rkcommon.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * (C) Copyright 2015 Google, Inc
  4. * Written by Simon Glass <sjg@chromium.org>
  5. *
  6. * (C) 2017 Theobroma Systems Design und Consulting GmbH
  7. *
  8. * Helper functions for Rockchip images
  9. */
  10. #include "imagetool.h"
  11. #include <image.h>
  12. #include <rc4.h>
  13. #include "mkimage.h"
  14. #include "rkcommon.h"
  15. enum {
  16. RK_SIGNATURE = 0x0ff0aa55,
  17. };
  18. /**
  19. * struct header0_info - header block for boot ROM
  20. *
  21. * This is stored at SD card block 64 (where each block is 512 bytes, or at
  22. * the start of SPI flash. It is encoded with RC4.
  23. *
  24. * @signature: Signature (must be RKSD_SIGNATURE)
  25. * @disable_rc4: 0 to use rc4 for boot image, 1 to use plain binary
  26. * @init_offset: Offset in blocks of the SPL code from this header
  27. * block. E.g. 4 means 2KB after the start of this header.
  28. * Other fields are not used by U-Boot
  29. */
  30. struct header0_info {
  31. uint32_t signature;
  32. uint8_t reserved[4];
  33. uint32_t disable_rc4;
  34. uint16_t init_offset;
  35. uint8_t reserved1[492];
  36. uint16_t init_size;
  37. uint16_t init_boot_size;
  38. uint8_t reserved2[2];
  39. };
  40. /**
  41. * struct header1_info
  42. */
  43. struct header1_info {
  44. uint32_t magic;
  45. };
  46. /**
  47. * struct spl_info - spl info for each chip
  48. *
  49. * @imagename: Image name(passed by "mkimage -n")
  50. * @spl_hdr: Boot ROM requires a 4-bytes spl header
  51. * @spl_size: Spl size(include extra 4-bytes spl header)
  52. * @spl_rc4: RC4 encode the SPL binary (same key as header)
  53. */
  54. struct spl_info {
  55. const char *imagename;
  56. const char *spl_hdr;
  57. const uint32_t spl_size;
  58. const bool spl_rc4;
  59. };
  60. static struct spl_info spl_infos[] = {
  61. { "px30", "RK33", 0x2800, false },
  62. { "rk3036", "RK30", 0x1000, false },
  63. { "rk3128", "RK31", 0x1800, false },
  64. { "rk3188", "RK31", 0x8000 - 0x800, true },
  65. { "rk322x", "RK32", 0x8000 - 0x1000, false },
  66. { "rk3288", "RK32", 0x8000, false },
  67. { "rk3308", "RK33", 0x40000 - 0x1000, false},
  68. { "rk3328", "RK32", 0x8000 - 0x1000, false },
  69. { "rk3368", "RK33", 0x8000 - 0x1000, false },
  70. { "rk3399", "RK33", 0x30000 - 0x2000, false },
  71. { "rv1108", "RK11", 0x1800, false },
  72. };
  73. /**
  74. * struct spl_params - spl params parsed in check_params()
  75. *
  76. * @init_file: Init data file path
  77. * @init_size: Aligned size of init data in bytes
  78. * @boot_file: Boot data file path
  79. * @boot_size: Aligned size of boot data in bytes
  80. */
  81. struct spl_params {
  82. char *init_file;
  83. uint32_t init_size;
  84. char *boot_file;
  85. uint32_t boot_size;
  86. };
  87. static struct spl_params spl_params = { 0 };
  88. static unsigned char rc4_key[16] = {
  89. 124, 78, 3, 4, 85, 5, 9, 7,
  90. 45, 44, 123, 56, 23, 13, 23, 17
  91. };
  92. static struct spl_info *rkcommon_get_spl_info(char *imagename)
  93. {
  94. int i;
  95. if (!imagename)
  96. return NULL;
  97. for (i = 0; i < ARRAY_SIZE(spl_infos); i++)
  98. if (!strncmp(imagename, spl_infos[i].imagename, 6))
  99. return spl_infos + i;
  100. return NULL;
  101. }
  102. static int rkcommon_get_aligned_size(struct image_tool_params *params,
  103. const char *fname)
  104. {
  105. int size;
  106. size = imagetool_get_filesize(params, fname);
  107. if (size < 0)
  108. return -1;
  109. /*
  110. * Pad to a 2KB alignment, as required for init/boot size by the ROM
  111. * (see https://lists.denx.de/pipermail/u-boot/2017-May/293268.html)
  112. */
  113. return ROUND(size, RK_SIZE_ALIGN);
  114. }
  115. int rkcommon_check_params(struct image_tool_params *params)
  116. {
  117. int i, size;
  118. /*
  119. * If this is a operation (list or extract), the don't require
  120. * imagename to be set.
