1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * Image manipulator for Marvell SoCs
4  *  supports Kirkwood, Dove, Armada 370, Armada XP, Armada 375, Armada 38x and
5  *  Armada 39x
6  *
7  * (C) Copyright 2013 Thomas Petazzoni
8  * <thomas.petazzoni@free-electrons.com>
9  *
10  * (C) Copyright 2022 Pali Rohár <pali@kernel.org>
11  */
12 
13 #define OPENSSL_API_COMPAT 0x10101000L
14 
15 #include "imagetool.h"
16 #include <limits.h>
17 #include <image.h>
18 #include <stdarg.h>
19 #include <stdint.h>
20 #include "kwbimage.h"
21 
22 #include <openssl/bn.h>
23 #include <openssl/rsa.h>
24 #include <openssl/pem.h>
25 #include <openssl/err.h>
26 #include <openssl/evp.h>
27 
28 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \
29     (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2070000fL)
RSA_get0_key(const RSA * r,const BIGNUM ** n,const BIGNUM ** e,const BIGNUM ** d)30 static void RSA_get0_key(const RSA *r,
31                  const BIGNUM **n, const BIGNUM **e, const BIGNUM **d)
32 {
33    if (n != NULL)
34        *n = r->n;
35    if (e != NULL)
36        *e = r->e;
37    if (d != NULL)
38        *d = r->d;
39 }
40 
41 #elif !defined(LIBRESSL_VERSION_NUMBER)
EVP_MD_CTX_cleanup(EVP_MD_CTX * ctx)42 void EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
43 {
44 	EVP_MD_CTX_reset(ctx);
45 }
46 #endif
47 
48 /* fls - find last (most-significant) bit set in 4-bit integer */
fls4(int num)49 static inline int fls4(int num)
50 {
51 	if (num & 0x8)
52 		return 4;
53 	else if (num & 0x4)
54 		return 3;
55 	else if (num & 0x2)
56 		return 2;
57 	else if (num & 0x1)
58 		return 1;
59 	else
60 		return 0;
61 }
62 
63 static struct image_cfg_element *image_cfg;
64 static int cfgn;
65 static int verbose_mode;
66 
67 struct boot_mode {
68 	unsigned int id;
69 	const char *name;
70 };
71 
72 /*
73  * SHA2-256 hash
74  */
75 struct hash_v1 {
76 	uint8_t hash[32];
77 };
78 
79 struct boot_mode boot_modes[] = {
80 	{ IBR_HDR_I2C_ID, "i2c"  },
81 	{ IBR_HDR_SPI_ID, "spi"  },
82 	{ IBR_HDR_NAND_ID, "nand" },
83 	{ IBR_HDR_SATA_ID, "sata" },
84 	{ IBR_HDR_PEX_ID, "pex"  },
85 	{ IBR_HDR_UART_ID, "uart" },
86 	{ IBR_HDR_SDIO_ID, "sdio" },
87 	{},
88 };
89 
90 struct nand_ecc_mode {
91 	unsigned int id;
92 	const char *name;
93 };
94 
95 struct nand_ecc_mode nand_ecc_modes[] = {
96 	{ IBR_HDR_ECC_DEFAULT, "default" },
97 	{ IBR_HDR_ECC_FORCED_HAMMING, "hamming" },
98 	{ IBR_HDR_ECC_FORCED_RS, "rs" },
99 	{ IBR_HDR_ECC_DISABLED, "disabled" },
100 	{},
101 };
102 
103 /* Used to identify an undefined execution or destination address */
104 #define ADDR_INVALID ((uint32_t)-1)
105 
106 #define BINARY_MAX_ARGS 255
107 
108 /* In-memory representation of a line of the configuration file */
109 
110 enum image_cfg_type {
111 	IMAGE_CFG_VERSION = 0x1,
112 	IMAGE_CFG_BOOT_FROM,
113 	IMAGE_CFG_DEST_ADDR,
114 	IMAGE_CFG_EXEC_ADDR,
115 	IMAGE_CFG_NAND_BLKSZ,
116 	IMAGE_CFG_NAND_BADBLK_LOCATION,
117 	IMAGE_CFG_NAND_ECC_MODE,
118 	IMAGE_CFG_NAND_PAGESZ,
119 	IMAGE_CFG_SATA_BLKSZ,
120 	IMAGE_CFG_CPU,
121 	IMAGE_CFG_BINARY,
122 	IMAGE_CFG_DATA,
123 	IMAGE_CFG_DATA_DELAY,
124 	IMAGE_CFG_BAUDRATE,
125 	IMAGE_CFG_UART_PORT,
126 	IMAGE_CFG_UART_MPP,
127 	IMAGE_CFG_DEBUG,
128 	IMAGE_CFG_KAK,
129 	IMAGE_CFG_CSK,
130 	IMAGE_CFG_CSK_INDEX,
131 	IMAGE_CFG_JTAG_DELAY,
132 	IMAGE_CFG_BOX_ID,
133 	IMAGE_CFG_FLASH_ID,
134 	IMAGE_CFG_SEC_COMMON_IMG,
135 	IMAGE_CFG_SEC_SPECIALIZED_IMG,
136 	IMAGE_CFG_SEC_BOOT_DEV,
137 	IMAGE_CFG_SEC_FUSE_DUMP,
138 
139 	IMAGE_CFG_COUNT
140 } type;
141 
142 static const char * const id_strs[] = {
143 	[IMAGE_CFG_VERSION] = "VERSION",
144 	[IMAGE_CFG_BOOT_FROM] = "BOOT_FROM",
145 	[IMAGE_CFG_DEST_ADDR] = "DEST_ADDR",
146 	[IMAGE_CFG_EXEC_ADDR] = "EXEC_ADDR",
147 	[IMAGE_CFG_NAND_BLKSZ] = "NAND_BLKSZ",
148 	[IMAGE_CFG_NAND_BADBLK_LOCATION] = "NAND_BADBLK_LOCATION",
149 	[IMAGE_CFG_NAND_ECC_MODE] = "NAND_ECC_MODE",
150 	[IMAGE_CFG_NAND_PAGESZ] = "NAND_PAGE_SIZE",
151 	[IMAGE_CFG_SATA_BLKSZ] = "SATA_BLKSZ",
152 	[IMAGE_CFG_CPU] = "CPU",
153 	[IMAGE_CFG_BINARY] = "BINARY",
154 	[IMAGE_CFG_DATA] = "DATA",
155 	[IMAGE_CFG_DATA_DELAY] = "DATA_DELAY",
156 	[IMAGE_CFG_BAUDRATE] = "BAUDRATE",
157 	[IMAGE_CFG_UART_PORT] = "UART_PORT",
158 	[IMAGE_CFG_UART_MPP] = "UART_MPP",
159 	[IMAGE_CFG_DEBUG] = "DEBUG",
160 	[IMAGE_CFG_KAK] = "KAK",
161 	[IMAGE_CFG_CSK] = "CSK",
162 	[IMAGE_CFG_CSK_INDEX] = "CSK_INDEX",
163 	[IMAGE_CFG_JTAG_DELAY] = "JTAG_DELAY",
164 	[IMAGE_CFG_BOX_ID] = "BOX_ID",
165 	[IMAGE_CFG_FLASH_ID] = "FLASH_ID",
166 	[IMAGE_CFG_SEC_COMMON_IMG] = "SEC_COMMON_IMG",
167 	[IMAGE_CFG_SEC_SPECIALIZED_IMG] = "SEC_SPECIALIZED_IMG",
168 	[IMAGE_CFG_SEC_BOOT_DEV] = "SEC_BOOT_DEV",
169 	[IMAGE_CFG_SEC_FUSE_DUMP] = "SEC_FUSE_DUMP"
170 };
171 
172 struct image_cfg_element {
173 	enum image_cfg_type type;
174 	union {
175 		unsigned int version;
176 		unsigned int cpu_sheeva;
177 		unsigned int bootfrom;
178 		struct {
179 			const char *file;
180 			unsigned int loadaddr;
181 			unsigned int args[BINARY_MAX_ARGS];
182 			unsigned int nargs;
183 		} binary;
184 		unsigned int dstaddr;
185 		unsigned int execaddr;
186 		unsigned int nandblksz;
187 		unsigned int nandbadblklocation;
188 		unsigned int nandeccmode;
189 		unsigned int nandpagesz;
190 		unsigned int satablksz;
191 		struct ext_hdr_v0_reg regdata;
192 		unsigned int regdata_delay;
193 		unsigned int baudrate;
194 		unsigned int uart_port;
195 		unsigned int uart_mpp;
196 		unsigned int debug;
197 		const char *key_name;
198 		int csk_idx;
199 		uint8_t jtag_delay;
200 		uint32_t boxid;
201 		uint32_t flashid;
202 		bool sec_specialized_img;
203 		unsigned int sec_boot_dev;
204 		const char *name;
205 	};
206 };
207 
208 #define IMAGE_CFG_ELEMENT_MAX 256
209 
210 /*
211  * Utility functions to manipulate boot mode and ecc modes (convert
212  * them back and forth between description strings and the
213  * corresponding numerical identifiers).
214  */
215 
image_boot_mode_name(unsigned int id)216 static const char *image_boot_mode_name(unsigned int id)
217 {
218 	int i;
219 
220 	for (i = 0; boot_modes[i].name; i++)
221 		if (boot_modes[i].id == id)
222 			return boot_modes[i].name;
223 	return NULL;
224 }
225 
image_boot_mode_id(const char * boot_mode_name)226 static int image_boot_mode_id(const char *boot_mode_name)
227 {
228 	int i;
229 
230 	for (i = 0; boot_modes[i].name; i++)
231 		if (!strcmp(boot_modes[i].name, boot_mode_name))
232 			return boot_modes[i].id;
233 
234 	return -1;
235 }
236 
image_nand_ecc_mode_name(unsigned int id)237 static const char *image_nand_ecc_mode_name(unsigned int id)
238 {
239 	int i;
240 
241 	for (i = 0; nand_ecc_modes[i].name; i++)
242 		if (nand_ecc_modes[i].id == id)
243 			return nand_ecc_modes[i].name;
244 
245 	return NULL;
246 }
247 
image_nand_ecc_mode_id(const char * nand_ecc_mode_name)248 static int image_nand_ecc_mode_id(const char *nand_ecc_mode_name)
249 {
250 	int i;
251 
252 	for (i = 0; nand_ecc_modes[i].name; i++)
253 		if (!strcmp(nand_ecc_modes[i].name, nand_ecc_mode_name))
254 			return nand_ecc_modes[i].id;
255 	return -1;
256 }
257 
258 static struct image_cfg_element *
image_find_option(unsigned int optiontype)259 image_find_option(unsigned int optiontype)
260 {
261 	int i;
262 
263 	for (i = 0; i < cfgn; i++) {
264 		if (image_cfg[i].type == optiontype)
265 			return &image_cfg[i];
266 	}
267 
268 	return NULL;
269 }
270 
271 static unsigned int
image_count_options(unsigned int optiontype)272 image_count_options(unsigned int optiontype)
273 {
274 	int i;
275 	unsigned int count = 0;
276 
277 	for (i = 0; i < cfgn; i++)
278 		if (image_cfg[i].type == optiontype)
279 			count++;
280 
281 	return count;
282 }
283 
image_get_csk_index(void)284 static int image_get_csk_index(void)
285 {
286 	struct image_cfg_element *e;
287 
288 	e = image_find_option(IMAGE_CFG_CSK_INDEX);
289 	if (!e)
290 		return -1;
291 
292 	return e->csk_idx;
293 }
294 
image_get_spezialized_img(void)295 static bool image_get_spezialized_img(void)
296 {
297 	struct image_cfg_element *e;
298 
299 	e = image_find_option(IMAGE_CFG_SEC_SPECIALIZED_IMG);
300 	if (!e)
301 		return false;
302 
303 	return e->sec_specialized_img;
304 }
305 
image_get_bootfrom(void)306 static int image_get_bootfrom(void)
307 {
308 	struct image_cfg_element *e;
309 
310 	e = image_find_option(IMAGE_CFG_BOOT_FROM);
311 	if (!e)
312 		/* fallback to SPI if no BOOT_FROM is not provided */
313 		return IBR_HDR_SPI_ID;
314 
315 	return e->bootfrom;
316 }
317 
image_is_cpu_sheeva(void)318 static int image_is_cpu_sheeva(void)
319 {
320 	struct image_cfg_element *e;
321 
322 	e = image_find_option(IMAGE_CFG_CPU);
323 	if (!e)
324 		return 0;
325 
326 	return e->cpu_sheeva;
327 }
328 
329 /*
330  * Compute a 8-bit checksum of a memory area. This algorithm follows
331  * the requirements of the Marvell SoC BootROM specifications.
332  */
image_checksum8(void * start,uint32_t len)333 static uint8_t image_checksum8(void *start, uint32_t len)
334 {
335 	uint8_t csum = 0;
336 	uint8_t *p = start;
337 
338 	/* check len and return zero checksum if invalid */
339 	if (!len)
340 		return 0;
341 
342 	do {
343 		csum += *p;
344 		p++;
345 	} while (--len);
346 
347 	return csum;
348 }
349 
350 /*
351  * Verify checksum over a complete header that includes the checksum field.
352  * Return 1 when OK, otherwise 0.
353  */
main_hdr_checksum_ok(void * hdr)354 static int main_hdr_checksum_ok(void *hdr)
355 {
356 	/* Offsets of checksum in v0 and v1 headers are the same */
357 	struct main_hdr_v0 *main_hdr = (struct main_hdr_v0 *)hdr;
358 	uint8_t checksum;
359 
360 	checksum = image_checksum8(hdr, kwbheader_size_for_csum(hdr));
361 	/* Calculated checksum includes the header checksum field. Compensate
362 	 * for that.
