sravan/system76-coreboot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

util/amdfwtool: Add options to separate signed firmwares

Browse Source 
Add support for separating signed firmwares into another CBFS. If
sig_opt flag in AMD/PSPFW file header is 1, it means that the firmware
is signed against AMD chain of trust and will be verified by PSP. If
those firmware binaries are put outside FW_MAIN_[AB], vboot can skip
redundant verification, improving overall verification time.

BUG=b:206909680
TEST=Build amdfwtool. Build Skyrim BIOS image and boot to OS.

Change-Id: I9f3610a7002b2a9c70946b083b0b3be6934200b0
Signed-off-by: Kangheui Won <khwon@chromium.org>
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@google.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/59866
Reviewed-by: Jon Murphy <jpmurphy@google.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This commit is contained in:
Kangheui Won
2021-12-03 20:25:05 +11:00
committed by Martin Roth
parent 236245ec7d
commit 3c164e13e7
2 changed files with 299 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
util/amdfwtool/amdfwtool.h
View File

@@ -275,14 +275,52 @@ typedef struct _ish_directory_table {
#define PSP_BOTH_AB (PSP_LVL1_AB | PSP_LVL2_AB)
typedef struct _amd_fw_entry {
amd_fw_type type;
/* Mendocino and later SoCs use fw_id instead of fw_type. fw_type is still around
for backwards compatibility. fw_id can be populated from the PSP binary file. */
uint16_t fw_id;
char *filename;
uint8_t subprog;
uint64_t dest;
size_t size;
int level;
uint64_t other;
/* If the binary is signed and the tool is invoked to keep the signed binaries separate,
then this field is populated with the offset of the concerned PSP binary (relative to
BIOS or PSP Directory table). */
uint64_t addr_signed;
uint32_t file_size;
/* Some files that don't have amd_fw_header have to be skipped from hashing. These files
include but not limited to: *iKek*, *.tkn, *.stkn */
bool skip_hashing;
} amd_fw_entry;
/* Most PSP binaries, if not all, have the following header format. */
struct amd_fw_header {
uint8_t reserved_0[20];
uint32_t fw_size_signed;
uint8_t reserved_18[24];
/* 1 if the image is signed, 0 otherwise */
uint32_t sig_opt;
uint32_t sig_id;
uint8_t sig_param[16];
uint32_t comp_opt;
uint8_t reserved_4c[4];
uint32_t uncomp_size;
uint32_t comp_size;
/* Starting MDN fw_id is populated instead of fw_type. */
uint16_t fw_id;
uint8_t reserved_5a[18];
uint32_t size_total;
uint8_t reserved_70[12];
/* Starting MDN fw_id is populated instead of fw_type. fw_type will still be around
for backwards compatibility. */
uint8_t fw_type;
uint8_t fw_subtype;
uint8_t fw_subprog;
uint8_t reserved_7f;
uint8_t reserved_80[128];
} __packed;
typedef struct _amd_cb_config {
bool have_whitelist;
bool unlock_secure;