1 // SPDX-License-Identifier: GPL-2.0+
3 * Generate MediaTek BootROM header for SPL/U-Boot images
5 * Copyright (C) 2018 MediaTek Inc.
6 * Author: Weijie Gao <weijie.gao@mediatek.com>
11 #include <u-boot/crc.h>
12 #include <u-boot/sha256.h>
13 #include "imagetool.h"
14 #include "mtk_image.h"
15 #include "mtk_nand_headers.h"
17 static const struct brom_img_type {
19 enum brlyt_img_type type;
23 .type = BRLYT_TYPE_NAND
26 .type = BRLYT_TYPE_EMMC
29 .type = BRLYT_TYPE_NOR
32 .type = BRLYT_TYPE_SDMMC
35 .type = BRLYT_TYPE_SNAND
38 .type = BRLYT_TYPE_SNAND
42 /* Indicates whether we're generating or verifying */
44 static uint32_t img_size;
46 /* Image type selected by user */
47 static enum brlyt_img_type hdr_media;
48 static uint32_t hdr_offset;
49 static int use_lk_hdr;
50 static int use_mt7621_hdr;
51 static bool is_arm64_image;
54 static char lk_name[32] = "U-Boot";
56 /* CRC32 normal table required by MT7621 image */
57 static uint32_t crc32tbl[256];
59 /* NAND header selected by user */
60 static const struct nand_header_type *hdr_nand;
61 static uint32_t hdr_nand_size;
63 /* GFH header + 2 * 4KB pages of NAND */
64 static char hdr_tmp[sizeof(struct gfh_header) + 0x2000];
66 static uint32_t crc32_normal_cal(uint32_t crc, const void *data, size_t length,
67 const uint32_t *crc32c_table)
69 const uint8_t *p = data;
72 crc = crc32c_table[(uint8_t)((crc >> 24) ^ *p++)] ^ (crc << 8);
77 static void crc32_normal_init(uint32_t *crc32c_table, uint32_t poly)
81 for (i = 0; i < 256; i++) {
83 for (j = 0; j < 8; j++)
84 v = (v << 1) ^ ((v & (1 << 31)) ? poly : 0);
90 static int mtk_image_check_image_types(uint8_t type)
92 if (type == IH_TYPE_MTKIMAGE)
98 static int mtk_brom_parse_imagename(const char *imagename)
100 #define is_blank_char(c) \
101 ((c) == '\t' || (c) == '\n' || (c) == '\r' || (c) == ' ')
103 char *buf = strdup(imagename), *key, *val, *end, *next;
106 /* User passed arguments from image name */
107 static const char *media = "";
108 static const char *hdr_offs = "";
109 static const char *nandinfo = "";
110 static const char *lk = "";
111 static const char *mt7621 = "";
112 static const char *arm64_param = "";
116 next = strchr(key, ';');
120 val = strchr(key, '=');
125 while (is_blank_char(*key))
128 end = key + strlen(key) - 1;
129 while ((end >= key) && is_blank_char(*end))
133 if (is_blank_char(*end))
137 while (is_blank_char(*val))
140 end = val + strlen(val) - 1;
141 while ((end >= val) && is_blank_char(*end))
145 if (is_blank_char(*end))
148 /* record user passed arguments */
149 if (!strcmp(key, "media"))
152 if (!strcmp(key, "hdroffset"))
155 if (!strcmp(key, "nandinfo"))
158 if (!strcmp(key, "lk"))
161 if (!strcmp(key, "mt7621"))
164 if (!strcmp(key, "lkname"))
165 snprintf(lk_name, sizeof(lk_name), "%s", val);
167 if (!strcmp(key, "arm64"))
177 /* if user specified LK image header, skip following checks */
178 if (lk && lk[0] == '1') {
184 /* if user specified MT7621 image header, skip following checks */
185 if (mt7621 && mt7621[0] == '1') {
191 /* parse media type */
192 for (i = 0; i < ARRAY_SIZE(brom_images); i++) {
193 if (!strcmp(brom_images[i].name, media)) {
194 hdr_media = brom_images[i].type;
199 /* parse nand header type */
200 hdr_nand = mtk_nand_header_find(nandinfo);
202 /* parse device header offset */
