Add SM4 IV length definition and update decryption logic in k230_boot.c

Author: kendryte747

.github/workflows/build.yml

@@ -124,17 +124,6 @@ jobs:
             # Also copy artifacts to artifacts folder
             cp ${{ github.workspace }}/canmv_k230/output/${UBOOT_DEFCONFIG}/uboot/u-boot.bin ~/artifacts/${base_name}/u-boot.bin || { echo "u-boot.bin missing"; exit $?; }
             cp ${{ github.workspace }}/canmv_k230/output/${UBOOT_DEFCONFIG}/uboot/spl/u-boot-spl.bin ~/artifacts/${base_name}/u-boot-spl.bin || { echo "u-boot-spl.bin missing"; exit $?; }
-
-            # build fastboot spl
-            make uboot-clean || exit $?
-            echo "CONFIG_UBOOT_ENABLE_FAST_BOOT=y" >> ${{ github.workspace }}/canmv_k230/.config
-            echo "CONFIG_UBOOT_FAST_BOOT_RTSMART=y" >> ${{ github.workspace }}/canmv_k230/.config
-            # disable prebuilt
-            sed -i 's/^CONFIG_UBOOT_USE_PREBUILT=y$/CONFIG_UBOOT_USE_PREBUILT=n/' ${{ github.workspace }}/canmv_k230/.config
-
-            make -j8 uboot || exit $?
-
-            cp ${{ github.workspace }}/canmv_k230/output/${UBOOT_DEFCONFIG}/uboot/spl/u-boot-spl.bin ~/artifacts/${base_name}/u-boot-spl-fastboot.bin || { echo "u-boot-spl-fastboot missing"; exit $?; }
           done
 
           tree ~/artifacts

board/kendryte/common/k230_boot.c

@@ -93,6 +93,7 @@ static uint64_t rtapp_load_addr, rtapp_size, rttapp_loaded = 0;
 #define K230_DISABLE_NONE_SECURITY_MASK	0x1U
 #define K230_GCM_IV_LEN			12U
 #define K230_GCM_TAG_LEN		16U
+#define K230_SM4_IV_LEN			16U
 #define K230_GCM_UPDATE_CHUNK_SIZE	0x10000U
 #define K230_DOWNSTREAM_AES_KEY_SLOT	OTPKEY_3
 #define K230_DOWNSTREAM_RSA_HASH_SLOT	OTPKEY_8
@@ -126,11 +127,6 @@ unsigned long k230_get_rttapp_load_addr(void)
     return addr & ~(4096-1);
 }
 
-static const uint8_t *k230_get_firmware_sm4_iv(void)
-{
-    return k230_firmware_sm4_iv;
-}
-
 static bool k230_calc_range_end(ulong start, ulong size, ulong *end)
 {
     ulong max_value = ~0UL;
@@ -388,7 +384,9 @@ static int k230_boot_check_and_get_plain_data(firmware_head_s *pfh,
         uint8_t puk_hash_otp[SHA256_SUM_LEN];
         pufs_ec_point_st puk = { .qlen = 32 };
         pufs_ecdsa_sig_st sig = { .qlen = 32 };
-        const uint8_t *sm4_iv = k230_get_firmware_sm4_iv();
+        const uint8_t *sm4_iv;
+        const uint8_t *sm4_input;
+        uint32_t sm4_input_len;
 
         if (pufs_read_otp(puk_hash_otp, sizeof(puk_hash_otp),
                   (K230_DOWNSTREAM_SM2_HASH_SLOT - OTPKEY_0) * OTP_KEY_LEN) != SUCCESS) {
@@ -423,9 +421,18 @@ static int k230_boot_check_and_get_plain_data(firmware_head_s *pfh,
             return 16;
         }
 
+        if (pfh->length < K230_SM4_IV_LEN) {
+            printf("sm4 payload too short\n");
+            return 17;
+        }
+
+        sm4_iv = cipher_data;
+        sm4_input = cipher_data + K230_SM4_IV_LEN;
+        sm4_input_len = pfh->length - K230_SM4_IV_LEN;
+
         plain_addr = k230_get_encrypted_image_decrypt_addr();
         if (cb_pufs_dec_cbc((uint8_t *)plain_addr, &outlen,
-                    cipher_data, pfh->length,
+                    sm4_input, sm4_input_len,
                     SM4, OTPKEY, K230_DOWNSTREAM_SM4_KEY_SLOT, 128,
                     sm4_iv, 0) != SUCCESS) {
             printf("sm4 decrypt error\n");