diff options
Diffstat (limited to 'arch/arm/mach-tegra/tegra20')
| -rw-r--r-- | arch/arm/mach-tegra/tegra20/Kconfig | 1 | ||||
| -rw-r--r-- | arch/arm/mach-tegra/tegra20/Makefile | 7 | ||||
| -rw-r--r-- | arch/arm/mach-tegra/tegra20/bct.c | 79 | ||||
| -rw-r--r-- | arch/arm/mach-tegra/tegra20/bct.h | 42 | ||||
| -rw-r--r-- | arch/arm/mach-tegra/tegra20/clock.c | 43 | ||||
| -rw-r--r-- | arch/arm/mach-tegra/tegra20/crypto.c | 143 | ||||
| -rw-r--r-- | arch/arm/mach-tegra/tegra20/crypto.h | 19 |
7 files changed, 165 insertions, 169 deletions
diff --git a/arch/arm/mach-tegra/tegra20/Kconfig b/arch/arm/mach-tegra/tegra20/Kconfig index 955786c0c4..57d11024bf 100644 --- a/arch/arm/mach-tegra/tegra20/Kconfig +++ b/arch/arm/mach-tegra/tegra20/Kconfig @@ -3,6 +3,7 @@ if TEGRA20 config TEGRA_LP0 bool select TEGRA_CLOCK_SCALING + select TEGRA_CRYPTO config TEGRA_PMU bool diff --git a/arch/arm/mach-tegra/tegra20/Makefile b/arch/arm/mach-tegra/tegra20/Makefile index bb17c90cca..991cabeec5 100644 --- a/arch/arm/mach-tegra/tegra20/Makefile +++ b/arch/arm/mach-tegra/tegra20/Makefile @@ -2,9 +2,8 @@ # # (C) Copyright 2010,2011 Nvidia Corporation. -ifdef CONFIG_SPL_BUILD -obj-y += cpu.o -endif +obj-$(CONFIG_SPL_BUILD) += cpu.o +obj-$(CONFIG_$(SPL_)CMD_EBTUPDATE) += bct.o # The AVP is ARMv4T architecture so we must use special compiler # flags for any startup files it might use. @@ -13,6 +12,6 @@ CFLAGS_warmboot_avp.o = -march=armv4t -U__LINUX_ARM_ARCH__ \ CFLAGS_REMOVE_warmboot_avp.o := $(LTO_CFLAGS) obj-y += clock.o funcmux.o pinmux.o -obj-$(CONFIG_TEGRA_LP0) += warmboot.o crypto.o warmboot_avp.o +obj-$(CONFIG_TEGRA_LP0) += warmboot.o warmboot_avp.o obj-$(CONFIG_TEGRA_CLOCK_SCALING) += emc.o obj-$(CONFIG_TEGRA_PMU) += pmu.o diff --git a/arch/arm/mach-tegra/tegra20/bct.c b/arch/arm/mach-tegra/tegra20/bct.c new file mode 100644 index 0000000000..5eb48990b6 --- /dev/null +++ b/arch/arm/mach-tegra/tegra20/bct.c @@ -0,0 +1,79 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Copyright (c) 2022, Ramin <raminterex@yahoo.com> + * Copyright (c) 2022, Svyatoslav Ryhel <clamor95@gmail.com> + */ + +#include <common.h> +#include <command.h> +#include <log.h> +#include <asm/arch-tegra/crypto.h> +#include "bct.h" +#include "uboot_aes.h" + +/* + * @param bct boot config table start in RAM + * @param ect bootloader start in RAM + * @param ebt_size bootloader file size in bytes + * Return: 0, or 1 if failed + */ +static int bct_patch(u8 *bct, u8 *ebt, u32 ebt_size) +{ + struct nvboot_config_table *bct_tbl = NULL; + u8 ebt_hash[AES128_KEY_LENGTH] = { 0 }; + u8 sbk[AES128_KEY_LENGTH] = { 0 }; + u8 *bct_hash = bct; + int ret; + + bct += BCT_HASH; + + memcpy(sbk, (u8 *)(bct + BCT_LENGTH), + NVBOOT_CMAC_AES_HASH_LENGTH * 4); + + ret = decrypt_data_block(bct, BCT_LENGTH, sbk); + if (ret) + return 1; + + ebt_size = roundup(ebt_size, EBT_ALIGNMENT); + + ret = encrypt_data_block(ebt, ebt_size, sbk); + if (ret) + return 1; + + ret = sign_enc_data_block(ebt, ebt_size, ebt_hash, sbk); + if (ret) + return 1; + + bct_tbl = (struct