rkcommon.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * (C) Copyright 2015 Google, Inc
  4. * Written by Simon Glass <sjg@chromium.org>
  5. *
  6. * (C) 2017 Theobroma Systems Design und Consulting GmbH
  7. *
  8. * Helper functions for Rockchip images
  9. */
  10. #include "imagetool.h"
  11. #include <image.h>
  12. #include <rc4.h>
  13. #include "mkimage.h"
  14. #include "rkcommon.h"
  15. enum {
  16. RK_SIGNATURE = 0x0ff0aa55,
  17. };
  18. /**
  19. * struct header0_info - header block for boot ROM
  20. *
  21. * This is stored at SD card block 64 (where each block is 512 bytes, or at
  22. * the start of SPI flash. It is encoded with RC4.
  23. *
  24. * @signature: Signature (must be RKSD_SIGNATURE)
  25. * @disable_rc4: 0 to use rc4 for boot image, 1 to use plain binary
  26. * @init_offset: Offset in blocks of the SPL code from this header
  27. * block. E.g. 4 means 2KB after the start of this header.
  28. * Other fields are not used by U-Boot
  29. */
  30. struct header0_info {
  31. uint32_t signature;
  32. uint8_t reserved[4];
  33. uint32_t disable_rc4;
  34. uint16_t init_offset;
  35. uint8_t reserved1[492];
  36. uint16_t init_size;
  37. uint16_t init_boot_size;
  38. uint8_t reserved2[2];
  39. };
  40. /**
  41. * struct header1_info
  42. */
  43. struct header1_info {
  44. uint32_t magic;
  45. };
  46. /**
  47. * struct spl_info - spl info for each chip
  48. *
  49. * @imagename: Image name(passed by "mkimage -n")
  50. * @spl_hdr: Boot ROM requires a 4-bytes spl header
  51. * @spl_size: Spl size(include extra 4-bytes spl header)
  52. * @spl_rc4: RC4 encode the SPL binary (same key as header)
  53. */
  54. struct spl_info {
  55. const char *imagename;
  56. const char *spl_hdr;
  57. const uint32_t spl_size;
  58. const bool spl_rc4;
  59. };
  60. static struct spl_info spl_infos[] = {
  61. { "px30", "RK33", 0x2800, false },
  62. { "rk3036", "RK30", 0x1000, false },
  63. { "rk3128", "RK31", 0x1800, false },
  64. { "rk3188", "RK31", 0x8000 - 0x800, true },
  65. { "rk322x", "RK32", 0x8000 - 0x1000, false },
  66. { "rk3288", "RK32", 0x8000, false },
  67. { "rk3308", "RK33", 0x40000 - 0x1000, false},
  68. { "rk3328", "RK32", 0x8000 - 0x1000, false },
  69. { "rk3368", "RK33", 0x8000 - 0x1000, false },
  70. { "rk3399", "RK33", 0x30000 - 0x2000, false },
  71. { "rv1108", "RK11", 0x1800, false },
  72. };
  73. /**
  74. * struct spl_params - spl params parsed in check_params()
  75. *
  76. * @init_file: Init data file path
  77. * @init_size: Aligned size of init data in bytes
  78. * @boot_file: Boot data file path
  79. * @boot_size: Aligned size of boot data in bytes
  80. */
  81. struct spl_params {
  82. char *init_file;
  83. uint32_t init_size;
  84. char *boot_file;
  85. uint32_t boot_size;
  86. };
  87. static struct spl_params spl_params = { 0 };
  88. static unsigned char rc4_key[16] = {
  89. 124, 78, 3, 4, 85, 5, 9, 7,
  90. 45, 44, 123, 56, 23, 13, 23, 17
  91. };
  92. static struct spl_info *rkcommon_get_spl_info(char *imagename)
  93. {
  94. int i;
  95. if (!imagename)
  96. return NULL;
  97. for (i = 0; i < ARRAY_SIZE(spl_infos); i++)
  98. if (!strncmp(imagename, spl_infos[i].imagename, 6))
  99. return spl_infos + i;
  100. return NULL;
  101. }
  102. static int rkcommon_get_aligned_size(struct image_tool_params *params,
  103. const char *fname)
  104. {
  105. int size;
  106. size = imagetool_get_filesize(params, fname);
  107. if (size < 0)
  108. return -1;
  109. /*
  110. * Pad to a 2KB alignment, as required for init/boot size by the ROM
  111. * (see https://lists.denx.de/pipermail/u-boot/2017-May/293268.html)
  112. */
  113. return ROUND(size, RK_SIZE_ALIGN);
  114. }
  115. int rkcommon_check_params(struct image_tool_params *params)
  116. {
  117. int i;
  118. /*
  119. * If this is a operation (list or extract), the don't require
  120. * imagename to be set.