363 	 */
364 	checksum -= main_hdr->checksum;
365 
366 	return checksum == main_hdr->checksum;
367 }
368 
image_checksum32(void * start,uint32_t len)369 static uint32_t image_checksum32(void *start, uint32_t len)
370 {
371 	uint32_t csum = 0;
372 	uint32_t *p = start;
373 
374 	/* check len and return zero checksum if invalid */
375 	if (!len)
376 		return 0;
377 
378 	if (len % sizeof(uint32_t)) {
379 		fprintf(stderr, "Length %d is not in multiple of %zu\n",
380 			len, sizeof(uint32_t));
381 		return 0;
382 	}
383 
384 	do {
385 		csum += *p;
386 		p++;
387 		len -= sizeof(uint32_t);
388 	} while (len > 0);
389 
390 	return csum;
391 }
392 
options_to_baudrate(uint8_t options)393 static unsigned int options_to_baudrate(uint8_t options)
394 {
395 	switch (options & 0x7) {
396 	case MAIN_HDR_V1_OPT_BAUD_2400:
397 		return 2400;
398 	case MAIN_HDR_V1_OPT_BAUD_4800:
399 		return 4800;
400 	case MAIN_HDR_V1_OPT_BAUD_9600:
401 		return 9600;
402 	case MAIN_HDR_V1_OPT_BAUD_19200:
403 		return 19200;
404 	case MAIN_HDR_V1_OPT_BAUD_38400:
405 		return 38400;
406 	case MAIN_HDR_V1_OPT_BAUD_57600:
407 		return 57600;
408 	case MAIN_HDR_V1_OPT_BAUD_115200:
409 		return 115200;
410 	case MAIN_HDR_V1_OPT_BAUD_DEFAULT:
411 	default:
412 		return 0;
413 	}
414 }
415 
baudrate_to_option(unsigned int baudrate)416 static uint8_t baudrate_to_option(unsigned int baudrate)
417 {
418 	switch (baudrate) {
419 	case 2400:
420 		return MAIN_HDR_V1_OPT_BAUD_2400;
421 	case 4800:
422 		return MAIN_HDR_V1_OPT_BAUD_4800;
423 	case 9600:
424 		return MAIN_HDR_V1_OPT_BAUD_9600;
425 	case 19200:
426 		return MAIN_HDR_V1_OPT_BAUD_19200;
427 	case 38400:
428 		return MAIN_HDR_V1_OPT_BAUD_38400;
429 	case 57600:
430 		return MAIN_HDR_V1_OPT_BAUD_57600;
431 	case 115200:
432 		return MAIN_HDR_V1_OPT_BAUD_115200;
433 	default:
434 		return MAIN_HDR_V1_OPT_BAUD_DEFAULT;
435 	}
436 }
437 
kwb_msg(const char * fmt,...)438 static void kwb_msg(const char *fmt, ...)
439 {
440 	if (verbose_mode) {
441 		va_list ap;
442 
443 		va_start(ap, fmt);
444 		vfprintf(stdout, fmt, ap);
445 		va_end(ap);
446 	}
447 }
448 
openssl_err(const char * msg)449 static int openssl_err(const char *msg)
450 {
451 	unsigned long ssl_err = ERR_get_error();
452 
453 	fprintf(stderr, "%s", msg);
454 	fprintf(stderr, ": %s\n",
455 		ERR_error_string(ssl_err, 0));
456 
457 	return -1;
458 }
459 
kwb_load_rsa_key(const char * keydir,const char * name,RSA ** p_rsa)460 static int kwb_load_rsa_key(const char *keydir, const char *name, RSA **p_rsa)
461 {
462 	char path[PATH_MAX];
463 	RSA *rsa;
464 	FILE *f;
465 
466 	if (!keydir)
467 		keydir = ".";
468 
469 	snprintf(path, sizeof(path), "%s/%s.key", keydir, name);
470 	f = fopen(path, "r");
471 	if (!f) {
472 		fprintf(stderr, "Couldn't open RSA private key: '%s': %s\n",
473 			path, strerror(errno));
474 		return -ENOENT;
475 	}
476 
477 	rsa = PEM_read_RSAPrivateKey(f, 0, NULL, "");
478 	if (!rsa) {
479 		openssl_err("Failure reading private key");
480 		fclose(f);
481 		return -EPROTO;
482 	}
483 	fclose(f);
484 	*p_rsa = rsa;
485 
486 	return 0;
487 }
488 
kwb_load_cfg_key(struct image_tool_params * params,unsigned int cfg_option,const char * key_name,RSA ** p_key)489 static int kwb_load_cfg_key(struct image_tool_params *params,
490 			    unsigned int cfg_option, const char *key_name,
491 			    RSA **p_key)
492 {
493 	struct image_cfg_element *e_key;
494 	RSA *key;
495 	int res;
496 
497 	*p_key = NULL;
498 
499 	e_key = image_find_option(cfg_option);
500 	if (!e_key) {
501 		fprintf(stderr, "%s not configured\n", key_name);
502 		return -ENOENT;
503 	}
504 
505 	res = kwb_load_rsa_key(params->keydir, e_key->key_name, &key);
506 	if (res < 0) {
507 		fprintf(stderr, "Failed to load %s\n", key_name);
508 		return -ENOENT;
509 	}
510 
511 	*p_key = key;
512 
513 	return 0;
514 }
515 
kwb_load_kak(struct image_tool_params * params,RSA ** p_kak)516 static int kwb_load_kak(struct image_tool_params *params, RSA **p_kak)
517 {
518 	return kwb_load_cfg_key(params, IMAGE_CFG_KAK, "KAK", p_kak);
519 }
520 
kwb_load_csk(struct image_tool_params * params,RSA ** p_csk)521 static int kwb_load_csk(struct image_tool_params *params, RSA **p_csk)
522 {
523 	return kwb_load_cfg_key(params, IMAGE_CFG_CSK, "CSK", p_csk);
524 }
525 
kwb_compute_pubkey_hash(struct pubkey_der_v1 * pk,struct hash_v1 * hash)526 static int kwb_compute_pubkey_hash(struct pubkey_der_v1 *pk,
527 				   struct hash_v1 *hash)
528 {
529 	EVP_MD_CTX *ctx;
530 	unsigned int key_size;
531 	unsigned int hash_size;
532 	int ret = 0;
533 
534 	if (!pk || !hash || pk->key[0] != 0x30 || pk->key[1] != 0x82)
535 		return -EINVAL;
536 
537 	key_size = (pk->key[2] << 8) + pk->key[3] + 4;
538 
539 	ctx = EVP_MD_CTX_create();
540 	if (!ctx)
541 		return openssl_err("EVP context creation failed");
542 
543 	EVP_MD_CTX_init(ctx);
544 	if (!EVP_DigestInit(ctx, EVP_sha256())) {
545 		ret = openssl_err("Digest setup failed");
546 		goto hash_err_ctx;
547 	}
548 
549 	if (!EVP_DigestUpdate(ctx, pk->key, key_size)) {
550 		ret = openssl_err("Hashing data failed");
551 		goto hash_err_ctx;
552 	}
553 
554 	if (!EVP_DigestFinal(ctx, hash->hash, &hash_size)) {
555 		ret = openssl_err("Could not obtain hash");
556 		goto hash_err_ctx;
557 	}
558 
559 	EVP_MD_CTX_cleanup(ctx);
560 
561 hash_err_ctx:
562 	EVP_MD_CTX_destroy(ctx);
563 	return ret;
564 }
565 
kwb_import_pubkey(RSA ** key,struct pubkey_der_v1 * src,char * keyname)566 static int kwb_import_pubkey(RSA **key, struct pubkey_der_v1 *src, char *keyname)
567 {
568 	RSA *rsa;
569 	const unsigned char *ptr;
570 
571 	if (!key || !src)
572 		goto fail;
573 
574 	ptr = src->key;
575 	rsa = d2i_RSAPublicKey(key, &ptr, sizeof(src->key));
576 	if (!rsa) {
577 		openssl_err("error decoding public key");
578 		goto fail;
579 	}
580 
581 	return 0;
582 fail:
583 	fprintf(stderr, "Failed to decode %s pubkey\n", keyname);
584 	return -EINVAL;
585 }
586 
kwb_export_pubkey(RSA * key,struct pubkey_der_v1 * dst,FILE * hashf,char * keyname)587 static int kwb_export_pubkey(RSA *key, struct pubkey_der_v1 *dst, FILE *hashf,
588 			     char *keyname)
589 {
590 	int size_exp, size_mod, size_seq;
591 	const BIGNUM *key_e, *key_n;
592 	uint8_t *cur;
593 	char *errmsg = "Failed to encode %s\n";
594 
595 	RSA_get0_key(key, NULL, &key_e, NULL);
596 	RSA_get0_key(key, &key_n, NULL, NULL);
597 
598 	if (!key || !key_e || !key_n || !dst) {
599 		fprintf(stderr, "export pk failed: (%p, %p, %p, %p)",
600 			key, key_e, key_n, dst);
601 		fprintf(stderr, errmsg, keyname);
602 		return -EINVAL;
603 	}
604 
605 	/*
606 	 * According to the specs, the key should be PKCS#1 DER encoded.
607 	 * But unfortunately the really required encoding seems to be different;
608 	 * it violates DER...! (But it still conformes to BER.)
609 	 * (Length always in long form w/ 2 byte length code; no leading zero
610 	 * when MSB of first byte is set...)
611 	 * So we cannot use the encoding func provided by OpenSSL and have to
612 	 * do the encoding manually.
613 	 */
614 
615 	size_exp = BN_num_bytes(key_e);
616 	size_mod = BN_num_bytes(key_n);
617 	size_seq = 4 + size_mod + 4 + size_exp;
618 
619 	if (size_mod > 256) {
620 		fprintf(stderr, "export pk failed: wrong mod size: %d\n",
621 			size_mod);
622 		fprintf(stderr, errmsg, keyname);
623 		return -EINVAL;
624 	}
625 
626 	if (4 + size_seq > sizeof(dst->key)) {
627 		fprintf(stderr, "export pk failed: seq too large (%d, %zu)\n",
628 			4 + size_seq, sizeof(dst->key));
629 		fprintf(stderr, errmsg, keyname);
630 		return -ENOBUFS;
631 	}
632 
633 	cur = dst->key;
634 
635 	/* PKCS#1 (RFC3447) RSAPublicKey structure */
636 	*cur++ = 0x30;		/* SEQUENCE */
637 	*cur++ = 0x82;
638 	*cur++ = (size_seq >> 8) & 0xFF;
639 	*cur++ = size_seq & 0xFF;
640 	/* Modulus */
641 	*cur++ = 0x02;		/* INTEGER */
642 	*cur++ = 0x82;
643 	*cur++ = (size_mod >> 8) & 0xFF;
644 	*cur++ = size_mod & 0xFF;
645 	BN_bn2bin(key_n, cur);
646 	cur += size_mod;
647 	/* Exponent */
648 	*cur++ = 0x02;		/* INTEGER */
649 	*cur++ = 0x82;
650 	*cur++ = (size_exp >> 8) & 0xFF;
651 	*cur++ = size_exp & 0xFF;
652 	BN_bn2bin(key_e, cur);
653 
654 	if (hashf) {
655 		struct hash_v1 pk_hash;
656 		int i;
657 		int ret = 0;
658 
659 		ret = kwb_compute_pubkey_hash(dst, &pk_hash);
660 		if (ret < 0) {
661 			fprintf(stderr, errmsg, keyname);
662 			return ret;
663 		}
664 
665 		fprintf(hashf, "SHA256 = ");
666 		for (i = 0 ; i < sizeof(pk_hash.hash); ++i)
667 			fprintf(hashf, "%02X", pk_hash.hash[i]);
668 		fprintf(hashf, "\n");
669 	}
670 
671 	return 0;
672 }
673 
kwb_sign(RSA * key,void * data,int datasz,struct sig_v1 * sig,char * signame)674 static int kwb_sign(RSA *key, void *data, int datasz, struct sig_v1 *sig,
675 		    char *signame)
676 {
677 	EVP_PKEY *evp_key;
678 	EVP_MD_CTX *ctx;
679 	unsigned int sig_size;
680 	int size;
681 	int ret = 0;
682 
683 	evp_key = EVP_PKEY_new();
684 	if (!evp_key)
685 		return openssl_err("EVP_PKEY object creation failed");
686 
687 	if (!EVP_PKEY_set1_RSA(evp_key, key)) {
688 		ret = openssl_err("EVP key setup failed");
689 		goto err_key;
690 	}
691 
692 	size = EVP_PKEY_size(evp_key);
693 	if (size > sizeof(sig->sig)) {
694 		fprintf(stderr, "Buffer to small for signature (%d bytes)\n",
695 			size);
696 		ret = -ENOBUFS;
697 		goto err_key;
698 	}
699 
700 	ctx = EVP_MD_CTX_create();
701 	if (!ctx) {
702 		ret = openssl_err("EVP context creation failed");
703 		goto err_key;
704 	}
705 	EVP_MD_CTX_init(ctx);
706 	if (!EVP_SignInit(ctx, EVP_sha256())) {
707 		ret = openssl_err("Signer setup failed");