  121. */
  122. if (params->lflag || params->iflag)
  123. return EXIT_SUCCESS;
  124. if (!rkcommon_get_spl_info(params->imagename))
  125. goto err_spl_info;
  126. spl_params.init_file = params->datafile;
  127. spl_params.boot_file = strchr(spl_params.init_file, ':');
  128. if (spl_params.boot_file) {
  129. *spl_params.boot_file = '\0';
  130. spl_params.boot_file += 1;
  131. }
  132. size = rkcommon_get_aligned_size(params, spl_params.init_file);
  133. if (size < 0)
  134. return EXIT_FAILURE;
  135. spl_params.init_size = size;
  136. /* Boot file is optional, and only for back-to-bootrom functionality. */
  137. if (spl_params.boot_file) {
  138. size = rkcommon_get_aligned_size(params, spl_params.boot_file);
  139. if (size < 0)
  140. return EXIT_FAILURE;
  141. spl_params.boot_size = size;
  142. }
  143. if (spl_params.init_size > rkcommon_get_spl_size(params)) {
  144. fprintf(stderr,
  145. "Error: SPL image is too large (size %#x than %#x)\n",
  146. spl_params.init_size, rkcommon_get_spl_size(params));
  147. return EXIT_FAILURE;
  148. }
  149. return EXIT_SUCCESS;
  150. err_spl_info:
  151. fprintf(stderr, "ERROR: imagename (%s) is not supported!\n",
  152. params->imagename ? params->imagename : "NULL");
  153. fprintf(stderr, "Available imagename:");
  154. for (i = 0; i < ARRAY_SIZE(spl_infos); i++)
  155. fprintf(stderr, "\t%s", spl_infos[i].imagename);
  156. fprintf(stderr, "\n");
  157. return EXIT_FAILURE;
  158. }
  159. const char *rkcommon_get_spl_hdr(struct image_tool_params *params)
  160. {
  161. struct spl_info *info = rkcommon_get_spl_info(params->imagename);
  162. /*
  163. * info would not be NULL, because of we checked params before.
  164. */
  165. return info->spl_hdr;
  166. }
  167. int rkcommon_get_spl_size(struct image_tool_params *params)
  168. {
  169. struct spl_info *info = rkcommon_get_spl_info(params->imagename);
  170. /*
  171. * info would not be NULL, because of we checked params before.
  172. */
  173. return info->spl_size;
  174. }
  175. bool rkcommon_need_rc4_spl(struct image_tool_params *params)
  176. {
  177. struct spl_info *info = rkcommon_get_spl_info(params->imagename);
  178. /*
  179. * info would not be NULL, because of we checked params before.
  180. */
  181. return info->spl_rc4;
  182. }
  183. static void rkcommon_set_header0(void *buf, struct image_tool_params *params)
  184. {
  185. struct header0_info *hdr = buf;
  186. uint32_t init_boot_size;
  187. memset(buf, '\0', RK_INIT_OFFSET * RK_BLK_SIZE);
  188. hdr->signature = cpu_to_le32(RK_SIGNATURE);
  189. hdr->disable_rc4 = cpu_to_le32(!rkcommon_need_rc4_spl(params));
  190. hdr->init_offset = cpu_to_le16(RK_INIT_OFFSET);
  191. hdr->init_size = cpu_to_le16(spl_params.init_size / RK_BLK_SIZE);
  192. /*
  193. * init_boot_size needs to be set, as it is read by the BootROM
  194. * to determine the size of the next-stage bootloader (e.g. U-Boot
  195. * proper), when used with the back-to-bootrom functionality.
