Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 1 | ifeq ($(CONFIG_INTEL_CBNT_SUPPORT),y) |
| 2 | |
Arthur Heymans | 2390754 | 2021-03-16 19:28:50 +0100 | [diff] [blame] | 3 | ramstage-y += cmos.c |
| 4 | |
Arthur Heymans | 21176dd | 2021-03-17 15:33:26 +0100 | [diff] [blame] | 5 | # The private key also contains the public key, so use that if a private key is provided. |
| 6 | ifeq ($(CONFIG_INTEL_CBNT_NEED_KM_PRIV_KEY),y) |
| 7 | $(obj)/km_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE)) |
| 8 | openssl pkey -in $< -pubout > $@ |
| 9 | else ifeq ($(CONFIG_INTEL_CBNT_NEED_KM_PUB_KEY),y) |
| 10 | $(obj)/km_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PUB_KEY_FILE)) |
| 11 | cp $< $@ |
| 12 | endif |
| 13 | |
| 14 | # The private key also contains the public key, so use that if a private key is provided. |
| 15 | ifeq ($(CONFIG_INTEL_CBNT_NEED_BPM_PRIV_KEY),y) |
| 16 | $(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE)) |
| 17 | openssl pkey -in $< -pubout > $@ |
| 18 | else ifeq ($(CONFIG_INTEL_CBNT_NEED_BPM_PUB_KEY),y) |
| 19 | $(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PUB_KEY_FILE)) |
| 20 | cp $< $@ |
| 21 | endif |
| 22 | |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame^] | 23 | BG_PROV:=$(obj)/bg-prov |
| 24 | CBNT_CFG:=$(obj)/cbnt.json |
| 25 | |
| 26 | $(BG_PROV): |
| 27 | printf " BG_PROV building tool\n" |
| 28 | cd 3rdparty/intel-sec-tools; \ |
| 29 | GO111MODULE=on go mod download; \ |
| 30 | GO111MODULE=on go mod verify; \ |
| 31 | GO111MODULE=on go build -o $(top)/$@ cmd/bg-prov/*.go |
| 32 | |
| 33 | $(CBNT_CFG): $(call strip_quotes, $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE)) |
| 34 | cp $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE) $@ |
| 35 | |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 36 | ifneq ($(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY),"") |
| 37 | cbfs-files-y += boot_policy_manifest.bin |
| 38 | boot_policy_manifest.bin-file := $(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY) |
| 39 | boot_policy_manifest.bin-type := raw |
| 40 | boot_policy_manifest.bin-align := 0x10 |
| 41 | |
Arthur Heymans | eeacd83 | 2021-02-19 17:14:23 +0100 | [diff] [blame] | 42 | $(call add_intermediate, add_bpm_fit, $(IFITTOOL) set_fit_ptr) |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 43 | $(IFITTOOL) -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $< |
| 44 | endif |
| 45 | |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame^] | 46 | ifeq ($(CONFIG_INTEL_CBNT_GENERATE_KM),y) |
| 47 | $(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(BG_PROV) $(CBNT_CFG) |
| 48 | printf " BG_PROV creating unsigned KM using config file\n" |
| 49 | $(BG_PROV) km-gen $@ $< --config=$(CBNT_CFG) |
| 50 | |
| 51 | $(obj)/km.bin: $(obj)/km_unsigned.bin $(BG_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE)) |
| 52 | printf " BG_PROV signing KM\n" |
| 53 | $(BG_PROV) km-sign $< $@ $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE) "" |
| 54 | |
| 55 | KM_FILE=$(obj)/km.bin |
| 56 | else |
| 57 | KM_FILE=$(CONFIG_INTEL_CBNT_KEY_MANIFEST_BINARY) |
| 58 | endif |
| 59 | |
| 60 | ifneq ($(KM_FILE),"") |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 61 | cbfs-files-y += key_manifest.bin |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame^] | 62 | key_manifest.bin-file := $(KM_FILE) |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 63 | key_manifest.bin-type := raw |
| 64 | key_manifest.bin-align := 0x10 |
| 65 | |
Arthur Heymans | eeacd83 | 2021-02-19 17:14:23 +0100 | [diff] [blame] | 66 | $(call add_intermediate, add_km_fit, $(IFITTOOL) set_fit_ptr) |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 67 | $(IFITTOOL) -r COREBOOT -a -n key_manifest.bin -t 11 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $< |
| 68 | endif |
| 69 | |
| 70 | endif # CONFIG_INTEL_CBNT_SUPPORT |