708 		goto err_ctx;
709 	}
710 
711 	if (!EVP_SignUpdate(ctx, data, datasz)) {
712 		ret = openssl_err("Signing data failed");
713 		goto err_ctx;
714 	}
715 
716 	if (!EVP_SignFinal(ctx, sig->sig, &sig_size, evp_key)) {
717 		ret = openssl_err("Could not obtain signature");
718 		goto err_ctx;
719 	}
720 
721 	EVP_MD_CTX_cleanup(ctx);
722 	EVP_MD_CTX_destroy(ctx);
723 	EVP_PKEY_free(evp_key);
724 
725 	return 0;
726 
727 err_ctx:
728 	EVP_MD_CTX_destroy(ctx);
729 err_key:
730 	EVP_PKEY_free(evp_key);
731 	fprintf(stderr, "Failed to create %s signature\n", signame);
732 	return ret;
733 }
734 
kwb_verify(RSA * key,void * data,int datasz,struct sig_v1 * sig,char * signame)735 static int kwb_verify(RSA *key, void *data, int datasz, struct sig_v1 *sig,
736 		      char *signame)
737 {
738 	EVP_PKEY *evp_key;
739 	EVP_MD_CTX *ctx;
740 	int size;
741 	int ret = 0;
742 
743 	evp_key = EVP_PKEY_new();
744 	if (!evp_key)
745 		return openssl_err("EVP_PKEY object creation failed");
746 
747 	if (!EVP_PKEY_set1_RSA(evp_key, key)) {
748 		ret = openssl_err("EVP key setup failed");
749 		goto err_key;
750 	}
751 
752 	size = EVP_PKEY_size(evp_key);
753 	if (size > sizeof(sig->sig)) {
754 		fprintf(stderr, "Invalid signature size (%d bytes)\n",
755 			size);
756 		ret = -EINVAL;
757 		goto err_key;
758 	}
759 
760 	ctx = EVP_MD_CTX_create();
761 	if (!ctx) {
762 		ret = openssl_err("EVP context creation failed");
763 		goto err_key;
764 	}
765 	EVP_MD_CTX_init(ctx);
766 	if (!EVP_VerifyInit(ctx, EVP_sha256())) {
767 		ret = openssl_err("Verifier setup failed");
768 		goto err_ctx;
769 	}
770 
771 	if (!EVP_VerifyUpdate(ctx, data, datasz)) {
772 		ret = openssl_err("Hashing data failed");
773 		goto err_ctx;
774 	}
775 
776 	if (EVP_VerifyFinal(ctx, sig->sig, sizeof(sig->sig), evp_key) != 1) {
777 		ret = openssl_err("Could not verify signature");
778 		goto err_ctx;
779 	}
780 
781 	EVP_MD_CTX_cleanup(ctx);
782 	EVP_MD_CTX_destroy(ctx);
783 	EVP_PKEY_free(evp_key);
784 
785 	return 0;
786 
787 err_ctx:
788 	EVP_MD_CTX_destroy(ctx);
789 err_key:
790 	EVP_PKEY_free(evp_key);
791 	fprintf(stderr, "Failed to verify %s signature\n", signame);
792 	return ret;
793 }
794 
kwb_sign_and_verify(RSA * key,void * data,int datasz,struct sig_v1 * sig,char * signame)795 static int kwb_sign_and_verify(RSA *key, void *data, int datasz,
796 			       struct sig_v1 *sig, char *signame)
797 {
798 	if (kwb_sign(key, data, datasz, sig, signame) < 0)
799 		return -1;
800 
801 	if (kwb_verify(key, data, datasz, sig, signame) < 0)
802 		return -1;
803 
804 	return 0;
805 }
806 
kwb_dump_fuse_cmds_38x(FILE * out,struct secure_hdr_v1 * sec_hdr)807 static int kwb_dump_fuse_cmds_38x(FILE *out, struct secure_hdr_v1 *sec_hdr)
808 {
809 	struct hash_v1 kak_pub_hash;
810 	struct image_cfg_element *e;
811 	unsigned int fuse_line;
812 	int i, idx;
813 	uint8_t *ptr;
814 	uint32_t val;
815 	int ret = 0;
816 
817 	if (!out || !sec_hdr)
818 		return -EINVAL;
819 
820 	ret = kwb_compute_pubkey_hash(&sec_hdr->kak, &kak_pub_hash);
821 	if (ret < 0)
822 		goto done;
823 
824 	fprintf(out, "# burn KAK pub key hash\n");
825 	ptr = kak_pub_hash.hash;
826 	for (fuse_line = 26; fuse_line <= 30; ++fuse_line) {
827 		fprintf(out, "fuse prog -y %u 0 ", fuse_line);
828 
829 		for (i = 4; i-- > 0;)
830 			fprintf(out, "%02hx", (ushort)ptr[i]);
831 		ptr += 4;
832 		fprintf(out, " 00");
833 
834 		if (fuse_line < 30) {
835 			for (i = 3; i-- > 0;)
836 				fprintf(out, "%02hx", (ushort)ptr[i]);
837 			ptr += 3;
838 		} else {
839 			fprintf(out, "000000");
840 		}
841 
842 		fprintf(out, " 1\n");
843 	}
844 
845 	fprintf(out, "# burn CSK selection\n");
846 
847 	idx = image_get_csk_index();
848 	if (idx < 0 || idx > 15) {
849 		ret = -EINVAL;
850 		goto done;
851 	}
852 	if (idx > 0) {
853 		for (fuse_line = 31; fuse_line < 31 + idx; ++fuse_line)
854 			fprintf(out, "fuse prog -y %u 0 00000001 00000000 1\n",
855 				fuse_line);
856 	} else {
857 		fprintf(out, "# CSK index is 0; no mods needed\n");
858 	}
859 
860 	e = image_find_option(IMAGE_CFG_BOX_ID);
861 	if (e) {
862 		fprintf(out, "# set box ID\n");
863 		fprintf(out, "fuse prog -y 48 0 %08x 00000000 1\n", e->boxid);
864 	}
865 
866 	e = image_find_option(IMAGE_CFG_FLASH_ID);
867 	if (e) {
868 		fprintf(out, "# set flash ID\n");
869 		fprintf(out, "fuse prog -y 47 0 %08x 00000000 1\n", e->flashid);
870 	}
871 
872 	fprintf(out, "# enable secure mode ");
873 	fprintf(out, "(must be the last fuse line written)\n");
874 
875 	val = 1;
876 	e = image_find_option(IMAGE_CFG_SEC_BOOT_DEV);
877 	if (!e) {
878 		fprintf(stderr, "ERROR: secured mode boot device not given\n");
879 		ret = -EINVAL;
880 		goto done;
881 	}
882 
883 	if (e->sec_boot_dev > 0xff) {
884 		fprintf(stderr, "ERROR: secured mode boot device invalid\n");
885 		ret = -EINVAL;
886 		goto done;
887 	}
888 
889 	val |= (e->sec_boot_dev << 8);
890 
891 	fprintf(out, "fuse prog -y 24 0 %08x 0103e0a9 1\n", val);
892 
893 	fprintf(out, "# lock (unused) fuse lines (0-23)s\n");
894 	for (fuse_line = 0; fuse_line < 24; ++fuse_line)
895 		fprintf(out, "fuse prog -y %u 2 1\n", fuse_line);
896 
897 	fprintf(out, "# OK, that's all :-)\n");
898 
899 done:
900 	return ret;
901 }
902 
kwb_dump_fuse_cmds(struct secure_hdr_v1 * sec_hdr)903 static int kwb_dump_fuse_cmds(struct secure_hdr_v1 *sec_hdr)
904 {
905 	int ret = 0;
906 	struct image_cfg_element *e;
907 
908 	e = image_find_option(IMAGE_CFG_SEC_FUSE_DUMP);
909 	if (!e)
910 		return 0;
911 
912 	if (!strcmp(e->name, "a38x")) {
913 		FILE *out = fopen("kwb_fuses_a38x.txt", "w+");
914 
915 		if (!out) {
916 			fprintf(stderr, "Couldn't open eFuse settings: '%s': %s\n",
917 				"kwb_fuses_a38x.txt", strerror(errno));
918 			return -ENOENT;
919 		}
920 
921 		kwb_dump_fuse_cmds_38x(out, sec_hdr);
922 		fclose(out);
923 		goto done;
924 	}
925 
926 	ret = -ENOSYS;
927 
928 done:
929 	return ret;
930 }
931 
image_fill_xip_header(void * image,struct image_tool_params * params)932 static int image_fill_xip_header(void *image, struct image_tool_params *params)
933 {
934 	struct main_hdr_v1 *main_hdr = image; /* kwbimage v0 and v1 have same XIP members */
935 	int version = kwbimage_version(image);
936 	uint32_t srcaddr = le32_to_cpu(main_hdr->srcaddr);
937 	uint32_t startaddr = 0;
938 
939 	if (main_hdr->blockid != IBR_HDR_SPI_ID) {
940 		fprintf(stderr, "XIP is supported only for SPI images\n");
941 		return 0;
942 	}
943 
944 	if (version == 0 &&
945 		   params->addr >= 0xE8000000 && params->addr < 0xEFFFFFFF &&
946 		   params->ep >= 0xE8000000 && params->ep < 0xEFFFFFFF) {
947 		/* Load and Execute address is in SPI address space (kwbimage v0) */
948 		startaddr = 0xE8000000;
949 	} else if (version != 0 &&
950 		   params->addr >= 0xD4000000 && params->addr < 0xD7FFFFFF &&
951 		   params->ep >= 0xD4000000 && params->ep < 0xD7FFFFFF) {
952 		/* Load and Execute address is in SPI address space (kwbimage v1) */
953 		startaddr = 0xD4000000;
954 	} else if (version != 0 &&
955 		   params->addr >= 0xD8000000 && params->addr < 0xDFFFFFFF &&
956 		   params->ep >= 0xD8000000 && params->ep < 0xDFFFFFFF) {
957 		/* Load and Execute address is in Device bus space (kwbimage v1) */
958 		startaddr = 0xD8000000;
959 	} else if (params->addr != 0x0) {
960 		/* Load address is non-zero */
961 		if (version == 0)
962 			fprintf(stderr, "XIP Load Address or XIP Entry Point is not in SPI address space\n");
963 		else
964 			fprintf(stderr, "XIP Load Address or XIP Entry Point is not in SPI nor in Device bus address space\n");
965 		return 0;
966 	}
967 
968 	/*
969 	 * For XIP destaddr must be set to 0xFFFFFFFF and
970 	 * execaddr relative to the start of XIP memory address space.
971 	 */
972 	main_hdr->destaddr = cpu_to_le32(0xFFFFFFFF);
973 
974 	if (startaddr == 0) {
975 		/*
976 		 * mkimage's --load-address 0x0 means that binary is Position
977 		 * Independent and in this case mkimage's --entry-point address
978 		 * is relative offset from beginning of the data part of image.
979 		 */
980 		main_hdr->execaddr = cpu_to_le32(srcaddr + params->ep);
981 	} else {
982 		/* The lowest possible load address is after the header at srcaddr. */
983 		if (params->addr - startaddr < srcaddr) {
984 			fprintf(stderr,
985 				"Invalid XIP Load Address 0x%08x.\n"
986 				"The lowest address for this configuration is 0x%08x.\n",
987 				params->addr, (unsigned)(startaddr + srcaddr));
988 			return 0;
989 		}
990 		main_hdr->srcaddr = cpu_to_le32(params->addr - startaddr);
991 		main_hdr->execaddr = cpu_to_le32(params->ep - startaddr);
992 	}
993 
994 	return 1;
995 }
996 
image_get_satablksz(void)997 static unsigned int image_get_satablksz(void)
998 {
999 	struct image_cfg_element *e;
1000 	e = image_find_option(IMAGE_CFG_SATA_BLKSZ);
1001 	return e ? e->satablksz : 512;
1002 }
1003 
image_headersz_align(size_t headersz,uint8_t blockid)1004 static size_t image_headersz_align(size_t headersz, uint8_t blockid)
1005 {
1006 	/*
1007 	 * Header needs to be 4-byte aligned, which is already ensured by code
1008 	 * above. Moreover UART images must have header aligned to 128 bytes
1009 	 * (xmodem block size), NAND images to 256 bytes (ECC calculation),
1010 	 * SDIO images to 512 bytes (SDHC/SDXC fixed block size) and SATA
1011 	 * images to specified storage block size (default 512 bytes).
1012 	 * Note that SPI images do not have to have header size aligned
1013 	 * to 256 bytes because it is possible to read from SPI storage from
1014 	 * any offset (read offset does not have to be aligned to block size).