  196. *
  197. * see https://lists.denx.de/pipermail/u-boot/2017-May/293267.html
  198. * for a more detailed explanation by Andy Yan
  199. */
  200. if (spl_params.boot_file)
  201. init_boot_size = spl_params.init_size + spl_params.boot_size;
  202. else
  203. init_boot_size = spl_params.init_size + RK_MAX_BOOT_SIZE;
  204. hdr->init_boot_size = cpu_to_le16(init_boot_size / RK_BLK_SIZE);
  205. rc4_encode(buf, RK_BLK_SIZE, rc4_key);
  206. }
  207. void rkcommon_set_header(void *buf, struct stat *sbuf, int ifd,
  208. struct image_tool_params *params)
  209. {
  210. struct header1_info *hdr = buf + RK_SPL_HDR_START;
  211. rkcommon_set_header0(buf, params);
  212. /* Set up the SPL name (i.e. copy spl_hdr over) */
  213. memcpy(&hdr->magic, rkcommon_get_spl_hdr(params), RK_SPL_HDR_SIZE);
  214. if (rkcommon_need_rc4_spl(params))
  215. rkcommon_rc4_encode_spl(buf, RK_SPL_HDR_START,
  216. spl_params.init_size);
  217. if (spl_params.boot_file) {
  218. if (rkcommon_need_rc4_spl(params))
  219. rkcommon_rc4_encode_spl(buf + RK_SPL_HDR_START,
  220. spl_params.init_size,
  221. spl_params.boot_size);
  222. }
  223. }
  224. static inline unsigned rkcommon_offset_to_spi(unsigned offset)
  225. {
  226. /*
  227. * While SD/MMC images use a flat addressing, SPI images are padded
  228. * to use the first 2K of every 4K sector only.
  229. */
  230. return ((offset & ~0x7ff) << 1) + (offset & 0x7ff);
  231. }
  232. static int rkcommon_parse_header(const void *buf, struct header0_info *header0,
  233. struct spl_info **spl_info)
  234. {
  235. unsigned hdr1_offset;
  236. struct header1_info *hdr1_sdmmc, *hdr1_spi;
  237. int i;
  238. if (spl_info)
  239. *spl_info = NULL;
  240. /*
  241. * The first header (hdr0) is always RC4 encoded, so try to decrypt
  242. * with the well-known key.
  243. */
  244. memcpy((void *)header0, buf, sizeof(struct header0_info));
  245. rc4_encode((void *)header0, sizeof(struct header0_info), rc4_key);
  246. if (le32_to_cpu(header0->signature) != RK_SIGNATURE)
  247. return -EPROTO;
  248. /* We don't support RC4 encoded image payloads here, yet... */
  249. if (le32_to_cpu(header0->disable_rc4) == 0)
  250. return -ENOSYS;
  251. hdr1_offset = le16_to_cpu(header0->init_offset) * RK_BLK_SIZE;
  252. hdr1_sdmmc = (struct header1_info *)(buf + hdr1_offset);
  253. hdr1_spi = (struct header1_info *)(buf +
  254. rkcommon_offset_to_spi(hdr1_offset));
  255. for (i = 0; i < ARRAY_SIZE(spl_infos); i++) {
  256. if (!memcmp(&hdr1_sdmmc->magic, spl_infos[i].spl_hdr,
  257. RK_SPL_HDR_SIZE)) {
  258. if (spl_info)
  259. *spl_info = &spl_infos[i];
  260. return IH_TYPE_RKSD;
  261. } else if (!memcmp(&hdr1_spi->magic, spl_infos[i].spl_hdr,
  262. RK_SPL_HDR_SIZE)) {
  263. if (spl_info)
  264. *spl_info = &spl_infos[i];
  265. return IH_TYPE_RKSPI;
  266. }
  267. }
  268. return -1;
  269. }
  270. int rkcommon_verify_header(unsigned char *buf, int size,
  271. struct image_tool_params *params)
  272. {
  273. struct header0_info header0;
  274. struct spl_info *img_spl_info, *spl_info;
  275. int ret;
  276. ret = rkcommon_parse_header(buf, &header0, &img_spl_info);
  277. /* If this is the (unimplemented) RC4 case, then rewrite the result */
  278. if (ret == -ENOSYS)
  279. return 0;
  280. if (ret < 0)
  281. return ret;
  282. /*
  283. * If no 'imagename' is specified via the commandline (e.g. if this is
  284. * 'dumpimage -l' w/o any further constraints), we accept any spl_info.
