Re: [PATCH v2 15/16] ARM: tegra30: implement BCT patching

Hi Svyatoslav,

On Thu, 2 Feb 2023 at 11:23, Svyatoslav Ryhel clamor95@gmail.com wrote:

From: Ramin Khonsari raminterex@yahoo.com

This function allows updating bootloader from u-boot on production devices without need in host PC.

Be aware! It works only with re-crypted BCT.

Tested-by: Andreas Westman Dorcsak hedmoo@yahoo.com # ASUS TF T30 Tested-by: Svyatoslav Ryhel clamor95@gmail.com # LG P895 T30 Signed-off-by: Ramin Khonsari raminterex@yahoo.com Signed-off-by: Svyatoslav Ryhel clamor95@gmail.com

---

arch/arm/mach-tegra/Kconfig | 10 ++++ arch/arm/mach-tegra/tegra30/Makefile | 1 + arch/arm/mach-tegra/tegra30/bct.c | 78 ++++++++++++++++++++++++++++ arch/arm/mach-tegra/tegra30/bct.h | 42 +++++++++++++++ 4 files changed, 131 insertions(+) create mode 100644 arch/arm/mach-tegra/tegra30/bct.c create mode 100644 arch/arm/mach-tegra/tegra30/bct.h

Please add something to doc/ about this.

diff --git a/arch/arm/mach-tegra/Kconfig b/arch/arm/mach-tegra/Kconfig index 5b0cd92d9e..922e57726f 100644 --- a/arch/arm/mach-tegra/Kconfig +++ b/arch/arm/mach-tegra/Kconfig @@ -229,4 +229,14 @@ config CMD_ENTERRCM for mechanical button actuators, or hooking up relays/... to the button.

+config CMD_EBTUPDATE

•   bool "Enable 'ebtupdate' command"
  

•   depends on TEGRA30
  

•   select TEGRA_CRYPTO
  

•   default n
  

That is always the default so you can drop this line

•   help
  

•     Updating u-boot from within u-boot in rather complex or even
  

•     impossible on production devices. To make it easier procedure of
  

•     re-cryption was created. If your device was re-crypted choose Y.
  

endif diff --git a/arch/arm/mach-tegra/tegra30/Makefile b/arch/arm/mach-tegra/tegra30/Makefile index 9f170576e7..28dd486d8d 100644 --- a/arch/arm/mach-tegra/tegra30/Makefile +++ b/arch/arm/mach-tegra/tegra30/Makefile @@ -3,5 +3,6 @@ # Copyright (c) 2010-2012, NVIDIA CORPORATION. All rights reserved.

obj-$(CONFIG_SPL_BUILD) += cpu.o +obj-$(CONFIG_$(SPL_)CMD_EBTUPDATE) += bct.o

obj-y += clock.o funcmux.o pinmux.o diff --git a/arch/arm/mach-tegra/tegra30/bct.c b/arch/arm/mach-tegra/tegra30/bct.c new file mode 100644 index 0000000000..c26338e263 --- /dev/null +++ b/arch/arm/mach-tegra/tegra30/bct.c @@ -0,0 +1,78 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/*

• • Copyright (c) 2022, Ramin raminterex@yahoo.com
• • Copyright (c) 2022, Svyatoslav Ryhel clamor95@gmail.com
• */

+#include <common.h> +#include <command.h> +#include <log.h> +#include <asm/arch-tegra/crypto.h> +#include "bct.h" +#include "uboot_aes.h"

+/*

• • \param bct boot config table start in RAM
• • \param ect bootloader start in RAM
• • \param ebt_size bootloader file size in bytes

Returns ?

