1 // SPDX-License-Identifier: GPL-2.0+
3 * (C) Copyright 2015 Google, Inc
6 * (C) 2017 Theobroma Systems Design und Consulting GmbH
8 * Helper functions for Rockchip images
11 #include "imagetool.h"
13 #include <u-boot/sha256.h>
19 RK_MAGIC = 0x0ff0aa55,
20 RK_MAGIC_V2 = 0x534E4B52,
37 * @size_and_off: [31:16]image size;[15:0]image offset
38 * @address: default as 0xFFFFFFFF
41 * @hash: hash of image
45 uint32_t size_and_off;
54 * struct header0_info_v2 - v2 header block for rockchip BootRom
56 * This is stored at SD card block 64 (where each block is 512 bytes)
58 * @magic: Magic (must be RK_MAGIC_V2)
59 * @size_and_nimage: [31:16]number of images;[15:0]
60 * offset to hash field of header(unit as 4Byte)
61 * @boot_flag: [3:0]hash type(0:none,1:sha256,2:sha512)
62 * @signature: hash or signature for header info
65 struct header0_info_v2 {
68 uint32_t size_and_nimage;
70 uint8_t reserved1[104];
71 struct image_entry images[4];
72 uint8_t reserved2[1064];
77 * struct header0_info - header block for boot ROM
79 * This is stored at SD card block 64 (where each block is 512 bytes, or at
80 * the start of SPI flash. It is encoded with RC4.
82 * @magic: Magic (must be RK_MAGIC)
83 * @disable_rc4: 0 to use rc4 for boot image, 1 to use plain binary
84 * @init_offset: Offset in blocks of the SPL code from this header
85 * block. E.g. 4 means 2KB after the start of this header.
86 * Other fields are not used by U-Boot
93 uint8_t reserved1[492];
95 uint16_t init_boot_size;
100 * struct header1_info
102 struct header1_info {
107 * struct spl_info - spl info for each chip
109 * @imagename: Image name(passed by "mkimage -n")
110 * @spl_hdr: Boot ROM requires a 4-bytes spl header
111 * @spl_size: Spl size(include extra 4-bytes spl header)
112 * @spl_rc4: RC4 encode the SPL binary (same key as header)
113 * @header_ver: header block version
116 const char *imagename;
118 const uint32_t spl_size;
120 const uint32_t header_ver;
123 static struct spl_info spl_infos[] = {
124 { "px30", "RK33", 0x2800, false, RK_HEADER_V1 },
125 { "rk3036", "RK30", 0x1000, false, RK_HEADER_V1 },
126 { "rk3066", "RK30", 0x8000 - 0x800, true, RK_HEADER_V1 },
127 { "rk3128", "RK31", 0x1800, false, RK_HEADER_V1 },
128 { "rk3188", "RK31", 0x8000 - 0x800, true, RK_HEADER_V1 },
129 { "rk322x", "RK32", 0x8000 - 0x1000, false, RK_HEADER_V1 },
130 { "rk3288", "RK32", 0x8000, false, RK_HEADER_V1 },
131 { "rk3308", "RK33", 0x40000 - 0x1000, false, RK_HEADER_V1 },
132 { "rk3328", "RK32", 0x8000 - 0x1000, false, RK_HEADER_V1 },
133 { "rk3368", "RK33", 0x8000 - 0x1000, false, RK_HEADER_V1 },
134 { "rk3399", "RK33", 0x30000 - 0x2000, false, RK_HEADER_V1 },
135 { "rv1108", "RK11", 0x1800, false, RK_HEADER_V1 },
136 { "rv1126", "110B", 0x10000 - 0x1000, false, RK_HEADER_V1 },
137 { "rk3568", "RK35", 0x14000 - 0x1000, false, RK_HEADER_V2 },
141 * struct spl_params - spl params parsed in check_params()
143 * @init_file: Init data file path
144 * @init_size: Aligned size of init data in bytes
145 * @boot_file: Boot data file path
146 * @boot_size: Aligned size of boot data in bytes
156 static struct spl_params spl_params = { 0 };
158 static const unsigned char rc4_key[16] = {
159 124, 78, 3, 4, 85, 5, 9, 7,
160 45, 44, 123, 56, 23, 13, 23, 17
163 static struct spl_info *rkcommon_get_spl_info(char *imagename)
170 for (i = 0; i < ARRAY_SIZE(spl_infos); i++)
171 if (!strncmp(imagename, spl_infos[i].imagename, 6))
172 return spl_infos + i;
177 static int rkcommon_get_aligned_size(struct image_tool_params *params,
182 size = imagetool_get_filesize(params, fname);
187 * Pad to a 2KB alignment, as required for init/boot size by the ROM
188 * (see https://lists.denx.de/pipermail/u-boot/2017-May/293268.html)
190 return ROUND(size, RK_SIZE_ALIGN);
193 int rkcommon_check_params(struct image_tool_params *params)
198 * If this is a operation (list or extract), the don't require
199 * imagename to be set.