203 if (hdr_offs && hdr_offs[0])
204 hdr_offset = strtoul(hdr_offs, NULL, 0);
206 if (arm64_param && arm64_param[0] == '1')
207 is_arm64_image = true;
211 if (hdr_media == BRLYT_TYPE_INVALID) {
212 fprintf(stderr, "Error: media type is invalid or missing.\n");
213 fprintf(stderr, " Please specify -n \"media=<type>\"\n");
217 if ((hdr_media == BRLYT_TYPE_NAND || hdr_media == BRLYT_TYPE_SNAND) &&
219 fprintf(stderr, "Error: nand info is invalid or missing.\n");
220 fprintf(stderr, " Please specify -n \"media=%s;"
221 "nandinfo=<info>\"\n", media);
225 if (hdr_media == BRLYT_TYPE_NAND || hdr_media == BRLYT_TYPE_SNAND)
226 hdr_nand_size = mtk_nand_header_size(hdr_nand);
231 static int mtk_image_check_params(struct image_tool_params *params)
234 fprintf(stderr, "Error: Load Address must be set.\n");
238 if (!params->imagename) {
239 fprintf(stderr, "Error: Image Name must be set.\n");
243 return mtk_brom_parse_imagename(params->imagename);
246 static int mtk_image_vrec_header(struct image_tool_params *params,
247 struct image_type_params *tparams)
250 tparams->header_size = sizeof(union lk_hdr);
251 tparams->hdr = &hdr_tmp;
252 memset(&hdr_tmp, 0xff, tparams->header_size);
256 if (use_mt7621_hdr) {
257 tparams->header_size = image_get_header_size();
258 tparams->hdr = &hdr_tmp;
259 memset(&hdr_tmp, 0, tparams->header_size);
263 if (hdr_media == BRLYT_TYPE_NAND || hdr_media == BRLYT_TYPE_SNAND)
264 tparams->header_size = hdr_nand_size;
266 tparams->header_size = sizeof(struct gen_device_header);
268 tparams->header_size += sizeof(struct gfh_header);
269 tparams->hdr = &hdr_tmp;
271 memset(&hdr_tmp, 0xff, tparams->header_size);
273 return SHA256_SUM_LEN;
276 static int mtk_image_verify_gfh(struct gfh_header *gfh, uint32_t type, int print)
278 if (strcmp(gfh->file_info.name, GFH_FILE_INFO_NAME))
281 if (le32_to_cpu(gfh->file_info.flash_type) != type)
285 printf("Load Address: %08x\n",
286 le32_to_cpu(gfh->file_info.load_addr) +
287 le32_to_cpu(gfh->file_info.jump_offset));
290 printf("Architecture: %s\n", is_arm64_image ? "ARM64" : "ARM");
295 static int mtk_image_verify_gen_header(const uint8_t *ptr, int print)
297 union gen_boot_header *gbh = (union gen_boot_header *)ptr;
298 uint32_t gfh_offset, total_size, devh_size;
299 struct brom_layout_header *bh;
300 struct gfh_header *gfh;
301 const char *bootmedia;
303 if (!strcmp(gbh->name, SF_BOOT_NAME))
304 bootmedia = "Serial NOR";
305 else if (!strcmp(gbh->name, EMMC_BOOT_NAME))
307 else if (!strcmp(gbh->name, SDMMC_BOOT_NAME))
308 bootmedia = "SD/MMC";
313 printf("Boot Media: %s\n", bootmedia);
315 if (le32_to_cpu(gbh->version) != 1 ||
316 le32_to_cpu(gbh->size) != sizeof(union gen_boot_header))
319 bh = (struct brom_layout_header *)(ptr + le32_to_cpu(gbh->size));
321 if (strcmp(bh->name, BRLYT_NAME))
324 if (le32_to_cpu(bh->magic) != BRLYT_MAGIC ||
325 (le32_to_cpu(bh->type) != BRLYT_TYPE_NOR &&
326 le32_to_cpu(bh->type) != BRLYT_TYPE_EMMC &&
327 le32_to_cpu(bh->type) != BRLYT_TYPE_SDMMC))
330 devh_size = sizeof(struct gen_device_header);
333 gfh_offset = devh_size;
335 gfh_offset = le32_to_cpu(bh->header_size);
337 if (gfh_offset + sizeof(struct gfh_header) > img_size) {
339 * This may happen if the hdr_offset used to generate
340 * this image is not zero.
