snagrecover: Add rockchip support

Add support for booting a rockchip bin file, made with boot_merger.
It can be:
- a file containing the rockchip miniloader, but in this case,
  it's not useful, as rockusb is not implemented
- a file containing uboot tpl and spl. In this case, if u-boot
  is configured for SPL DFU, the snagrecover configuration file
  may specify an u-boot FIT image to load into the first DFU slot.
  This will allow booting u-boot proper and then to fastboot/ums/dfu/...
  to flash.

Signed-off-by: Arnaud Patard <[email protected]>

Author: apatard

docs/fw_binaries.md

@@ -289,3 +289,100 @@ extract the FSBL and PMUFW from the complete boot image.
 configuration:
  * path
 
+## For Rockchip devices
+
+While it is possible to use the DDR init files and SPL files from Rockchip,
+it is easier to use the files generated by u-boot as support for the
+Rokchip USB protocol is not implemented.
+Nevertheless, this means that to boot u-boot proper, u-boot has to be
+patched to get support for:
+
+- boot from RAM,
+- boot from SPL DFU
+
+The patches have been sent to the u-boot mailing list by their authors
+and not yet merged. The patches can all be found inside this
+[merge request](https://gitlab.collabora.com/hardware-enablement/rockchip-3588/u-boot/-/merge_requests/5).
+
+
+
+### Using binary generated by Rockchip's ``boot_merger``
+
+[example](../src/snagrecover/templates/rockchip-merger.yaml)
+
+Snagboot can upload the ``CODE471_OPTION`` and ``CODE472_OPTION`` of a binary
+generated with the ``boot_merger`` tool and configuration files from
+[Rockchip rkbin](https://github.com/radxa/rkbin/tree/develop-v2024.03/).
+
+In case of u-boot, this would mean to upload the TPL, SPL and then use SPL DFU
+to boot u-boot proper (see later section for SPL DFU).
+
+An example configuration for rk3399 would be:
+```
+[CHIP_NAME]
+NAME=RK330C
+[VERSION]
+MAJOR=1
+MINOR=123
+[CODE471_OPTION]
+NUM=1
+Path1=tpl/u-boot-tpl-dtb.bin
+Sleep=1
+[CODE472_OPTION]
+NUM=1
+Path1=spl/u-boot-spl-dtb.bin
+Sleep=3000
+[LOADER_OPTION]
+NUM=2
+LOADER1=FlashData
+LOADER2=FlashBoot
+FlashData=spl/u-boot-spl-dtb.bin
+FlashBoot=u-boot.itb
+[OUTPUT]
+PATH=rk3399_uboot.bin
+[FLAG]
+471_RC4_OFF=false
+```
+
+The ``tpl/u-boot-tpl-dtb.bin``, ``spl/u-boot-spl-dtb.bin``, ``u-boot.itb``
+files are generated during u-boot's build. Please note has the ``LOADER_OPTION``
+is not handled by snagboot.
+
+
+### Boot from Ram
+
+[example](../src/snagrecover/templates/rockchip-ramboot.yaml)
+
+When building u-boot with the previously mentioned patches, u-boot will generate two files:
+
+- ``u-boot-rockchip-usb471.bin``
+- ``u-boot-rockchip-usb472.bin``
+
+These are the files needed to boot from RAM.
+On platforms like rk3588 using the TPL from rockchip, some issues will arrive
+when booting. It's due to the ``u-boot-rockchip-usb472.bin`` binary overwriting
+the ATAGS provided by the TPL. A possible fix would be to patch u-boot with
+https://github.com/u-boot/u-boot/commit/a6e85a35b50ade7df5f32092c1cc05ade303a22a.
+
+
+### Boot from SPL DFU
+
+[example](../src/snagrecover/templates/rockchip-spl-dfu.yaml)
+
+To enable u-boot with SPL DFU support in the u-boot configuration, ensure that the
+following options are enabled:
+
+```
+CONFIG_SPL_DM_USB_GADGET=y
+CONFIG_SPL_USB_GADGET=y
+CONFIG_SPL_DFU=y
+```
+
+The (SPL) USB gadget driver needs to be enabled too.
+
+At the end of the build, the following files will be needed:
+
+- ``mkimage-in-simple-bin.mkimage-u-boot-tpl`` or ``mkimage-in-simple-bin.mkimage-rockchip-tpl``
+- ``mkimage-in-simple-bin.mkimage-u-boot-spl``
+- ``u-boot.itb``
+

src/snagrecover/50-snagboot.rules

@@ -76,3 +76,21 @@ SUBSYSTEM=="usb", ATTRS{idVendor}=="0451", ATTRS{idProduct}=="d022", MODE="0660"
 