  121. */
  122. if (params->lflag || params->iflag)
  123. return EXIT_SUCCESS;
  124. if (!rkcommon_get_spl_info(params->imagename))
  125. goto err_spl_info;
  126. spl_params.init_file = params->datafile;
  127. spl_params.boot_file = strchr(spl_params.init_file, ':');
  128. if (spl_params.boot_file) {
  129. *spl_params.boot_file = '\0';
  130. spl_params.boot_file += 1;
  131. }
  132. spl_params.init_size =
  133. rkcommon_get_aligned_size(params, spl_params.init_file);
  134. if (spl_params.init_size < 0)
  135. return EXIT_FAILURE;
  136. /* Boot file is optional, and only for back-to-bootrom functionality. */
  137. if (spl_params.boot_file) {
  138. spl_params.boot_size =
  139. rkcommon_get_aligned_size(params, spl_params.boot_file);
  140. if (spl_params.boot_size < 0)
  141. return EXIT_FAILURE;
  142. }
  143. if (spl_params.init_size > rkcommon_get_spl_size(params)) {
  144. fprintf(stderr,
  145. "Error: SPL image is too large (size %#x than %#x)\n",
  146. spl_params.init_size, rkcommon_get_spl_size(params));
  147. return EXIT_FAILURE;
  148. }
  149. return EXIT_SUCCESS;
  150. err_spl_info:
  151. fprintf(stderr, "ERROR: imagename (%s) is not supported!\n",
  152. params->imagename ? params->imagename : "NULL");
  153. fprintf(stderr, "Available imagename:");
  154. for (i = 0; i < ARRAY_SIZE(spl_infos); i++)
  155. fprintf(stderr, "\t%s", spl_infos[i].imagename);
  156. fprintf(stderr, "\n");
  157. return EXIT_FAILURE;
  158. }
  159. const char *rkcommon_get_spl_hdr(struct image_tool_params *params)
  160. {
  161. struct spl_info *info = rkcommon_get_spl_info(params->imagename);
  162. /*
  163. * info would not be NULL, because of we checked params before.
  164. */
  165. return info->spl_hdr;
  166. }
  167. int rkcommon_get_spl_size(struct image_tool_params *params)
  168. {
  169. struct spl_info *info = rkcommon_get_spl_info(params->imagename);
  170. /*
  171. * info would not be NULL, because of we checked params before.
  172. */
  173. return info->spl_size;
  174. }
  175. bool rkcommon_need_rc4_spl(struct image_tool_params *params)
  176. {
  177. struct spl_info *info = rkcommon_get_spl_info(params->imagename);
  178. /*
  179. * info would not be NULL, because of we checked params before.
  180. */
  181. return info->spl_rc4;
  182. }
  183. static void rkcommon_set_header0(void *buf, struct image_tool_params *params)
  184. {
  185. struct header0_info *hdr = buf;
  186. memset(buf, '\0', RK_INIT_OFFSET * RK_BLK_SIZE);
  187. hdr->signature = RK_SIGNATURE;
  188. hdr->disable_rc4 = !rkcommon_need_rc4_spl(params);
  189. hdr->init_offset = RK_INIT_OFFSET;
  190. hdr->init_size = spl_params.init_size / RK_BLK_SIZE;
  191. /*
  192. * init_boot_size needs to be set, as it is read by the BootROM
  193. * to determine the size of the next-stage bootloader (e.g. U-Boot
  194. * proper), when used with the back-to-bootrom functionality.