1015 	 */
1016 	if (blockid == IBR_HDR_UART_ID)
1017 		return ALIGN(headersz, 128);
1018 	else if (blockid == IBR_HDR_NAND_ID)
1019 		return ALIGN(headersz, 256);
1020 	else if (blockid == IBR_HDR_SDIO_ID)
1021 		return ALIGN(headersz, 512);
1022 	else if (blockid == IBR_HDR_SATA_ID)
1023 		return ALIGN(headersz, image_get_satablksz());
1024 	else
1025 		return headersz;
1026 }
1027 
image_headersz_v0(int * hasext)1028 static size_t image_headersz_v0(int *hasext)
1029 {
1030 	size_t headersz;
1031 
1032 	headersz = sizeof(struct main_hdr_v0);
1033 	if (image_count_options(IMAGE_CFG_DATA) > 0) {
1034 		headersz += sizeof(struct ext_hdr_v0);
1035 		if (hasext)
1036 			*hasext = 1;
1037 	}
1038 
1039 	return headersz;
1040 }
1041 
image_create_v0(size_t * dataoff,struct image_tool_params * params,int payloadsz)1042 static void *image_create_v0(size_t *dataoff, struct image_tool_params *params,
1043 			     int payloadsz)
1044 {
1045 	struct image_cfg_element *e;
1046 	size_t headersz;
1047 	struct main_hdr_v0 *main_hdr;
1048 	uint8_t *image;
1049 	int has_ext = 0;
1050 
1051 	/*
1052 	 * Calculate the size of the header and the offset of the
1053 	 * payload
1054 	 */
1055 	headersz = image_headersz_v0(&has_ext);
1056 	*dataoff = image_headersz_align(headersz, image_get_bootfrom());
1057 
1058 	image = malloc(headersz);
1059 	if (!image) {
1060 		fprintf(stderr, "Cannot allocate memory for image\n");
1061 		return NULL;
1062 	}
1063 
1064 	memset(image, 0, headersz);
1065 
1066 	main_hdr = (struct main_hdr_v0 *)image;
1067 
1068 	/* Fill in the main header */
1069 	main_hdr->blocksize =
1070 		cpu_to_le32(payloadsz);
1071 	main_hdr->srcaddr   = cpu_to_le32(*dataoff);
1072 	main_hdr->ext       = has_ext;
1073 	main_hdr->version   = 0;
1074 	main_hdr->destaddr  = cpu_to_le32(params->addr);
1075 	main_hdr->execaddr  = cpu_to_le32(params->ep);
1076 	main_hdr->blockid   = image_get_bootfrom();
1077 
1078 	e = image_find_option(IMAGE_CFG_NAND_ECC_MODE);
1079 	if (e)
1080 		main_hdr->nandeccmode = e->nandeccmode;
1081 	e = image_find_option(IMAGE_CFG_NAND_BLKSZ);
1082 	if (e)
1083 		main_hdr->nandblocksize = e->nandblksz / (64 * 1024);
1084 	e = image_find_option(IMAGE_CFG_NAND_PAGESZ);
1085 	if (e)
1086 		main_hdr->nandpagesize = cpu_to_le16(e->nandpagesz);
1087 	e = image_find_option(IMAGE_CFG_NAND_BADBLK_LOCATION);
1088 	if (e)
1089 		main_hdr->nandbadblklocation = e->nandbadblklocation;
1090 
1091 	/* For SATA srcaddr is specified in number of sectors. */
1092 	if (main_hdr->blockid == IBR_HDR_SATA_ID) {
1093 		params->bl_len = image_get_satablksz();
1094 		main_hdr->srcaddr = cpu_to_le32(le32_to_cpu(main_hdr->srcaddr) / params->bl_len);
1095 	}
1096 
1097 	/* For PCIe srcaddr is not used and must be set to 0xFFFFFFFF. */
1098 	if (main_hdr->blockid == IBR_HDR_PEX_ID)
1099 		main_hdr->srcaddr = cpu_to_le32(0xFFFFFFFF);
1100 
1101 	if (params->xflag) {
1102 		if (!image_fill_xip_header(main_hdr, params)) {
1103 			free(image);
1104 			return NULL;
1105 		}
1106 		*dataoff = le32_to_cpu(main_hdr->srcaddr);
1107 	}
1108 
1109 	/* Generate the ext header */
1110 	if (has_ext) {
1111 		struct ext_hdr_v0 *ext_hdr;
1112 		int cfgi, datai;
1113 
1114 		ext_hdr = (struct ext_hdr_v0 *)
1115 				(image + sizeof(struct main_hdr_v0));
1116 		ext_hdr->offset = cpu_to_le32(0x40);
1117 
1118 		for (cfgi = 0, datai = 0; cfgi < cfgn; cfgi++) {
1119 			e = &image_cfg[cfgi];
1120 			if (e->type != IMAGE_CFG_DATA)
1121 				continue;
1122 
1123 			ext_hdr->rcfg[datai].raddr =
1124 				cpu_to_le32(e->regdata.raddr);
1125 			ext_hdr->rcfg[datai].rdata =
1126 				cpu_to_le32(e->regdata.rdata);
1127 			datai++;
1128 		}
1129 
1130 		ext_hdr->checksum = image_checksum8(ext_hdr,
1131 						    sizeof(struct ext_hdr_v0));
1132 	}
1133 
1134 	main_hdr->checksum = image_checksum8(image,
1135 					     sizeof(struct main_hdr_v0));
1136 
1137 	return image;
1138 }
1139 
image_headersz_v1(int * hasext)1140 static size_t image_headersz_v1(int *hasext)
1141 {
1142 	struct image_cfg_element *e;
1143 	unsigned int count;
1144 	size_t headersz;
1145 	int cpu_sheeva;
1146 	struct stat s;
1147 	int cfgi;
1148 	int ret;
1149 
1150 	headersz = sizeof(struct main_hdr_v1);
1151 
1152 	if (image_get_csk_index() >= 0) {
1153 		headersz += sizeof(struct secure_hdr_v1);
1154 		if (hasext)
1155 			*hasext = 1;
1156 	}
1157 
1158 	cpu_sheeva = image_is_cpu_sheeva();
1159 
1160 	count = 0;
1161 	for (cfgi = 0; cfgi < cfgn; cfgi++) {
1162 		e = &image_cfg[cfgi];
1163 
1164 		if (e->type == IMAGE_CFG_DATA)
1165 			count++;
1166 
1167 		if (e->type == IMAGE_CFG_DATA_DELAY ||
1168 		    (e->type == IMAGE_CFG_BINARY && count > 0)) {
1169 			headersz += sizeof(struct register_set_hdr_v1) + 8 * count + 4;
1170 			count = 0;
1171 		}
1172 
1173 		if (e->type != IMAGE_CFG_BINARY)
1174 			continue;
1175 
1176 		ret = stat(e->binary.file, &s);
1177 		if (ret < 0) {
1178 			char cwd[PATH_MAX];
1179 			char *dir = cwd;
1180 
1181 			memset(cwd, 0, sizeof(cwd));
1182 			if (!getcwd(cwd, sizeof(cwd))) {
1183 				dir = "current working directory";
1184 				perror("getcwd() failed");
1185 			}
1186 
1187 			fprintf(stderr,
1188 				"Didn't find the file '%s' in '%s' which is mandatory to generate the image\n"
1189 				"This file generally contains the DDR3 training code, and should be extracted from an existing bootable\n"
1190 				"image for your board. Use 'dumpimage -T kwbimage -p 1' to extract it from an existing image.\n",
1191 				e->binary.file, dir);
1192 			return 0;
1193 		}
1194 
1195 		headersz += sizeof(struct opt_hdr_v1) + sizeof(uint32_t) +
1196 			(e->binary.nargs) * sizeof(uint32_t);
1197 
1198 		if (e->binary.loadaddr) {
1199 			/*
1200 			 * BootROM loads kwbimage header (in which the
1201 			 * executable code is also stored) to address
1202 			 * 0x40004000 or 0x40000000. Thus there is
1203 			 * restriction for the load address of the N-th
1204 			 * BINARY image.
1205 			 */
1206 			unsigned int base_addr, low_addr, high_addr;
1207 
1208 			base_addr = cpu_sheeva ? 0x40004000 : 0x40000000;
1209 			low_addr = base_addr + headersz;
1210 			high_addr = low_addr +
1211 				    (BINARY_MAX_ARGS - e->binary.nargs) * sizeof(uint32_t);
1212 
1213 			if (cpu_sheeva && e->binary.loadaddr % 16) {
1214 				fprintf(stderr,
1215 					"Invalid LOAD_ADDRESS 0x%08x for BINARY %s with %d args.\n"
1216 					"Address for CPU SHEEVA must be 16-byte aligned.\n",
1217 					e->binary.loadaddr, e->binary.file, e->binary.nargs);
1218 				return 0;
1219 			}
1220 
1221 			if (e->binary.loadaddr % 4 || e->binary.loadaddr < low_addr ||
1222 			    e->binary.loadaddr > high_addr) {
1223 				fprintf(stderr,
1224 					"Invalid LOAD_ADDRESS 0x%08x for BINARY %s with %d args.\n"
1225 					"Address must be 4-byte aligned and in range 0x%08x-0x%08x.\n",
1226 					e->binary.loadaddr, e->binary.file,
1227 					e->binary.nargs, low_addr, high_addr);
1228 				return 0;
1229 			}
1230 			headersz = e->binary.loadaddr - base_addr;
1231 		} else if (cpu_sheeva) {
1232 			headersz = ALIGN(headersz, 16);
1233 		} else {
1234 			headersz = ALIGN(headersz, 4);
1235 		}
1236 
1237 		headersz += ALIGN(s.st_size, 4) + sizeof(uint32_t);
1238 		if (hasext)
1239 			*hasext = 1;
1240 	}
1241 
1242 	if (count > 0)
1243 		headersz += sizeof(struct register_set_hdr_v1) + 8 * count + 4;
1244 
1245 	/*
1246 	 * For all images except UART, headersz stored in header itself should
1247 	 * contains header size without padding. For UART image BootROM rounds
1248 	 * down headersz to multiply of 128 bytes. Therefore align UART headersz
1249 	 * to multiply of 128 bytes to ensure that remaining UART header bytes
1250 	 * are not ignored by BootROM.
1251 	 */
1252 	if (image_get_bootfrom() == IBR_HDR_UART_ID)
1253 		headersz = ALIGN(headersz, 128);
1254 
1255 	return headersz;
1256 }
1257 
add_binary_header_v1(uint8_t ** cur,uint8_t ** next_ext,struct image_cfg_element * binarye,struct main_hdr_v1 * main_hdr)1258 static int add_binary_header_v1(uint8_t **cur, uint8_t **next_ext,
1259 				struct image_cfg_element *binarye,
1260 				struct main_hdr_v1 *main_hdr)
1261 {
1262 	struct opt_hdr_v1 *hdr = (struct opt_hdr_v1 *)*cur;
1263 	uint32_t base_addr;
1264 	uint32_t add_args;
1265 	uint32_t offset;
1266 	uint32_t *args;
1267 	size_t binhdrsz;
1268 	int cpu_sheeva;
1269 	struct stat s;
1270 	int argi;
1271 	FILE *bin;
1272 	int ret;
1273 
1274 	hdr->headertype = OPT_HDR_V1_BINARY_TYPE;
1275 
1276 	bin = fopen(binarye->binary.file, "r");
1277 	if (!bin) {
1278 		fprintf(stderr, "Cannot open binary file %s\n",
1279 			binarye->binary.file);
1280 		return -1;
1281 	}
1282 
1283 	if (fstat(fileno(bin), &s)) {
1284 		fprintf(stderr, "Cannot stat binary file %s\n",
1285 			binarye->binary.file);
1286 		goto err_close;
1287 	}
1288 
1289 	*cur += sizeof(struct opt_hdr_v1);
1290 
1291 	args = (uint32_t *)*cur;
1292 	*args = cpu_to_le32(binarye->binary.nargs);
1293 	args++;
1294 	for (argi = 0; argi < binarye->binary.nargs; argi++)
1295 		args[argi] = cpu_to_le32(binarye->binary.args[argi]);
1296 
1297 	*cur += (binarye->binary.nargs + 1) * sizeof(uint32_t);
1298 
1299 	/*
1300 	 * ARM executable code inside the BIN header on platforms with Sheeva
1301 	 * CPU (A370 and AXP) must always be aligned with the 128-bit boundary.
1302 	 * In the case when this code is not position independent (e.g. ARM
1303 	 * SPL), it must be placed at fixed load and execute address.
1304 	 * This requirement can be met by inserting dummy arguments into
1305 	 * BIN header, if needed.
1306 	 */
1307 	cpu_sheeva = image_is_cpu_sheeva();
1308 	base_addr = cpu_sheeva ? 0x40004000 : 0x40000000;
1309 	offset = *cur - (uint8_t *)main_hdr;
1310 	if (binarye->binary.loadaddr)
1311 		add_args = (binarye->binary.loadaddr - base_addr - offset) / sizeof(uint32_t);
1312 	else if (cpu_sheeva)
1313 		add_args = ((16 - offset % 16) % 16) / sizeof(uint32_t);
1314 	else
1315 		add_args = 0;
1316 	if (add_args) {
1317 		*(args - 1) = cpu_to_le32(binarye->binary.nargs + add_args);
1318 		*cur += add_args * sizeof(uint32_t);
1319 	}
1320 
1321 	ret = fread(*cur, s.st_size, 1, bin);
1322 	if (ret != 1) {
1323 		fprintf(stderr,
1324 			"Could not read binary image %s\n",
1325 			binarye->binary.file);
1326 		goto err_close;
1327 	}
1328 
1329 	fclose(bin);
1330 
1331 	*cur += ALIGN(s.st_size, 4);
1332 
1333 	*((uint32_t *)*cur) = 0x00000000;
1334 	**next_ext = 1;
1335 	*next_ext = *cur;
1336 
1337 	*cur += sizeof(uint32_t);
1338 
1339 	binhdrsz = sizeof(struct opt_hdr_v1) +
1340 		(binarye->binary.nargs + add_args + 2) * sizeof(uint32_t) +
1341 		ALIGN(s.st_size, 4);
1342 	hdr->headersz_lsb = cpu_to_le16(binhdrsz & 0xFFFF);
1343 	hdr->headersz_msb = (binhdrsz & 0xFFFF0000) >> 16;
1344 
1345 	return 0;
1346 
1347 err_close:
1348 	fclose(bin);
1349 
1350 	return -1;
1351 }
1352 
export_pub_kak_hash(RSA * kak,struct secure_hdr_v1 * secure_hdr)1353 static int export_pub_kak_hash(RSA *kak, struct secure_hdr_v1 *secure_hdr)
1354 {
1355 	FILE *hashf;
1356 	int res;
1357 
1358 	hashf = fopen("pub_kak_hash.txt", "w");
1359 	if (!hashf) {
1360 		fprintf(stderr, "Couldn't open hash file: '%s': %s\n",
1361 			"pub_kak_hash.txt", strerror(errno));
1362 		return 1;
1363 	}
1364 
1365 	res = kwb_export_pubkey(kak, &secure_hdr->kak, hashf, "KAK");
1366 
1367 	fclose(hashf);
1368 
1369 	return res < 0 ? 1 : 0;
1370 }
1371 
kwb_sign_csk_with_kak(struct image_tool_params * params,struct secure_hdr_v1 * secure_hdr,RSA * csk)1372 static int kwb_sign_csk_with_kak(struct image_tool_params *params,
1373 				 struct secure_hdr_v1 *secure_hdr, RSA *csk)
1374 {
1375 	RSA *kak = NULL;
1376 	RSA *kak_pub = NULL;
1377 	int csk_idx = image_get_csk_index();
1378 	struct sig_v1 tmp_sig;
1379 
1380 	if (csk_idx < 0 || csk_idx > 15) {
1381 		fprintf(stderr, "Invalid CSK index %d\n", csk_idx);
1382 		return 1;
1383 	}
1384 
1385 	if (kwb_load_kak(params, &kak) < 0)
1386 		return 1;
1387 