  285. */
  286. if (params->imagename == NULL)
  287. return 0;
  288. /* Match the 'imagename' against the 'spl_hdr' found */
  289. spl_info = rkcommon_get_spl_info(params->imagename);
  290. if (spl_info && img_spl_info)
  291. return strcmp(spl_info->spl_hdr, img_spl_info->spl_hdr);
  292. return -ENOENT;
  293. }
  294. void rkcommon_print_header(const void *buf)
  295. {
  296. struct header0_info header0;
  297. struct spl_info *spl_info;
  298. uint8_t image_type;
  299. int ret, boot_size, init_size;
  300. ret = rkcommon_parse_header(buf, &header0, &spl_info);
  301. /* If this is the (unimplemented) RC4 case, then fail silently */
  302. if (ret == -ENOSYS)
  303. return;
  304. if (ret < 0) {
  305. fprintf(stderr, "Error: image verification failed\n");
  306. return;
  307. }
  308. image_type = ret;
  309. printf("Image Type: Rockchip %s (%s) boot image\n",
  310. spl_info->spl_hdr,
  311. (image_type == IH_TYPE_RKSD) ? "SD/MMC" : "SPI");
  312. init_size = le16_to_cpu(header0.init_size) * RK_BLK_SIZE;
  313. printf("Init Data Size: %d bytes\n", init_size);
  314. boot_size = le16_to_cpu(header0.init_boot_size) * RK_BLK_SIZE - init_size;
  315. if (boot_size != RK_MAX_BOOT_SIZE)
  316. printf("Boot Data Size: %d bytes\n", boot_size);
  317. }
  318. void rkcommon_rc4_encode_spl(void *buf, unsigned int offset, unsigned int size)
  319. {
  320. unsigned int remaining = size;
  321. while (remaining > 0) {
  322. int step = (remaining > RK_BLK_SIZE) ? RK_BLK_SIZE : remaining;
  323. rc4_encode(buf + offset, step, rc4_key);
  324. offset += RK_BLK_SIZE;
  325. remaining -= step;
  326. }
  327. }
  328. int rkcommon_vrec_header(struct image_tool_params *params,
  329. struct image_type_params *tparams)
  330. {
  331. /*
  332. * The SPL image looks as follows:
  333. *
  334. * 0x0 header0 (see rkcommon.c)
  335. * 0x800 spl_name ('RK30', ..., 'RK33')
  336. * (start of the payload for AArch64 payloads: we expect the
  337. * first 4 bytes to be available for overwriting with our
  338. * spl_name)
  339. * 0x804 first instruction to be executed
  340. * (start of the image/payload for 32bit payloads)
  341. *
  342. * For AArch64 (ARMv8) payloads, natural alignment (8-bytes) is
  343. * required for its sections (so the image we receive needs to
  344. * have the first 4 bytes reserved for the spl_name). Reserving
  345. * these 4 bytes is done using the BOOT0_HOOK infrastructure.
  346. *
  347. * The header is always at 0x800 (as we now use a payload
  348. * prepadded using the boot0 hook for all targets): the first
  349. * 4 bytes of these images can safely be overwritten using the
  350. * boot magic.