201 if (params->lflag || params->iflag)
204 if (!rkcommon_get_spl_info(params->imagename))
207 spl_params.init_file = params->datafile;
209 spl_params.boot_file = strchr(spl_params.init_file, ':');
210 if (spl_params.boot_file) {
211 *spl_params.boot_file = '\0';
212 spl_params.boot_file += 1;
215 size = rkcommon_get_aligned_size(params, spl_params.init_file);
218 spl_params.init_size = size;
220 /* Boot file is optional, and only for back-to-bootrom functionality. */
221 if (spl_params.boot_file) {
222 size = rkcommon_get_aligned_size(params, spl_params.boot_file);
225 spl_params.boot_size = size;
228 if (spl_params.init_size > rkcommon_get_spl_size(params)) {
230 "Error: SPL image is too large (size %#x than %#x)\n",
231 spl_params.init_size, rkcommon_get_spl_size(params));
238 fprintf(stderr, "ERROR: imagename (%s) is not supported!\n",
239 params->imagename ? params->imagename : "NULL");
241 fprintf(stderr, "Available imagename:");
242 for (i = 0; i < ARRAY_SIZE(spl_infos); i++)
243 fprintf(stderr, "\t%s", spl_infos[i].imagename);
244 fprintf(stderr, "\n");
249 const char *rkcommon_get_spl_hdr(struct image_tool_params *params)
251 struct spl_info *info = rkcommon_get_spl_info(params->imagename);
254 * info would not be NULL, because of we checked params before.
256 return info->spl_hdr;
259 int rkcommon_get_spl_size(struct image_tool_params *params)
261 struct spl_info *info = rkcommon_get_spl_info(params->imagename);
264 * info would not be NULL, because of we checked params before.
266 return info->spl_size;
269 bool rkcommon_need_rc4_spl(struct image_tool_params *params)
271 struct spl_info *info = rkcommon_get_spl_info(params->imagename);
274 * info would not be NULL, because of we checked params before.
276 return info->spl_rc4;
279 bool rkcommon_is_header_v2(struct image_tool_params *params)
281 struct spl_info *info = rkcommon_get_spl_info(params->imagename);
283 return (info->header_ver == RK_HEADER_V2);
286 static void do_sha256_hash(uint8_t *buf, uint32_t size, uint8_t *out)
291 sha256_update(&ctx, buf, size);
292 sha256_finish(&ctx, out);
295 static void rkcommon_set_header0(void *buf, struct image_tool_params *params)
297 struct header0_info *hdr = buf;
298 uint32_t init_boot_size;
300 memset(buf, '\0', RK_INIT_OFFSET * RK_BLK_SIZE);
301 hdr->magic = cpu_to_le32(RK_MAGIC);
302 hdr->disable_rc4 = cpu_to_le32(!rkcommon_need_rc4_spl(params));
303 hdr->init_offset = cpu_to_le16(RK_INIT_OFFSET);
304 hdr->init_size = cpu_to_le16(spl_params.init_size / RK_BLK_SIZE);
307 * init_boot_size needs to be set, as it is read by the BootROM
308 * to determine the size of the next-stage bootloader (e.g. U-Boot
309 * proper), when used with the back-to-bootrom functionality.