1388 	if (export_pub_kak_hash(kak, secure_hdr))
1389 		return 1;
1390 
1391 	if (kwb_import_pubkey(&kak_pub, &secure_hdr->kak, "KAK") < 0)
1392 		return 1;
1393 
1394 	if (kwb_export_pubkey(csk, &secure_hdr->csk[csk_idx], NULL, "CSK") < 0)
1395 		return 1;
1396 
1397 	if (kwb_sign_and_verify(kak, &secure_hdr->csk,
1398 				sizeof(secure_hdr->csk) +
1399 				sizeof(secure_hdr->csksig),
1400 				&tmp_sig, "CSK") < 0)
1401 		return 1;
1402 
1403 	if (kwb_verify(kak_pub, &secure_hdr->csk,
1404 		       sizeof(secure_hdr->csk) +
1405 		       sizeof(secure_hdr->csksig),
1406 		       &tmp_sig, "CSK (2)") < 0)
1407 		return 1;
1408 
1409 	secure_hdr->csksig = tmp_sig;
1410 
1411 	return 0;
1412 }
1413 
add_secure_header_v1(struct image_tool_params * params,uint8_t * image_ptr,size_t image_size,uint8_t * header_ptr,size_t headersz,struct secure_hdr_v1 * secure_hdr)1414 static int add_secure_header_v1(struct image_tool_params *params, uint8_t *image_ptr,
1415 				size_t image_size, uint8_t *header_ptr, size_t headersz,
1416 				struct secure_hdr_v1 *secure_hdr)
1417 {
1418 	struct image_cfg_element *e_jtagdelay;
1419 	struct image_cfg_element *e_boxid;
1420 	struct image_cfg_element *e_flashid;
1421 	RSA *csk = NULL;
1422 	struct sig_v1 tmp_sig;
1423 	bool specialized_img = image_get_spezialized_img();
1424 
1425 	kwb_msg("Create secure header content\n");
1426 
1427 	e_jtagdelay = image_find_option(IMAGE_CFG_JTAG_DELAY);
1428 	e_boxid = image_find_option(IMAGE_CFG_BOX_ID);
1429 	e_flashid = image_find_option(IMAGE_CFG_FLASH_ID);
1430 
1431 	if (kwb_load_csk(params, &csk) < 0)
1432 		return 1;
1433 
1434 	secure_hdr->headertype = OPT_HDR_V1_SECURE_TYPE;
1435 	secure_hdr->headersz_msb = 0;
1436 	secure_hdr->headersz_lsb = cpu_to_le16(sizeof(struct secure_hdr_v1));
1437 	if (e_jtagdelay)
1438 		secure_hdr->jtag_delay = e_jtagdelay->jtag_delay;
1439 	if (e_boxid && specialized_img)
1440 		secure_hdr->boxid = cpu_to_le32(e_boxid->boxid);
1441 	if (e_flashid && specialized_img)
1442 		secure_hdr->flashid = cpu_to_le32(e_flashid->flashid);
1443 
1444 	if (kwb_sign_csk_with_kak(params, secure_hdr, csk))
1445 		return 1;
1446 
1447 	if (kwb_sign_and_verify(csk, image_ptr, image_size - 4,
1448 				&secure_hdr->imgsig, "image") < 0)
1449 		return 1;
1450 
1451 	if (kwb_sign_and_verify(csk, header_ptr, headersz, &tmp_sig, "header") < 0)
1452 		return 1;
1453 
1454 	secure_hdr->hdrsig = tmp_sig;
1455 
1456 	kwb_dump_fuse_cmds(secure_hdr);
1457 
1458 	return 0;
1459 }
1460 
finish_register_set_header_v1(uint8_t ** cur,uint8_t ** next_ext,struct register_set_hdr_v1 * register_set_hdr,int * datai,uint8_t delay)1461 static void finish_register_set_header_v1(uint8_t **cur, uint8_t **next_ext,
1462 					  struct register_set_hdr_v1 *register_set_hdr,
1463 					  int *datai, uint8_t delay)
1464 {
1465 	int size = sizeof(struct register_set_hdr_v1) + 8 * (*datai) + 4;
1466 
1467 	register_set_hdr->headertype = OPT_HDR_V1_REGISTER_TYPE;
1468 	register_set_hdr->headersz_lsb = cpu_to_le16(size & 0xFFFF);
1469 	register_set_hdr->headersz_msb = size >> 16;
1470 	register_set_hdr->data[*datai].last_entry.delay = delay;
1471 	*cur += size;
1472 	**next_ext = 1;
1473 	*next_ext = &register_set_hdr->data[*datai].last_entry.next;
1474 	*datai = 0;
1475 }
1476 
image_create_v1(size_t * dataoff,struct image_tool_params * params,uint8_t * ptr,int payloadsz)1477 static void *image_create_v1(size_t *dataoff, struct image_tool_params *params,
1478 			     uint8_t *ptr, int payloadsz)
1479 {
1480 	struct image_cfg_element *e;
1481 	struct main_hdr_v1 *main_hdr;
1482 	struct register_set_hdr_v1 *register_set_hdr;
1483 	struct secure_hdr_v1 *secure_hdr = NULL;
1484 	size_t headersz;
1485 	uint8_t *image, *cur;
1486 	int hasext = 0;
1487 	uint8_t *next_ext = NULL;
1488 	int cfgi, datai;
1489 	uint8_t delay;
1490 
1491 	/*
1492 	 * Calculate the size of the header and the offset of the
1493 	 * payload
1494 	 */
1495 	headersz = image_headersz_v1(&hasext);
1496 	if (headersz == 0)
1497 		return NULL;
1498 	*dataoff = image_headersz_align(headersz, image_get_bootfrom());
1499 
1500 	image = malloc(headersz);
1501 	if (!image) {
1502 		fprintf(stderr, "Cannot allocate memory for image\n");
1503 		return NULL;
1504 	}
1505 
1506 	memset(image, 0, headersz);
1507 
1508 	main_hdr = (struct main_hdr_v1 *)image;
1509 	cur = image;
1510 	cur += sizeof(struct main_hdr_v1);
1511 	next_ext = &main_hdr->ext;
1512 
1513 	/* Fill the main header */
1514 	main_hdr->blocksize    =
1515 		cpu_to_le32(payloadsz);
1516 	main_hdr->headersz_lsb = cpu_to_le16(headersz & 0xFFFF);
1517 	main_hdr->headersz_msb = (headersz & 0xFFFF0000) >> 16;
1518 	main_hdr->destaddr     = cpu_to_le32(params->addr);
1519 	main_hdr->execaddr     = cpu_to_le32(params->ep);
1520 	main_hdr->srcaddr      = cpu_to_le32(*dataoff);
1521 	main_hdr->ext          = hasext;
1522 	main_hdr->version      = 1;
1523 	main_hdr->blockid      = image_get_bootfrom();
1524 
1525 	e = image_find_option(IMAGE_CFG_NAND_BLKSZ);
1526 	if (e)
1527 		main_hdr->nandblocksize = e->nandblksz / (64 * 1024);
1528 	e = image_find_option(IMAGE_CFG_NAND_PAGESZ);
1529 	if (e)
1530 		main_hdr->nandpagesize = cpu_to_le16(e->nandpagesz);
1531 	e = image_find_option(IMAGE_CFG_NAND_BADBLK_LOCATION);
1532 	if (e)
1533 		main_hdr->nandbadblklocation = e->nandbadblklocation;
1534 	e = image_find_option(IMAGE_CFG_BAUDRATE);
1535 	if (e)
1536 		main_hdr->options |= baudrate_to_option(e->baudrate);
1537 	e = image_find_option(IMAGE_CFG_UART_PORT);
1538 	if (e)
1539 		main_hdr->options |= (e->uart_port & 3) << 3;
1540 	e = image_find_option(IMAGE_CFG_UART_MPP);
1541 	if (e)
1542 		main_hdr->options |= (e->uart_mpp & 7) << 5;
1543 	e = image_find_option(IMAGE_CFG_DEBUG);
1544 	if (e)
1545 		main_hdr->flags = e->debug ? 0x1 : 0;
1546 
1547 	/* For SATA srcaddr is specified in number of sectors. */
1548 	if (main_hdr->blockid == IBR_HDR_SATA_ID) {
1549 		params->bl_len = image_get_satablksz();
1550 		main_hdr->srcaddr = cpu_to_le32(le32_to_cpu(main_hdr->srcaddr) / params->bl_len);
1551 	}
1552 
1553 	/* For PCIe srcaddr is not used and must be set to 0xFFFFFFFF. */
1554 	if (main_hdr->blockid == IBR_HDR_PEX_ID)
1555 		main_hdr->srcaddr = cpu_to_le32(0xFFFFFFFF);
1556 
1557 	if (params->xflag) {
1558 		if (!image_fill_xip_header(main_hdr, params)) {
1559 			free(image);
1560 			return NULL;
1561 		}
1562 		*dataoff = le32_to_cpu(main_hdr->srcaddr);
1563 	}
1564 
1565 	if (image_get_csk_index() >= 0) {
1566 		/*
1567 		 * only reserve the space here; we fill the header later since
1568 		 * we need the header to be complete to compute the signatures
1569 		 */
1570 		secure_hdr = (struct secure_hdr_v1 *)cur;
1571 		cur += sizeof(struct secure_hdr_v1);
1572 		*next_ext = 1;
1573 		next_ext = &secure_hdr->next;
1574 	}
1575 
1576 	datai = 0;
1577 	for (cfgi = 0; cfgi < cfgn; cfgi++) {
1578 		e = &image_cfg[cfgi];
1579 		if (e->type != IMAGE_CFG_DATA &&
1580 		    e->type != IMAGE_CFG_DATA_DELAY &&
1581 		    e->type != IMAGE_CFG_BINARY)
1582 			continue;
1583 
1584 		if (datai == 0)
1585 			register_set_hdr = (struct register_set_hdr_v1 *)cur;
1586 
1587 		/* If delay is not specified, use the smallest possible value. */
1588 		if (e->type == IMAGE_CFG_DATA_DELAY)
1589 			delay = e->regdata_delay;
1590 		else
1591 			delay = REGISTER_SET_HDR_OPT_DELAY_MS(0);
1592 
1593 		/*
1594 		 * DATA_DELAY command is the last entry in the register set
1595 		 * header and BINARY command inserts new binary header.
1596 		 * Therefore BINARY command requires to finish register set
1597 		 * header if some DATA command was specified. And DATA_DELAY
1598 		 * command automatically finish register set header even when
1599 		 * there was no DATA command.
1600 		 */
1601 		if (e->type == IMAGE_CFG_DATA_DELAY ||
1602 		    (e->type == IMAGE_CFG_BINARY && datai != 0))
1603 			finish_register_set_header_v1(&cur, &next_ext, register_set_hdr,
1604 						      &datai, delay);
1605 
1606 		if (e->type == IMAGE_CFG_DATA) {
1607 			register_set_hdr->data[datai].entry.address =
1608 				cpu_to_le32(e->regdata.raddr);
1609 			register_set_hdr->data[datai].entry.value =
1610 				cpu_to_le32(e->regdata.rdata);
1611 			datai++;
1612 		}
1613 
1614 		if (e->type == IMAGE_CFG_BINARY) {
1615 			if (add_binary_header_v1(&cur, &next_ext, e, main_hdr))
1616 				return NULL;
1617 		}
1618 	}
1619 	if (datai != 0) {
1620 		/* Set delay to the smallest possible value. */
1621 		delay = REGISTER_SET_HDR_OPT_DELAY_MS(0);
1622 		finish_register_set_header_v1(&cur, &next_ext, register_set_hdr,
1623 					      &datai, delay);
1624 	}
1625 
1626 	if (secure_hdr && add_secure_header_v1(params, ptr + *dataoff, payloadsz,
1627 					       image, headersz, secure_hdr))
1628 		return NULL;
1629 
1630 	/* Calculate and set the header checksum */
1631 	main_hdr->checksum = image_checksum8(main_hdr, headersz);
1632 
1633 	return image;
1634 }
1635 
recognize_keyword(char * keyword)1636 static int recognize_keyword(char *keyword)
1637 {
1638 	int kw_id;
1639 
1640 	for (kw_id = 1; kw_id < IMAGE_CFG_COUNT; ++kw_id)
1641 		if (!strcmp(keyword, id_strs[kw_id]))
1642 			return kw_id;
1643 
1644 	return 0;
1645 }
1646 
image_create_config_parse_oneline(char * line,struct image_cfg_element * el)1647 static int image_create_config_parse_oneline(char *line,
1648 					     struct image_cfg_element *el)
1649 {
1650 	char *keyword, *saveptr, *value1, *value2;
1651 	char delimiters[] = " \t";
1652 	int keyword_id, ret, argi;
1653 	char *unknown_msg = "Ignoring unknown line '%s'\n";
1654 
1655 	keyword = strtok_r(line, delimiters, &saveptr);
1656 
1657 	if (!keyword) {
1658 		fprintf(stderr, "Parameter missing in line '%s'\n", line);
1659 		return -1;
1660 	}
1661 
1662 	keyword_id = recognize_keyword(keyword);
1663 
1664 	if (!keyword_id) {
1665 		fprintf(stderr, unknown_msg, line);
1666 		return 0;
1667 	}
1668 
1669 	el->type = keyword_id;
1670 
1671 	value1 = strtok_r(NULL, delimiters, &saveptr);
1672 
1673 	if (!value1) {
1674 		fprintf(stderr, "Parameter missing in line '%s'\n", line);
1675 		return -1;
1676 	}
1677 
1678 	switch (keyword_id) {
1679 	case IMAGE_CFG_VERSION:
1680 		el->version = atoi(value1);
1681 		break;
1682 	case IMAGE_CFG_CPU:
1683 		if (strcmp(value1, "FEROCEON") == 0)
1684 			el->cpu_sheeva = 0;
1685 		else if (strcmp(value1, "SHEEVA") == 0)
1686 			el->cpu_sheeva = 1;
1687 		else if (strcmp(value1, "A9") == 0)
1688 			el->cpu_sheeva = 0;
1689 		else {
1690 			fprintf(stderr, "Invalid CPU %s\n", value1);
1691 			return -1;
1692 		}
1693 		break;
1694 	case IMAGE_CFG_BOOT_FROM:
1695 		ret = image_boot_mode_id(value1);
1696 
1697 		if (ret < 0) {
1698 			fprintf(stderr, "Invalid boot media '%s'\n", value1);
1699 			return -1;
1700 		}
1701 		el->bootfrom = ret;
1702 		break;
1703 	case IMAGE_CFG_NAND_BLKSZ:
1704 		el->nandblksz = strtoul(value1, NULL, 16);
1705 		break;
1706 	case IMAGE_CFG_NAND_BADBLK_LOCATION:
1707 		el->nandbadblklocation = strtoul(value1, NULL, 16);
1708 		break;
1709 	case IMAGE_CFG_NAND_ECC_MODE:
1710 		ret = image_nand_ecc_mode_id(value1);
1711 
1712 		if (ret < 0) {
1713 			fprintf(stderr, "Invalid NAND ECC mode '%s'\n", value1);
1714 			return -1;
1715 		}
1716 		el->nandeccmode = ret;
1717 		break;
1718 	case IMAGE_CFG_NAND_PAGESZ:
1719 		el->nandpagesz = strtoul(value1, NULL, 16);
1720 		break;
1721 	case IMAGE_CFG_SATA_BLKSZ:
1722 		el->satablksz = strtoul(value1, NULL, 0);
1723 		if (el->satablksz & (el->satablksz-1)) {
1724 			fprintf(stderr, "Invalid SATA block size '%s'\n", value1);
1725 			return -1;
1726 		}
1727 		break;
1728 	case IMAGE_CFG_BINARY:
1729 		argi = 0;
1730 
1731 		el->binary.file = strdup(value1);
1732 		while (1) {
1733 			char *value = strtok_r(NULL, delimiters, &saveptr);
1734 			char *endptr;
1735 
1736 			if (!value)
1737 				break;
1738 
1739 			if (!strcmp(value, "LOAD_ADDRESS")) {