• */

+static int bct_patch(u8 *bct, u8 *ebt, u32 ebt_size) +{

•   struct nvboot_config_table *bct_tbl = NULL;
  

•   u8 ebt_hash[AES128_KEY_LENGTH] = { 0 };
  

•   u8 sbk[AES128_KEY_LENGTH] = { 0 };
  

•   u8 *bct_hash = bct;
  

•   int ret;
  

•   bct += BCT_HASH;
  

•   memcpy(sbk, (u8 *)(bct + BCT_LENGTH),
  

•          NVBOOT_CMAC_AES_HASH_LENGTH * 4);
  

•   ret = decrypt_data_block(bct, BCT_LENGTH, sbk);
  

•   if (ret)
  

•           return 1;
  

•   ebt_size = roundup(ebt_size, EBT_ALIGNMENT);
  

•   ret = encrypt_data_block(ebt, ebt_size, sbk);
  

•   if (ret)
  

•           return 1;
  

•   ret = sign_enc_data_block(ebt, ebt_size, ebt_hash, sbk);
  

•   if (ret)
  

•           return 1;
  

•   bct_tbl = (struct nvboot_config_table *)bct;
  

•   memcpy((u8 *)&bct_tbl->bootloader[0].crypto_hash,
  

•          ebt_hash, NVBOOT_CMAC_AES_HASH_LENGTH * 4);
  

•   bct_tbl->bootloader[0].entry_point = CONFIG_SPL_TEXT_BASE;
  

•   bct_tbl->bootloader[0].load_addr = CONFIG_SPL_TEXT_BASE;
  

•   bct_tbl->bootloader[0].length = ebt_size;
  

•   ret = encrypt_data_block(bct, BCT_LENGTH, sbk);
  

•   if (ret)
  

•           return 1;
  

•   ret = sign_enc_data_block(bct, BCT_LENGTH, bct_hash, sbk);
  

•   if (ret)
  

•           return 1;
  

•   return 0;
  

+}

+static int do_ebtupdate(struct cmd_tbl *cmdtp, int flag, int argc,

•                   char *const argv[])
  

+{

•   u32 bct_addr = hextoul(argv[1], NULL);
  

•   u32 ebt_addr = hextoul(argv[2], NULL);
  

•   u32 ebt_size = hextoul(argv[3], NULL);
  

•   return bct_patch((u8 *)bct_addr, (u8 *)ebt_addr, ebt_size);
  

+}

+U_BOOT_CMD(ebtupdate, 4, 0, do_ebtupdate,

•      "update bootloader on re-crypted Tegra30 devices",
  

•      ""
  

Please add doc/usage/cmd file

+); diff --git a/arch/arm/mach-tegra/tegra30/bct.h b/arch/arm/mach-tegra/tegra30/bct.h new file mode 100644 index 0000000000..9797384da3 --- /dev/null +++ b/arch/arm/mach-tegra/tegra30/bct.h @@ -0,0 +1,42 @@ +/* SPDX-License-Identifier: GPL-2.0+ */

+#ifndef _BCT_H_ +#define _BCT_H_

+/*

• • Defines the BCT parametres for T30
• */

+#define BCT_LENGTH 0x17E0 +#define BCT_HASH 0x10 +#define EBT_ALIGNMENT 0x10

+/*

• • Defines the CMAC-AES-128 hash length in 32 bit words. (128 bits = 4 words)
• */

+#define NVBOOT_CMAC_AES_HASH_LENGTH 4

+/*

• • Defines the maximum number of bootloader descriptions in the BCT.
• */

+#define NVBOOT_MAX_BOOTLOADERS 4

+struct nv_bootloader_info {

•   u32 version;
  

•   u32 start_blk;
  

•   u32 start_page;
  

•   u32 length;
  

•   u32 load_addr;
  

•   u32 entry_point;
  

•   u32 attribute;
  

•   u32 crypto_hash[NVBOOT_CMAC_AES_HASH_LENGTH];
  

+};

+struct nvboot_config_table {

•   u32 unused0[4];
  

•   u32 boot_data_version;
  

•   u32 unused1[972];
  

•   struct nv_bootloader_info bootloader[NVBOOT_MAX_BOOTLOADERS];
  

•   u32 unused2[508];
  

+};

+#endif /* _BCT_H_ */

2.37.2

Regards, Simon