diff options
| author | Arthur Heymans <arthur@aheymans.xyz> | 2021-03-17 15:33:26 +0100 |
|---|---|---|
| committer | Patrick Georgi <pgeorgi@google.com> | 2021-03-28 15:56:11 +0000 |
| commit | 21176ddd5708beaef2d6a3aae032c307f65edaa1 (patch) | |
| tree | 8bd870c1401b6131edb2302a988725dc40864f5a /src/security | |
| parent | 6482b16c7f81792735b61682dad2c55d36a77f3b (diff) | |
| download | coreboot-21176ddd5708beaef2d6a3aae032c307f65edaa1.tar.xz | |
security/intel/cbnt: Prepare for KM/BPM generation
Private and/or public keys will be provided as user input via Kconfig.
As a private key also contains the public key, only ask what is required.
Change-Id: I86d129bb1d13d833a26281defad2a1cb5bf86595
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/51576
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Christian Walter <christian.walter@9elements.com>
Diffstat (limited to 'src/security')
| -rw-r--r-- | src/security/intel/cbnt/Kconfig | 36 | ||||
| -rw-r--r-- | src/security/intel/cbnt/Makefile.inc | 18 |
2 files changed, 54 insertions, 0 deletions
diff --git a/src/security/intel/cbnt/Kconfig b/src/security/intel/cbnt/Kconfig index 7289f7c514..11e09200f0 100644 --- a/src/security/intel/cbnt/Kconfig +++ b/src/security/intel/cbnt/Kconfig @@ -16,6 +16,42 @@ config INTEL_CBNT_SUPPORT if INTEL_CBNT_SUPPORT +config INTEL_CBNT_NEED_KM_PUB_KEY + bool + +config INTEL_CBNT_NEED_KM_PRIV_KEY + bool + +config INTEL_CBNT_KM_PUB_KEY_FILE + string "Key manifest (KM) public key" + depends on INTEL_CBNT_NEED_KM_PUB_KEY && !INTEL_CBNT_NEED_KM_PRIV_KEY + help + Location of the key manifest (KM) public key file in .pem format. + +config INTEL_CBNT_KM_PRIV_KEY_FILE + string "Key manifest (KM) private key" + depends on INTEL_CBNT_NEED_KM_PRIV_KEY + help + Location of the key manifest (KM) private key file in .pem format. + +config INTEL_CBNT_NEED_BPM_PUB_KEY + bool + +config INTEL_CBNT_NEED_BPM_PRIV_KEY + bool + +config INTEL_CBNT_BPM_PUB_KEY_FILE + string "Boot policy manifest (BPM) public key" + depends on INTEL_CBNT_NEED_BPM_PUB_KEY && !INTEL_CBNT_NEED_BPM_PRIV_KEY + help + Location of the boot policy manifest (BPM) public key file in .pem format. + +config INTEL_CBNT_BPM_PRIV_KEY_FILE + string "Boot policy manifest (BPM) private key" + depends on INTEL_CBNT_NEED_BPM_PRIV_KEY + help + Location of the boot policy manifest (BPM) private key file in .pem format. + config INTEL_CBNT_KEY_MANIFEST_BINARY string "KM (Key Manifest) binary location" help diff --git a/src/security/intel/cbnt/Makefile.inc b/src/security/intel/cbnt/Makefile.inc index 4565a272b7..9f495048dd 100644 --- a/src/security/intel/cbnt/Makefile.inc +++ b/src/security/intel/cbnt/Makefile.inc @@ -2,6 +2,24 @@ ifeq ($(CONFIG_INTEL_CBNT_SUPPORT),y) ramstage-y += cmos.c +# The private key also contains the public key, so use that if a private key is provided. +ifeq ($(CONFIG_INTEL_CBNT_NEED_KM_PRIV_KEY),y) +$(obj)/km_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE)) + openssl pkey -in $< -pubout > $@ +else ifeq ($(CONFIG_INTEL_CBNT_NEED_KM_PUB_KEY),y) +$(obj)/km_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PUB_KEY_FILE)) + cp $< $@ +endif + +# The private key also contains the public key, so use that if a private key is provided. +ifeq ($(CONFIG_INTEL_CBNT_NEED_BPM_PRIV_KEY),y) +$(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE)) + openssl pkey -in $< -pubout > $@ +else ifeq ($(CONFIG_INTEL_CBNT_NEED_BPM_PUB_KEY),y) +$(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PUB_KEY_FILE)) + cp $< $@ +endif + ifneq ($(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY),"") cbfs-files-y += boot_policy_manifest.bin boot_policy_manifest.bin-file := $(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY) |