WIP

Signed-off-by: Krystian Hebel <[email protected]>

Author: krystian-hebel

head.S

@@ -45,9 +45,18 @@ GLOBAL(sl_header)
 	.word	_entry           /* SL header SKL offset to code start */
 	.word	_end_of_measured /* SL header SKL measured length */
 	.byte	0xda, 0x75, 0xc4, 0x0e, 0xd0, 0xd3, 0x5d, 0x48, 0xb6, 0xae, 0x3c, 0xb2, 0xf, 0xb7, 0xad, 0x3a
-	.long	0xffffffff
-	.long	0xaaaa5555
-	.word	0x1E
+	.long	0xffffffff       /* Reserved */
+	.long	0xaaaa5555       /* Total Length including signature and pubkey raw data */
+	.word	soc_flag         /* Offset to SOCFLAG Structure, see below */
+	.word	skl_info         /* Offset to SKL info with UUID and version */
+	.word	bootloader_data  /* Offset to SLRT filled by the bootloader */
+
+soc_flag:
+	/*
+	 * This structure isn't described in the spec, but it is assumed to be a
+	 * number of entries, followed by family and model of supported CPUs, in
+	 * form of EAX of CPUID leaf 1 with stepping set to 0.
+	 */
 	.long	0x00000008
 	.long	0x00860f00
 	.long	0x00a50f00
@@ -57,8 +66,6 @@ GLOBAL(sl_header)
 	.long	0x00a10f00
 	.long	0x00a80f00
 	.long	0x00aa0f00
-	.word	skl_info         /* Offset to SKL info with UUID and version */
-	.word	bootloader_data  /* Offset to SLRT filled by the bootloader */
 ENDDATA(sl_header)
 
 	.text
@@ -313,9 +320,11 @@ gdt:
 .Lgdt_end:
 ENDDATA(gdt)
 
+/*
 	.section .skinit_reserved, "a", @progbits
 GLOBAL(skinit_reserved)
 	.fill 0x740, 1, 0x00
+*/
 
 #ifdef __x86_64__
 	/* 64bit Pagetables, identity map of the first 4G of RAM. */

link.lds

@@ -51,8 +51,18 @@ SECTIONS
 
 	. = ALIGN(16);
 
-	.skinit_reserved : {
-		*(.skinit_reserved)
+	.skl_sig_hdr : {
+		*(.skl_sig_hdr)
+	}
+
+	_end_of_signed = .;
+
+	.skl_sig : {
+		*(.skl_sig)
+	}
+
+	.skl_pubkey : {
+		*(.skl_pubkey)
 	}
 
 	.bss : {

main.c

@@ -40,6 +40,51 @@ const skl_info_t __used skl_info = {
     .version = 0,
 };
 
+#if !defined(AMDSL)
+typedef struct tdFW_SIG_HEADER
+{
+    u8 Nonce[16];          /* [0x00] Unique image id */
+    u32 HeaderVersion;     /* [0x10] Version of the header */
+    u32 SizeFWSigned;      /* [0x14] Signed Fw Size in bytes */
+    u32 EncOption;         /* [0x18] 0 - Not encrypted, 1 - encrypted */
+    u32 EncAlgID;          /* [0x1C] Encryption algorithm id */
+    u8 EncParameters[16];  /* [0x20] Encryption Parameters */
+    u32 SigOption;         /* [0x30] 0 - not signed 1 - signed */
+    u32 SigAlgID;          /* [0x34] Signature algorithm ID */
+    u8 SigParameters[16];  /* [0x38] Signature parameter */
+    u32 CompOption;        /* [0x48] Compression option */
+    u32 SecPatchLevel;     /* [0x4C] Security patch level */
+    u32 UnCompImageSize;   /* [0x50] Uncompressed Image Size */
+    u32 CompImageSize;     /* [0x54] compressed Image Size */
+    u8 CompParameters[8];  /* [0x58] Compression Parameters */
+    u32 ImageVersion;      /* [0x60] Off Chip Firmware Version */
+    u32 APUFamilyID;       /* [0x64] APU Family ID or SoC ID */
+    u32 FirmwareLoadAddr;  /* [0x68] Firmware Load address (default 0) */
+    u32 SizeImage;         /* [0x6C] FW size with signature */
+    u32 SizeFWUnSigned;    /* [0x70] Size of Un-signed portion of the FW */
+    u32 FirmwareSplitAddr; /* [0x74] Offset of Nwd OS */
+    u32 SigFlags;          /* [0x78] Flags for FW signing options, perm, etc */
+    u8 FwType;             /* [0x7C] FwType */
+    u8 SubType;            /* [0x7D] SubType identifies FW */
+    u8 Reserved1[2];       /* [0x7E] *** RESERVED *** */
+    u8 EncKey[16];         /* [0x80] Encryption Key (Wrapped MEK) */
+    u8 SigningInfo[16];    /* [0x90] Signing tool specific information */
+    u8 Padd[96];           /* [0xA0] *** RESERVED *** */
+} FW_SIG_HEADER; /* Total 256 bytes */
+
+extern char _end_of_signed[];
+
+FW_SIG_HEADER __section(".skl_sig_hdr") __used hdr = {
+    .HeaderVersion = 0x31534124, /* "$AS1" */
+    .SizeFWSigned  = _u(_end_of_signed),
+    .SigOption     = 1,
+    .SigParameters = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
+                      0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff}, /* TBD! */
+    .ImageVersion  = 0x02000200,
+    .SizeImage     = _u(_end_of_signed) + 0x200,
+};
+#endif
+
 #if !defined(AMDSL)
 static void extend_pcr(struct tpm *tpm, void *data, u32 size, u32 pcr, char *ev)
 {

sanity_check.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 . util.sh
 
-SKL_INFO=`hexdump "$SLB_FILE" -s66 -n2 -e '/2 "%u"'`
+SKL_INFO=`hexdump "$SLB_FILE" -s30 -n2 -e '/2 "%u"'`
 
 if ! od --format=x8 --skip-bytes=$SKL_INFO --read-bytes=16 $SLB_FILE | grep -q "e91192048e26f178 02ccc4765bc82a83"; then
     echo "ERROR: SKL UUID missing or misplaced in $SLB_FILE" >&2