[PATCH] scripts: rk-usb-loader: push header first

[PATCH] scripts: rk-usb-loader: push header first

[Sascha Hauer]

From: Michael Tretter <m.tretter@pengutronix.de>

Board that have secure boot enabled need the image header to be able
to verify the signature. Boards with secure boot disabled still work
with this patch as tested on a RK3588 board.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 scripts/rk-usb-loader.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/scripts/rk-usb-loader.c b/scripts/rk-usb-loader.c
index c9769d79d3..157bb5ad5c 100644
--- a/scripts/rk-usb-loader.c
+++ b/scripts/rk-usb-loader.c
@@ -256,6 +256,11 @@ static int upload_image(const char *filename)
 		goto err;
 	}
 
+	log_info("Uploading header\n");
+	ret = upload(dev, 0x471, hdr, sizeof(*hdr));
+	if (ret)
+		goto err;
+
 	for (i = 0; i < n_files; i++) {
 		struct newidb_entry *entry = &hdr->entries[i];
 		int foffset, fsize, wIndex;
-- 
2.47.3

Re: [PATCH] scripts: rk-usb-loader: push header first

[Michael Tretter]

On Wed, 11 Mar 2026 11:03:47 +0100, Sascha Hauer wrote:
> From: Michael Tretter <m.tretter@pengutronix.de>
> 
> Board that have secure boot enabled need the image header to be able
> to verify the signature. Boards with secure boot disabled still work
> with this patch as tested on a RK3588 board.

I'm not against adding this to the rk-usb-loader, but maybe add some
comment that this change is based on a wild guess and works by chance. I
still don't know, how the ROM code or the USB protocol works and if it
is really correct or necessary to send the entire header.

Michael

> 
> Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> ---
>  scripts/rk-usb-loader.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/scripts/rk-usb-loader.c b/scripts/rk-usb-loader.c
> index c9769d79d3..157bb5ad5c 100644
> --- a/scripts/rk-usb-loader.c
> +++ b/scripts/rk-usb-loader.c
> @@ -256,6 +256,11 @@ static int upload_image(const char *filename)
>  		goto err;
>  	}
>  
> +	log_info("Uploading header\n");
> +	ret = upload(dev, 0x471, hdr, sizeof(*hdr));
> +	if (ret)
> +		goto err;
> +
>  	for (i = 0; i < n_files; i++) {
>  		struct newidb_entry *entry = &hdr->entries[i];
>  		int foffset, fsize, wIndex;
> -- 
> 2.47.3
> 
> 

Re: [PATCH] scripts: rk-usb-loader: push header first

[Robin van der Gracht]

Hi Michael,

On 3/11/26 11:13, Michael Tretter wrote:
> On Wed, 11 Mar 2026 11:03:47 +0100, Sascha Hauer wrote:
>> From: Michael Tretter <m.tretter@pengutronix.de>
>>
>> Board that have secure boot enabled need the image header to be able
>> to verify the signature. Boards with secure boot disabled still work
>> with this patch as tested on a RK3588 board.
> I'm not against adding this to the rk-usb-loader, but maybe add some
> comment that this change is based on a wild guess and works by chance. I
> still don't know, how the ROM code or the USB protocol works and if it
> is really correct or necessary to send the entire header.
Right, add it to the list ;)

I already have this change to my repo so I think its great that this 
gets mainlined.

Tested-By: Robin van der Gracht <robin.van.der.gracht@protonic.nl>

- Robin

Re: [PATCH] scripts: rk-usb-loader: push header first

[Sascha Hauer]

On Wed, Mar 11, 2026 at 11:13:47AM +0100, Michael Tretter wrote:
> On Wed, 11 Mar 2026 11:03:47 +0100, Sascha Hauer wrote:
> > From: Michael Tretter <m.tretter@pengutronix.de>
> > 
> > Board that have secure boot enabled need the image header to be able
> > to verify the signature. Boards with secure boot disabled still work
> > with this patch as tested on a RK3588 board.
> 
> I'm not against adding this to the rk-usb-loader, but maybe add some
> comment that this change is based on a wild guess and works by chance. I
> still don't know, how the ROM code or the USB protocol works and if it
> is really correct or necessary to send the entire header.

I can add a comment. FWIW I found another project [1] for a rk-usb-loader
which does exactly the same.

[1] https://github.com/DualTachyon/rk3588-tools/blob/main/rk-usb.c#L117

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

Re: [PATCH] scripts: rk-usb-loader: push header first

[Sascha Hauer]

On Wed, 11 Mar 2026 11:03:47 +0100, Sascha Hauer wrote:
> Board that have secure boot enabled need the image header to be able
> to verify the signature. Boards with secure boot disabled still work
> with this patch as tested on a RK3588 board.
> 
> 

Applied, thanks!

[1/1] scripts: rk-usb-loader: push header first
      https://git.pengutronix.de/cgit/barebox/commit/?id=4cc52dda164b (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>