 #Xilinx rules
 SUBSYSTEM=="usb", ATTRS{idVendor}=="03fd", ATTRS{idProduct}=="0050", MODE="0660", TAG+="uaccess"
+
+#Rockchip systems
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="2207", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="110a", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="110b", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="300a", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="301a", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="310b", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="310c", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="320a", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="320b", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="320c", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="330a", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="330c", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="330d", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="330e", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="350a", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2207", ATTRS{idProduct}=="350b", MODE="0660", TAG+="uaccess"

src/snagrecover/config.py

@@ -52,6 +52,23 @@
 		"imx8mm": "1fc9:0134",
 		"imx8mq": "1fc9:012b",
 		"imx53" : "15a2:004e",
+	},
+	"rockchip": {
+		"rv1108": "2207:110a",
+		"rv1126": "2207:110b",
+		"rk3066": "2207:300a",
+		"rk3036": "2207:301a",
+		"rk3188": "2207:310b",
+		"rk3128": "2207:310c",
+		"rk3288": "2207:320a",
+		"rk322x": "2207:320b",
+		"rk3328": "2207:320c",
+		"rk3368": "2207:330a",
+		"rk3399": "2207:330c",
+		"px30": "2207:330d",
+		"rk3308": "2207:330e",
+		"rk3568": "2207:350a",
+		"rk3588": "2207:350b"
 	}
 }
 
@@ -80,6 +97,8 @@ def init_config(args: list):
 		if args.usb_path is None:
 			if soc_family == "imx":
 				usb_ids = default_usb_ids["imx"][soc_model]
+			elif soc_family == "rockchip":
+				usb_ids = default_usb_ids["rockchip"][soc_model]
 			else:
 				usb_ids = default_usb_ids[soc_family]
 

src/snagrecover/firmware/firmware.py

@@ -146,6 +146,9 @@ def run_firmware(port, fw_name: str, subfw_name: str = ""):
 	elif soc_family == "zynqmp":
 		from snagrecover.firmware.zynqmp_fw import zynqmp_run
 		zynqmp_run(port, fw_name, fw_blob, subfw_name)
+	elif soc_family == "rockchip":
+		from snagrecover.firmware.rk_fw import rockchip_run
+		rockchip_run(port, fw_name, fw_blob)
 	else:
 		raise Exception(f"Unsupported SoC family {soc_family}")
 	logger.info(f"Done installing firmware {fw_name}")

src/snagrecover/firmware/rk_fw.py

@@ -12,28 +12,29 @@
 import logging
 import struct
 import time
-from cryptography.hazmat.primitives.ciphers import Cipher
-from cryptography.hazmat.decrepit.ciphers.algorithms import ARC4
 from crccheck import crc
 from dataclasses import dataclass
 
 logger = logging.getLogger("snagrecover")
 from snagrecover.protocols import rockchip
+from snagrecover.protocols import dfu
 from snagrecover.utils import BinFileHeader
 from snagrecover.config import recovery_config
 
+
 # List generated with a grep on rkbin repository
-NEWIDB_LIST = [ "rk3506", "rk3506b", "rk3528", "rk3562", "rk3566", "rk3568", "rk3576", "rk3583", "rk3588", "rv1103b", "rv1106" ]
+NEWIDB_LIST = ["rk3506", "rk3506b", "rk3528", "rk3562", "rk3566", "rk3568", "rk3576", "rk3583", "rk3588", "rv1103b", "rv1106"]
 
