[DNM, WIP] Implement VIP

Cargo.toml

@@ -1,3 +1,3 @@
 [workspace]
-members = ["cli", "qramdump", "qdl"]
+members = ["cli", "qdl", "qramdump", "qviptblgen"]
 resolver = "2"

cli/Cargo.toml

@@ -17,7 +17,7 @@ maintenance = { status = "actively-developed" }
 anyhow = "1.0.89"
 clap = { version = "4.5.18", features = ["derive"] }
 clap-num = "1.1.1"
-qdl = { path = "../qdl/", features = ["serial", "usb"] }
+qdl = { path = "../qdl/", features = ["serial", "usb", "vip"] }
 gptman = "1.1.2"
 indexmap = "2.5.0"
 owo-colors = "4.1.0"

cli/src/main.rs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: BSD-3-Clause
 // Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
-use anyhow::{Result, bail};
+use anyhow::{Context, Result, bail};
 use clap::{Parser, Subcommand};
 use clap_num::maybe_hex;
 use itertools::Itertools;
@@ -18,6 +18,7 @@ use util::{
 };
 
 use std::fs::{self, File};
+use std::io::Write;
 use std::{path::Path, str::FromStr};
 
 mod flasher;
@@ -164,6 +165,12 @@ struct Args {
     #[arg(long, default_value = "false")]
     verbose_firehose: bool,
 
+    #[arg(short = 'M')]
+    vip_mbn_path: Option<String>,
+
+    #[arg(short = 'T')]
+    vip_aux_tbl_path: Option<String>,
+
     #[command(subcommand)]
     command: Command,
 }
@@ -182,6 +189,25 @@ fn main() -> Result<()> {
         Err(e) => bail!("Couldn't open the programmer binary: {}", e.to_string()),
     };
 
+    let vip_mbn = match args.vip_mbn_path {
+        Some(p) => match fs::read(p) {
+            Ok(m) => Some(m),
+            Err(e) => bail!("Couldn't read the VIP MBN: {}", e.to_string()),
+        },
+        None => None,
+    };
+
+    let vip_aux = match args.vip_aux_tbl_path {
+        Some(p) => match fs::read(p) {
+            Ok(a) => a,
+            Err(e) => bail!(
+                "Couldn't read the VIP chained table file: {}",
+                e.to_string()
+            ),
+        },
+        None => vec![],
+    };
+
     println!(
         "{} {}",
         env!("CARGO_PKG_NAME").green(),
@@ -219,6 +245,8 @@ fn main() -> Result<()> {
             ..Default::default()
         },
         reset_on_drop: false,
+        vip_digest_table: vip_aux,
+        fh_packet_counter: 0,
     };
 
     // In case another program on the system has already consumed the HELLO packet,
@@ -265,6 +293,13 @@ fn main() -> Result<()> {
     // If we're past Sahara, activate the Firehose reset-on-drop listener
     qdl_dev.reset_on_drop = true;
 
+    // If VIP is used, the hash table must be sent first, even before <configure>
+    if let Some(vip_mbn) = vip_mbn {
+        qdl_dev
+            .write_all(&vip_mbn)
+            .with_context(|| "Couldn't load the VIP MBN")?;
+    }
+
     // Get any "welcome" logs
     firehose_read(&mut qdl_dev, firehose_parser_ack_nak)?;
 

qdl/Cargo.toml

@@ -8,7 +8,7 @@ license = "BSD-3-Clause"
 readme = "README.md"
 repository = "https://github.com/qualcomm/qdlrs"
 categories = ["embedded"]
-publish = false # TODO
+publish = false                                  # TODO
 
 [badges]
 maintenance = { status = "actively-developed" }
@@ -28,8 +28,10 @@ rusb = { version = "0.9.4", optional = true }
 serde = { version = "1.0.210", features = ["derive"] }
 serde_repr = "0.1.19"
 serial2 = { version = "0.2.28", optional = true }
+sha2 = { version = "0.10.9", optional = true }
 xmltree = { version = "0.11.0", features = ["attribute-order"] }
 
 [features]
 serial = ["dep:serial2"]
 usb = ["dep:rusb"]
+vip = ["dep:sha2"]

qdl/src/lib.rs

@@ -29,6 +29,8 @@ pub mod serial;
 pub mod types;
 #[cfg(feature = "usb")]
 pub mod usb;
+#[cfg(feature = "vip")]
+pub mod vip;
 
 pub fn setup_target_device(
     backend: QdlBackend,
@@ -48,7 +50,7 @@ pub fn setup_target_device(
 }
 
 /// Wrapper for easily creating Firehose-y XML packets
-fn firehose_xml_setup(op: &str, kvps: &[(&str, &str)]) -> anyhow::Result<Vec<u8>> {
+pub fn firehose_xml_setup(op: &str, kvps: &[(&str, &str)]) -> anyhow::Result<Vec<u8>> {
     let mut xml = Element::new("data");
     let mut op_node = Element::new(op);
     for kvp in kvps.iter() {
@@ -233,7 +235,7 @@ pub fn firehose_configure<T: Read + Write + QdlChan>(
             ("MemoryName", &config.storage_type.to_string()),
             ("AlwaysValidate", &(config.hash_packets as u32).to_string()),
             ("Verbose", &(config.verbose_firehose as u32).to_string()),
-            ("MaxDigestTableSizeInBytes", "8192"), // TODO: (low prio)
+            ("MaxDigestTableSizeInBytes", "8192"),
             (
                 "MaxPayloadSizeToTargetInBytes",
                 &config.send_buffer_size.to_string(),

qdl/src/types.rs

@@ -8,6 +8,7 @@ use std::{
 
 use anyhow::{Error, bail};
 use owo_colors::OwoColorize;
+use sha2::Digest;
 
 use crate::firehose_reset;
 
@@ -96,6 +97,8 @@ pub trait QdlReadWrite: Read + Write {}
 pub struct QdlDevice<'a> {
     pub rw: &'a mut dyn QdlReadWrite,
     pub fh_cfg: FirehoseConfiguration,
+    pub vip_digest_table: Vec<u8>,
+    pub fh_packet_counter: usize,
     pub reset_on_drop: bool,
 }
 
@@ -107,7 +110,13 @@ impl Read for QdlDevice<'_> {
 
 impl Write for QdlDevice<'_> {
     fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
-        self.rw.write(buf)
+        let ret = self.rw.write(buf);
+        if ret.is_ok() {
+            self.fh_packet_counter += 1;
+            self.write_next_hash()?;
+        }
+
+        ret
     }
 
     fn flush(&mut self) -> std::io::Result<()> {
@@ -125,6 +134,26 @@ impl QdlChan for QdlDevice<'_> {
     }
 }
 
+impl QdlDevice<'_> {
+    fn write_next_hash(&mut self) -> std::io::Result<usize> {
+        // Hashes 0..53 come from the MBN image
+        if self.fh_packet_counter >= 54 && !self.vip_digest_table.is_empty() {
+            let buf = match self
+                .vip_digest_table
+                .chunks(sha2::Sha256::output_size())
+                .nth(self.fh_packet_counter - 54)
+            {
+                Some(b) => Ok(b),
+                None => Err(std::io::Error::other("Faulty VIP chained table!")),
+            }?;
+
+            return self.rw.write(buf);
+        }
+
+        Ok(0)
+    }
+}
+
 impl Drop for QdlDevice<'_> {
     fn drop(&mut self) {
         // Avoid having the board be stuck in EDL limbo in case of errors