311 * see https://lists.denx.de/pipermail/u-boot/2017-May/293267.html
312 * for a more detailed explanation by Andy Yan
314 if (spl_params.boot_file)
315 init_boot_size = spl_params.init_size + spl_params.boot_size;
317 init_boot_size = spl_params.init_size + RK_MAX_BOOT_SIZE;
318 hdr->init_boot_size = cpu_to_le16(init_boot_size / RK_BLK_SIZE);
320 rc4_encode(buf, RK_BLK_SIZE, rc4_key);
323 static void rkcommon_set_header0_v2(void *buf, struct image_tool_params *params)
325 struct header0_info_v2 *hdr = buf;
326 uint32_t sector_offset, image_sector_count;
327 uint32_t image_size_array[2];
328 uint8_t *image_ptr = NULL;
331 printf("Image Type: Rockchip %s boot image\n",
332 rkcommon_get_spl_hdr(params));
333 memset(buf, '\0', RK_INIT_OFFSET * RK_BLK_SIZE);
334 hdr->magic = cpu_to_le32(RK_MAGIC_V2);
335 hdr->size_and_nimage = cpu_to_le32((2 << 16) + 384);
336 hdr->boot_flag = cpu_to_le32(HASH_SHA256);
338 image_size_array[0] = spl_params.init_size;
339 image_size_array[1] = spl_params.boot_size;
341 for (i = 0; i < 2; i++) {
342 image_sector_count = image_size_array[i] / RK_BLK_SIZE;
343 hdr->images[i].size_and_off = cpu_to_le32((image_sector_count
344 << 16) + sector_offset);
345 hdr->images[i].address = 0xFFFFFFFF;
346 hdr->images[i].counter = cpu_to_le32(i + 1);
347 image_ptr = buf + sector_offset * RK_BLK_SIZE;
348 do_sha256_hash(image_ptr, image_size_array[i],
349 hdr->images[i].hash);
350 sector_offset = sector_offset + image_sector_count;
353 do_sha256_hash(buf, (void *)hdr->hash - buf, hdr->hash);
356 void rkcommon_set_header(void *buf, struct stat *sbuf, int ifd,
357 struct image_tool_params *params)
359 struct header1_info *hdr = buf + RK_SPL_HDR_START;
361 if (rkcommon_is_header_v2(params)) {
362 rkcommon_set_header0_v2(buf, params);
364 rkcommon_set_header0(buf, params);
366 /* Set up the SPL name (i.e. copy spl_hdr over) */
367 if (memcmp(&hdr->magic, "RSAK", 4))
368 memcpy(&hdr->magic, rkcommon_get_spl_hdr(params), RK_SPL_HDR_SIZE);
370 if (rkcommon_need_rc4_spl(params))
371 rkcommon_rc4_encode_spl(buf, RK_SPL_HDR_START,
372 spl_params.init_size);
374 if (spl_params.boot_file) {
375 if (rkcommon_need_rc4_spl(params))
376 rkcommon_rc4_encode_spl(buf + RK_SPL_HDR_START,
377 spl_params.init_size,
378 spl_params.boot_size);
383 static inline unsigned int rkcommon_offset_to_spi(unsigned int offset)
386 * While SD/MMC images use a flat addressing, SPI images are padded
387 * to use the first 2K of every 4K sector only.
389 return ((offset & ~0x7ff) << 1) + (offset & 0x7ff);
392 static int rkcommon_parse_header(const void *buf, struct header0_info *header0,
393 struct spl_info **spl_info)
395 unsigned int hdr1_offset;
396 struct header1_info *hdr1_sdmmc, *hdr1_spi;
403 * The first header (hdr0) is always RC4 encoded, so try to decrypt
404 * with the well-known key.