341 * Since device header size is not fixed, we can't
342 * cover all possible cases.
343 * Assuming the image is valid only if the real
344 * device header size equals to devh_size.
346 total_size = le32_to_cpu(bh->total_size);
348 if (total_size - gfh_offset > img_size - devh_size)
351 gfh_offset = devh_size;
355 gfh = (struct gfh_header *)(ptr + gfh_offset);
357 return mtk_image_verify_gfh(gfh, GFH_FLASH_TYPE_GEN, print);
360 static int mtk_image_verify_nand_header(const uint8_t *ptr, int print)
362 struct brom_layout_header *bh;
363 struct nand_header_info info;
364 struct gfh_header *gfh;
365 const char *bootmedia;
368 ret = mtk_nand_header_info(ptr, &info);
373 bh = (struct brom_layout_header *)(ptr + info.page_size);
375 if (strcmp(bh->name, BRLYT_NAME))
378 if (le32_to_cpu(bh->magic) != BRLYT_MAGIC)
381 if (le32_to_cpu(bh->type) == BRLYT_TYPE_NAND)
382 bootmedia = "Parallel NAND";
383 else if (le32_to_cpu(bh->type) == BRLYT_TYPE_SNAND)
384 bootmedia = "Serial NAND (SNFI/AP)";
389 bootmedia = "Serial NAND (SNFI/HSM)";
391 bootmedia = "Serial NAND (SPIM)";
395 printf("Boot Media: %s\n", bootmedia);
397 if (info.page_size >= 1024)
398 printf("Page Size: %dKB\n", info.page_size >> 10);
400 printf("Page Size: %dB\n", info.page_size);
402 printf("Spare Size: %dB\n", info.spare_size);
405 gfh = (struct gfh_header *)(ptr + info.gfh_offset);
407 return mtk_image_verify_gfh(gfh, GFH_FLASH_TYPE_NAND, print);
410 static uint32_t crc32be_cal(const void *data, size_t length)
415 if (crc32tbl[1] != MT7621_IH_CRC_POLYNOMIAL)
416 crc32_normal_init(crc32tbl, MT7621_IH_CRC_POLYNOMIAL);
418 crc = crc32_normal_cal(crc, data, length, crc32tbl);
420 for (; length; length >>= 8) {
422 crc = crc32_normal_cal(crc, &c, 1, crc32tbl);
428 static int mtk_image_verify_mt7621_header(const uint8_t *ptr, int print)
430 const image_header_t *hdr = (const image_header_t *)ptr;
431 struct mt7621_nand_header *nhdr;
432 uint32_t spl_size, crcval;
433 image_header_t header;
436 spl_size = image_get_size(hdr);
438 if (spl_size > img_size) {
440 printf("Incomplete SPL image\n");
444 ret = image_check_hcrc(hdr);
447 printf("Bad header CRC\n");
451 ret = image_check_dcrc(hdr);
454 printf("Bad data CRC\n");
458 /* Copy header so we can blank CRC field for re-calculation */
459 memmove(&header, hdr, image_get_header_size());
460 image_set_hcrc(&header, 0);
462 nhdr = (struct mt7621_nand_header *)header.ih_name;
463 crcval = be32_to_cpu(nhdr->crc);
466 if (crcval != crc32be_cal(&header, image_get_header_size())) {
468 printf("Bad NAND header CRC\n");
473 printf("Load Address: %08x\n", image_get_load(hdr));
475 printf("Image Name: %.*s\n", MT7621_IH_NMLEN,
476 image_get_name(hdr));
478 if (IMAGE_ENABLE_TIMESTAMP) {
480 genimg_print_time((time_t)image_get_time(hdr));