 BOOTTAG = b"BOOT"
 LDRTAG = b"LDR "
-TAG_LIST = [ BOOTTAG, LDRTAG ]
+TAG_LIST = [BOOTTAG, LDRTAG]
 BOOTENTRYSIZE = 57
 BOOTHEADERENTRYSIZE = 6
 BOOTHEADERSIZE = 102
 BOOTHEADERTIMESIZE = 7
 RC4_KEY = bytearray([124, 78, 3, 4, 85, 5, 9, 7, 45, 44, 123, 56, 23, 13, 23, 17])
 
+
 @dataclass
 class BootEntry(BinFileHeader):
 	size: int
@@ -76,6 +77,7 @@ class BootReleaseTime(BinFileHeader):
 	def __str__(self):
 		return f"{self.year}/{self.month}/{self.day} {self.hour}:{self.minute}:{self.second}"
 
+
 class LoaderFileError(Exception):
 	def __init__(self, message):
 		self.message = message
@@ -84,6 +86,7 @@ def __init__(self, message):
 	def __str__(self):
 		return f"File format error: {self.message}"
 
+
 @dataclass
 class BootHeader(BinFileHeader):
 	tag: bytes
@@ -105,7 +108,7 @@ class BootHeader(BinFileHeader):
 
 	def __post_init__(self):
 		if self.tag not in TAG_LIST:
-			raise LoaderFileError(f"Invalid tag {self.header.tag}")
+			raise LoaderFileError(f"Invalid tag {self.tag}")
 		# not sure how to exactly parse version/merge_version
 		self.maj_ver = self.version >> 8
 		self.min_ver = self.version & 0xff
@@ -128,6 +131,7 @@ def __post_init__(self):
 	def __str__(self):
 		return f"{self.tag}, {self.size} ,{self.maj_ver}.{self.min_ver}, 0x{self.merge_version:0x}, {self.releasetime}, {self.chip}, {self.entry471}, {self.entry472}, {self.loader}, sign: {self.sign}, enc: {self.rc4}"
 
+
 class RkCrc32(crc.Crc32Base):
 	"""CRC-32/ROCKCHIP
 	"""
@@ -139,6 +143,7 @@ class RkCrc32(crc.Crc32Base):
 	_reflect_output = False
 	_xor_output = 0
 
+
 class LoaderFile():
 	def __init__(self, blob):
 		self.blob = blob
@@ -170,7 +175,7 @@ def __init__(self, blob):
 		(self.crc32,) = struct.unpack("<I", crc32)
 		assert self.crc32 == calc_crc32
 
-	def entry_data(self, name, idx = 0):
+	def entry_data(self, name, idx=0):
 		entry = None
 		if name == "471":
 			entry = self.entry471
@@ -190,6 +195,38 @@ def entry_data(self, name, idx = 0):
 	def __str__(self):
 		return f"{self.header} crc: {self.crc32:02x}"
 
+
+# Manual implementation of RC4, from Wikipedia's page
+# Not very secure, so don't use it elsewhere.
+class rc4():
+	def __init__(self):
+		self.S = list(range(256))
+		self.i = 0
+		self.j = 0
+
+	def ksa(self, key):
+		keylength = len(key)
+		self.S = list(range(256))
+		j = 0
+		for i in range(256):
+			j = (j + self.S[i] + key[i % keylength]) % 256
+			self.S[i], self.S[j] = self.S[j], self.S[i]
+
+	def prga(self):
+		self.i = (self.i + 1) % 256
+		self.j = (self.j + self.S[self.i]) % 256
+		self.S[self.i], self.S[self.j] = self.S[self.j], self.S[self.i]
+		K = self.S[(self.S[self.i] + self.S[self.j]) % 256]
+		return K
+
+	def encrypt(self, buf):
+		obuf = bytearray(len(buf))
+
+		for offset in list(range(len(buf))):
+			obuf[offset] = buf[offset] ^ self.prga()
+		return obuf
+
+
 def rc4_encrypt(fw_blob):
 
 	soc_model = recovery_config["soc_model"]
@@ -201,28 +238,39 @@ def rc4_encrypt(fw_blob):
 	padded_len = (blob_len+4095)//4096 * 4096
 	fw_blob = bytearray(fw_blob)
 	fw_blob += bytearray([0]*(padded_len - blob_len))
-	a = ARC4(RC4_KEY)
-	c = Cipher(a, mode=None)
-	d = c.encryptor()
+	encoder = rc4()
+	encoder.ksa(RC4_KEY)
 	obuf = bytearray()
 	for i in range(padded_len):
-		obuf += d.update(fw_blob[i*512:(i+1)*512])
+		obuf += encoder.encrypt(fw_blob[i*512:(i+1)*512])
 	return obuf
 
