx.de fallback (https://ftp.denx.de is
already listed):
- package/boot/uboot-tools, tools/mkimage
Signed-off-by: Paul Spooren <mail@aparcar.org>
The defconfig file used to build tools is "tools-only_defconfig".
Though u-boot scripts can still automatically handle the old style
name for compatibility reason, it's better to use the correct name.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/22844
Signed-off-by: Nick Hainke <vincent@systemli.org>
Patches for mtk_image supporting newer SoCs have been dropped in the
process of updating mkimage to U-Boot 2022.10. While it is true that
the patches have been merged upstream a while ago, they were not merged
in time to be part of the U-Boot 2022.10 release.
See also commit 537b423d9f ("uboot-mediatek: update to U-Boot 2022.10")
which explicitly mentions that.
Fixes: 6e245777bd ("tools/mkimage: update to 2022.10")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
All images generated by mkimage are now always validated.
This change broke our downstream support for setting a custom value for
IH_MAGIC (mkimage -M ...). Make sure also plain legacy kernel images
with custom value set for IH_MAGIC validate correctly.
Fixes: fa9895ee5b ("tools: mkimage: update to U-Boot release 2022.07")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Removed patch 090-macos-arm64-builing-fix.patch as an equivalent
solution was applied upstream:
3b142045e8 Support building on macOS/arm64
To not add new host dependencies (libuuid, gnuTLS) don't build the
anyway unused mkeficapsule tool which would otherwise now be built
by default.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
mkimage limits the length of the file paths in can deal with to 256
characters. Turns out that in automated builds by asu we break this
limit, so increase it to 1024 characters.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Remove the then unnecessary patch doing exactly that individually.
See also 09465d80 "u-boot.mk: always link host libraries static".
Signed-off-by: Andre Heider <a.heider@gmail.com>
Add patches for mkimage to allow using it instead of the binary-only
'bromimage' tool to generate bl2 for MT7622.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* The fit image is now created with 0666 permission in upstream U-Boot
remove our patch switch creates it with 0744
* The generated/autoconf.h file is created now as an empty file, it is
not needed to remove this include any more.
* Upstream lib/rsa/rsa-sign.c now includes stdlib.h instead of malloc.h
* ALIGN_MASK was moved to imagetool.h, own patch should not be needed
any more.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
also change the download source to https and add a mirror
drop merged patches
Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>
[Add extra changes to compile on FreeBSD, merge two patches]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This updates the U-Boot which provides the host tools like mkimage to
version 2019.07.
The patches were cleaned up and it was checked if this still compiles
on Linux and FreeBSD.
CONFIG_FIT_SIGNATURE_MAX_SIZE is set to the default value.
The patch for libressl was merged upstream.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Fixes timeouts with trying to access the FTP site.
Also remove mirror2.openwrt.org, which does not keep current tarballs
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The new mkimage version requires a CONFIG_MKIMAGE_DTC_PATH variable to be
provided during build, in order to hardcode a path to a suitable DT
compiler executable.
Failure to do so will result in stray "sh: 1: -I: not found" errors when
invoking mkimage for FIT image generation.
Fix the issue by supplying "dtc" as CONFIG_MKIMAGE_DTC_PATH value during
build. As we intend our host utilities to be relocatable and since we're
already overriding PATH when invoking mkimage, an absolute path is not
required.
Fixes: b13e981d72 ("tools/mkimage: update to version 2018.03")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This activates support for fit images and some other new mkimage
features. Some of the patches were applied upstream and could be
removed.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
For some boards u-boot binary environment file is required,
which is generated by mkenvimage utility. But in OpenWrt there
is no separate support for mkenvimage, which is a part of u-boot tools.
mkenvimage gets built in u-boot/tools as well as mkimage anyways.
So lets just copy mkenvimage to the $(STAGING_DIR_HOST)/bin/ directory.
Signed-off-by: Evgeniy Didin <Evgeniy.Didin@synopsys.com>
CC: Alexey Brodkin <abrodkin@synopsys.com>
CC: Hauke Mehrtens <hauke@hauke-m.de>
CC: John Crispin <john@phrozen.org>
Since linker argument order is significant on modern host compilers, pass
the required libcrypto libraries through the HOST_LOADLIBES variable in
order to ensure proper order of the final linker command line.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
LibreSSL's libcrypto.so has an indirect dependency to librt for clock_gettime()
on Linux.
Use pkg-config to portably discover the required linker flags.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
The OpenSSL 1.1.x version series undergone some major API changes which made
the RSA structure opaque and deprecated a number of methods, so add some
conditional compat code to make the u-boot source build again.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Shiji Yang
Ryan Leung
Robert Marko
Massimo Mazzariol
John Crispin
Paul Spooren
Stefan Kalscheuer
Shiji Yang
Nick Hainke
Linhui Liu
Daniel Golle
Huangbin Zhan
Sergey V. Lobanov
Andre Heider
Hauke Mehrtens
Ted Hess
Lucian Cristian
Felix Fietkau
Jo-Philipp Wich
Evgeniy Didin
Marty Plummer
Matthias Schiffer