nvboot_config_table *)bct; + + memcpy((u8 *)&bct_tbl->bootloader[0].crypto_hash, + ebt_hash, NVBOOT_CMAC_AES_HASH_LENGTH * 4); + bct_tbl->bootloader[0].entry_point = CONFIG_SPL_TEXT_BASE; + bct_tbl->bootloader[0].load_addr = CONFIG_SPL_TEXT_BASE; + bct_tbl->bootloader[0].length = ebt_size; + + ret = encrypt_data_block(bct, BCT_LENGTH, sbk); + if (ret) + return 1; + + ret = sign_enc_data_block(bct, BCT_LENGTH, bct_hash, sbk); + if (ret) + return 1; + + return 0; +} + +static int do_ebtupdate(struct cmd_tbl *cmdtp, int flag, int argc, + char *const argv[]) +{ + u32 bct_addr = hextoul(argv[1], NULL); + u32 ebt_addr = hextoul(argv[2], NULL); + u32 ebt_size = hextoul(argv[3], NULL); + + return bct_patch((u8 *)bct_addr, (u8 *)ebt_addr, ebt_size); +} + +U_BOOT_CMD(ebtupdate, 4, 0, do_ebtupdate, + "update bootloader on re-crypted Tegra20 devices", + "" +); diff --git a/arch/arm/mach-tegra/tegra20/bct.h b/arch/arm/mach-tegra/tegra20/bct.h new file mode 100644 index 0000000000..4b78aef7cf --- /dev/null +++ b/arch/arm/mach-tegra/tegra20/bct.h @@ -0,0 +1,42 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ + +#ifndef _BCT_H_ +#define _BCT_H_ + +/* + * Defines the BCT parametres for T20 + */ +#define BCT_LENGTH 0xFE0 +#define BCT_HASH 0x10 +#define EBT_ALIGNMENT 0x10 + +/* + * Defines the CMAC-AES-128 hash length in 32 bit words. (128 bits = 4 words) + */ +#define NVBOOT_CMAC_AES_HASH_LENGTH 4 + +/* + * Defines the maximum number of bootloader descriptions in the BCT. + */ +#define NVBOOT_MAX_BOOTLOADERS 4 + +struct nv_bootloader_info { + u32 version; + u32 start_blk; + u32 start_page; + u32 length; + u32 load_addr; + u32 entry_point; + u32 attribute; + u32 crypto_hash[NVBOOT_CMAC_AES_HASH_LENGTH]; +}; + +struct nvboot_config_table { + u32 unused0[4]; + u32 boot_data_version; + u32 unused1[668]; + struct nv_bootloader_info bootloader[NVBOOT_MAX_BOOTLOADERS]; + u32 unused2[508]; +}; + +#endif /* _BCT_H_ */ diff --git a/arch/arm/mach-tegra/tegra20/clock.c b/arch/arm/mach-tegra/tegra20/clock.c index 8c127430aa..067a9f1a2f 100644 --- a/arch/arm/mach-tegra/tegra20/clock.c +++ b/arch/arm/mach-tegra/tegra20/clock.c @@ -20,6 +20,8 @@ #include <fdtdec.h> #include <linux/delay.h> +#include <dt-bindings/clock/tegra20-car.h> + /* * Clock types that we can use as a source. The Tegra20 has muxes for the * peripheral clocks, and in most cases there are four options for the clock @@ -578,6 +580,41 @@ enum periph_id clk_id_to_periph_id(int clk_id) return clk_id; } } + +/* + * Convert a device tree clock ID to our PLL ID. + * + * @param clk_id Clock ID according to tegra20 device tree binding + * Return: clock ID, or CLOCK_ID_NONE if the clock ID is invalid + */ +enum clock_id clk_id_to_pll_id(int clk_id) +{ + switch (clk_id) { + case TEGRA20_CLK_PLL_C: + return CLOCK_ID_CGENERAL; + case TEGRA20_CLK_PLL_M: + return CLOCK_ID_MEMORY; + case TEGRA20_CLK_PLL_P: + return CLOCK_ID_PERIPH; + case TEGRA20_CLK_PLL_A: + return CLOCK_ID_AUDIO; + case TEGRA20_CLK_PLL_U: + return CLOCK_ID_USB; + case TEGRA20_CLK_PLL_D: + case TEGRA20_CLK_PLL_D_OUT0: + return CLOCK_ID_DISPLAY; + case TEGRA20_CLK_PLL_X: + return CLOCK_ID_XCPU; + case TEGRA20_CLK_PLL_E: + return CLOCK_ID_EPCI; + case TEGRA20_CLK_CLK_32K: + return CLOCK_ID_32KHZ; + case TEGRA20_CLK_CLK_M: + return CLOCK_ID_CLK_M; + default: + return CLOCK_ID_NONE; + } +} #endif /* CONFIG_IS_ENABLED(OF_CONTROL) */ void clock_early_init(void) @@ -760,14 +797,14 @@ struct periph_clk_init periph_clk_init_table[] = { { PERIPH_ID_SBC2, CLOCK_ID_PERIPH }, { PERIPH_ID_SBC3, CLOCK_ID_PERIPH }, { PERIPH_ID_SBC4, CLOCK_ID_PERIPH }, - { PERIPH_ID_HOST1X, CLOCK_ID_PERIPH }, - { PERIPH_ID_DISP1, CLOCK_ID_CGENERAL }, + { PERIPH_ID_HOST1X, CLOCK_ID_CGENERAL }, + { PERIPH_ID_DISP1, CLOCK_ID_PERIPH }, { PERIPH_ID_NDFLASH, CLOCK_ID_PERIPH }, { PERIPH_ID_SDMMC1, CLOCK_ID_PERIPH }, { PERIPH_ID_SDMMC2, CLOCK_ID_PERIPH }, { PERIPH_ID_SDMMC3, CLOCK_ID_PERIPH }, { PERIPH_ID_SDMMC4, CLOCK_ID_PERIPH }, - { PERIPH_ID_PWM, CLOCK_ID_SFROM32KHZ }, + { PERIPH_ID_PWM, CLOCK_ID_PERIPH }, { PERIPH_ID_DVC_I2C, CLOCK_ID_PERIPH }, { PERIPH_ID_I2C1, CLOCK_ID_PERIPH }, { PERIPH_ID_I2C2, CLOCK_ID_PERIPH }, diff --git a/arch/arm/mach-tegra/tegra20/crypto.c b/arch/arm/mach-tegra/tegra20/crypto.c deleted file mode 100644 index 1efaa5c3ec..0000000000 --- a/arch/arm/mach-tegra/tegra20/crypto.c +++ /dev/null @@ -1,143 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0+ -/* - * Copyright (c) 2011 The Chromium OS Authors. - * (C) Copyright 2010 - 2011 NVIDIA Corporation <www.nvidia.com> - */ - -#include <common.h> -#include <log.h> -#include <linux/errno.h> -#include "crypto.h" -#include "uboot_aes.h" - -static u8 zero_key[16]; - -#define AES_CMAC_CONST_RB 0x87 /* from RFC 4493, Figure 2.2 */ - -enum security_op { - SECURITY_SIGN = 1 << 0, /* Sign the data */ - SECURITY_ENCRYPT = 1 << 1, /* Encrypt the data */ -}; - -/** - * Shift a vector left by one bit - * - * \param in Input vector - * \param out Output vector - * \param size Length of vector in bytes - */ -static void left_shift_vector(u8 *in, u8 *out, int size) -{ - int carry = 0; - int i; - - for (i = size - 1; i >= 0; i--) { - out[i] = (in[i] << 1) | carry; - carry = in[i] >> 7; /* get most significant bit */ - } -} - -/** - * Sign a block of data, putting the result into dst. - * - * \param key Input AES key, length AES128_KEY_LENGTH - * \param key_schedule Expanded key to use - * \param src Source data of length 'num_aes_blocks' blocks - * \param dst Destination buffer, length AES128_KEY_LENGTH - * \param num_aes_blocks Number of AES blocks to encrypt - */ -static void sign_object(u8 *key, u8 *key_schedule, u8 *src, u8 *dst, - u32 num_aes_blocks) -{ - u8 tmp_data[AES128_KEY_LENGTH]; - u8 iv[AES128_KEY_LENGTH] = {0}; - u8 left[AES128_KEY_LENGTH]; - u8 k1[AES128_KEY_LENGTH]; - u8 *cbc_chain_data; - unsigned i; - - cbc_chain_data = zero_key; /* Convenient array of 0's for IV */ - - /* compute K1 constant needed by AES-CMAC calculation */ - for (i = 0; i < AES128_KEY_LENGTH; i++) - tmp_data[i] = 0; - - aes_cbc_encrypt_blocks(AES128_KEY_LENGTH, key_schedule, iv, - tmp_data, left, 