  195. *
  196. * see https://lists.denx.de/pipermail/u-boot/2017-May/293267.html
  197. * for a more detailed explanation by Andy Yan
  198. */
  199. if (spl_params.boot_file)
  200. hdr->init_boot_size =
  201. hdr->init_size + spl_params.boot_size / RK_BLK_SIZE;
  202. else
  203. hdr->init_boot_size =
  204. hdr->init_size + RK_MAX_BOOT_SIZE / RK_BLK_SIZE;
  205. rc4_encode(buf, RK_BLK_SIZE, rc4_key);
  206. }
  207. void rkcommon_set_header(void *buf, struct stat *sbuf, int ifd,
  208. struct image_tool_params *params)
  209. {
  210. struct header1_info *hdr = buf + RK_SPL_HDR_START;
  211. rkcommon_set_header0(buf, params);
  212. /* Set up the SPL name (i.e. copy spl_hdr over) */
  213. memcpy(&hdr->magic, rkcommon_get_spl_hdr(params), RK_SPL_HDR_SIZE);
  214. if (rkcommon_need_rc4_spl(params))
  215. rkcommon_rc4_encode_spl(buf, RK_SPL_HDR_START,
  216. spl_params.init_size);
  217. if (spl_params.boot_file) {
  218. if (rkcommon_need_rc4_spl(params))
  219. rkcommon_rc4_encode_spl(buf + RK_SPL_HDR_START,
  220. spl_params.init_size,
  221. spl_params.boot_size);
  222. }
  223. }
  224. static inline unsigned rkcommon_offset_to_spi(unsigned offset)
  225. {
  226. /*
  227. * While SD/MMC images use a flat addressing, SPI images are padded
  228. * to use the first 2K of every 4K sector only.
  229. */
  230. return ((offset & ~0x7ff) << 1) + (offset & 0x7ff);
  231. }
  232. static int rkcommon_parse_header(const void *buf, struct header0_info *header0,
  233. struct spl_info **spl_info)
  234. {
  235. unsigned hdr1_offset;
  236. struct header1_info *hdr1_sdmmc, *hdr1_spi;
  237. int i;
  238. if (spl_info)
  239. *spl_info = NULL;
  240. /*
  241. * The first header (hdr0) is always RC4 encoded, so try to decrypt
  242. * with the well-known key.
  243. */
  244. memcpy((void *)header0, buf, sizeof(struct header0_info));
  245. rc4_encode((void *)header0, sizeof(struct header0_info), rc4_key);
  246. if (header0->signature != RK_SIGNATURE)
  247. return -EPROTO;
  248. /* We don't support RC4 encoded image payloads here, yet... */
  249. if (header0->disable_rc4 == 0)
  250. return -ENOSYS;
  251. hdr1_offset = header0->init_offset * RK_BLK_SIZE;
  252. hdr1_sdmmc = (struct header1_info *)(buf + hdr1_offset);
  253. hdr1_spi = (struct header1_info *)(buf +
  254. rkcommon_offset_to_spi(hdr1_offset));
  255. for (i = 0; i < ARRAY_SIZE(spl_infos); i++) {
  256. if (!memcmp(&hdr1_sdmmc->magic, spl_infos[i].spl_hdr, 4)) {
  257. if (spl_info)
  258. *spl_info = &spl_infos[i];
  259. return IH_TYPE_RKSD;
  260. } else if (!memcmp(&hdr1_spi->magic, spl_infos[i].spl_hdr, 4)) {
  261. if (spl_info)
  262. *spl_info = &spl_infos[i];
  263. return IH_TYPE_RKSPI;
  264. }
  265. }
  266. return -1;
  267. }
  268. int rkcommon_verify_header(unsigned char *buf, int size,
  269. struct image_tool_params *params)
  270. {
  271. struct header0_info header0;
  272. struct spl_info *img_spl_info, *spl_info;
  273. int ret;
  274. ret = rkcommon_parse_header(buf, &header0, &img_spl_info);
  275. /* If this is the (unimplemented) RC4 case, then rewrite the result */
  276. if (ret == -ENOSYS)
  277. return 0;
  278. if (ret < 0)
  279. return ret;
  280. /*
  281. * If no 'imagename' is specified via the commandline (e.g. if this is
  282. * 'dumpimage -l' w/o any further constraints), we accept any spl_info.