1740 				value = strtok_r(NULL, delimiters, &saveptr);
1741 				if (!value) {
1742 					fprintf(stderr,
1743 						"Missing address argument for BINARY LOAD_ADDRESS\n");
1744 					return -1;
1745 				}
1746 				el->binary.loadaddr = strtoul(value, &endptr, 16);
1747 				if (*endptr) {
1748 					fprintf(stderr,
1749 						"Invalid argument '%s' for BINARY LOAD_ADDRESS\n",
1750 						value);
1751 					return -1;
1752 				}
1753 				value = strtok_r(NULL, delimiters, &saveptr);
1754 				if (value) {
1755 					fprintf(stderr,
1756 						"Unexpected argument '%s' after BINARY LOAD_ADDRESS\n",
1757 						value);
1758 					return -1;
1759 				}
1760 				break;
1761 			}
1762 
1763 			el->binary.args[argi] = strtoul(value, &endptr, 16);
1764 			if (*endptr) {
1765 				fprintf(stderr, "Invalid argument '%s' for BINARY\n", value);
1766 				return -1;
1767 			}
1768 			argi++;
1769 			if (argi >= BINARY_MAX_ARGS) {
1770 				fprintf(stderr,
1771 					"Too many arguments for BINARY\n");
1772 				return -1;
1773 			}
1774 		}
1775 		el->binary.nargs = argi;
1776 		break;
1777 	case IMAGE_CFG_DATA:
1778 		value2 = strtok_r(NULL, delimiters, &saveptr);
1779 
1780 		if (!value1 || !value2) {
1781 			fprintf(stderr,
1782 				"Invalid number of arguments for DATA\n");
1783 			return -1;
1784 		}
1785 
1786 		el->regdata.raddr = strtoul(value1, NULL, 16);
1787 		el->regdata.rdata = strtoul(value2, NULL, 16);
1788 		break;
1789 	case IMAGE_CFG_DATA_DELAY:
1790 		if (!strcmp(value1, "SDRAM_SETUP"))
1791 			el->regdata_delay = REGISTER_SET_HDR_OPT_DELAY_SDRAM_SETUP;
1792 		else
1793 			el->regdata_delay = REGISTER_SET_HDR_OPT_DELAY_MS(strtoul(value1, NULL, 10));
1794 		if (el->regdata_delay > 255) {
1795 			fprintf(stderr, "Maximal DATA_DELAY is 255\n");
1796 			return -1;
1797 		}
1798 		break;
1799 	case IMAGE_CFG_BAUDRATE:
1800 		el->baudrate = strtoul(value1, NULL, 10);
1801 		break;
1802 	case IMAGE_CFG_UART_PORT:
1803 		el->uart_port = strtoul(value1, NULL, 16);
1804 		break;
1805 	case IMAGE_CFG_UART_MPP:
1806 		el->uart_mpp = strtoul(value1, NULL, 16);
1807 		break;
1808 	case IMAGE_CFG_DEBUG:
1809 		el->debug = strtoul(value1, NULL, 10);
1810 		break;
1811 	case IMAGE_CFG_KAK:
1812 		el->key_name = strdup(value1);
1813 		break;
1814 	case IMAGE_CFG_CSK:
1815 		el->key_name = strdup(value1);
1816 		break;
1817 	case IMAGE_CFG_CSK_INDEX:
1818 		el->csk_idx = strtol(value1, NULL, 0);
1819 		break;
1820 	case IMAGE_CFG_JTAG_DELAY:
1821 		el->jtag_delay = strtoul(value1, NULL, 0);
1822 		break;
1823 	case IMAGE_CFG_BOX_ID:
1824 		el->boxid = strtoul(value1, NULL, 0);
1825 		break;
1826 	case IMAGE_CFG_FLASH_ID:
1827 		el->flashid = strtoul(value1, NULL, 0);
1828 		break;
1829 	case IMAGE_CFG_SEC_SPECIALIZED_IMG:
1830 		el->sec_specialized_img = true;
1831 		break;
1832 	case IMAGE_CFG_SEC_COMMON_IMG:
1833 		el->sec_specialized_img = false;
1834 		break;
1835 	case IMAGE_CFG_SEC_BOOT_DEV:
1836 		el->sec_boot_dev = strtoul(value1, NULL, 0);
1837 		break;
1838 	case IMAGE_CFG_SEC_FUSE_DUMP:
1839 		el->name = strdup(value1);
1840 		break;
1841 	default:
1842 		fprintf(stderr, unknown_msg, line);
1843 	}
1844 
1845 	return 0;
1846 }
1847 
1848 /*
1849  * Parse the configuration file 'fcfg' into the array of configuration
1850  * elements 'image_cfg', and return the number of configuration
1851  * elements in 'cfgn'.
1852  */
image_create_config_parse(FILE * fcfg)1853 static int image_create_config_parse(FILE *fcfg)
1854 {
1855 	int ret;
1856 	int cfgi = 0;
1857 
1858 	/* Parse the configuration file */
1859 	while (!feof(fcfg)) {
1860 		char *line;
1861 		char buf[256];
1862 
1863 		/* Read the current line */
1864 		memset(buf, 0, sizeof(buf));
1865 		line = fgets(buf, sizeof(buf), fcfg);
1866 		if (!line)
1867 			break;
1868 
1869 		/* Ignore useless lines */
1870 		if (line[0] == '\n' || line[0] == '#')
1871 			continue;
1872 
1873 		/* Strip final newline */
1874 		if (line[strlen(line) - 1] == '\n')
1875 			line[strlen(line) - 1] = 0;
1876 
1877 		/* Parse the current line */
1878 		ret = image_create_config_parse_oneline(line,
1879 							&image_cfg[cfgi]);
1880 		if (ret)
1881 			return ret;
1882 
1883 		cfgi++;
1884 
1885 		if (cfgi >= IMAGE_CFG_ELEMENT_MAX) {
1886 			fprintf(stderr,
1887 				"Too many configuration elements in .cfg file\n");
1888 			return -1;
1889 		}
1890 	}
1891 
1892 	cfgn = cfgi;
1893 	return 0;
1894 }
1895 
image_get_version(void)1896 static int image_get_version(void)
1897 {
1898 	struct image_cfg_element *e;
1899 
1900 	e = image_find_option(IMAGE_CFG_VERSION);
1901 	if (!e)
1902 		return -1;
1903 
1904 	return e->version;
1905 }
1906 
kwbimage_set_header(void * ptr,struct stat * sbuf,int ifd,struct image_tool_params * params)1907 static void kwbimage_set_header(void *ptr, struct stat *sbuf, int ifd,
1908 				struct image_tool_params *params)
1909 {
1910 	FILE *fcfg;
1911 	void *image = NULL;
1912 	int version;
1913 	size_t dataoff = 0;
1914 	size_t datasz;
1915 	uint32_t checksum;
1916 	struct stat s;
1917 	int ret;
1918 
1919 	params->bl_len = 1;
1920 
1921 	/*
1922 	 * Do not use sbuf->st_size as it contains size with padding.
1923 	 * We need original image data size, so stat original file.
1924 	 */
1925 	if (params->skipcpy) {
1926 		s.st_size = 0;
1927 	} else if (stat(params->datafile, &s)) {
1928 		fprintf(stderr, "Could not stat data file %s: %s\n",
1929 			params->datafile, strerror(errno));
1930 		exit(EXIT_FAILURE);
1931 	}
1932 	datasz = ALIGN(s.st_size, 4);
1933 
1934 	fcfg = fopen(params->imagename, "r");
1935 	if (!fcfg) {
1936 		fprintf(stderr, "Could not open input file %s\n",
1937 			params->imagename);
1938 		exit(EXIT_FAILURE);
1939 	}
1940 
1941 	image_cfg = malloc(IMAGE_CFG_ELEMENT_MAX *
1942 			   sizeof(struct image_cfg_element));
1943 	if (!image_cfg) {
1944 		fprintf(stderr, "Cannot allocate memory\n");
1945 		fclose(fcfg);
1946 		exit(EXIT_FAILURE);
1947 	}
1948 
1949 	memset(image_cfg, 0,
1950 	       IMAGE_CFG_ELEMENT_MAX * sizeof(struct image_cfg_element));
1951 	rewind(fcfg);
1952 
1953 	ret = image_create_config_parse(fcfg);
1954 	fclose(fcfg);
1955 	if (ret) {
1956 		free(image_cfg);
1957 		exit(EXIT_FAILURE);
1958 	}
1959 
1960 	version = image_get_version();
1961 	switch (version) {
1962 		/*
1963 		 * Fallback to version 0 if no version is provided in the
1964 		 * cfg file
1965 		 */
1966 	case -1:
1967 	case 0:
1968 		image = image_create_v0(&dataoff, params, datasz + 4);
1969 		break;
1970 
1971 	case 1:
1972 		image = image_create_v1(&dataoff, params, ptr, datasz + 4);
1973 		break;
1974 
1975 	default:
1976 		fprintf(stderr, "Unsupported version %d\n", version);
1977 		free(image_cfg);
1978 		exit(EXIT_FAILURE);
1979 	}
1980 
1981 	if (!image) {
1982 		fprintf(stderr, "Could not create image\n");
1983 		free(image_cfg);
1984 		exit(EXIT_FAILURE);
1985 	}
1986 
1987 	free(image_cfg);
1988 
1989 	/* Build and add image data checksum */
1990 	checksum = cpu_to_le32(image_checksum32((uint8_t *)ptr + dataoff,
1991 						datasz));
1992 	memcpy((uint8_t *)ptr + dataoff + datasz, &checksum, sizeof(uint32_t));
1993 
1994 	/* Finally copy the header into the image area */
1995 	memcpy(ptr, image, kwbheader_size(image));
1996 
1997 	free(image);
1998 }
1999 
kwbimage_print_header(const void * ptr,struct image_tool_params * params)2000 static void kwbimage_print_header(const void *ptr, struct image_tool_params *params)
2001 {
2002 	struct main_hdr_v0 *mhdr = (struct main_hdr_v0 *)ptr;
2003 	struct bin_hdr_v0 *bhdr;
2004 	struct opt_hdr_v1 *ohdr;
2005 
2006 	printf("Image Type:   MVEBU Boot from %s Image\n",
2007 	       image_boot_mode_name(mhdr->blockid));
2008 	printf("Image version:%d\n", kwbimage_version(ptr));
2009 
2010 	for_each_opt_hdr_v1 (ohdr, mhdr) {
2011 		if (ohdr->headertype == OPT_HDR_V1_BINARY_TYPE) {
2012 			printf("BIN Img Size: ");
2013 			genimg_print_size(opt_hdr_v1_size(ohdr) - 12 -
2014 					  4 * ohdr->data[0]);
2015 			printf("BIN Img Offs: ");
2016 			genimg_print_size(((uint8_t *)ohdr - (uint8_t *)mhdr) +
2017 					  8 + 4 * ohdr->data[0]);
2018 		}
2019 	}
2020 
2021 	for_each_bin_hdr_v0(bhdr, mhdr) {
2022 		printf("BIN Img Size: ");
2023 		genimg_print_size(le32_to_cpu(bhdr->size));
2024 		printf("BIN Img Addr: %08x\n", le32_to_cpu(bhdr->destaddr));
2025 		printf("BIN Img Entr: %08x\n", le32_to_cpu(bhdr->execaddr));
2026 	}
2027 
2028 	printf("Data Size:    ");
2029 	genimg_print_size(le32_to_cpu(mhdr->blocksize) - sizeof(uint32_t));
2030 	printf("Data Offset:  ");
2031 	if (mhdr->blockid == IBR_HDR_SATA_ID)
2032 		printf("%u Sector%s (LBA) = ", le32_to_cpu(mhdr->srcaddr),
2033 		       le32_to_cpu(mhdr->srcaddr) != 1 ? "s" : "");
2034 	genimg_print_size(le32_to_cpu(mhdr->srcaddr) * params->bl_len);
2035 	if (mhdr->blockid == IBR_HDR_SATA_ID)
2036 		printf("Sector Size:  %u Bytes\n", params->bl_len);
2037 	if (mhdr->blockid == IBR_HDR_SPI_ID && le32_to_cpu(mhdr->destaddr) == 0xFFFFFFFF) {
2038 		printf("Load Address: XIP\n");
2039 		printf("Execute Offs: %08x\n", le32_to_cpu(mhdr->execaddr));
2040 	} else {
2041 		printf("Load Address: %08x\n", le32_to_cpu(mhdr->destaddr));
2042 		printf("Entry Point:  %08x\n", le32_to_cpu(mhdr->execaddr));
2043 	}
2044 }
2045 
kwbimage_check_image_types(uint8_t type)2046 static int kwbimage_check_image_types(uint8_t type)
2047 {
2048 	if (type == IH_TYPE_KWBIMAGE)
2049 		return EXIT_SUCCESS;
2050 
2051 	return EXIT_FAILURE;
2052 }
2053 
kwbimage_verify_header(unsigned char * ptr,int image_size,struct image_tool_params * params)2054 static int kwbimage_verify_header(unsigned char *ptr, int image_size,
2055 				  struct image_tool_params *params)
2056 {
2057 	size_t header_size = kwbheader_size(ptr);
2058 	uint8_t blockid;
2059 	uint32_t offset;
2060 	uint32_t size;
2061 	uint8_t csum;
2062 	int blksz;
2063 
2064 	if (header_size > 192*1024)
2065 		return -FDT_ERR_BADSTRUCTURE;
2066 
2067 	if (header_size > image_size)
2068 		return -FDT_ERR_BADSTRUCTURE;
2069 
2070 	if (!main_hdr_checksum_ok(ptr))
2071 		return -FDT_ERR_BADSTRUCTURE;
2072 
2073 	/* Only version 0 extended header has checksum */
2074 	if (kwbimage_version(ptr) == 0) {
2075 		struct main_hdr_v0 *mhdr = (struct main_hdr_v0 *)ptr;
2076 		struct ext_hdr_v0 *ext_hdr;
2077 		struct bin_hdr_v0 *bhdr;
2078 
2079 		for_each_ext_hdr_v0(ext_hdr, ptr) {
2080 			csum = image_checksum8(ext_hdr, sizeof(*ext_hdr) - 1);
2081 			if (csum != ext_hdr->checksum)
2082 				return -FDT_ERR_BADSTRUCTURE;
2083 		}
2084 
2085 		for_each_bin_hdr_v0(bhdr, ptr) {
2086 			csum = image_checksum8(bhdr, (uint8_t *)&bhdr->checksum - (uint8_t *)bhdr - 1);
2087 			if (csum != bhdr->checksum)
2088 				return -FDT_ERR_BADSTRUCTURE;
2089 
2090 			if (bhdr->offset > sizeof(*bhdr) || bhdr->offset % 4 != 0)
2091 				return -FDT_ERR_BADSTRUCTURE;
2092 
2093 			if (bhdr->offset + bhdr->size + 4 > sizeof(*bhdr) || bhdr->size % 4 != 0)
2094 				return -FDT_ERR_BADSTRUCTURE;
2095 
2096 			if (image_checksum32((uint8_t *)bhdr + bhdr->offset, bhdr->size) !=
2097 			    *(uint32_t *)((uint8_t *)bhdr + bhdr->offset + bhdr->size))
2098 				return -FDT_ERR_BADSTRUCTURE;
2099 		}
2100 
2101 		blockid = mhdr->blockid;
2102 		offset = le32_to_cpu(mhdr->srcaddr);
2103 		size = le32_to_cpu(mhdr->blocksize);
2104 	} else if (kwbimage_version(ptr) == 1) {
2105 		struct main_hdr_v1 *mhdr = (struct main_hdr_v1 *)ptr;
2106 		const uint8_t *mhdr_end;
2107 		struct opt_hdr_v1 *ohdr;
2108 
2109 		mhdr_end = (uint8_t *)mhdr + header_size;
2110 		for_each_opt_hdr_v1 (ohdr, ptr)
2111 			if (!opt_hdr_v1_valid_size(ohdr, mhdr_end))
2112 				return -FDT_ERR_BADSTRUCTURE;
2113 
2114 		blockid = mhdr->blockid;
2115 		offset = le32_to_cpu(mhdr->srcaddr);
2116 		size = le32_to_cpu(mhdr->blocksize);
2117 	} else {
2118 		return -FDT_ERR_BADSTRUCTURE;
2119 	}
2120 
2121 	if (size < 4 || size % 4 != 0)
2122 		return -FDT_ERR_BADSTRUCTURE;
2123 
2124 	/*
2125 	 * For SATA srcaddr is specified in number of sectors.
