1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright (C) 2016 Michal Simek <michals@xilinx.com>
4 * Copyright (C) 2015 Nathan Rossi <nathan@nathanrossi.com>
6 * The following Boot Header format/structures and values are defined in the
8 * * ug1085 ZynqMP TRM doc v1.4 (Chapter 11, Table 11-4)
9 * * ug1137 ZynqMP Software Developer Guide v6.0 (Chapter 16)
11 * Expected Header Size = 0x9C0
12 * Forced as 'little' endian, 32-bit words
14 * 0x 0 - Interrupt table (8 words)
15 * ... (Default value = 0xeafffffe)
17 * 0x 20 - Width detection
18 * * DEFAULT_WIDTHDETECTION 0xaa995566
19 * 0x 24 - Image identifier
20 * * DEFAULT_IMAGEIDENTIFIER 0x584c4e58
23 * * 0xa5c3c5a3 - eFuse
24 * * 0xa5c3c5a7 - obfuscated key in eFUSE
25 * * 0x3a5c3c5a - bbRam
26 * * 0xa35c7ca5 - obfuscated key in boot header
28 * 0x 30 - Image offset
29 * 0x 34 - PFW image length
30 * 0x 38 - Total PFW image length
31 * 0x 3C - Image length
32 * 0x 40 - Total image length
33 * 0x 44 - Image attributes
34 * 0x 48 - Header checksum
35 * 0x 4c - Obfuscated key
39 * 0x 70 - User defined
42 * 0x a0 - Secure header initialization vector
45 * 0x ac - Obfuscated key initialization vector
48 * 0x b8 - Register Initialization, 511 Address and Data word pairs
49 * * List is terminated with an address of 0xffffffff or
50 * ... * at the max number of entries
55 * 0x9c0 - Data/Image starts here or above
58 #include "imagetool.h"
62 #define HEADER_INTERRUPT_DEFAULT (cpu_to_le32(0xeafffffe))
63 #define HEADER_REGINIT_NULL (cpu_to_le32(0xffffffff))
64 #define HEADER_WIDTHDETECTION (cpu_to_le32(0xaa995566))
65 #define HEADER_IMAGEIDENTIFIER (cpu_to_le32(0x584c4e58))
66 #define HEADER_CPU_SELECT_A53_64BIT (0x2 << 10)
69 ENCRYPTION_EFUSE = 0xa5c3c5a3,
70 ENCRYPTION_OEFUSE = 0xa5c3c5a7,
71 ENCRYPTION_BBRAM = 0x3a5c3c5a,
72 ENCRYPTION_OBBRAM = 0xa35c7ca5,
73 ENCRYPTION_NONE = 0x0,
76 struct zynqmp_reginit {
81 #define HEADER_INTERRUPT_VECTORS 8
82 #define HEADER_REGINITS 256
84 struct image_header_table {
85 uint32_t version; /* 0x00 */
86 uint32_t nr_parts; /* 0x04 */
87 uint32_t partition_header_offset; /* 0x08, divided by 4 */
88 uint32_t image_header_offset; /* 0x0c, divided by 4 */
89 uint32_t auth_certificate_offset; /* 0x10 */
90 uint32_t boot_device; /* 0x14 */
91 uint32_t __reserved1[9]; /* 0x18 - 0x38 */
92 uint32_t checksum; /* 0x3c */
95 #define PART_ATTR_VEC_LOCATION 0x800000
96 #define PART_ATTR_BS_BLOCK_SIZE_MASK 0x700000
97 #define PART_ATTR_BS_BLOCK_SIZE_DEFAULT 0x000000
98 #define PART_ATTR_BS_BLOCK_SIZE_8MB 0x400000
99 #define PART_ATTR_BIG_ENDIAN 0x040000
100 #define PART_ATTR_PART_OWNER_MASK 0x030000
101 #define PART_ATTR_PART_OWNER_FSBL 0x000000
102 #define PART_ATTR_PART_OWNER_UBOOT 0x010000
103 #define PART_ATTR_RSA_SIG 0x008000
104 #define PART_ATTR_CHECKSUM_MASK 0x007000