  283. */
  284. if (params->imagename == NULL)
  285. return 0;
  286. /* Match the 'imagename' against the 'spl_hdr' found */
  287. spl_info = rkcommon_get_spl_info(params->imagename);
  288. if (spl_info && img_spl_info)
  289. return strcmp(spl_info->spl_hdr, img_spl_info->spl_hdr);
  290. return -ENOENT;
  291. }
  292. void rkcommon_print_header(const void *buf)
  293. {
  294. struct header0_info header0;
  295. struct spl_info *spl_info;
  296. uint8_t image_type;
  297. int ret, boot_size;
  298. ret = rkcommon_parse_header(buf, &header0, &spl_info);
  299. /* If this is the (unimplemented) RC4 case, then fail silently */
  300. if (ret == -ENOSYS)
  301. return;
  302. if (ret < 0) {
  303. fprintf(stderr, "Error: image verification failed\n");
  304. return;
  305. }
  306. image_type = ret;
  307. printf("Image Type: Rockchip %s (%s) boot image\n",
  308. spl_info->spl_hdr,
  309. (image_type == IH_TYPE_RKSD) ? "SD/MMC" : "SPI");
  310. printf("Init Data Size: %d bytes\n", header0.init_size * RK_BLK_SIZE);
  311. boot_size = (header0.init_boot_size - header0.init_size) * RK_BLK_SIZE;
  312. if (boot_size != RK_MAX_BOOT_SIZE)
  313. printf("Boot Data Size: %d bytes\n", boot_size);
  314. }
  315. void rkcommon_rc4_encode_spl(void *buf, unsigned int offset, unsigned int size)
  316. {
  317. unsigned int remaining = size;
  318. while (remaining > 0) {
  319. int step = (remaining > RK_BLK_SIZE) ? RK_BLK_SIZE : remaining;
  320. rc4_encode(buf + offset, step, rc4_key);
  321. offset += RK_BLK_SIZE;
  322. remaining -= step;
  323. }
  324. }
  325. int rkcommon_vrec_header(struct image_tool_params *params,
  326. struct image_type_params *tparams)
  327. {
  328. /*
  329. * The SPL image looks as follows:
  330. *
  331. * 0x0 header0 (see rkcommon.c)
  332. * 0x800 spl_name ('RK30', ..., 'RK33')
  333. * (start of the payload for AArch64 payloads: we expect the
  334. * first 4 bytes to be available for overwriting with our
  335. * spl_name)
  336. * 0x804 first instruction to be executed
  337. * (start of the image/payload for 32bit payloads)
  338. *
  339. * For AArch64 (ARMv8) payloads, natural alignment (8-bytes) is
  340. * required for its sections (so the image we receive needs to
  341. * have the first 4 bytes reserved for the spl_name). Reserving
  342. * these 4 bytes is done using the BOOT0_HOOK infrastructure.
  343. *
  344. * The header is always at 0x800 (as we now use a payload
  345. * prepadded using the boot0 hook for all targets): the first
  346. * 4 bytes of these images can safely be overwritten using the
  347. * boot magic.