2126 	 * Try all possible sector sizes which are power of two,
2127 	 * at least 512 bytes and up to the 32 kB.
2128 	 */
2129 	if (blockid == IBR_HDR_SATA_ID) {
2130 		for (blksz = 512; blksz < 0x10000; blksz *= 2) {
2131 			if (offset * blksz > image_size || offset * blksz + size > image_size)
2132 				break;
2133 
2134 			if (image_checksum32(ptr + offset * blksz, size - 4) ==
2135 			    *(uint32_t *)(ptr + offset * blksz + size - 4)) {
2136 				params->bl_len = blksz;
2137 				return 0;
2138 			}
2139 		}
2140 
2141 		return -FDT_ERR_BADSTRUCTURE;
2142 	}
2143 
2144 	/*
2145 	 * For PCIe srcaddr is always set to 0xFFFFFFFF.
2146 	 * This expects that data starts after all headers.
2147 	 */
2148 	if (blockid == IBR_HDR_PEX_ID && offset == 0xFFFFFFFF)
2149 		offset = header_size;
2150 
2151 	if (offset % 4 != 0 || offset > image_size || offset + size > image_size)
2152 		return -FDT_ERR_BADSTRUCTURE;
2153 
2154 	if (image_checksum32(ptr + offset, size - 4) !=
2155 	    *(uint32_t *)(ptr + offset + size - 4))
2156 		return -FDT_ERR_BADSTRUCTURE;
2157 
2158 	params->bl_len = 1;
2159 	return 0;
2160 }
2161 
kwbimage_generate(struct image_tool_params * params,struct image_type_params * tparams)2162 static int kwbimage_generate(struct image_tool_params *params,
2163 			     struct image_type_params *tparams)
2164 {
2165 	FILE *fcfg;
2166 	struct stat s;
2167 	int alloc_len;
2168 	int bootfrom;
2169 	int version;
2170 	void *hdr;
2171 	int ret;
2172 	int align, size;
2173 	unsigned int satablksz;
2174 
2175 	fcfg = fopen(params->imagename, "r");
2176 	if (!fcfg) {
2177 		fprintf(stderr, "Could not open input file %s\n",
2178 			params->imagename);
2179 		exit(EXIT_FAILURE);
2180 	}
2181 
2182 	if (params->skipcpy) {
2183 		s.st_size = 0;
2184 	} else if (stat(params->datafile, &s)) {
2185 		fprintf(stderr, "Could not stat data file %s: %s\n",
2186 			params->datafile, strerror(errno));
2187 		exit(EXIT_FAILURE);
2188 	}
2189 
2190 	image_cfg = malloc(IMAGE_CFG_ELEMENT_MAX *
2191 			   sizeof(struct image_cfg_element));
2192 	if (!image_cfg) {
2193 		fprintf(stderr, "Cannot allocate memory\n");
2194 		fclose(fcfg);
2195 		exit(EXIT_FAILURE);
2196 	}
2197 
2198 	memset(image_cfg, 0,
2199 	       IMAGE_CFG_ELEMENT_MAX * sizeof(struct image_cfg_element));
2200 	rewind(fcfg);
2201 
2202 	ret = image_create_config_parse(fcfg);
2203 	fclose(fcfg);
2204 	if (ret) {
2205 		free(image_cfg);
2206 		exit(EXIT_FAILURE);
2207 	}
2208 
2209 	bootfrom = image_get_bootfrom();
2210 	version = image_get_version();
2211 	satablksz = image_get_satablksz();
2212 	switch (version) {
2213 		/*
2214 		 * Fallback to version 0 if no version is provided in the
2215 		 * cfg file
2216 		 */
2217 	case -1:
2218 	case 0:
2219 		alloc_len = image_headersz_v0(NULL);
2220 		break;
2221 
2222 	case 1:
2223 		alloc_len = image_headersz_v1(NULL);
2224 		if (!alloc_len) {
2225 			free(image_cfg);
2226 			exit(EXIT_FAILURE);
2227 		}
2228 		if (alloc_len > 192*1024) {
2229 			fprintf(stderr, "Header is too big (%u bytes), maximal kwbimage header size is %u bytes\n", alloc_len, 192*1024);
2230 			free(image_cfg);
2231 			exit(EXIT_FAILURE);
2232 		}
2233 		break;
2234 
2235 	default:
2236 		fprintf(stderr, "Unsupported version %d\n", version);
2237 		free(image_cfg);
2238 		exit(EXIT_FAILURE);
2239 	}
2240 
2241 	alloc_len = image_headersz_align(alloc_len, image_get_bootfrom());
2242 
2243 	free(image_cfg);
2244 
2245 	hdr = malloc(alloc_len);
2246 	if (!hdr) {
2247 		fprintf(stderr, "%s: malloc return failure: %s\n",
2248 			params->cmdname, strerror(errno));
2249 		exit(EXIT_FAILURE);
2250 	}
2251 
2252 	memset(hdr, 0, alloc_len);
2253 	tparams->header_size = alloc_len;
2254 	tparams->hdr = hdr;
2255 
2256 	/*
2257 	 * Final SATA images must be aligned to disk block size.
2258 	 * Final SDIO images must be aligned to 512 bytes.
2259 	 * Final SPI and NAND images must be aligned to 256 bytes.
2260 	 * Final UART image must be aligned to 128 bytes.
2261 	 */
2262 	if (bootfrom == IBR_HDR_SATA_ID)
2263 		align = satablksz;
2264 	else if (bootfrom == IBR_HDR_SDIO_ID)
2265 		align = 512;
2266 	else if (bootfrom == IBR_HDR_SPI_ID || bootfrom == IBR_HDR_NAND_ID)
2267 		align = 256;
2268 	else if (bootfrom == IBR_HDR_UART_ID)
2269 		align = 128;
2270 	else
2271 		align = 4;
2272 
2273 	/*
2274 	 * The resulting image needs to be 4-byte aligned. At least
2275 	 * the Marvell hdrparser tool complains if its unaligned.
2276 	 * After the image data is stored 4-byte checksum.
2277 	 */
2278 	size = 4 + (align - (alloc_len + s.st_size + 4) % align) % align;
2279 
2280 	/*
2281 	 * This function should return aligned size of the datafile.
2282 	 * When skipcpy is set (datafile is skipped) then return value of this
2283 	 * function is ignored, so we have to put required kwbimage aligning
2284 	 * into the preallocated header size.
2285 	 */
2286 	if (params->skipcpy) {
2287 		tparams->header_size += size;
2288 		return 0;
2289 	} else {
2290 		return size;
2291 	}
2292 }
2293 
kwbimage_generate_config(void * ptr,struct image_tool_params * params)2294 static int kwbimage_generate_config(void *ptr, struct image_tool_params *params)
2295 {
2296 	struct main_hdr_v0 *mhdr0 = (struct main_hdr_v0 *)ptr;
2297 	struct main_hdr_v1 *mhdr = (struct main_hdr_v1 *)ptr;
2298 	size_t header_size = kwbheader_size(ptr);
2299 	struct register_set_hdr_v1 *regset_hdr;
2300 	struct ext_hdr_v0_reg *regdata;
2301 	struct ext_hdr_v0 *ehdr0;
2302 	struct bin_hdr_v0 *bhdr0;
2303 	struct opt_hdr_v1 *ohdr;
2304 	int regset_count;
2305 	int params_count;
2306 	unsigned offset;
2307 	int is_v0_ext;
2308 	int cur_idx;
2309 	int version;
2310 	FILE *f;
2311 	int i;
2312 
2313 	f = fopen(params->outfile, "w");
2314 	if (!f) {
2315 		fprintf(stderr, "Can't open \"%s\": %s\n", params->outfile, strerror(errno));
2316 		return -1;
2317 	}
2318 
2319 	version = kwbimage_version(ptr);
2320 
2321 	is_v0_ext = 0;
2322 	if (version == 0) {
2323 		if (mhdr0->ext > 1 || mhdr0->bin ||
2324 		    ((ehdr0 = ext_hdr_v0_first(ptr)) &&
2325 		     (ehdr0->match_addr || ehdr0->match_mask || ehdr0->match_value)))
2326 			is_v0_ext = 1;
2327 	}
2328 
2329 	if (version != 0)
2330 		fprintf(f, "VERSION %d\n", version);
2331 
2332 	fprintf(f, "BOOT_FROM %s\n", image_boot_mode_name(mhdr->blockid) ?: "<unknown>");
2333 
2334 	if (version == 0 && mhdr->blockid == IBR_HDR_NAND_ID)
2335 		fprintf(f, "NAND_ECC_MODE %s\n", image_nand_ecc_mode_name(mhdr0->nandeccmode));
2336 
2337 	if (mhdr->blockid == IBR_HDR_NAND_ID)
2338 		fprintf(f, "NAND_PAGE_SIZE 0x%x\n", (unsigned)le16_to_cpu(mhdr->nandpagesize));
2339 
2340 	if (mhdr->blockid == IBR_HDR_NAND_ID && (version != 0 || is_v0_ext || mhdr->nandblocksize != 0)) {
2341 		if (mhdr->nandblocksize != 0) /* block size explicitly set in 64 kB unit */
2342 			fprintf(f, "NAND_BLKSZ 0x%x\n", (unsigned)mhdr->nandblocksize * 64*1024);
2343 		else if (le16_to_cpu(mhdr->nandpagesize) > 512)
2344 			fprintf(f, "NAND_BLKSZ 0x10000\n"); /* large page NAND flash = 64 kB block size */
2345 		else
2346 			fprintf(f, "NAND_BLKSZ 0x4000\n"); /* small page NAND flash = 16 kB block size */
2347 	}
2348 
2349 	if (mhdr->blockid == IBR_HDR_NAND_ID && (version != 0 || is_v0_ext))
2350 		fprintf(f, "NAND_BADBLK_LOCATION 0x%x\n", (unsigned)mhdr->nandbadblklocation);
2351 
2352 	if (version == 0 && mhdr->blockid == IBR_HDR_SATA_ID)
2353 		fprintf(f, "SATA_PIO_MODE %u\n", (unsigned)mhdr0->satapiomode);
2354 
2355 	if (mhdr->blockid == IBR_HDR_SATA_ID)
2356 		fprintf(f, "SATA_BLKSZ %u\n", params->bl_len);
2357 
2358 	/*
2359 	 * Addresses and sizes which are specified by mkimage command line
2360 	 * arguments and not in kwbimage config file
2361 	 */
2362 
2363 	if (version != 0)
2364 		fprintf(f, "#HEADER_SIZE 0x%x\n",
2365 			((unsigned)mhdr->headersz_msb << 8) | le16_to_cpu(mhdr->headersz_lsb));
2366 
2367 	fprintf(f, "#SRC_ADDRESS 0x%x\n", le32_to_cpu(mhdr->srcaddr));
2368 	fprintf(f, "#BLOCK_SIZE 0x%x\n", le32_to_cpu(mhdr->blocksize));
2369 	fprintf(f, "#DEST_ADDRESS 0x%08x\n", le32_to_cpu(mhdr->destaddr));
2370 	fprintf(f, "#EXEC_ADDRESS 0x%08x\n", le32_to_cpu(mhdr->execaddr));
2371 
2372 	if (version != 0) {
2373 		if (options_to_baudrate(mhdr->options))
2374 			fprintf(f, "BAUDRATE %u\n", options_to_baudrate(mhdr->options));
2375 		if (options_to_baudrate(mhdr->options) ||
2376 		    ((mhdr->options >> 3) & 0x3) || ((mhdr->options >> 5) & 0x7)) {
2377 			fprintf(f, "UART_PORT %u\n", (unsigned)((mhdr->options >> 3) & 0x3));
2378 			fprintf(f, "UART_MPP 0x%x\n", (unsigned)((mhdr->options >> 5) & 0x7));
2379 		}
2380 		if (mhdr->flags & 0x1)
2381 			fprintf(f, "DEBUG 1\n");
2382 	}
2383 
2384 	cur_idx = 1;
2385 	for_each_opt_hdr_v1(ohdr, ptr) {
2386 		if (ohdr->headertype == OPT_HDR_V1_SECURE_TYPE) {
2387 			fprintf(f, "#SECURE_HEADER\n");
