diff options
| author | Arthur Heymans <arthur@aheymans.xyz> | 2021-02-08 14:28:03 +0100 |
|---|---|---|
| committer | Patrick Georgi <pgeorgi@google.com> | 2021-03-28 15:56:24 +0000 |
| commit | 2ef2e4793a511922d7b5c3a5ea79b45689cd4ec0 (patch) | |
| tree | a55f63fdba124faa510a3f209d448d13a1e554df /src | |
| parent | 21176ddd5708beaef2d6a3aae032c307f65edaa1 (diff) | |
| download | coreboot-2ef2e4793a511922d7b5c3a5ea79b45689cd4ec0.tar.xz | |
security/intel/cbnt: Add option to generate KM
This add an option to generate KM using the 9elements bg-prov tool
using a json config file.
The option to just include a provided KM binary is kept.
A template for the json config file can be obtained via
"bg-prov template".
Another option is to extract it from a working configuration:
"bg-prov read-config".
Change-Id: I18bbdd13047be634b8ee280a6b902096a65836e4
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/50409
Reviewed-by: Christian Walter <christian.walter@9elements.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/security/intel/cbnt/Kconfig | 20 | ||||
| -rw-r--r-- | src/security/intel/cbnt/Makefile.inc | 31 |
2 files changed, 49 insertions, 2 deletions
diff --git a/src/security/intel/cbnt/Kconfig b/src/security/intel/cbnt/Kconfig index 11e09200f0..8c4d999043 100644 --- a/src/security/intel/cbnt/Kconfig +++ b/src/security/intel/cbnt/Kconfig @@ -16,6 +16,25 @@ config INTEL_CBNT_SUPPORT if INTEL_CBNT_SUPPORT +config INTEL_CBNT_GENERATE_KM + bool "Generate Key Manifest (KM)" + default y + select INTEL_CBNT_NEED_KM_PUB_KEY + select INTEL_CBNT_NEED_KM_PRIV_KEY + help + Select y to generate the Key Manifest (KM). + Select n to include a KM binary. + +config INTEL_CBNT_BG_PROV_CFG_FILE + string "CBnT json config file" + depends on INTEL_CBNT_GENERATE_KM + help + Location of the bg-prov json config file. + Either get a sample JSON config file: + $ bg-prov template + Or extract it from a working configuration: + $ bg-prov read-config + config INTEL_CBNT_NEED_KM_PUB_KEY bool @@ -54,6 +73,7 @@ config INTEL_CBNT_BPM_PRIV_KEY_FILE config INTEL_CBNT_KEY_MANIFEST_BINARY string "KM (Key Manifest) binary location" + depends on !INTEL_CBNT_GENERATE_KM help Location of the Key Manifest (KM) diff --git a/src/security/intel/cbnt/Makefile.inc b/src/security/intel/cbnt/Makefile.inc index 9f495048dd..b508974283 100644 --- a/src/security/intel/cbnt/Makefile.inc +++ b/src/security/intel/cbnt/Makefile.inc @@ -20,6 +20,19 @@ $(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PUB_KEY_FILE)) cp $< $@ endif +BG_PROV:=$(obj)/bg-prov +CBNT_CFG:=$(obj)/cbnt.json + +$(BG_PROV): + printf " BG_PROV building tool\n" + cd 3rdparty/intel-sec-tools; \ + GO111MODULE=on go mod download; \ + GO111MODULE=on go mod verify; \ + GO111MODULE=on go build -o $(top)/$@ cmd/bg-prov/*.go + +$(CBNT_CFG): $(call strip_quotes, $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE)) + cp $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE) $@ + ifneq ($(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY),"") cbfs-files-y += boot_policy_manifest.bin boot_policy_manifest.bin-file := $(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY) @@ -30,9 +43,23 @@ $(call add_intermediate, add_bpm_fit, $(IFITTOOL) set_fit_ptr) $(IFITTOOL) -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $< endif -ifneq ($(CONFIG_INTEL_CBNT_KEY_MANIFEST_BINARY),"") +ifeq ($(CONFIG_INTEL_CBNT_GENERATE_KM),y) +$(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(BG_PROV) $(CBNT_CFG) + printf " BG_PROV creating unsigned KM using config file\n" + $(BG_PROV) km-gen $@ $< --config=$(CBNT_CFG) + +$(obj)/km.bin: $(obj)/km_unsigned.bin $(BG_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE)) + printf " BG_PROV signing KM\n" + $(BG_PROV) km-sign $< $@ $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE) "" + +KM_FILE=$(obj)/km.bin +else +KM_FILE=$(CONFIG_INTEL_CBNT_KEY_MANIFEST_BINARY) +endif + +ifneq ($(KM_FILE),"") cbfs-files-y += key_manifest.bin -key_manifest.bin-file := $(CONFIG_INTEL_CBNT_KEY_MANIFEST_BINARY) +key_manifest.bin-file := $(KM_FILE) key_manifest.bin-type := raw key_manifest.bin-align := 0x10 |