483 printf("Data Size: ");
484 genimg_print_size(image_get_data_size(hdr));
490 static int mtk_image_verify_header(unsigned char *ptr, int image_size,
491 struct image_tool_params *params)
493 image_header_t *hdr = (image_header_t *)ptr;
494 union lk_hdr *lk = (union lk_hdr *)ptr;
496 /* nothing to verify for LK image header */
497 if (le32_to_cpu(lk->magic) == LK_PART_MAGIC)
500 img_size = image_size;
502 if (image_get_magic(hdr) == IH_MAGIC)
503 return mtk_image_verify_mt7621_header(ptr, 0);
505 if (is_mtk_nand_header(ptr))
506 return mtk_image_verify_nand_header(ptr, 0);
508 return mtk_image_verify_gen_header(ptr, 0);
513 static void mtk_image_print_header(const void *ptr)
515 image_header_t *hdr = (image_header_t *)ptr;
516 union lk_hdr *lk = (union lk_hdr *)ptr;
518 if (le32_to_cpu(lk->magic) == LK_PART_MAGIC) {
519 printf("Image Type: MediaTek LK Image\n");
520 printf("Load Address: %08x\n", le32_to_cpu(lk->loadaddr));
524 printf("Image Type: MediaTek BootROM Loadable Image\n");
526 if (image_get_magic(hdr) == IH_MAGIC) {
527 mtk_image_verify_mt7621_header(ptr, 1);
531 if (is_mtk_nand_header(ptr))
532 mtk_image_verify_nand_header(ptr, 1);
534 mtk_image_verify_gen_header(ptr, 1);
537 static void put_brom_layout_header(struct brom_layout_header *hdr, int type)
539 strncpy(hdr->name, BRLYT_NAME, sizeof(hdr->name));
540 hdr->version = cpu_to_le32(1);
541 hdr->magic = cpu_to_le32(BRLYT_MAGIC);
542 hdr->type = cpu_to_le32(type);
545 static void put_ghf_common_header(struct gfh_common_header *gfh, int size,
548 memcpy(gfh->magic, GFH_HEADER_MAGIC, sizeof(gfh->magic));
550 gfh->size = cpu_to_le16(size);
551 gfh->type = cpu_to_le16(type);
554 static void put_ghf_header(struct gfh_header *gfh, int file_size,
555 int dev_hdr_size, int load_addr, int flash_type)
559 memset(gfh, 0, sizeof(struct gfh_header));
561 /* GFH_FILE_INFO header */
562 put_ghf_common_header(&gfh->file_info.gfh, sizeof(gfh->file_info),
563 GFH_TYPE_FILE_INFO, 1);
564 strncpy(gfh->file_info.name, GFH_FILE_INFO_NAME,
565 sizeof(gfh->file_info.name));
566 gfh->file_info.unused = cpu_to_le32(1);
567 gfh->file_info.file_type = cpu_to_le16(1);
568 gfh->file_info.flash_type = flash_type;
569 gfh->file_info.sig_type = GFH_SIG_TYPE_SHA256;
570 gfh->file_info.load_addr = cpu_to_le32(load_addr - sizeof(*gfh));
571 gfh->file_info.total_size = cpu_to_le32(file_size - dev_hdr_size);
572 gfh->file_info.max_size = cpu_to_le32(file_size);
573 gfh->file_info.hdr_size = sizeof(*gfh);
574 gfh->file_info.sig_size = SHA256_SUM_LEN;
575 gfh->file_info.jump_offset = sizeof(*gfh);
576 gfh->file_info.processed = cpu_to_le32(1);
578 /* GFH_BL_INFO header */
579 put_ghf_common_header(&gfh->bl_info.gfh, sizeof(gfh->bl_info),
580 GFH_TYPE_BL_INFO, 1);
581 gfh->bl_info.attr = cpu_to_le32(1);
