Skip to content

rimage signing support for CAVS2.5 - #33

Merged
lgirdwood merged 11 commits into
masterfrom
lrg/topic/cavs25
Nov 16, 2020
Merged

rimage signing support for CAVS2.5#33
lgirdwood merged 11 commits into
masterfrom
lrg/topic/cavs25

Conversation

@lgirdwood

@lgirdwood lgirdwood commented Oct 28, 2020 •
edited
Loading

Copy link
Copy Markdown
Member

This PR will add signing support for CAVS2.5 platforms. Key differences are hashes are now SHA384 and signing is now RSA PSS. This is a plan B until meu can be released.

TODO:

  • CSE checksum is 32bits instead of 8bits and needs fixed. Unsure of checksum end address (i.e. scope of data that is checksummed).
  • Hashes start/end and sizes for ext0x16 and ext signed_pkg
  • Validation support to be added to rimage - this allows the tool to self validate and to validate meu (as a means to confirming CAVS2.5 signing is correct as PSS signatures are not reproducible)

@lgirdwood

lgirdwood commented Oct 28, 2020

Copy link
Copy Markdown
Member Author

@lyakh @juimonen @harshapriya-n @mwasko @cujomalainey @singalsu fyi
@juimonen can you take a look at the CSE checksum - I will do the other two.

@lgirdwood

lgirdwood commented Oct 28, 2020

Copy link
Copy Markdown
Member Author

@juimonen btw, a quick way to visualise any delta can be done using meld after stripping ext manifest and converting to text. i.e.

./scripts/xtensa-build-all.sh tgl
dd if=build_tgl_gcc/sof-tgl.ri bs=1 skip=784 of=sof-tgl.ri-strip
hexdump -C sof-tgl.ri-strip > sof-tgl.ri.txt

You will also need to force rimage signing in xtensa-build-all for tgl

@juimonen

juimonen commented Oct 28, 2020

Copy link
Copy Markdown

@lgirdwood it seems that meu is calculating crc32 checksum...

@juimonen

juimonen commented Oct 28, 2020

Copy link
Copy Markdown

@lgirdwood FYI: https://github.com/juimonen/rimage/tree/crc32

@lgirdwood lgirdwood mentioned this pull request Oct 29, 2020
Closed
lrgirdwo and others added 10 commits November 12, 2020 22:19
@lrgirdwo
config: tgl: fix CSE offsets for TGL
e24d6fb 
Now aligns with actual offsets.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
@lrgirdwo
css: add css header for cavs v2.5
e18bda3 
Header contests are the same but with bigger key.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
Jaska Uimonen @lrgirdwo
cse: add simple crc32 function to calculate the v2.5 header checksum
e35208e 
Add simple crc32 function to calculate the checksum for v2.5 headers.
Implementation is very simple using shift register as we don't require
speed. Calculate the v2.5 header checksum with crc-32/iso-hdlc
parameters.

Signed-off-by: Jaska Uimonen <jaska.uimonen@linux.intel.com>
Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
@lrgirdwo
manifest: Add cavs2.5 structures and offsets
387bc53 
cavs2.5 has different offsets and structures.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
@lrgirdwo
user: manifest: add macros for SHA385 modulus length
a60627c 
Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
@lrgirdwo
pkcs: Add PSS signing mechanism for CAVS2.5
7145d85 
Add RSA PSS signing support for CAVS 2.5 platforms.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
@lrgirdwo
hash: make module_sha384_create non static.
ad4ed2b 
Used by other clients now.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
@lrgirdwo
plat_auth: use cavs 2.5 plat auth offsets
12247f6 
cavs2.5 has different offsets for plat auth data.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
@lrgirdwo
cavs: add support for cavs2.5 code signing
02b0d50 
cavs 2.5 uses a larger key and the RSA signing PSS mode.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
@lrgirdwo
manifest: cavs25: Add support for ext data type 0x16
c43ce10 
This type was used by early versions of meu, but the hash is not
used in later versions. Leave the code in in case it has to come back.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
@lgirdwood lgirdwood changed the title WIP: rimage signing support for CAVS2.5 rimage signing support for CAVS2.5 Nov 12, 2020
@lgirdwood

lgirdwood commented Nov 12, 2020

Copy link
Copy Markdown
Member Author

@juimonen can you check if we need any changes to SOF build scripts to use rimage for TGL. Thanks

@juimonen juimonen mentioned this pull request Nov 13, 2020
Merged
@juimonen

juimonen commented Nov 13, 2020

Copy link
Copy Markdown

@lgirdwood yes we need this: thesofproject/sof#3604

@lrgirdwo
verify: add signature verification support
16c8661 
Add support to verify signatures of cavs firmware binaries.

Signed-off-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
@lgirdwood

lgirdwood commented Nov 16, 2020

Copy link
Copy Markdown
Member Author

CI showing checkpatch warnings.

@lgirdwood
lgirdwood merged commit 7b7c192 into master Nov 16, 2020
@lgirdwood
lgirdwood deleted the lrg/topic/cavs25 branch November 16, 2020 11:57
@marc-hb marc-hb mentioned this pull request Jan 11, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@fredoh9 fredoh9 Awaiting requested review from fredoh9
@ranj063 ranj063 Awaiting requested review from ranj063
@singalsu singalsu Awaiting requested review from singalsu
@ktrzcinx ktrzcinx Awaiting requested review from ktrzcinx
@jajanusz jajanusz Awaiting requested review from jajanusz

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@lgirdwood @juimonen @lrgirdwo