105 #define PART_ATTR_CHECKSUM_NONE 0x000000
106 #define PART_ATTR_CHECKSUM_MD5 0x001000
107 #define PART_ATTR_CHECKSUM_SHA2 0x002000
108 #define PART_ATTR_CHECKSUM_SHA3 0x003000
109 #define PART_ATTR_DEST_CPU_SHIFT 8
110 #define PART_ATTR_DEST_CPU_MASK 0x000f00
111 #define PART_ATTR_DEST_CPU_NONE 0x000000
112 #define PART_ATTR_DEST_CPU_A53_0 0x000100
113 #define PART_ATTR_DEST_CPU_A53_1 0x000200
114 #define PART_ATTR_DEST_CPU_A53_2 0x000300
115 #define PART_ATTR_DEST_CPU_A53_3 0x000400
116 #define PART_ATTR_DEST_CPU_R5_0 0x000500
117 #define PART_ATTR_DEST_CPU_R5_1 0x000600
118 #define PART_ATTR_DEST_CPU_R5_L 0x000700
119 #define PART_ATTR_DEST_CPU_PMU 0x000800
120 #define PART_ATTR_ENCRYPTED 0x000080
121 #define PART_ATTR_DEST_DEVICE_SHIFT 4
122 #define PART_ATTR_DEST_DEVICE_MASK 0x000070
123 #define PART_ATTR_DEST_DEVICE_NONE 0x000000
124 #define PART_ATTR_DEST_DEVICE_PS 0x000010
125 #define PART_ATTR_DEST_DEVICE_PL 0x000020
126 #define PART_ATTR_DEST_DEVICE_PMU 0x000030
127 #define PART_ATTR_DEST_DEVICE_XIP 0x000040
128 #define PART_ATTR_A53_EXEC_AARCH32 0x000008
129 #define PART_ATTR_TARGET_EL_SHIFT 1
130 #define PART_ATTR_TARGET_EL_MASK 0x000006
131 #define PART_ATTR_TZ_SECURE 0x000001
133 static const char *dest_cpus[0x10] = {
134 "none", "a5x-0", "a5x-1", "a5x-2", "a5x-3", "r5-0", "r5-1",
135 "r5-lockstep", "pmu", "unknown", "unknown", "unknown", "unknown",
136 "unknown", "unknown", "unknown"
139 struct partition_header {
140 uint32_t len_enc; /* 0x00, divided by 4 */
141 uint32_t len_unenc; /* 0x04, divided by 4 */
142 uint32_t len; /* 0x08, divided by 4 */
143 uint32_t next_partition_offset; /* 0x0c */
144 uint64_t entry_point; /* 0x10 */
145 uint64_t load_address; /* 0x18 */
146 uint32_t offset; /* 0x20, divided by 4 */
147 uint32_t attributes; /* 0x24 */
148 uint32_t __reserved1; /* 0x28 */
149 uint32_t checksum_offset; /* 0x2c, divided by 4 */
150 uint32_t __reserved2; /* 0x30 */
151 uint32_t auth_certificate_offset; /* 0x34 */
152 uint32_t __reserved3; /* 0x38 */
153 uint32_t checksum; /* 0x3c */
156 struct zynqmp_header {
157 uint32_t interrupt_vectors[HEADER_INTERRUPT_VECTORS]; /* 0x0 */
158 uint32_t width_detection; /* 0x20 */
159 uint32_t image_identifier; /* 0x24 */
160 uint32_t encryption; /* 0x28 */
161 uint32_t image_load; /* 0x2c */
162 uint32_t image_offset; /* 0x30 */
163 uint32_t pfw_image_length; /* 0x34 */
164 uint32_t total_pfw_image_length; /* 0x38 */
165 uint32_t image_size; /* 0x3c */
166 uint32_t image_stored_size; /* 0x40 */
167 uint32_t image_attributes; /* 0x44 */
168 uint32_t checksum; /* 0x48 */
169 uint32_t __reserved1[19]; /* 0x4c */
170 uint32_t image_header_table_offset; /* 0x98 */
171 uint32_t __reserved2[7]; /* 0x9c */
172 struct zynqmp_reginit register_init[HEADER_REGINITS]; /* 0xb8 */
173 uint32_t __reserved4[66]; /* 0x9c0 */
176 static struct zynqmp_header zynqmpimage_header;
177 static void *dynamic_header;
180 static uint32_t zynqmpimage_checksum(struct zynqmp_header *ptr)
182 uint32_t checksum = 0;
187 checksum += le32_to_cpu(ptr->width_detection);
188 checksum += le32_to_cpu(ptr->image_identifier);
189 checksum += le32_to_cpu(ptr->encryption);
190 checksum += le32_to_cpu(ptr->image_load);
191 checksum += le32_to_cpu(ptr->image_offset);
192 checksum += le32_to_cpu(ptr->pfw_image_length);
193 checksum += le32_to_cpu(ptr->total_pfw_image_length);
194 checksum += le32_to_cpu(ptr->image_size);
195 checksum += le32_to_cpu(ptr->image_stored_size);
196 checksum += le32_to_cpu(ptr->image_attributes);
197 checksum = ~checksum;
199 return cpu_to_le32(checksum);
202 static void zynqmpimage_default_header(struct zynqmp_header *ptr)
209 ptr->width_detection = HEADER_WIDTHDETECTION;
210 ptr->image_attributes = HEADER_CPU_SELECT_A53_64BIT;
211 ptr->image_identifier = HEADER_IMAGEIDENTIFIER;
212 ptr->encryption = cpu_to_le32(ENCRYPTION_NONE);
214 /* Setup not-supported/constant/reserved fields */
215 for (i = 0; i < HEADER_INTERRUPT_VECTORS; i++)
216 ptr->interrupt_vectors[i] = HEADER_INTERRUPT_DEFAULT;
218 for (i = 0; i < HEADER_REGINITS; i++) {
219 ptr->register_init[i].address = HEADER_REGINIT_NULL;
220 ptr->register_init[i].data = 0;
224 * Certain reserved fields are required to be set to 0, ensure they are
227 ptr->pfw_image_length = 0x0;
228 ptr->total_pfw_image_length = 0x0;
231 /* mkimage glue functions */
232 static int zynqmpimage_verify_header(unsigned char *ptr, int image_size,
233 struct image_tool_params *params)
235 struct zynqmp_header *zynqhdr = (struct zynqmp_header *)ptr;
237 if (image_size < sizeof(struct zynqmp_header))
240 if (zynqhdr->width_detection != HEADER_WIDTHDETECTION)
242 if (zynqhdr->image_identifier != HEADER_IMAGEIDENTIFIER)
245 if (zynqmpimage_checksum(zynqhdr) != zynqhdr->checksum)
251 static void print_partition(const void *ptr, const struct partition_header *ph)
253 uint32_t attr = le32_to_cpu(ph->attributes);
254 unsigned long len = le32_to_cpu(ph->len) * 4;
255 const char *part_owner;
256 const char *dest_devs[0x8] = {
257 "none", "PS", "PL", "PMU", "unknown", "unknown", "unknown",
261 switch (attr & PART_ATTR_PART_OWNER_MASK) {
262 case PART_ATTR_PART_OWNER_FSBL:
265 case PART_ATTR_PART_OWNER_UBOOT:
266 part_owner = "U-Boot";
269 part_owner = "Unknown";
273 printf("%s payload on CPU %s (%s):\n", part_owner,
274 dest_cpus[(attr & PART_ATTR_DEST_CPU_MASK) >> 8],
275 dest_devs[(attr & PART_ATTR_DEST_DEVICE_MASK) >> 4]);
277 printf(" Offset : 0x%08x\n", le32_to_cpu(ph->offset) * 4);
278 printf(" Size : %lu (0x%lx) bytes\n", len, len);
279 printf(" Load : 0x%08llx",
280 (unsigned long long)le64_to_cpu(ph->load_address));
281 if (ph->load_address != ph->entry_point)
282 printf(" (entry=0x%08llx)\n",
283 (unsigned long long)le64_to_cpu(ph->entry_point));
286 printf(" Attributes : ");
288 if (attr & PART_ATTR_VEC_LOCATION)
291 if (attr & PART_ATTR_ENCRYPTED)
292 printf("encrypted ");
294 switch (attr & PART_ATTR_CHECKSUM_MASK) {
295 case PART_ATTR_CHECKSUM_MD5:
298 case PART_ATTR_CHECKSUM_SHA2:
301 case PART_ATTR_CHECKSUM_SHA3:
306 if (attr & PART_ATTR_BIG_ENDIAN)
307 printf("BigEndian ");
309 if (attr & PART_ATTR_RSA_SIG)
312 if (attr & PART_ATTR_A53_EXEC_AARCH32)
315 if (attr & PART_ATTR_TARGET_EL_MASK)
316 printf("EL%d ", (attr & PART_ATTR_TARGET_EL_MASK) >> 1);
318 if (attr & PART_ATTR_TZ_SECURE)
322 printf(" Checksum : 0x%08x\n", le32_to_cpu(ph->checksum));
325 static void zynqmpimage_print_header(const void *ptr)
327 struct zynqmp_header *zynqhdr = (struct zynqmp_header *)ptr;
330 printf("Image Type : Xilinx ZynqMP Boot Image support\n");
331 printf("Image Offset : 0x%08x\n", le32_to_cpu(zynqhdr->image_offset));
332 printf("Image Size : %lu bytes (%lu bytes packed)\n",
333 (unsigned long)le32_to_cpu(zynqhdr->image_size),
334 (unsigned long)le32_to_cpu(zynqhdr->image_stored_size));
336 if (zynqhdr->pfw_image_length)
337 printf("PMUFW Size : %lu bytes (%lu bytes packed)\n",
338 (unsigned long)le32_to_cpu(zynqhdr->pfw_image_length),
339 (unsigned long)le32_to_cpu(
340 zynqhdr->total_pfw_image_length));
342 printf("Image Load : 0x%08x\n", le32_to_cpu(zynqhdr->image_load));
343 printf("Checksum : 0x%08x\n", le32_to_cpu(zynqhdr->checksum));
345 for (i = 0; i < HEADER_INTERRUPT_VECTORS; i++) {
346 if (zynqhdr->interrupt_vectors[i] == HEADER_INTERRUPT_DEFAULT)
349 printf("Modified Interrupt Vector Address [%d]: 0x%08x\n", i,
350 le32_to_cpu(zynqhdr->interrupt_vectors[i]));
353 for (i = 0; i < HEADER_REGINITS; i++) {
354 if (zynqhdr->register_init[i].address == HEADER_REGINIT_NULL)
358 printf("Custom Register Initialization:\n");
360 printf(" @ 0x%08x -> 0x%08x\n",
361 le32_to_cpu(zynqhdr->register_init[i].address),
362 le32_to_cpu(zynqhdr->register_init[i].data));
365 if (zynqhdr->image_header_table_offset) {
366 struct image_header_table *iht = (void *)ptr +
367 zynqhdr->image_header_table_offset;
368 struct partition_header *ph;
373 ph_offset = le32_to_cpu(iht->partition_header_offset) * 4;
374 ph = (void *)ptr + ph_offset;
375 for (i = 0; i < le32_to_cpu(iht->nr_parts); i++) {
376 next = le32_to_cpu(ph->next_partition_offset) * 4;
378 /* Partition 0 is the base image itself */
380 print_partition(ptr, ph);
382 ph = (void *)ptr + next;
386 free(dynamic_header);
389 static int zynqmpimage_check_params(struct image_tool_params *params)
394 if (params->addr != 0x0) {
395 fprintf(stderr, "Error: Load Address cannot be specified.\n");
400 * If the entry point is specified ensure it is 64 byte aligned.