  351. */
  352. tparams->header_size = RK_SPL_HDR_START;
  353. /* Allocate, clear and install the header */
  354. tparams->hdr = malloc(tparams->header_size);
  355. if (!tparams->hdr) {
  356. fprintf(stderr, "%s: Can't alloc header: %s\n",
  357. params->cmdname, strerror(errno));
  358. exit(EXIT_FAILURE);
  359. }
  360. memset(tparams->hdr, 0, tparams->header_size);
  361. /*
  362. * We need to store the original file-size (i.e. before padding), as
  363. * imagetool does not set this during its adjustment of file_size.
  364. */
  365. params->orig_file_size = tparams->header_size +
  366. spl_params.init_size + spl_params.boot_size;
  367. params->file_size = ROUND(params->orig_file_size, RK_SIZE_ALIGN);
  368. /* Ignoring pad len, since we are using our own copy_image() */
  369. return 0;
  370. }
  371. static int pad_file(struct image_tool_params *params, int ifd, int pad)
  372. {
  373. uint8_t zeros[4096];
  374. memset(zeros, 0, sizeof(zeros));
  375. while (pad > 0) {
  376. int todo = sizeof(zeros);
  377. if (todo > pad)
  378. todo = pad;
  379. if (write(ifd, (char *)&zeros, todo) != todo) {
  380. fprintf(stderr, "%s: Write error on %s: %s\n",
  381. params->cmdname, params->imagefile,
  382. strerror(errno));
  383. return -1;
  384. }
  385. pad -= todo;
  386. }
  387. return 0;
  388. }
  389. static int copy_file(struct image_tool_params *params, int ifd,
  390. const char *file, int padded_size)
  391. {
  392. int dfd;
  393. struct stat sbuf;
  394. unsigned char *ptr;
  395. int size;
  396. if (params->vflag)
  397. fprintf(stderr, "Adding Image %s\n", file);
  398. dfd = open(file, O_RDONLY | O_BINARY);
  399. if (dfd < 0) {
  400. fprintf(stderr, "%s: Can't open %s: %s\n",
  401. params->cmdname, file, strerror(errno));
  402. return -1;
  403. }
  404. if (fstat(dfd, &sbuf) < 0) {
  405. fprintf(stderr, "%s: Can't stat %s: %s\n",
  406. params->cmdname, file, strerror(errno));
  407. goto err_close;
  408. }
  409. if (params->vflag)
  410. fprintf(stderr, "Size %u(pad to %u)\n",
  411. (int)sbuf.st_size, padded_size);
  412. ptr = mmap(0, sbuf.st_size, PROT_READ, MAP_SHARED, dfd, 0);
  413. if (ptr == MAP_FAILED) {
  414. fprintf(stderr, "%s: Can't read %s: %s\n",
  415. params->cmdname, file, strerror(errno));
  416. goto err_munmap;
  417. }
  418. size = sbuf.st_size;
  419. if (write(ifd, ptr, size) != size) {
  420. fprintf(stderr, "%s: Write error on %s: %s\n",
  421. params->cmdname, params->imagefile, strerror(errno));
  422. goto err_munmap;
  423. }
  424. munmap((void *)ptr, sbuf.st_size);
  425. close(dfd);
  426. return pad_file(params, ifd, padded_size - size);
  427. err_munmap:
  428. munmap((void *)ptr, sbuf.st_size);
  429. err_close:
  430. close(dfd);
  431. return -1;
  432. }
  433. int rockchip_copy_image(int ifd, struct image_tool_params *params)
  434. {
  435. int ret;
  436. ret = copy_file(params, ifd, spl_params.init_file,
  437. spl_params.init_size);
  438. if (ret)
  439. return ret;
  440. if (spl_params.boot_file) {
  441. ret = copy_file(params, ifd, spl_params.boot_file,
  442. spl_params.boot_size);
  443. if (ret)
  444. return ret;
  445. }
  446. return pad_file(params, ifd,
  447. params->file_size - params->orig_file_size);
  448. }