1## SPDX-License-Identifier: GPL-2.0-only 2 3ifeq ($(CONFIG_INTEL_CBNT_SUPPORT),y) 4 5all-y += logging.c 6ramstage-y += cmos.c 7 8# As specified in Intel Trusted Execution Technology and Boot Guard Server BIOS 9# Specification, document number # 558294 10PK_HASH_ALG_SHA1:=4 11PK_HASH_ALG_SHA256:=11 12PK_HASH_ALG_SHA384:=12 13 14# The private key also contains the public key, so use that if a private key is provided. 15ifeq ($(CONFIG_INTEL_CBNT_NEED_KM_PRIV_KEY),y) 16$(obj)/km_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE)) 17 openssl pkey -in $< -pubout > $@ 18else ifeq ($(CONFIG_INTEL_CBNT_NEED_KM_PUB_KEY),y) 19$(obj)/km_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PUB_KEY_FILE)) 20 cp $< $@ 21endif 22 23# The private key also contains the public key, so use that if a private key is provided. 24ifeq ($(CONFIG_INTEL_CBNT_NEED_BPM_PRIV_KEY),y) 25$(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE)) 26 openssl pkey -in $< -pubout > $@ 27else ifeq ($(CONFIG_INTEL_CBNT_NEED_BPM_PUB_KEY),y) 28$(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PUB_KEY_FILE)) 29 cp $< $@ 30endif 31 32CBNT_PROV:=$(obj)/cbnt-prov 33CBNT_CFG:=$(obj)/cbnt.json 34 35ifneq ($(CONFIG_INTEL_CBNT_PROV_EXTERNAL_BIN),y) 36$(CBNT_PROV): 37 printf " CBNT_PROV building tool\n" 38 cd 3rdparty/intel-sec-tools; \ 39 GO111MODULE=on go build -o $(abspath $@) cmd/cbnt-prov/main.go cmd/cbnt-prov/cmd.go 40else 41$(CBNT_PROV): $(call strip_quotes, $(CONFIG_INTEL_CBNT_PROV_EXTERNAL_BIN_PATH)) 42 cp $< $@ 43endif 44 45$(CBNT_CFG): $(call strip_quotes, $(CONFIG_INTEL_CBNT_CBNT_PROV_CFG_FILE)) 46 cp $(CONFIG_INTEL_CBNT_CBNT_PROV_CFG_FILE) $@ 47 48ifeq ($(CONFIG_INTEL_CBNT_GENERATE_BPM),y) 49ifeq ($(CONFIG_INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE),y) 50$(obj)/bpm_unsigned.bin: $(obj)/coreboot.pre $(CBNT_PROV) $(CBNT_CFG) 51 printf " CBNT_PROV creating unsigned BPM using config file\n" 52 $(CBNT_PROV) bpm-gen $@ $< --config=$(CBNT_CFG) --cut 53else 54$(obj)/bpm_unsigned.bin: $(obj)/coreboot.pre $(CBNT_PROV) set_fit_ptr 55 printf " CBNT_PROV creating unsigned BPM\n" 56 $(CBNT_PROV) bpm-gen $@ $< --revision=$(CONFIG_INTEL_CBNT_BPM_REVISION) \ 57 --svn=$(CONFIG_INTEL_CBNT_BPM_SVN) \ 58 --acmsvn=$(CONFIG_INTEL_CBNT_ACM_SVN) \ 59 --nems=$(CONFIG_INTEL_CBNT_NUM_NEM_PAGES) \ 60 --pbet=$(CONFIG_INTEL_CBNT_PBET) \ 61 --ibbflags=$(CONFIG_INTEL_CBNT_IBB_FLAGS) \ 62 --entrypoint=$(shell printf "%d" 0xfffffff0) \ 63 --ibbhash=$(PK_HASH_ALG_SHA256),$(PK_HASH_ALG_SHA1),$(PK_HASH_ALG_SHA384) \ 64 --sinitmin=$(CONFIG_INTEL_CBNT_SINIT_SVN) \ 65 --txtflags=0 \ 66 --powerdowninterval=$(CONFIG_INTEL_CBNT_PD_INTERVAL) \ 67 --acpibaseoffset=$(shell printf "%d" $(CONFIG_INTEL_ACPI_BASE_ADDRESS)) \ 68 --powermbaseoffset=$(shell printf "%d" $(CONFIG_INTEL_PCH_PWRM_BASE_ADDRESS)) \ 69 --cmosoff0=$(shell printf "%d" $(CONFIG_INTEL_CBNT_CMOS_OFFSET)) \ 70 --cmosoff1=$(call int-add, $(CONFIG_INTEL_CBNT_CMOS_OFFSET) 1) \ 71 --cut \ 72 --out=$(obj)/bpm_cfg.json 73endif 74 75ifeq ($(CONFIG_INTEL_CBNT_BPM_ONLY_UNSIGNED),y) 76build_complete:: $(obj)/bpm_unsigned.bin 77 78show_notices:: 79 @printf "\n** WARNING **\n" 80 @printf "Build generated an unsigned BPM image: build/bpm_unsigned.bin.\n" 81 @printf "The resulting image will not work with CBnT.\n" 82 @printf "After you have externally signed the image you can add it to the coreboot image:\n" 83 @printf "$$ cbfstool build/coreboot.rom add -f bpm.bin -n boot_policy_manifest.bin -t raw -a 16\n" 84 @printf "$$ ifittool -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s 12 -f build/coreboot.rom\n" 85else 86$(obj)/bpm.bin: $(obj)/bpm_unsigned.bin $(CBNT_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE)) 87 printf " CBNT_PROV signing real BPM\n" 88 $(CBNT_PROV) bpm-sign $< $@ $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE) "" 89 90# Add BPM at the end of the build when all files have been added 91$(call add_intermediate, add_bpm, $(obj)/bpm.bin) 92 printf " CBNT Adding BPM\n" 93 -$(CBFSTOOL) $< remove -n boot_policy_manifest.bin 2>/dev/null 94 $(CBFSTOOL) $< add -f $(obj)/bpm.bin -n boot_policy_manifest.bin -a 0x10 -t raw 95 96$(call add_intermediate, fit_bpm, set_fit_ptr add_bpm $(IFITTOOL)) 97 printf " IFITTOOL Adding BPM\n" 98 $(IFITTOOL) -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $< 99 100endif # CONFIG_INTEL_CBNT_BPM_ONLY_UNSIGNED 101 102else # CONFIG_INTEL_CBNT_GENERATE_BPM 103 104ifneq ($(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY),"") 105cbfs-files-y += boot_policy_manifest.bin 106boot_policy_manifest.bin-file := $(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY) 107boot_policy_manifest.bin-type := raw 108boot_policy_manifest.bin-align := 0x10 109 110$(call add_intermediate, add_bpm_fit, $(IFITTOOL) set_fit_ptr) 111 $(IFITTOOL) -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $< 112endif 113endif # CONFIG_INTEL_CBNT_GENERATE_BPM 114 115ifeq ($(CONFIG_INTEL_CBNT_GENERATE_KM),y) 116ifeq ($(CONFIG_INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE),y) 117$(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(CBNT_PROV) $(CBNT_CFG) 118 printf " CBNT_PROV creating unsigned KM using config file\n" 119 $(CBNT_PROV) km-gen $@ $< --config=$(CBNT_CFG) 120else 121$(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(obj)/bpm_pub.pem $(CBNT_PROV) 122 printf " CBNT_PROV creating unsigned KM\n" 123 $(CBNT_PROV) km-gen $@ $< --revision=$(CONFIG_INTEL_CBNT_KM_REVISION) \ 124 --svn=$(CONFIG_INTEL_CBNT_KM_SVN) \ 125 --id=$(CONFIG_INTEL_CBNT_KM_ID) \ 126 --pkhashalg=$(PK_HASH_ALG_SHA256) \ 127 --bpmpubkey=$(obj)/bpm_pub.pem \ 128 --bpmhashalgo=$(PK_HASH_ALG_SHA256) \ 129 --out=$(obj)/km_cfg.json 130endif 131 132$(obj)/km.bin: $(obj)/km_unsigned.bin $(CBNT_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE)) 133 printf " CBNT_PROV signing KM\n" 134 $(CBNT_PROV) km-sign $< $@ $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE) "" 135 136KM_FILE=$(obj)/km.bin 137else 138KM_FILE=$(CONFIG_INTEL_CBNT_KEY_MANIFEST_BINARY) 139endif 140 141ifneq ($(KM_FILE),"") 142ifeq ($(CONFIG_INTEL_CBNT_KM_ONLY_UNSIGNED),y) 143$(call add_intermediate, gen_unsigned_km, $(obj)/km_unsigned.bin) 144 @printf "Generating unsgined KM\n" 145 146show_notices:: 147 @printf "\n** WARNING **\n" 148 @printf "Build generated an unsigned KM image: build/km_unsiged.bin.\n" 149 @printf "The resulting image will not work with CBnT.\n" 150 @printf "After you have externally signed the image you can add it to the coreboot image:\n" 151 @printf "$$ cbfstool build/coreboot.rom add -f km.bin -n key_manifest.bin -t raw -a 16\n" 152 @printf "$$ ifittool -r COREBOOT -a -n key_manifest.bin -t 11 -s 12 -f build/coreboot.rom\n" 153 154else 155cbfs-files-y += key_manifest.bin 156key_manifest.bin-file := $(KM_FILE) 157key_manifest.bin-type := raw 158key_manifest.bin-align := 0x10 159 160$(call add_intermediate, add_km_fit, $(IFITTOOL) set_fit_ptr) 161 $(IFITTOOL) -r COREBOOT -a -n key_manifest.bin -t 11 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $< 162endif 163 164endif # CONFIG_INTEL_CBNT_KM_ONLY_UNSIGNED 165endif # CONFIG_INTEL_CBNT_SUPPORT 166