+
 def rockchip_run(dev, fw_name, fw_blob):
-	rom = rockchip.RochipBootRom(dev)
 
 	if fw_name == 'code471':
 		logger.info("Downloading code471...")
+		rom = rockchip.RochipBootRom(dev)
 		blob = rc4_encrypt(fw_blob)
 		rom.write_blob(blob, 0x471)
 	elif fw_name == 'code472':
 		logger.info("Downloading code472...")
+		rom = rockchip.RochipBootRom(dev)
 		blob = rc4_encrypt(fw_blob)
 		rom.write_blob(blob, 0x472)
+	elif fw_name == "u-boot-fit":
+		id = dfu.search_partid(dev, "u-boot.itb")
+		if id is None:
+			logger.error("Missing u-boot.itb DFU partition")
+		dfu_cmd = dfu.DFU(dev, stm32=False)
+		dfu_cmd.get_status()
+		dfu_cmd.download_and_run(fw_blob, id, 0, len(fw_blob))
+		dfu_cmd.get_status()
+		dfu_cmd.detach(id)
 	else:
 		fw = LoaderFile(fw_blob)
 		logger.info(f"{fw}")
+		rom = rockchip.RochipBootRom(dev)
 		for i in range(fw.header.entry471.count):
 			logger.info(f"Downloading entry 471 {i}...")
 			(data, delay) = fw.entry_data("471", i)

src/snagrecover/protocols/rockchip.py

@@ -13,6 +13,7 @@
 
 logger = logging.getLogger("snagrecover")
 
+USB_REQUEST_TYPE_VENDOR = (0x02 << 5)
 
 class RochipBootRomError(Exception):
 	pass
@@ -43,13 +44,13 @@ def __init__(self, dev: usb.core.Device):
 		self.ep_in = ep_in
 		self.ep_out = ep_out
 
-	def __write_chunk(self, addr: int, chunk: bytes) -> bool:
+	def __write_chunk(self, code: int, chunk: bytes) -> bool:
 		logger.debug(f"Sending {len(chunk)} bytes")
-		return self.dev.ctrl_transfer(0x40, 0x0c, 0, addr, chunk)
+		return self.dev.ctrl_transfer(USB_REQUEST_TYPE_VENDOR, 0x0c, 0, code, chunk)
 
-	def write_blob(self, blob: bytes, addr: int) -> bool:
-		if addr != 0x471 and addr != 0x472:
-			raise RochipBootRomError("Invalid address. Can only be 471 or 472")
+	def write_blob(self, blob: bytes, code: int) -> bool:
+		if code != 0x471 and code != 0x472:
+			raise RochipBootRomError("Invalid code value. Can only be 0x471 or 0x472")
 		crc = Crc16Ibm3740()
 		total_written = 0
 		crc_sent = False
@@ -67,14 +68,14 @@ def write_blob(self, blob: bytes, addr: int) -> bool:
 				chunk.append(crcbytes >> 8)
 				chunk.append(crcbytes & 0xff)
 				crc_sent = True
-			written = self.__write_chunk(addr, chunk)
+			written = self.__write_chunk(code, chunk)
 			ret = written == len(chunk)
 			if ret is False:
 				return ret
 			total_written += written
 			if chunk_len+2 == 4096:
 				chunk = [0x00]
-				written = self.__write_chunk(addr, chunk)
+				written = self.__write_chunk(code, chunk)
 				ret = written == len(chunk)
 				if ret is False:
 					return ret
@@ -83,7 +84,7 @@ def write_blob(self, blob: bytes, addr: int) -> bool:
 			crcbytes = crc.final()
 			chunk.append(crcbytes >> 8)
 			chunk.append(crcbytes & 0xff)
-			written = self.__write_chunk(addr, chunk)
+			written = self.__write_chunk(code, chunk)
 			ret = written == len(chunk)
 			if ret is False:
 				return ret