ARM: tegra30: implement BCT patching

This function allows updating bootloader from u-boot
on production devices without need in host PC.

Be aware! It works only with re-crypted BCT.

Tested-by: Andreas Westman Dorcsak <hedmoo@yahoo.com> # ASUS TF T30
Tested-by: Svyatoslav Ryhel <clamor95@gmail.com> # LG P895 T30
Signed-off-by: Ramin Khonsari <raminterex@yahoo.com>
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Signed-off-by: Tom <twarren@nvidia.com>

4 files changed, 131 insertions, 0 deletions

diff --git a/arch/arm/mach-tegra/Kconfig b/arch/arm/mach-tegra/Kconfig
index 5b0cd92d9e6..8490d42a7b3 100644
--- a/arch/arm/mach-tegra/Kconfig
+++ b/arch/arm/mach-tegra/Kconfig
@@ -229,4 +229,13 @@ config CMD_ENTERRCM
 	  for mechanical button actuators, or hooking up relays/... to the
 	  button.
 
+config CMD_EBTUPDATE
+	bool "Enable 'ebtupdate' command"
+	depends on TEGRA30
+	select TEGRA_CRYPTO
+	help
+	  Updating u-boot from within u-boot in rather complex or even
+	  impossible on production devices. To make it easier procedure of
+	  re-cryption was created. If your device was re-crypted choose Y.
+
 endif
diff --git a/arch/arm/mach-tegra/tegra30/Makefile b/arch/arm/mach-tegra/tegra30/Makefile
index 9f170576e7c..28dd486d8dd 100644
--- a/arch/arm/mach-tegra/tegra30/Makefile
+++ b/arch/arm/mach-tegra/tegra30/Makefile
@@ -3,5 +3,6 @@
 # Copyright (c) 2010-2012, NVIDIA CORPORATION.  All rights reserved.
 
 obj-$(CONFIG_SPL_BUILD) += cpu.o
+obj-$(CONFIG_$(SPL_)CMD_EBTUPDATE) += bct.o
 
 obj-y	+= clock.o funcmux.o pinmux.o
diff --git a/arch/arm/mach-tegra/tegra30/bct.c b/arch/arm/mach-tegra/tegra30/bct.c
new file mode 100644
index 00000000000..c56958da691
--- /dev/null
+++ b/arch/arm/mach-tegra/tegra30/bct.c
@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2022, Ramin <raminterex@yahoo.com>
+ * Copyright (c) 2022, Svyatoslav Ryhel <clamor95@gmail.com>
+ */
+
+#include <common.h>
+#include <command.h>
+#include <log.h>
+#include <asm/arch-tegra/crypto.h>
+#include "bct.h"
+#include "uboot_aes.h"
+
+/*
+ * @param  bct		boot config table start in RAM
+ * @param  ect		bootloader start in RAM
+ * @param  ebt_size	bootloader file size in bytes
+ * Return: 0, or 1 if failed
+ */
+static int bct_patch(u8 *bct, u8 *ebt, u32 ebt_size)
+{
+	struct nvboot_config_table *bct_tbl = NULL;
+	u8 ebt_hash[AES128_KEY_LENGTH] = { 0 };
+	u8 sbk[AES128_KEY_LENGTH] = { 0 };
+	u8 *bct_hash = bct;
+	int ret;
+
+	bct += BCT_HASH;
+
+	memcpy(sbk, (u8 *)(bct + BCT_LENGTH),
+	       NVBOOT_CMAC_AES_HASH_LENGTH * 4);
+
+	ret = decrypt_data_block(bct, BCT_LENGTH, sbk);
+	if (ret)
+		return 1;
+
+	ebt_size = roundup(ebt_size, EBT_ALIGNMENT);
+
+	ret = encrypt_data_block(ebt, ebt_size, sbk);
+	if (ret)
+		return 1;
+
+	ret = sign_enc_data_block(ebt, ebt_size, ebt_hash, sbk);
+	if (ret)
+		return 1;
+
+	bct_tbl = (struct nvboot_config_table *)bct;
+
+	memcpy((u8 *)&bct_tbl->bootloader[0].crypto_hash,
+	       ebt_hash, NVBOOT_CMAC_AES_HASH_LENGTH * 4);
+	bct_tbl->bootloader[0].entry_point = CONFIG_SPL_TEXT_BASE;
+	bct_tbl->bootloader[0].load_addr = CONFIG_SPL_TEXT_BASE;
+	bct_tbl->bootloader[0].length = ebt_size;
+
+	ret = encrypt_data_block(bct, BCT_LENGTH, sbk);
+	if (ret)
+		return 1;
+
+	ret = sign_enc_data_block(bct, BCT_LENGTH, bct_hash, sbk);
+	if (ret)
+		return 1;
+
+	return 0;
+}
+
+static int do_ebtupdate(struct cmd_tbl *cmdtp, int flag, int argc,
+			char *const argv[])
+{
+	u32 bct_addr = hextoul(argv[1], NULL);
+	u32 ebt_addr = hextoul(argv[2], NULL);
+	u32 ebt_size = hextoul(argv[3], NULL);
+
+	return bct_patch((u8 *)bct_addr, (u8 *)ebt_addr, ebt_size);
+}
+
+U_BOOT_CMD(ebtupdate,	4,	0,	do_ebtupdate,
+	   "update bootloader on re-crypted Tegra30 devices",
+	   ""
+);
diff --git a/arch/arm/mach-tegra/tegra30/bct.h b/arch/arm/mach-tegra/tegra30/bct.h
new file mode 100644
index 00000000000..9797384da32
--- /dev/null
+++ b/arch/arm/mach-tegra/tegra30/bct.h
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+
+#ifndef _BCT_H_
+#define _BCT_H_
+
+/*
+ * Defines the BCT parametres for T30
+ */
+#define BCT_LENGTH		0x17E0
+#define BCT_HASH		0x10
+#define EBT_ALIGNMENT		0x10
+
+/*
+ * Defines the CMAC-AES-128 hash length in 32 bit words. (128 bits = 4 words)
+ */
+#define NVBOOT_CMAC_AES_HASH_LENGTH		4
+
+/*
+ * Defines the maximum number of bootloader descriptions in the BCT.
+ */
+#define NVBOOT_MAX_BOOTLOADERS			4
+
+struct nv_bootloader_info {
+	u32 version;
+	u32 start_blk;
+	u32 start_page;
+	u32 length;
+	u32 load_addr;
+	u32 entry_point;
+	u32 attribute;
+	u32 crypto_hash[NVBOOT_CMAC_AES_HASH_LENGTH];
+};
+
+struct nvboot_config_table {
+	u32 unused0[4];
+	u32 boot_data_version;
+	u32 unused1[972];
+	struct nv_bootloader_info bootloader[NVBOOT_MAX_BOOTLOADERS];
+	u32 unused2[508];
+};
+
+#endif /* _BCT_H_ */