  348. */
  349. tparams->header_size = RK_SPL_HDR_START;
  350. /* Allocate, clear and install the header */
  351. tparams->hdr = malloc(tparams->header_size);
  352. if (!tparams->hdr) {
  353. fprintf(stderr, "%s: Can't alloc header: %s\n",
  354. params->cmdname, strerror(errno));
  355. exit(EXIT_FAILURE);
  356. }
  357. memset(tparams->hdr, 0, tparams->header_size);
  358. /*
  359. * We need to store the original file-size (i.e. before padding), as
  360. * imagetool does not set this during its adjustment of file_size.
  361. */
  362. params->orig_file_size = tparams->header_size +
  363. spl_params.init_size + spl_params.boot_size;
  364. params->file_size = ROUND(params->orig_file_size, RK_SIZE_ALIGN);
  365. /* Ignoring pad len, since we are using our own copy_image() */
  366. return 0;
  367. }
  368. static int pad_file(struct image_tool_params *params, int ifd, int pad)
  369. {
  370. uint8_t zeros[4096];
  371. memset(zeros, 0, sizeof(zeros));
  372. while (pad > 0) {
  373. int todo = sizeof(zeros);
  374. if (todo > pad)
  375. todo = pad;
  376. if (write(ifd, (char *)&zeros, todo) != todo) {
  377. fprintf(stderr, "%s: Write error on %s: %s\n",
  378. params->cmdname, params->imagefile,
  379. strerror(errno));
  380. return -1;
  381. }
  382. pad -= todo;
  383. }
  384. return 0;
  385. }
  386. static int copy_file(struct image_tool_params *params, int ifd,
  387. const char *file, int padded_size)
  388. {
  389. int dfd;
  390. struct stat sbuf;
  391. unsigned char *ptr;
  392. int size;
  393. if (params->vflag)
  394. fprintf(stderr, "Adding Image %s\n", file);
  395. dfd = open(file, O_RDONLY | O_BINARY);
  396. if (dfd < 0) {
  397. fprintf(stderr, "%s: Can't open %s: %s\n",
  398. params->cmdname, file, strerror(errno));
  399. return -1;
  400. }
  401. if (fstat(dfd, &sbuf) < 0) {
  402. fprintf(stderr, "%s: Can't stat %s: %s\n",
  403. params->cmdname, file, strerror(errno));
  404. goto err_close;
  405. }
  406. if (params->vflag)
  407. fprintf(stderr, "Size %u(pad to %u)\n",
  408. (int)sbuf.st_size, padded_size);
  409. ptr = mmap(0, sbuf.st_size, PROT_READ, MAP_SHARED, dfd, 0);
  410. if (ptr == MAP_FAILED) {
  411. fprintf(stderr, "%s: Can't read %s: %s\n",
  412. params->cmdname, file, strerror(errno));
  413. goto err_munmap;
  414. }
  415. size = sbuf.st_size;
  416. if (write(ifd, ptr, size) != size) {
  417. fprintf(stderr, "%s: Write error on %s: %s\n",
  418. params->cmdname, params->imagefile, strerror(errno));
  419. goto err_munmap;
  420. }
  421. munmap((void *)ptr, sbuf.st_size);
  422. close(dfd);
  423. return pad_file(params, ifd, padded_size - size);
  424. err_munmap:
  425. munmap((void *)ptr, sbuf.st_size);
  426. err_close:
  427. close(dfd);
  428. return -1;
  429. }
  430. int rockchip_copy_image(int ifd, struct image_tool_params *params)
  431. {
  432. int ret;
  433. ret = copy_file(params, ifd, spl_params.init_file,
  434. spl_params.init_size);
  435. if (ret)
  436. return ret;
  437. if (spl_params.boot_file) {
  438. ret = copy_file(params, ifd, spl_params.boot_file,
  439. spl_params.boot_size);
  440. if (ret)
  441. return ret;
  442. }
  443. return pad_file(params, ifd,
  444. params->file_size - params->orig_file_size);
  445. }