Flashing » History » Version 4
tsaitgaist, 10/13/2017 05:22 PM
add how to flash operator files
1 | 1 | tsaitgaist | h1. Flashing |
---|---|---|---|
2 | |||
3 | There are several way to flash partitions (e.g. updating) manually: |
||
4 | * using @/usr/sbin/ubiupdatevol@: |
||
5 | <pre> |
||
6 | ubiupdatevol version 1.2 - a tool to write data to UBI volumes. |
||
7 | |||
8 | Usage: ubiupdatevol <UBI volume node file name> [-t] [-s <size>] [-h] [-V] [--truncate] |
||
9 | [--size=<size>] [--help] [--version] <image file> |
||
10 | |||
11 | Example 1: ubiupdatevol /dev/ubi0_1 fs.img - write file "fs.img" to UBI volume /dev/ubi0_1 |
||
12 | Example 2: ubiupdatevol /dev/ubi0_1 -t - wipe out UBI volume /dev/ubi0_1 |
||
13 | |||
14 | -t, --truncate truncate volume (wipe it out) |
||
15 | -s, --size=<bytes> bytes in input, if not reading from file |
||
16 | -h, --help print help message |
||
17 | -V, --version print program version |
||
18 | </pre> |
||
19 | * using @/APP/dev_only/swupd.sh@ |
||
20 | <pre> |
||
21 | swupd.sh - update flash partitions on the target |
||
22 | |||
23 | Easy mode: |
||
24 | using NFS: swupd.sh -i<IP> -p<PATH> |
||
25 | where: |
||
26 | <IP> = IP address of your VM (defaults to 192.168.16.18) |
||
27 | <PATH> = path of NFS directory (defaults to /home/femto/ftpdata) |
||
28 | |||
29 | using wget: swupd.sh -w<URL> |
||
30 | where: |
||
31 | <URL> = URL to fetch images from (e.g. ftp://user:pass@host/path) |
||
32 | |||
33 | Expert mode: (stay away from them!) |
||
34 | -k update kernel |
||
35 | -r update root fs |
||
36 | -a update application partition |
||
37 | -u update unitdata partition |
||
38 | -c update caldata partition |
||
39 | -x toggle banks |
||
40 | -z don't reboot after successful update |
||
41 | |||
42 | -o<str> Pass option string <str> to wget |
||
43 | </pre> |
||
44 | |||
45 | 2 | tsaitgaist | @/etc/init.d/flash_update@ takes care of flashing all partitions at once (also done during boot in @/etc/init.d/rcS@). |
46 | 1 | tsaitgaist | |
47 | Lastly the operator can also flash images remotely through @/APP/bin/oam_start@. |
||
48 | 2 | tsaitgaist | |
49 | h1. Secure boot |
||
50 | |||
51 | h2. System |
||
52 | |||
53 | The partition signatures (kernel, rootfs, data) are stored in @/dev/mtdblock2/bootdata.ini@ (the only file in the @bootdata@ partition). |
||
54 | While @bootdata@ is not signed itself, it only contains the signatures. |
||
55 | You can also see the content using @/APP/dev_only/cat_bootdata.sh@ |
||
56 | The corresponding public key seems to be burned in the OTP section of the CPU, providing secure boot (this has not been verified). |
||
57 | 1 | tsaitgaist | |
58 | @bootdata.ini@ also defines which system will be booted (A or B). |
||
59 | The file is updated using @/APP/dev_only/write_bootdata.sh@ |
||
60 | 3 | tsaitgaist | |
61 | For the [[Bootlog]] the femtocell seems to use "secure boot": |
||
62 | # the Percello bootrom verifies the Percello bootloader: |
||
63 | <pre> |
||
64 | Percello bootrom version 1.2.8 |
||
65 | ... |
||
66 | Board: Secure mode |
||
67 | ... |
||
68 | Secured device - OTP2: verification ...PASSED |
||
69 | Secured device - OTP3: verification ...PASSED |
||
70 | Running Percello bootloader |
||
71 | PASSED |
||
72 | </pre> |
||
73 | # the Percello bootloader loader the Sagemcom FM-loader |
||
74 | <pre> |
||
75 | Nand execute: load_addr: 3fe0000 |
||
76 | |||
77 | Percello bootloader version 0.6 (from NAND) |
||
78 | </pre> |
||
79 | # the Sagemcom FM-loader verifies the signatures of the kernel, rootfs, and app partitions |
||
80 | <pre> |
||
81 | Sagemcom FM-loader v2.0.4-11 |
||
82 | Boot 1 (cold) into main system, secured |