1); - - left_shift_vector(left, k1, sizeof(left)); - - if ((left[0] >> 7) != 0) /* get MSB of L */ - k1[AES128_KEY_LENGTH - 1] ^= AES_CMAC_CONST_RB; - - /* compute the AES-CMAC value */ - for (i = 0; i < num_aes_blocks; i++) { - /* Apply the chain data */ - aes_apply_cbc_chain_data(cbc_chain_data, src, tmp_data); - - /* for the final block, XOR K1 into the IV */ - if (i == num_aes_blocks - 1) - aes_apply_cbc_chain_data(tmp_data, k1, tmp_data); - - /* encrypt the AES block */ - aes_encrypt(AES128_KEY_LENGTH, tmp_data, - key_schedule, dst); - - debug("sign_obj: block %d of %d\n", i, num_aes_blocks); - - /* Update pointers for next loop. */ - cbc_chain_data = dst; - src += AES128_KEY_LENGTH; - } -} - -/** - * Encrypt and sign a block of data (depending on security mode). - * - * \param key Input AES key, length AES128_KEY_LENGTH - * \param oper Security operations mask to perform (enum security_op) - * \param src Source data - * \param length Size of source data - * \param sig_dst Destination address for signature, AES128_KEY_LENGTH bytes - */ -static int encrypt_and_sign(u8 *key, enum security_op oper, u8 *src, - u32 length, u8 *sig_dst) -{ - u32 num_aes_blocks; - u8 key_schedule[AES128_EXPAND_KEY_LENGTH]; - u8 iv[AES128_KEY_LENGTH] = {0}; - - debug("encrypt_and_sign: length = %d\n", length); - - /* - * The only need for a key is for signing/checksum purposes, so - * if not encrypting, expand a key of 0s. - */ - aes_expand_key(oper & SECURITY_ENCRYPT ? key : zero_key, - AES128_KEY_LENGTH, key_schedule); - - num_aes_blocks = (length + AES128_KEY_LENGTH - 1) / AES128_KEY_LENGTH; - - if (oper & SECURITY_ENCRYPT) { - /* Perform this in place, resulting in src being encrypted. */ - debug("encrypt_and_sign: begin encryption\n"); - aes_cbc_encrypt_blocks(AES128_KEY_LENGTH, key_schedule, iv, src, - src, num_aes_blocks); - debug("encrypt_and_sign: end encryption\n"); - } - - if (oper & SECURITY_SIGN) { - /* encrypt the data, overwriting the result in signature. */ - debug("encrypt_and_sign: begin signing\n"); - sign_object(key, key_schedule, src, sig_dst, num_aes_blocks); - debug("encrypt_and_sign: end signing\n"); - } - - return 0; -} - -int sign_data_block(u8 *source, unsigned length, u8 *signature) -{ - return encrypt_and_sign(zero_key, SECURITY_SIGN, source, - length, signature); -} diff --git a/arch/arm/mach-tegra/tegra20/crypto.h b/arch/arm/mach-tegra/tegra20/crypto.h deleted file mode 100644 index a773d03fc7..0000000000 --- a/arch/arm/mach-tegra/tegra20/crypto.h +++ /dev/null @@ -1,19 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0+ */ -/* - * Copyright (c) 2011 The Chromium OS Authors. - * (C) Copyright 2010 - 2011 NVIDIA Corporation <www.nvidia.com> - */ - -#ifndef _CRYPTO_H_ -#define _CRYPTO_H_ - -/** - * Sign a block of data - * - * \param source Source data - * \param length Size of source data - * \param signature Destination address for signature, AES_KEY_LENGTH bytes - */ -int sign_data_block(u8 *source, unsigned length, u8 *signature); - -#endif /* #ifndef _CRYPTO_H_ */ |