2388 		} else if (ohdr->headertype == OPT_HDR_V1_BINARY_TYPE) {
2389 			fprintf(f, "BINARY binary%d.bin", cur_idx);
2390 			for (i = 0; i < ohdr->data[0]; i++)
2391 				fprintf(f, " 0x%x", le32_to_cpu(((uint32_t *)ohdr->data)[i + 1]));
2392 			offset = (unsigned)((uint8_t *)ohdr - (uint8_t *)mhdr) + 8 + 4 * ohdr->data[0];
2393 			fprintf(f, " LOAD_ADDRESS 0x%08x\n", 0x40000000 + offset);
2394 			fprintf(f, " # for CPU SHEEVA: LOAD_ADDRESS 0x%08x\n", 0x40004000 + offset);
2395 			cur_idx++;
2396 		} else if (ohdr->headertype == OPT_HDR_V1_REGISTER_TYPE) {
2397 			regset_hdr = (struct register_set_hdr_v1 *)ohdr;
2398 			if (opt_hdr_v1_size(ohdr) > sizeof(*ohdr))
2399 				regset_count = (opt_hdr_v1_size(ohdr) - sizeof(*ohdr)) /
2400 					       sizeof(regset_hdr->data[0].entry);
2401 			else
2402 				regset_count = 0;
2403 			for (i = 0; i < regset_count; i++)
2404 				fprintf(f, "DATA 0x%08x 0x%08x\n",
2405 					le32_to_cpu(regset_hdr->data[i].entry.address),
2406 					le32_to_cpu(regset_hdr->data[i].entry.value));
2407 			if (regset_count > 0) {
2408 				if (regset_hdr->data[regset_count-1].last_entry.delay !=
2409 				    REGISTER_SET_HDR_OPT_DELAY_SDRAM_SETUP)
2410 					fprintf(f, "DATA_DELAY %u\n",
2411 						(unsigned)regset_hdr->data[regset_count-1].last_entry.delay);
2412 				else
2413 					fprintf(f, "DATA_DELAY SDRAM_SETUP\n");
2414 			}
2415 		}
2416 	}
2417 
2418 	if (version == 0 && !is_v0_ext && le16_to_cpu(mhdr0->ddrinitdelay))
2419 		fprintf(f, "DDR_INIT_DELAY %u\n", (unsigned)le16_to_cpu(mhdr0->ddrinitdelay));
2420 
2421 	for_each_ext_hdr_v0(ehdr0, ptr) {
2422 		if (is_v0_ext) {
2423 			fprintf(f, "\nMATCH ADDRESS 0x%08x MASK 0x%08x VALUE 0x%08x\n",
2424 				le32_to_cpu(ehdr0->match_addr),
2425 				le32_to_cpu(ehdr0->match_mask),
2426 				le32_to_cpu(ehdr0->match_value));
2427 			if (ehdr0->rsvd1[0] || ehdr0->rsvd1[1] || ehdr0->rsvd1[2] ||
2428 			    ehdr0->rsvd1[3] || ehdr0->rsvd1[4] || ehdr0->rsvd1[5] ||
2429 			    ehdr0->rsvd1[6] || ehdr0->rsvd1[7])
2430 				fprintf(f, "#DDR_RSVD1 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n",
2431 					ehdr0->rsvd1[0], ehdr0->rsvd1[1], ehdr0->rsvd1[2],
2432 					ehdr0->rsvd1[3], ehdr0->rsvd1[4], ehdr0->rsvd1[5],
2433 					ehdr0->rsvd1[6], ehdr0->rsvd1[7]);
2434 			if (ehdr0->rsvd2[0] || ehdr0->rsvd2[1] || ehdr0->rsvd2[2] ||
2435 			    ehdr0->rsvd2[3] || ehdr0->rsvd2[4] || ehdr0->rsvd2[5] ||
2436 			    ehdr0->rsvd2[6])
2437 				fprintf(f, "#DDR_RSVD2 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n",
2438 					ehdr0->rsvd2[0], ehdr0->rsvd2[1], ehdr0->rsvd2[2],
2439 					ehdr0->rsvd2[3], ehdr0->rsvd2[4], ehdr0->rsvd2[5],
2440 					ehdr0->rsvd2[6]);
2441 			if (ehdr0->ddrwritetype)
2442 				fprintf(f, "DDR_WRITE_TYPE %u\n", (unsigned)ehdr0->ddrwritetype);
2443 			if (ehdr0->ddrresetmpp)
2444 				fprintf(f, "DDR_RESET_MPP 0x%x\n", (unsigned)ehdr0->ddrresetmpp);
2445 			if (ehdr0->ddrclkenmpp)
2446 				fprintf(f, "DDR_CLKEN_MPP 0x%x\n", (unsigned)ehdr0->ddrclkenmpp);
2447 			if (ehdr0->ddrinitdelay)
2448 				fprintf(f, "DDR_INIT_DELAY %u\n", (unsigned)ehdr0->ddrinitdelay);
2449 		}
2450 
2451 		if (ehdr0->offset) {
2452 			for (regdata = (struct ext_hdr_v0_reg *)((uint8_t *)ptr + ehdr0->offset);
2453 			     (uint8_t *)regdata < (uint8_t *)ptr + header_size &&
2454 			     (regdata->raddr || regdata->rdata);
2455 			     regdata++)
2456 				fprintf(f, "DATA 0x%08x 0x%08x\n", le32_to_cpu(regdata->raddr),
2457 					le32_to_cpu(regdata->rdata));
2458 			if ((uint8_t *)regdata != (uint8_t *)ptr + ehdr0->offset)
2459 				fprintf(f, "DATA 0x0 0x0\n");
2460 		}
2461 
2462 		if (le32_to_cpu(ehdr0->enddelay))
2463 			fprintf(f, "DATA_DELAY %u\n", le32_to_cpu(ehdr0->enddelay));
2464 		else if (is_v0_ext)
2465 			fprintf(f, "DATA_DELAY SDRAM_SETUP\n");
2466 	}
2467 
2468 	cur_idx = 1;
2469 	for_each_bin_hdr_v0(bhdr0, ptr) {
2470 		fprintf(f, "\nMATCH ADDRESS 0x%08x MASK 0x%08x VALUE 0x%08x\n",
2471 			le32_to_cpu(bhdr0->match_addr),
2472 			le32_to_cpu(bhdr0->match_mask),
2473 			le32_to_cpu(bhdr0->match_value));
2474 
2475 		fprintf(f, "BINARY binary%d.bin", cur_idx);
2476 		params_count = fls4(bhdr0->params_flags & 0xF);
2477 		for (i = 0; i < params_count; i++)
2478 			fprintf(f, " 0x%x", (bhdr0->params[i] & (1 << i)) ? bhdr0->params[i] : 0);
2479 		fprintf(f, " LOAD_ADDRESS 0x%08x", le32_to_cpu(bhdr0->destaddr));
2480 		fprintf(f, " EXEC_ADDRESS 0x%08x", le32_to_cpu(bhdr0->execaddr));
2481 		fprintf(f, "\n");
2482 
2483 		fprintf(f, "#BINARY_OFFSET 0x%x\n", le32_to_cpu(bhdr0->offset));
2484 		fprintf(f, "#BINARY_SIZE 0x%x\n", le32_to_cpu(bhdr0->size));
2485 
2486 		if (bhdr0->rsvd1)
2487 			fprintf(f, "#BINARY_RSVD1 0x%x\n", (unsigned)bhdr0->rsvd1);
2488 		if (bhdr0->rsvd2)
2489 			fprintf(f, "#BINARY_RSVD2 0x%x\n", (unsigned)bhdr0->rsvd2);
2490 
2491 		cur_idx++;
2492 	}
2493 
2494 	/* Undocumented reserved fields */
2495 
2496 	if (version == 0 && (mhdr0->rsvd1[0] || mhdr0->rsvd1[1] || mhdr0->rsvd1[2]))
2497 		fprintf(f, "#RSVD1 0x%x 0x%x 0x%x\n", (unsigned)mhdr0->rsvd1[0],
2498 			(unsigned)mhdr0->rsvd1[1], (unsigned)mhdr0->rsvd1[2]);
2499 
2500 	if (version == 0 && le16_to_cpu(mhdr0->rsvd2))
2501 		fprintf(f, "#RSVD2 0x%x\n", (unsigned)le16_to_cpu(mhdr0->rsvd2));
2502 
2503 	if (version != 0 && mhdr->reserved4)
2504 		fprintf(f, "#RESERVED4 0x%x\n", (unsigned)mhdr->reserved4);
2505 
2506 	if (version != 0 && mhdr->reserved5)
2507 		fprintf(f, "#RESERVED5 0x%x\n", (unsigned)le16_to_cpu(mhdr->reserved5));
2508 
2509 	fclose(f);
2510 
2511 	return 0;
2512 }
2513 
kwbimage_extract_subimage(void * ptr,struct image_tool_params * params)2514 static int kwbimage_extract_subimage(void *ptr, struct image_tool_params *params)
2515 {
2516 	struct main_hdr_v1 *mhdr = (struct main_hdr_v1 *)ptr;
2517 	size_t header_size = kwbheader_size(ptr);
2518 	struct bin_hdr_v0 *bhdr;
2519 	struct opt_hdr_v1 *ohdr;
2520 	int idx = params->pflag;
2521 	int cur_idx;
2522 	uint32_t offset;
2523 	ulong image;
2524 	ulong size;
2525 
2526 	/* Generate kwbimage config file when '-p -1' is specified */
2527 	if (idx == -1)
2528 		return kwbimage_generate_config(ptr, params);
2529 
2530 	image = 0;
2531 	size = 0;
2532 
2533 	if (idx == 0) {
2534 		/* Extract data image when -p is not specified or when '-p 0' is specified */
2535 		offset = le32_to_cpu(mhdr->srcaddr);
2536 
2537 		if (mhdr->blockid == IBR_HDR_SATA_ID)
2538 			offset *= params->bl_len;
2539 
2540 		if (mhdr->blockid == IBR_HDR_PEX_ID && offset == 0xFFFFFFFF)
2541 			offset = header_size;
2542 
2543 		image = (ulong)((uint8_t *)ptr + offset);
2544 		size = le32_to_cpu(mhdr->blocksize) - 4;
2545 	} else {
2546 		/* Extract N-th binary header executabe image when other '-p N' is specified */
2547 		cur_idx = 1;
2548 		for_each_opt_hdr_v1(ohdr, ptr) {
2549 			if (ohdr->headertype != OPT_HDR_V1_BINARY_TYPE)
2550 				continue;
2551 
2552 			if (idx == cur_idx) {
2553 				image = (ulong)&ohdr->data[4 + 4 * ohdr->data[0]];
2554 				size = opt_hdr_v1_size(ohdr) - 12 - 4 * ohdr->data[0];
2555 				break;
2556 			}
2557 
2558 			++cur_idx;
2559 		}
2560 		for_each_bin_hdr_v0(bhdr, ptr) {
2561 			if (idx == cur_idx) {
2562 				image = (ulong)bhdr + bhdr->offset;
2563 				size = bhdr->size;
2564 				break;
2565 			}
2566 			++cur_idx;
2567 		}
2568 
2569 		if (!image) {
2570 			fprintf(stderr, "Argument -p %d is invalid\n", idx);
2571 			fprintf(stderr, "Available subimages:\n");
2572 			fprintf(stderr, " -p -1  - kwbimage config file\n");
2573 			fprintf(stderr, " -p 0   - data image\n");
2574 			if (cur_idx - 1 > 0)
2575 				fprintf(stderr, " -p N   - Nth binary header image (totally: %d)\n",
2576 					cur_idx - 1);
2577 			return -1;
2578 		}
2579 	}
2580 
2581 	return imagetool_save_subimage(params->outfile, image, size);
2582 }
2583 
kwbimage_check_params(struct image_tool_params * params)2584 static int kwbimage_check_params(struct image_tool_params *params)
2585 {
2586 	if (!params->lflag && !params->iflag && !params->pflag &&
2587 	    (!params->imagename || !strlen(params->imagename))) {
2588 		char *msg = "Configuration file for kwbimage creation omitted";
2589 
2590 		fprintf(stderr, "Error:%s - %s\n", params->cmdname, msg);
2591 		return 1;
2592 	}
2593 
2594 	return (params->dflag && (params->fflag || params->lflag || params->skipcpy)) ||
2595 		(params->fflag) ||
2596 		(params->lflag && (params->dflag || params->fflag));
2597 }
2598 
2599 /*
2600  * kwbimage type parameters definition
2601  */
2602 U_BOOT_IMAGE_TYPE(
2603 	kwbimage,
2604 	"Marvell MVEBU Boot Image support",
2605 	0,
2606 	NULL,
2607 	kwbimage_check_params,
2608 	kwbimage_verify_header,
2609 	kwbimage_print_header,
2610 	kwbimage_set_header,
2611 	kwbimage_extract_subimage,
2612 	kwbimage_check_image_types,
2613 	NULL,
2614 	kwbimage_generate
2615 );
2616