||
83 | ... |
||
84 | Unit key found and verified |
||
85 | TrustStor signature check passed |
||
86 | Group A signature check passed |
||
87 | Kernel A signature check passed |
||
88 | Root file system A signature check passed |
||
89 | Application file system A signature check passed |
||
90 | </pre> |
||
91 | |||
92 | You can check if secure boot has been activated using @cat /proc/prc6000/otp_data/boot/secured@ but it is unclear how the signatures are verified. |
||
93 | 2 | tsaitgaist | |
94 | h2. Operator |
||
95 | |||
96 | The @unidata@ (mtd3) signature is checked in @/etc/init.d/flash_update@ (called by @/etc/init.d/rcS@) using @/boot/bc_cli -u${PARTNUM_UNITDATA} -q@ (with PARTNUM_UNITDATA=3): |
||
97 | * hash is sha1sum of 0x2000 (8192) first bytes |
||
98 | * signature is at 0x2000 (after the cramfs indicated size) |
||
99 | * public key is first 256 bytes of @/caldata/unitkey.bin@ |
||
100 | |||
101 | It the signature check fails, @unidata_backup@ is used. |
||
102 | If this signature check fails too, it enters recovery mode |
||
103 | |||
104 | 4 | tsaitgaist | @caldata@ in mounted without check (in @/etc/init.d/flash_update@). |
105 | This allows to flash your own operator data: |
||
106 | # create your own key pair |
||
107 | <pre> |
||
108 | # generate 2048-bit RSA key pair |
||
109 | openssl genrsa -out key.pem 2048 |
||
110 | # export public key |
||
111 | openssl rsa -in key.pem -pubout -out pubkey.pem |
||
112 | # export public key as raw bytes |
||
113 | openssl rsa -in key.pem -pubout -text 2>&1 | grep -A18 "modulus" | tail -n +2 | sed "s/[^0-9a-f]//g" | sed "s/^00//" | xxd -r -p > pubkey.bin |
||
114 | </pre> |
||
115 | # prepare the @unitdata@ |
||
116 | <pre> |
||
117 | # create cramfs image |
||
118 | mkfs.cramfs unitdata_folder unitdata.bin |
||
119 | # sign partition |
||
120 | openssl dgst -sha1 -sign key.pem -out unitdata.sig unitdata.bin |
||
121 | # verify signature |
||
122 | openssl dgst -sha1 -verify pubkey.pem -signature unitdata.sig unitdata.bin |
||
123 | # append signature to image (read out by bc_cli) |
||
124 | cat unitdata.sig >> unitdata.bin |
||
125 | </pre> |
||
126 | # transfer data |
||
127 | <pre> |
||
128 | # transfer unidata image |
||
129 | scp -i /tmp/femto_id_rsa -o KexAlgorithms=diffie-hellman-group1-sha1 unitdata.bin root@192.168.23.200:/tmp/ |
||
130 | # transfer public key |
||
131 | scp -i /tmp/femto_id_rsa -o KexAlgorithms=diffie-hellman-group1-sha1 pubkey.bin root@192.168.23.200:/tmp/ |
||
132 | </pre> |
||
133 | # install images on femtocell (once logged in as root) |
||
134 | <pre> |
||
135 | # copy original caldata files |
||
136 | cp -r /caldata /tmp/caldata |
||
137 | # backup original keys (only do this the first time you flash caldata) |
||
138 | mv /tmp/caldata/unitkey.bin /tmp/caldata/unitkey.bin.bak |
||
139 | # write public key to unitkey.bin (used by bc_cli to verify unitdata partition) |
||
140 | cp /tmp/pubkey.bin /tmp/caldata/unitkey.bin |
||
141 | # append rest of data (not sure what it is used for) |
||
142 | dd if=/tmp/caldata/unitkey.bin.bak bs=1 skip=256 >> /tmp/caldata/unitkey.bin |
||
143 | # create caldata cramfs image |
||
144 | mkfs.cramfs /tmp/caldata /tmp/caldata.bin |
||
145 | # flash new caldata image |
||
146 | umount /caldata |
||
147 | source /etc/init.d/partnum.sh |
||
148 | ubiupdatevol /dev/ubi0_$(($PARTNUM_CALDATA-$PARTNUM_UBI_OFFS)) /tmp/caldata.bin |
||
149 | sync |
||
150 | # flash new unitdata image |
||
151 | umount /unitdata |
||
152 | ubiupdatevol /dev/ubi0_$(($PARTNUM_UNITDATA-$PARTNUM_UBI_OFFS)) /tmp/unitdata.bin |
||
153 | sync |
||
154 | # enjoy |
||
155 | reboot |
||
156 | </pre> |