583 /* GFH_BROM_CFG header */
584 put_ghf_common_header(&gfh->brom_cfg.gfh, sizeof(gfh->brom_cfg),
585 GFH_TYPE_BROM_CFG, 3);
586 cfg_bits = GFH_BROM_CFG_USBDL_AUTO_DETECT_DIS |
587 GFH_BROM_CFG_USBDL_BY_KCOL0_TIMEOUT_EN |
588 GFH_BROM_CFG_USBDL_BY_FLAG_TIMEOUT_EN;
589 gfh->brom_cfg.usbdl_by_kcol0_timeout_ms = cpu_to_le32(5000);
590 if (is_arm64_image) {
591 gfh->brom_cfg.jump_bl_arm64 = GFH_BROM_CFG_JUMP_BL_ARM64;
592 cfg_bits |= GFH_BROM_CFG_JUMP_BL_ARM64_EN;
594 gfh->brom_cfg.cfg_bits = cpu_to_le32(cfg_bits);
596 /* GFH_BL_SEC_KEY header */
597 put_ghf_common_header(&gfh->bl_sec_key.gfh, sizeof(gfh->bl_sec_key),
598 GFH_TYPE_BL_SEC_KEY, 1);
600 /* GFH_ANTI_CLONE header */
601 put_ghf_common_header(&gfh->anti_clone.gfh, sizeof(gfh->anti_clone),
602 GFH_TYPE_ANTI_CLONE, 1);
603 gfh->anti_clone.ac_offset = cpu_to_le32(0x10);
604 gfh->anti_clone.ac_len = cpu_to_le32(0x80);
606 /* GFH_BROM_SEC_CFG header */
607 put_ghf_common_header(&gfh->brom_sec_cfg.gfh,
608 sizeof(gfh->brom_sec_cfg),
609 GFH_TYPE_BROM_SEC_CFG, 1);
610 gfh->brom_sec_cfg.cfg_bits =
611 cpu_to_le32(BROM_SEC_CFG_JTAG_EN | BROM_SEC_CFG_UART_EN);
614 static void put_hash(uint8_t *buff, int size)
619 sha256_update(&ctx, buff, size);
620 sha256_finish(&ctx, buff + size);
623 static void mtk_image_set_gen_header(void *ptr, off_t filesize,
626 struct gen_device_header *hdr = (struct gen_device_header *)ptr;
627 struct gfh_header *gfh;
628 const char *bootname = NULL;
630 if (hdr_media == BRLYT_TYPE_NOR)
631 bootname = SF_BOOT_NAME;
632 else if (hdr_media == BRLYT_TYPE_EMMC)
633 bootname = EMMC_BOOT_NAME;
634 else if (hdr_media == BRLYT_TYPE_SDMMC)
635 bootname = SDMMC_BOOT_NAME;
637 /* Generic device header */
638 snprintf(hdr->boot.name, sizeof(hdr->boot.name), "%s", bootname);
639 hdr->boot.version = cpu_to_le32(1);
640 hdr->boot.size = cpu_to_le32(sizeof(hdr->boot));
643 put_brom_layout_header(&hdr->brlyt, hdr_media);
644 hdr->brlyt.header_size = cpu_to_le32(hdr_offset + sizeof(*hdr));
645 hdr->brlyt.total_size = cpu_to_le32(hdr_offset + filesize);
646 hdr->brlyt.header_size_2 = hdr->brlyt.header_size;
647 hdr->brlyt.total_size_2 = hdr->brlyt.total_size;
650 gfh = (struct gfh_header *)(ptr + sizeof(struct gen_device_header));
651 put_ghf_header(gfh, filesize, sizeof(struct gen_device_header),
652 loadaddr, GFH_FLASH_TYPE_GEN);
654 /* Generate SHA256 hash */
655 put_hash((uint8_t *)gfh,
656 filesize - sizeof(struct gen_device_header) - SHA256_SUM_LEN);
659 static void mtk_image_set_nand_header(void *ptr, off_t filesize,
662 struct brom_layout_header *brlyt;
663 struct gfh_header *gfh;
664 uint32_t payload_pages, nand_page_size;
667 nand_page_size = mtk_nand_header_put(hdr_nand, ptr);
669 if (nand_page_size) {
671 payload_pages = (filesize + nand_page_size - 1) /
673 brlyt = (struct brom_layout_header *)(ptr + nand_page_size);
674 put_brom_layout_header(brlyt, hdr_media);
675 brlyt->header_size = cpu_to_le32(2);
676 brlyt->total_size = cpu_to_le32(payload_pages);
677 brlyt->header_size_2 = brlyt->header_size;
678 brlyt->total_size_2 = brlyt->total_size;
679 brlyt->unused = cpu_to_le32(1);
683 gfh = (struct gfh_header *)(ptr + hdr_nand_size);
684 put_ghf_header(gfh, filesize, hdr_nand_size, loadaddr,
685 GFH_FLASH_TYPE_NAND);
687 /* Generate SHA256 hash */
688 put_hash((uint8_t *)gfh, filesize - hdr_nand_size - SHA256_SUM_LEN);
691 static void mtk_image_set_mt7621_header(void *ptr, off_t filesize,
694 image_header_t *hdr = (image_header_t *)ptr;
695 struct mt7621_stage1_header *shdr;
696 struct mt7621_nand_header *nhdr;
697 uint32_t datasize, crcval;
699 datasize = filesize - image_get_header_size();
700 nhdr = (struct mt7621_nand_header *)hdr->ih_name;
701 shdr = (struct mt7621_stage1_header *)(ptr + image_get_header_size());
703 shdr->ep = cpu_to_be32(loadaddr);
704 shdr->stage_size = cpu_to_be32(datasize);
706 image_set_magic(hdr, IH_MAGIC);
707 image_set_time(hdr, time(NULL));
708 image_set_size(hdr, datasize);
709 image_set_load(hdr, loadaddr);
710 image_set_ep(hdr, loadaddr);
711 image_set_os(hdr, IH_OS_U_BOOT);
712 image_set_arch(hdr, IH_ARCH_MIPS);
713 image_set_type(hdr, IH_TYPE_STANDALONE);
714 image_set_comp(hdr, IH_COMP_NONE);
716 crcval = crc32(0, (uint8_t *)shdr, datasize);
717 image_set_dcrc(hdr, crcval);
719 strncpy(nhdr->ih_name, "MT7621 NAND", MT7621_IH_NMLEN);
721 nhdr->ih_stage_offset = cpu_to_be32(image_get_header_size());
723 crcval = crc32be_cal(hdr, image_get_header_size());
724 nhdr->crc = cpu_to_be32(crcval);
726 crcval = crc32(0, (uint8_t *)hdr, image_get_header_size());
727 image_set_hcrc(hdr, crcval);
730 static void mtk_image_set_header(void *ptr, struct stat *sbuf, int ifd,
731 struct image_tool_params *params)
733 union lk_hdr *lk = (union lk_hdr *)ptr;
736 lk->magic = cpu_to_le32(LK_PART_MAGIC);
737 lk->size = cpu_to_le32(sbuf->st_size - sizeof(union lk_hdr));
738 lk->loadaddr = cpu_to_le32(params->addr);
739 lk->mode = 0xffffffff; /* must be non-zero */
740 memset(lk->name, 0, sizeof(lk->name));
741 strncpy(lk->name, lk_name, sizeof(lk->name));
746 img_size = sbuf->st_size;
748 if (use_mt7621_hdr) {
749 mtk_image_set_mt7621_header(ptr, sbuf->st_size, params->addr);
753 if (hdr_media == BRLYT_TYPE_NAND || hdr_media == BRLYT_TYPE_SNAND)
754 mtk_image_set_nand_header(ptr, sbuf->st_size, params->addr);
756 mtk_image_set_gen_header(ptr, sbuf->st_size, params->addr);
761 "MediaTek BootROM Loadable Image support",
764 mtk_image_check_params,
765 mtk_image_verify_header,
766 mtk_image_print_header,
767 mtk_image_set_header,
769 mtk_image_check_image_types,
771 mtk_image_vrec_header