x86 FSP: Tiger Lake boot fixes, 64-bit Linux payload, OS measurement, and a UPD decoder

[dgarske]

Summary

This PR introduces generic x86 Firmware Support Package (FSP) improvements developed while bringing up wolfBoot on an Intel Tiger Lake UP3 board.

• NotifyPhase reset handling: Honours reset requests (warm, cold, global) returned from NotifyPhase instead of treating them as fatal errors. Adds support for Tiger Lake's global reset (CF9_GLB_RST in PMC ETR3) with a fail-secure halt if ETR3 is locked.
• 64-bit Linux boot protocol: Enables the 64-bit bzImage loader under WOLFBOOT_64BIT to allow 64-bit x86 FSP targets to boot signed bzImages directly.
• Optional initrd container: Adds support for packing an optional initrd into the signed image using a lightweight container header, enabling modular distribution kernels to mount root.
• Disk OS image measurement: Adds WOLFBOOT_MEASURED_PCR_OS (opt-in) to measure verified OS images into a configurable TPM PCR, including digest algorithm re-hashing and fail-secure error handling.
• FSP fixes & cleanup:
  • Initialises hobList before FspMemInit to prevent uninitialised pointer access on error or reset paths.
  • Fixes a link failure (wolfBoot_print_hexstr) when MEASURED_BOOT=1 is enabled without TPM seal/keystore options.
• Tooling & Docs:
  • Adds tools/x86_fsp/decode_fsp_upd.py to parse FSP UPD blocks using header offset comments.
  • Updates docs/Targets.md covering the Linux payload container, PCR measurement, and decoder usage.

Test Status

• Hardware validation (Tiger Lake UP3 SBC): Confirmed global reset handling, signed 64-bit bzImage boot (with/without initrd) to userspace, and verified TPM PCR measurements match predicted values.
• Build verification: Verified against kontron_vx3060_s2 target using MEASURED_BOOT + LINUX_PAYLOAD + SHA-384 options.
• Regression testing: Passed QEMU x86 FSP filesystem test (tools/scripts/x86_fsp/qemu/test_qemu.sh -f).

[Copilot]

🟡 Changes recommended

Address the Linux loader bounds and register-state issues and the UPD decoder offset handling.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds Tiger Lake FSP reset handling, 64-bit Linux payloads with optional initrds, OS PCR measurement, UPD decoding, tests, and documentation.

Changes:

• Adds 64-bit bzImage and initrd loading.
• Handles FSP reset requests and global reset.
• Adds optional TPM OS measurement.
• Adds UPD decoder tooling and tests.

File summaries

File	Summary	Review notes
tools/x86_fsp/decode_fsp_upd.py	UPD decoder	Moderate issue: nested struct fields can be decoded with incorrect offsets.
tools/unit-tests/unit-linux-loader-initrd.c	Initrd placement tests	No findings.
tools/unit-tests/Makefile	Test integration	No findings.
src/x86/linux_loader.c	Linux kernel and initrd loading	Critical bounds-validation issue; moderate missing RDI clearing for 64-bit entry.
src/x86/fsp.c	FSP reset handling	No findings.
src/x86/common.c	Tiger Lake global reset	No findings.
src/update_disk.c	OS PCR measurement	No findings.
src/tpm.c	TPM measurement helpers	No findings.
src/boot_x86_fsp.c	FSP initialization safety	No findings.
options.mk	PCR configuration	No findings.
include/x86/fsp.h	FSP reset constants	No findings.
include/x86/common.h	Reset declaration	No findings.
docs/Targets.md	Feature documentation	No findings.

Review details

Suppressed comments (1)

tools/x86_fsp/decode_fsp_upd.py:52

• DECL.finditer() scans the entire header, including the typedefs for nested FSPM_ARCH_UPD/FSPM_CONFIG members whose offsets are relative to their own structs. Those fields are appended alongside the outer FSPM_UPD fields and then sorted, so the decoder can report duplicate/wrong offsets and decode unrelated bytes; skipping only the outer struct-typed declaration does not prevent this. Restrict parsing to the requested outer UPD struct (or recursively add nested base offsets) before decoding.

    for m in DECL.finditer(text):
        off = int(m.group(1), 16)
        title = " ".join(m.group(2).split())
        ctype = m.group(4)
        name = m.group(5)
        count = int(m.group(6)) if m.group(6) else 1
        if ctype not in WIDTH:
            # A struct-typed member (FSP_UPD_HEADER, FSPM_ARCH_UPD, ...). Its
            # own fields are declared in another header; skip it rather than
            # attributing this offset to whatever scalar comes next.
            continue
        fields.append((off, ctype, name, count, title))

• Files reviewed: 13/13 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.