Re: [PATCH v2 2/4] tools: mkimage: Add Allwinner TOC0 support

[Samuel Holland <samuel@sholland.org>]

On 8/22/21 5:07 AM, Pali Rohár wrote:
> Hello!
> 
> On Saturday 21 August 2021 23:46:46 Samuel Holland wrote:
>> Most Allwinner sunxi SoCs have separate boot ROMs in non-secure and
>> secure mode. The "non-secure" or "normal" boot ROM (NBROM) uses the
>> existing sunxi_egon image type. The secure boot ROM (SBROM) uses a
>> completely different image type, known as TOC0.
>>
>> A TOC0 image is composed of a header and two or more items. One item
>> is the firmware binary. The others form a chain linking the firmware
>> signature to the root-of-trust public key (ROTPK), which has its hash
>> burned in the SoC's eFuses. Signatures are made using RSA-2048 + SHA256.
>>
>> The pseudo-ASN.1 structure is manually assembled; this is done to work
>> around bugs/quirks in the boot ROM, which vary between SoCs. This TOC0
>> implementation has been verified to work with the A50, A64, H5, H6,
>> and H616 SBROMs, and it may work with other SoCs.
>>
>> Signed-off-by: Samuel Holland <samuel@sholland.org>
>> ---
>>
>> Changes in v2:
>>  - Moved certificate and key item structures out of sunxi_image.h
>>  - Renamed "main" and "item" variables for clarity
>>  - Improved error messages, and added a hint about key generation
>>  - Added a comment explaining the purpose of the various key files
>>  - Mentioned testing this code on A50 in the commit message
>>
>>  arch/arm/Kconfig      |   1 +
>>  common/image.c        |   1 +
>>  include/image.h       |   1 +
>>  include/sunxi_image.h |  36 ++
>>  tools/Makefile        |   3 +-
>>  tools/sunxi_toc0.c    | 907 ++++++++++++++++++++++++++++++++++++++++++
>>  6 files changed, 948 insertions(+), 1 deletion(-)
>>  create mode 100644 tools/sunxi_toc0.c
>>
>> diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
>> index d692139199c..799fe7d43af 100644
>> --- a/arch/arm/Kconfig
>> +++ b/arch/arm/Kconfig
>> @@ -1014,6 +1014,7 @@ config ARCH_SUNXI
>>  	select SUNXI_GPIO
>>  	select SYS_NS16550
>>  	select SYS_THUMB_BUILD if !ARM64
>> +	select TOOLS_LIBCRYPTO
>>  	select USB if DISTRO_DEFAULTS
>>  	select USB_KEYBOARD if DISTRO_DEFAULTS && USB_HOST
>>  	select USB_STORAGE if DISTRO_DEFAULTS && USB_HOST
>> diff --git a/common/image.c b/common/image.c
>> index 59c52a1f9ad..8f1634c1206 100644
>> --- a/common/image.c
>> +++ b/common/image.c
>> @@ -191,6 +191,7 @@ static const table_entry_t uimage_type[] = {
>>  	{	IH_TYPE_MTKIMAGE,   "mtk_image",   "MediaTek BootROM loadable Image" },
>>  	{	IH_TYPE_COPRO, "copro", "Coprocessor Image"},
>>  	{	IH_TYPE_SUNXI_EGON, "sunxi_egon",  "Allwinner eGON Boot Image" },
>> +	{	IH_TYPE_SUNXI_TOC0, "sunxi_toc0",  "Allwinner TOC0 Boot Image" },
>>  	{	-1,		    "",		  "",			},
>>  };
>>  
>> diff --git a/include/image.h b/include/image.h
>> index e20f0b69d58..a4efc090309 100644
>> --- a/include/image.h
>> +++ b/include/image.h
>> @@ -284,6 +284,7 @@ enum {
>>  	IH_TYPE_IMX8IMAGE,		/* Freescale IMX8Boot Image	*/
>>  	IH_TYPE_COPRO,			/* Coprocessor Image for remoteproc*/
>>  	IH_TYPE_SUNXI_EGON,		/* Allwinner eGON Boot Image */
>> +	IH_TYPE_SUNXI_TOC0,		/* Allwinner TOC0 Boot Image */
>>  
>>  	IH_TYPE_COUNT,			/* Number of image types */
>>  };
>> diff --git a/include/sunxi_image.h b/include/sunxi_image.h
>> index 5b2055c0af3..399ad0be999 100644
>> --- a/include/sunxi_image.h
>> +++ b/include/sunxi_image.h
>> @@ -9,9 +9,12 @@
>>   *
>>   * Shared between mkimage and the SPL.
>>   */
>> +
>>  #ifndef	SUNXI_IMAGE_H
>>  #define	SUNXI_IMAGE_H
>>  
>> +#include <linux/types.h>
>> +
>>  #define BOOT0_MAGIC		"eGON.BT0"
>>  #define BROM_STAMP_VALUE	0x5f0a6c39
>>  #define SPL_SIGNATURE		"SPL" /* marks "sunxi" SPL header */
>> @@ -79,4 +82,37 @@ struct boot_file_head {
>>  /* Compile time check to assure proper alignment of structure */
>>  typedef char boot_file_head_not_multiple_of_32[1 - 2*(sizeof(struct boot_file_head) % 32)];
> 
> (Just suggestion for future, not related to this patch series: above
> check could be rewritten/cleaned to use static assert)

I will send a separate patch once this is merged.

>>  
>> +struct toc0_main_info {
>> +	uint8_t	name[8];
>> +	__le32	magic;
>> +	__le32	checksum;
>> +	__le32	serial;
>> +	__le32	status;
>> +	__le32	num_items;
>> +	__le32	length;
>> +	uint8_t	platform[4];
>> +	uint8_t	reserved[8];
>> +	uint8_t	end[4];
>> +};
>> +
>> +#define TOC0_MAIN_INFO_NAME		"TOC0.GLH"
>> +#define TOC0_MAIN_INFO_MAGIC		0x89119800
>> +#define TOC0_MAIN_INFO_END		"MIE;"
>> +
>> +struct toc0_item_info {
>> +	__le32	name;
>> +	__le32	offset;
>> +	__le32	length;
>> +	__le32	status;
>> +	__le32	type;
>> +	__le32	load_addr;
>> +	uint8_t	reserved[4];
>> +	uint8_t	end[4];
>> +};
> 
> These structures are raw image structures, right? Therefore they should
> be marked as __packed?

I'm not sure why I would want to do that? The structures do not have any
padding to start with, and the layout of the image format implies that
they will be naturally aligned (and in fact the boot ROM assumes this).
Marking them as packed would only cause GCC to generate less efficient code.

>> +U_BOOT_IMAGE_TYPE(
>> +	sunxi_toc0,
>> +	"Allwinner TOC0 Boot Image support",
>> +	TOC0_DEFAULT_HEADER_LEN,
>> +	NULL,
>> +	toc0_check_params,
>> +	toc0_verify_header,
>> +	toc0_print_header,
>> +	toc0_set_header,
>> +	NULL,
> 
> Are you planning to implement this missing (extract_subimage) dumpimage
> function in future?

Yes, eventually. I didn't want to delay the rest of the code for it,
since it is not needed to build U-Boot.

Regards,
Samuel