summaryrefslogtreecommitdiff
path: root/src/security
diff options
context:
space:
mode:
Diffstat (limited to 'src/security')
-rw-r--r--src/security/intel/cbnt/Kconfig36
-rw-r--r--src/security/intel/cbnt/Makefile.inc18
2 files changed, 54 insertions, 0 deletions
diff --git a/src/security/intel/cbnt/Kconfig b/src/security/intel/cbnt/Kconfig
index 7289f7c514..11e09200f0 100644
--- a/src/security/intel/cbnt/Kconfig
+++ b/src/security/intel/cbnt/Kconfig
@@ -16,6 +16,42 @@ config INTEL_CBNT_SUPPORT
if INTEL_CBNT_SUPPORT
+config INTEL_CBNT_NEED_KM_PUB_KEY
+ bool
+
+config INTEL_CBNT_NEED_KM_PRIV_KEY
+ bool
+
+config INTEL_CBNT_KM_PUB_KEY_FILE
+ string "Key manifest (KM) public key"
+ depends on INTEL_CBNT_NEED_KM_PUB_KEY && !INTEL_CBNT_NEED_KM_PRIV_KEY
+ help
+ Location of the key manifest (KM) public key file in .pem format.
+
+config INTEL_CBNT_KM_PRIV_KEY_FILE
+ string "Key manifest (KM) private key"
+ depends on INTEL_CBNT_NEED_KM_PRIV_KEY
+ help
+ Location of the key manifest (KM) private key file in .pem format.
+
+config INTEL_CBNT_NEED_BPM_PUB_KEY
+ bool
+
+config INTEL_CBNT_NEED_BPM_PRIV_KEY
+ bool
+
+config INTEL_CBNT_BPM_PUB_KEY_FILE
+ string "Boot policy manifest (BPM) public key"
+ depends on INTEL_CBNT_NEED_BPM_PUB_KEY && !INTEL_CBNT_NEED_BPM_PRIV_KEY
+ help
+ Location of the boot policy manifest (BPM) public key file in .pem format.
+
+config INTEL_CBNT_BPM_PRIV_KEY_FILE
+ string "Boot policy manifest (BPM) private key"
+ depends on INTEL_CBNT_NEED_BPM_PRIV_KEY
+ help
+ Location of the boot policy manifest (BPM) private key file in .pem format.
+
config INTEL_CBNT_KEY_MANIFEST_BINARY
string "KM (Key Manifest) binary location"
help
diff --git a/src/security/intel/cbnt/Makefile.inc b/src/security/intel/cbnt/Makefile.inc
index 4565a272b7..9f495048dd 100644
--- a/src/security/intel/cbnt/Makefile.inc
+++ b/src/security/intel/cbnt/Makefile.inc
@@ -2,6 +2,24 @@ ifeq ($(CONFIG_INTEL_CBNT_SUPPORT),y)
ramstage-y += cmos.c
+# The private key also contains the public key, so use that if a private key is provided.
+ifeq ($(CONFIG_INTEL_CBNT_NEED_KM_PRIV_KEY),y)
+$(obj)/km_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE))
+ openssl pkey -in $< -pubout > $@
+else ifeq ($(CONFIG_INTEL_CBNT_NEED_KM_PUB_KEY),y)
+$(obj)/km_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PUB_KEY_FILE))
+ cp $< $@
+endif
+
+# The private key also contains the public key, so use that if a private key is provided.
+ifeq ($(CONFIG_INTEL_CBNT_NEED_BPM_PRIV_KEY),y)
+$(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE))
+ openssl pkey -in $< -pubout > $@
+else ifeq ($(CONFIG_INTEL_CBNT_NEED_BPM_PUB_KEY),y)
+$(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PUB_KEY_FILE))
+ cp $< $@
+endif
+
ifneq ($(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY),"")
cbfs-files-y += boot_policy_manifest.bin
boot_policy_manifest.bin-file := $(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY)