Martin Roth | f362bbd | 2023-08-04 12:24:24 -0600 | [diff] [blame] | 1 | ## SPDX-License-Identifier: GPL-2.0-only |
| 2 | |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 3 | ifeq ($(CONFIG_INTEL_CBNT_SUPPORT),y) |
| 4 | |
Arthur Heymans | ee55d71 | 2021-05-12 16:22:05 +0200 | [diff] [blame] | 5 | all-y += logging.c |
Arthur Heymans | 2390754 | 2021-03-16 19:28:50 +0100 | [diff] [blame] | 6 | ramstage-y += cmos.c |
| 7 | |
Arthur Heymans | 8b91c9f | 2021-03-31 12:21:32 +0200 | [diff] [blame] | 8 | # As specified in Intel Trusted Execution Technology and Boot Guard Server BIOS |
| 9 | # Specification, document number # 558294 |
| 10 | PK_HASH_ALG_SHA1:=4 |
| 11 | PK_HASH_ALG_SHA256:=11 |
| 12 | PK_HASH_ALG_SHA384:=12 |
| 13 | |
Arthur Heymans | 21176dd | 2021-03-17 15:33:26 +0100 | [diff] [blame] | 14 | # The private key also contains the public key, so use that if a private key is provided. |
| 15 | ifeq ($(CONFIG_INTEL_CBNT_NEED_KM_PRIV_KEY),y) |
| 16 | $(obj)/km_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE)) |
| 17 | openssl pkey -in $< -pubout > $@ |
| 18 | else ifeq ($(CONFIG_INTEL_CBNT_NEED_KM_PUB_KEY),y) |
| 19 | $(obj)/km_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PUB_KEY_FILE)) |
| 20 | cp $< $@ |
| 21 | endif |
| 22 | |
| 23 | # The private key also contains the public key, so use that if a private key is provided. |
| 24 | ifeq ($(CONFIG_INTEL_CBNT_NEED_BPM_PRIV_KEY),y) |
| 25 | $(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE)) |
| 26 | openssl pkey -in $< -pubout > $@ |
| 27 | else ifeq ($(CONFIG_INTEL_CBNT_NEED_BPM_PUB_KEY),y) |
| 28 | $(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PUB_KEY_FILE)) |
| 29 | cp $< $@ |
| 30 | endif |
| 31 | |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 32 | CBNT_PROV:=$(obj)/cbnt-prov |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame] | 33 | CBNT_CFG:=$(obj)/cbnt.json |
| 34 | |
Arthur Heymans | 0250a78 | 2021-03-31 16:54:37 +0200 | [diff] [blame] | 35 | ifneq ($(CONFIG_INTEL_CBNT_PROV_EXTERNAL_BIN),y) |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 36 | $(CBNT_PROV): |
| 37 | printf " CBNT_PROV building tool\n" |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame] | 38 | cd 3rdparty/intel-sec-tools; \ |
Elyes Haouas | d985e9d | 2023-06-15 19:09:51 +0200 | [diff] [blame] | 39 | GO111MODULE=on go build -o $(abspath $@) cmd/cbnt-prov/main.go cmd/cbnt-prov/cmd.go |
Arthur Heymans | 0250a78 | 2021-03-31 16:54:37 +0200 | [diff] [blame] | 40 | else |
| 41 | $(CBNT_PROV): $(call strip_quotes, $(CONFIG_INTEL_CBNT_PROV_EXTERNAL_BIN_PATH)) |
| 42 | cp $< $@ |
| 43 | endif |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame] | 44 | |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 45 | $(CBNT_CFG): $(call strip_quotes, $(CONFIG_INTEL_CBNT_CBNT_PROV_CFG_FILE)) |
| 46 | cp $(CONFIG_INTEL_CBNT_CBNT_PROV_CFG_FILE) $@ |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame] | 47 | |
Arthur Heymans | 15412c0 | 2021-02-08 22:38:40 +0100 | [diff] [blame] | 48 | ifeq ($(CONFIG_INTEL_CBNT_GENERATE_BPM),y) |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 49 | ifeq ($(CONFIG_INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE),y) |
Arthur Heymans | 8ae248e | 2021-07-06 16:21:24 +0200 | [diff] [blame] | 50 | $(obj)/bpm_unsigned.bin: $(obj)/coreboot.pre $(CBNT_PROV) $(CBNT_CFG) |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 51 | printf " CBNT_PROV creating unsigned BPM using config file\n" |
| 52 | $(CBNT_PROV) bpm-gen $@ $< --config=$(CBNT_CFG) --cut |
Arthur Heymans | 3d5319e | 2021-02-19 19:39:56 +0100 | [diff] [blame] | 53 | else |
Arthur Heymans | 8ae248e | 2021-07-06 16:21:24 +0200 | [diff] [blame] | 54 | $(obj)/bpm_unsigned.bin: $(obj)/coreboot.pre $(CBNT_PROV) set_fit_ptr |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 55 | printf " CBNT_PROV creating unsigned BPM\n" |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 56 | $(CBNT_PROV) bpm-gen $@ $< --revision=$(CONFIG_INTEL_CBNT_BPM_REVISION) \ |
Arthur Heymans | 3d5319e | 2021-02-19 19:39:56 +0100 | [diff] [blame] | 57 | --svn=$(CONFIG_INTEL_CBNT_BPM_SVN) \ |
| 58 | --acmsvn=$(CONFIG_INTEL_CBNT_ACM_SVN) \ |
| 59 | --nems=$(CONFIG_INTEL_CBNT_NUM_NEM_PAGES) \ |
| 60 | --pbet=$(CONFIG_INTEL_CBNT_PBET) \ |
| 61 | --ibbflags=$(CONFIG_INTEL_CBNT_IBB_FLAGS) \ |
| 62 | --entrypoint=$(shell printf "%d" 0xfffffff0) \ |
Arthur Heymans | 8b91c9f | 2021-03-31 12:21:32 +0200 | [diff] [blame] | 63 | --ibbhash=$(PK_HASH_ALG_SHA256),$(PK_HASH_ALG_SHA1),$(PK_HASH_ALG_SHA384) \ |
Arthur Heymans | f69cece | 2021-05-04 08:15:22 +0200 | [diff] [blame] | 64 | --sinitmin=$(CONFIG_INTEL_CBNT_SINIT_SVN) \ |
Arthur Heymans | 3d5319e | 2021-02-19 19:39:56 +0100 | [diff] [blame] | 65 | --txtflags=0 \ |
| 66 | --powerdowninterval=$(CONFIG_INTEL_CBNT_PD_INTERVAL) \ |
| 67 | --acpibaseoffset=$(shell printf "%d" $(CONFIG_INTEL_ACPI_BASE_ADDRESS)) \ |
| 68 | --powermbaseoffset=$(shell printf "%d" $(CONFIG_INTEL_PCH_PWRM_BASE_ADDRESS)) \ |
| 69 | --cmosoff0=$(shell printf "%d" $(CONFIG_INTEL_CBNT_CMOS_OFFSET)) \ |
| 70 | --cmosoff1=$(call int-add, $(CONFIG_INTEL_CBNT_CMOS_OFFSET) 1) \ |
| 71 | --cut \ |
| 72 | --out=$(obj)/bpm_cfg.json |
| 73 | endif |
Arthur Heymans | 15412c0 | 2021-02-08 22:38:40 +0100 | [diff] [blame] | 74 | |
Arthur Heymans | 6362df3 | 2021-03-17 12:23:20 +0100 | [diff] [blame] | 75 | ifeq ($(CONFIG_INTEL_CBNT_BPM_ONLY_UNSIGNED),y) |
| 76 | build_complete:: $(obj)/bpm_unsigned.bin |
Martin Roth | 372503f | 2023-12-08 00:43:23 -0700 | [diff] [blame] | 77 | |
| 78 | show_notices:: |
Arthur Heymans | 6362df3 | 2021-03-17 12:23:20 +0100 | [diff] [blame] | 79 | @printf "\n** WARNING **\n" |
| 80 | @printf "Build generated an unsigned BPM image: build/bpm_unsigned.bin.\n" |
| 81 | @printf "The resulting image will not work with CBnT.\n" |
| 82 | @printf "After you have externally signed the image you can add it to the coreboot image:\n" |
| 83 | @printf "$$ cbfstool build/coreboot.rom add -f bpm.bin -n boot_policy_manifest.bin -t raw -a 16\n" |
| 84 | @printf "$$ ifittool -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s 12 -f build/coreboot.rom\n" |
| 85 | else |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 86 | $(obj)/bpm.bin: $(obj)/bpm_unsigned.bin $(CBNT_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE)) |
| 87 | printf " CBNT_PROV signing real BPM\n" |
| 88 | $(CBNT_PROV) bpm-sign $< $@ $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE) "" |
Arthur Heymans | 15412c0 | 2021-02-08 22:38:40 +0100 | [diff] [blame] | 89 | |
| 90 | # Add BPM at the end of the build when all files have been added |
Arthur Heymans | 8ae248e | 2021-07-06 16:21:24 +0200 | [diff] [blame] | 91 | $(call add_intermediate, add_bpm, $(obj)/bpm.bin) |
Arthur Heymans | 15412c0 | 2021-02-08 22:38:40 +0100 | [diff] [blame] | 92 | printf " CBNT Adding BPM\n" |
Arthur Heymans | 8ae248e | 2021-07-06 16:21:24 +0200 | [diff] [blame] | 93 | -$(CBFSTOOL) $< remove -n boot_policy_manifest.bin 2>/dev/null |
| 94 | $(CBFSTOOL) $< add -f $(obj)/bpm.bin -n boot_policy_manifest.bin -a 0x10 -t raw |
| 95 | |
| 96 | $(call add_intermediate, fit_bpm, set_fit_ptr add_bpm $(IFITTOOL)) |
Arthur Heymans | 15412c0 | 2021-02-08 22:38:40 +0100 | [diff] [blame] | 97 | printf " IFITTOOL Adding BPM\n" |
Arthur Heymans | 8ae248e | 2021-07-06 16:21:24 +0200 | [diff] [blame] | 98 | $(IFITTOOL) -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $< |
Arthur Heymans | 15412c0 | 2021-02-08 22:38:40 +0100 | [diff] [blame] | 99 | |
Arthur Heymans | 6362df3 | 2021-03-17 12:23:20 +0100 | [diff] [blame] | 100 | endif # CONFIG_INTEL_CBNT_BPM_ONLY_UNSIGNED |
| 101 | |
Arthur Heymans | 15412c0 | 2021-02-08 22:38:40 +0100 | [diff] [blame] | 102 | else # CONFIG_INTEL_CBNT_GENERATE_BPM |
Arthur Heymans | 6362df3 | 2021-03-17 12:23:20 +0100 | [diff] [blame] | 103 | |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 104 | ifneq ($(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY),"") |
| 105 | cbfs-files-y += boot_policy_manifest.bin |
| 106 | boot_policy_manifest.bin-file := $(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY) |
| 107 | boot_policy_manifest.bin-type := raw |
| 108 | boot_policy_manifest.bin-align := 0x10 |
| 109 | |
Arthur Heymans | eeacd83 | 2021-02-19 17:14:23 +0100 | [diff] [blame] | 110 | $(call add_intermediate, add_bpm_fit, $(IFITTOOL) set_fit_ptr) |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 111 | $(IFITTOOL) -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $< |
| 112 | endif |
Arthur Heymans | 15412c0 | 2021-02-08 22:38:40 +0100 | [diff] [blame] | 113 | endif # CONFIG_INTEL_CBNT_GENERATE_BPM |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 114 | |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame] | 115 | ifeq ($(CONFIG_INTEL_CBNT_GENERATE_KM),y) |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 116 | ifeq ($(CONFIG_INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE),y) |
| 117 | $(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(CBNT_PROV) $(CBNT_CFG) |
| 118 | printf " CBNT_PROV creating unsigned KM using config file\n" |
| 119 | $(CBNT_PROV) km-gen $@ $< --config=$(CBNT_CFG) |