402 if (params->eflag && (params->ep % 64 != 0)) {
404 "Error: Entry Point must be aligned to a 64-byte boundary.\n");
408 return !(params->lflag || params->dflag);
411 static int zynqmpimage_check_image_types(uint8_t type)
413 if (type == IH_TYPE_ZYNQMPIMAGE)
418 static uint32_t fsize(FILE *fp)
420 int size, ret, origin;
424 fprintf(stderr, "Incorrect file size\n");
429 ret = fseek(fp, 0L, SEEK_END);
431 fprintf(stderr, "Incorrect file SEEK_END\n");
438 fprintf(stderr, "Incorrect file size\n");
444 ret = fseek(fp, origin, SEEK_SET);
446 fprintf(stderr, "Incorrect file SEEK_SET to %d\n", origin);
454 static void zynqmpimage_pmufw(struct zynqmp_header *zynqhdr,
455 const char *filename)
459 /* Setup PMU fw size */
460 zynqhdr->pfw_image_length = fsize(fpmu);
461 zynqhdr->total_pfw_image_length = zynqhdr->pfw_image_length;
463 zynqhdr->image_size -= zynqhdr->pfw_image_length;
464 zynqhdr->image_stored_size -= zynqhdr->total_pfw_image_length;
466 /* Read the whole PMUFW to the header */
467 size = fread(&zynqhdr->__reserved4[66], 1,
468 zynqhdr->pfw_image_length, fpmu);
469 if (size != zynqhdr->pfw_image_length) {
470 fprintf(stderr, "Cannot read PMUFW file: %s\n", filename);
478 static void zynqmpimage_parse_initparams(struct zynqmp_header *zynqhdr,
479 const char *filename)
482 struct zynqmp_reginit reginit;
483 unsigned int reg_count = 0;
485 struct stat path_stat;
487 /* Expect a table of register-value pairs, e.g. "0x12345678 0x4321" */
488 fp = fopen(filename, "r");
490 fprintf(stderr, "Cannot open initparams file: %s\n", filename);
494 err = fstat(fileno(fp), &path_stat);
500 if (!S_ISREG(path_stat.st_mode)) {
506 r = fscanf(fp, "%x %x", ®init.address, ®init.data);
508 zynqhdr->register_init[reg_count] = reginit;
511 r = fscanf(fp, "%*[^\n]\n"); /* Skip to next line */
512 } while ((r != EOF) && (reg_count < HEADER_REGINITS));
516 static void zynqmpimage_set_header(void *ptr, struct stat *sbuf, int ifd,
517 struct image_tool_params *params)
519 struct zynqmp_header *zynqhdr = (struct zynqmp_header *)ptr;
520 zynqmpimage_default_header(zynqhdr);
522 /* place image directly after header */
523 zynqhdr->image_offset =
524 cpu_to_le32((uint32_t)sizeof(struct zynqmp_header));
525 zynqhdr->image_size = cpu_to_le32(params->file_size -
526 sizeof(struct zynqmp_header));
527 zynqhdr->image_stored_size = zynqhdr->image_size;
528 zynqhdr->image_load = 0xfffc0000;
530 zynqhdr->image_load = cpu_to_le32((uint32_t)params->ep);
534 zynqmpimage_pmufw(zynqhdr, params->imagename);
536 /* User can pass in text file with init list */
537 if (strlen(params->imagename2))
538 zynqmpimage_parse_initparams(zynqhdr, params->imagename2);
540 zynqhdr->checksum = zynqmpimage_checksum(zynqhdr);
543 static int zynqmpimage_vrec_header(struct image_tool_params *params,
544 struct image_type_params *tparams)
546 struct stat path_stat;
547 char *filename = params->imagename;
550 /* Handle static case without PMUFW */
551 tparams->header_size = sizeof(struct zynqmp_header);
552 tparams->hdr = (void *)&zynqmpimage_header;
554 /* PMUFW name is passed via params->imagename */
555 if (strlen(filename) == 0)
558 fpmu = fopen(filename, "r");
560 fprintf(stderr, "Cannot open PMUFW file: %s\n", filename);
564 err = fstat(fileno(fpmu), &path_stat);
571 if (!S_ISREG(path_stat.st_mode)) {
577 /* Increase header size by PMUFW file size */
578 tparams->header_size += fsize(fpmu);
580 /* Allocate buffer with space for PMUFW */
581 dynamic_header = calloc(1, tparams->header_size);
582 tparams->hdr = dynamic_header;
589 "Xilinx ZynqMP Boot Image support",
590 sizeof(struct zynqmp_header),
591 (void *)&zynqmpimage_header,
592 zynqmpimage_check_params,
593 zynqmpimage_verify_header,
594 zynqmpimage_print_header,
595 zynqmpimage_set_header,
597 zynqmpimage_check_image_types,
599 zynqmpimage_vrec_header