406 memcpy((void *)header0, buf, sizeof(struct header0_info));
407 rc4_encode((void *)header0, sizeof(struct header0_info), rc4_key);
409 if (le32_to_cpu(header0->magic) != RK_MAGIC)
412 /* We don't support RC4 encoded image payloads here, yet... */
413 if (le32_to_cpu(header0->disable_rc4) == 0)
416 hdr1_offset = le16_to_cpu(header0->init_offset) * RK_BLK_SIZE;
417 hdr1_sdmmc = (struct header1_info *)(buf + hdr1_offset);
418 hdr1_spi = (struct header1_info *)(buf +
419 rkcommon_offset_to_spi(hdr1_offset));
421 for (i = 0; i < ARRAY_SIZE(spl_infos); i++) {
422 if (!memcmp(&hdr1_sdmmc->magic, spl_infos[i].spl_hdr,
425 *spl_info = &spl_infos[i];
427 } else if (!memcmp(&hdr1_spi->magic, spl_infos[i].spl_hdr,
430 *spl_info = &spl_infos[i];
431 return IH_TYPE_RKSPI;
438 static int rkcommon_parse_header_v2(const void *buf, struct header0_info_v2 *header)
440 memcpy((void *)header, buf, sizeof(struct header0_info_v2));
442 if (le32_to_cpu(header->magic) != RK_MAGIC_V2)
448 int rkcommon_verify_header(unsigned char *buf, int size,
449 struct image_tool_params *params)
451 struct header0_info header0;
452 struct spl_info *img_spl_info, *spl_info;
455 /* spl_hdr is abandon on header_v2 */
456 if ((*(uint32_t *)buf) == RK_MAGIC_V2)
459 ret = rkcommon_parse_header(buf, &header0, &img_spl_info);
461 /* If this is the (unimplemented) RC4 case, then rewrite the result */
469 * If no 'imagename' is specified via the commandline (e.g. if this is
470 * 'dumpimage -l' w/o any further constraints), we accept any spl_info.
472 if (params->imagename == NULL)
475 /* Match the 'imagename' against the 'spl_hdr' found */
476 spl_info = rkcommon_get_spl_info(params->imagename);
477 if (spl_info && img_spl_info)
478 return strcmp(spl_info->spl_hdr, img_spl_info->spl_hdr);
483 void rkcommon_print_header(const void *buf)
485 struct header0_info header0;
486 struct header0_info_v2 header0_v2;
487 struct spl_info *spl_info;
489 int ret, boot_size, init_size;
491 if ((*(uint32_t *)buf) == RK_MAGIC_V2) {
492 ret = rkcommon_parse_header_v2(buf, &header0_v2);
495 fprintf(stderr, "Error: image verification failed\n");
499 init_size = header0_v2.images[0].size_and_off >> 16;
500 init_size = init_size * RK_BLK_SIZE;
501 boot_size = header0_v2.images[1].size_and_off >> 16;
502 boot_size = boot_size * RK_BLK_SIZE;
504 ret = rkcommon_parse_header(buf, &header0, &spl_info);
506 /* If this is the (unimplemented) RC4 case, then fail silently */
511 fprintf(stderr, "Error: image verification failed\n");
516 init_size = header0.init_size * RK_BLK_SIZE;
517 boot_size = header0.init_boot_size * RK_BLK_SIZE - init_size;
519 printf("Image Type: Rockchip %s (%s) boot image\n",
521 (image_type == IH_TYPE_RKSD) ? "SD/MMC" : "SPI");
524 printf("Init Data Size: %d bytes\n", init_size);
526 if (boot_size != RK_MAX_BOOT_SIZE)
527 printf("Boot Data Size: %d bytes\n", boot_size);
530 void rkcommon_rc4_encode_spl(void *buf, unsigned int offset, unsigned int size)
532 unsigned int remaining = size;
534 while (remaining > 0) {
535 int step = (remaining > RK_BLK_SIZE) ? RK_BLK_SIZE : remaining;
537 rc4_encode(buf + offset, step, rc4_key);
538 offset += RK_BLK_SIZE;
543 int rkcommon_vrec_header(struct image_tool_params *params,
544 struct image_type_params *tparams)
547 * The SPL image looks as follows:
549 * 0x0 header0 (see rkcommon.c)
550 * 0x800 spl_name ('RK30', ..., 'RK33')
551 * (start of the payload for AArch64 payloads: we expect the
552 * first 4 bytes to be available for overwriting with our
554 * 0x804 first instruction to be executed
555 * (start of the image/payload for 32bit payloads)
557 * For AArch64 (ARMv8) payloads, natural alignment (8-bytes) is
558 * required for its sections (so the image we receive needs to
559 * have the first 4 bytes reserved for the spl_name). Reserving
560 * these 4 bytes is done using the BOOT0_HOOK infrastructure.