Arthur Heymans | 0514324 | 2021-02-08 19:41:23 +0100 | [diff] [blame] | 120 | else |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 121 | $(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(obj)/bpm_pub.pem $(CBNT_PROV) |
| 122 | printf " CBNT_PROV creating unsigned KM\n" |
| 123 | $(CBNT_PROV) km-gen $@ $< --revision=$(CONFIG_INTEL_CBNT_KM_REVISION) \ |
Arthur Heymans | 0514324 | 2021-02-08 19:41:23 +0100 | [diff] [blame] | 124 | --svn=$(CONFIG_INTEL_CBNT_KM_SVN) \ |
| 125 | --id=$(CONFIG_INTEL_CBNT_KM_ID) \ |
| 126 | --pkhashalg=$(PK_HASH_ALG_SHA256) \ |
| 127 | --bpmpubkey=$(obj)/bpm_pub.pem \ |
| 128 | --bpmhashalgo=$(PK_HASH_ALG_SHA256) \ |
| 129 | --out=$(obj)/km_cfg.json |
| 130 | endif |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame] | 131 | |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 132 | $(obj)/km.bin: $(obj)/km_unsigned.bin $(CBNT_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE)) |
| 133 | printf " CBNT_PROV signing KM\n" |
| 134 | $(CBNT_PROV) km-sign $< $@ $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE) "" |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame] | 135 | |
| 136 | KM_FILE=$(obj)/km.bin |
| 137 | else |
| 138 | KM_FILE=$(CONFIG_INTEL_CBNT_KEY_MANIFEST_BINARY) |
| 139 | endif |
| 140 | |
| 141 | ifneq ($(KM_FILE),"") |
Arthur Heymans | 5e0119e | 2021-03-17 12:03:39 +0100 | [diff] [blame] | 142 | ifeq ($(CONFIG_INTEL_CBNT_KM_ONLY_UNSIGNED),y) |
| 143 | $(call add_intermediate, gen_unsigned_km, $(obj)/km_unsigned.bin) |
| 144 | @printf "Generating unsgined KM\n" |
| 145 | |
Martin Roth | 372503f | 2023-12-08 00:43:23 -0700 | [diff] [blame] | 146 | show_notices:: |
Arthur Heymans | 5e0119e | 2021-03-17 12:03:39 +0100 | [diff] [blame] | 147 | @printf "\n** WARNING **\n" |
| 148 | @printf "Build generated an unsigned KM image: build/km_unsiged.bin.\n" |
| 149 | @printf "The resulting image will not work with CBnT.\n" |
| 150 | @printf "After you have externally signed the image you can add it to the coreboot image:\n" |
| 151 | @printf "$$ cbfstool build/coreboot.rom add -f km.bin -n key_manifest.bin -t raw -a 16\n" |
| 152 | @printf "$$ ifittool -r COREBOOT -a -n key_manifest.bin -t 11 -s 12 -f build/coreboot.rom\n" |
| 153 | |
| 154 | else |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 155 | cbfs-files-y += key_manifest.bin |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame] | 156 | key_manifest.bin-file := $(KM_FILE) |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 157 | key_manifest.bin-type := raw |
| 158 | key_manifest.bin-align := 0x10 |
| 159 | |
Arthur Heymans | eeacd83 | 2021-02-19 17:14:23 +0100 | [diff] [blame] | 160 | $(call add_intermediate, add_km_fit, $(IFITTOOL) set_fit_ptr) |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 161 | $(IFITTOOL) -r COREBOOT -a -n key_manifest.bin -t 11 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $< |
| 162 | endif |
| 163 | |
Arthur Heymans | 5e0119e | 2021-03-17 12:03:39 +0100 | [diff] [blame] | 164 | endif # CONFIG_INTEL_CBNT_KM_ONLY_UNSIGNED |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 165 | endif # CONFIG_INTEL_CBNT_SUPPORT |