562 * The header is always at 0x800 (as we now use a payload
563 * prepadded using the boot0 hook for all targets): the first
564 * 4 bytes of these images can safely be overwritten using the
567 tparams->header_size = RK_SPL_HDR_START;
569 /* Allocate, clear and install the header */
570 tparams->hdr = malloc(tparams->header_size);
572 fprintf(stderr, "%s: Can't alloc header: %s\n",
573 params->cmdname, strerror(errno));
576 memset(tparams->hdr, 0, tparams->header_size);
579 * We need to store the original file-size (i.e. before padding), as
580 * imagetool does not set this during its adjustment of file_size.
582 params->orig_file_size = tparams->header_size +
583 spl_params.init_size + spl_params.boot_size;
585 params->file_size = ROUND(params->orig_file_size, RK_SIZE_ALIGN);
587 /* Ignoring pad len, since we are using our own copy_image() */
591 static int pad_file(struct image_tool_params *params, int ifd, int pad)
595 memset(zeros, 0, sizeof(zeros));
598 int todo = sizeof(zeros);
602 if (write(ifd, (char *)&zeros, todo) != todo) {
603 fprintf(stderr, "%s: Write error on %s: %s\n",
604 params->cmdname, params->imagefile,
614 static int copy_file(struct image_tool_params *params, int ifd,
615 const char *file, int padded_size)
623 fprintf(stderr, "Adding Image %s\n", file);
625 dfd = open(file, O_RDONLY | O_BINARY);
627 fprintf(stderr, "%s: Can't open %s: %s\n",
628 params->cmdname, file, strerror(errno));
632 if (fstat(dfd, &sbuf) < 0) {
633 fprintf(stderr, "%s: Can't stat %s: %s\n",
634 params->cmdname, file, strerror(errno));
639 fprintf(stderr, "Size %u(pad to %u)\n",
640 (int)sbuf.st_size, padded_size);
642 ptr = mmap(0, sbuf.st_size, PROT_READ, MAP_SHARED, dfd, 0);
643 if (ptr == MAP_FAILED) {
644 fprintf(stderr, "%s: Can't read %s: %s\n",
645 params->cmdname, file, strerror(errno));
650 if (write(ifd, ptr, size) != size) {
651 fprintf(stderr, "%s: Write error on %s: %s\n",
652 params->cmdname, params->imagefile, strerror(errno));
656 munmap((void *)ptr, sbuf.st_size);
658 return pad_file(params, ifd, padded_size - size);
661 munmap((void *)ptr, sbuf.st_size);
667 int rockchip_copy_image(int ifd, struct image_tool_params *params)
671 ret = copy_file(params, ifd, spl_params.init_file,
672 spl_params.init_size);
676 if (spl_params.boot_file) {
677 ret = copy_file(params, ifd, spl_params.boot_file,
678 spl_params.boot_size);
683 return pad_file(params, ifd,
684 params->file_size - params->orig_file_size);