GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security/intel/cbnt: Add option to generate BPM 

This add an option to generate BPM using the 9elements bg-prov tool
using a json config file.

A template for the json config file can be obtained via
"bg-prov template".
Another option is to extract it from a working configuration:
"bg-prov read-config".

The option to just include a provided BPM binary is kept.

Change-Id: I38808ca56953b80bac36bd186932d6286a79bebe
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/50411
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Reviewed-by: Christian Walter <christian.walter@9elements.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This commit is contained in:
Arthur Heymans 2021-02-08 22:38:40 +01:00
parent 5e0119eaf6
commit 15412c0681
2 changed files with 28 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/security/intel/cbnt/Kconfig
View File

@ -47,9 +47,17 @@ config INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE
Select y to generate KM from a json config file. Select y to generate KM from a json config file.
Select n to generate KM from Kconfig options Select n to generate KM from Kconfig options
config INTEL_CBNT_GENERATE_BPM
bool "Generate Boot Policy Manifest (BPM)"
default y
select INTEL_CBNT_NEED_BPM_PRIV_KEY
help
Select y to generate the Boot Policy Manifest (BPM).
Select n to include a BPM binary.
config INTEL_CBNT_BG_PROV_CFG_FILE config INTEL_CBNT_BG_PROV_CFG_FILE
string "CBnT json config file" string "CBnT json config file"
depends on INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE depends on INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE || INTEL_CBNT_GENERATE_BPM
help help
Location of the bg-prov json config file. Location of the bg-prov json config file.
Either get a sample JSON config file: Either get a sample JSON config file:
@ -140,6 +148,7 @@ config INTEL_CBNT_KEY_MANIFEST_BINARY
config INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY config INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY
string "BPM (Boot Policy Manifest) binary location" string "BPM (Boot Policy Manifest) binary location"
depends on !INTEL_CBNT_GENERATE_BPM
help help
Location of the Boot Policy Manifest (BPM) Location of the Boot Policy Manifest (BPM)

18
src/security/intel/cbnt/Makefile.inc
View File

@ -33,6 +33,23 @@ $(BG_PROV):
$(CBNT_CFG): $(call strip_quotes, $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE)) $(CBNT_CFG): $(call strip_quotes, $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE))
cp $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE) $@ cp $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE) $@
ifeq ($(CONFIG_INTEL_CBNT_GENERATE_BPM),y)
$(obj)/bpm_unsigned.bin: $(obj)/coreboot.rom $(BG_PROV) $(CBNT_CFG)
printf " BG_PROV creating unsigned BPM using config file\n"
$(BG_PROV) bpm-gen $@ $< --config=$(CBNT_CFG) --cut
$(obj)/bpm.bin: $(obj)/bpm_unsigned.bin $(BG_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE))
printf " BG_PROV signing real BPM\n"
$(BG_PROV) bpm-sign $< $@ $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE) ""
# Add BPM at the end of the build when all files have been added
files_added:: $(obj)/bpm.bin
printf " CBNT Adding BPM\n"
$(CBFSTOOL) $(obj)/coreboot.rom add -f $< -n boot_policy_manifest.bin -a 0x10 -t raw
printf " IFITTOOL Adding BPM\n"
$(IFITTOOL) -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $(obj)/coreboot.rom
else # CONFIG_INTEL_CBNT_GENERATE_BPM
ifneq ($(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY),"") ifneq ($(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY),"")
cbfs-files-y += boot_policy_manifest.bin cbfs-files-y += boot_policy_manifest.bin
boot_policy_manifest.bin-file := $(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY) boot_policy_manifest.bin-file := $(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY)
@ -42,6 +59,7 @@ boot_policy_manifest.bin-align := 0x10
$(call add_intermediate, add_bpm_fit, $(IFITTOOL) set_fit_ptr) $(call add_intermediate, add_bpm_fit, $(IFITTOOL) set_fit_ptr)
$(IFITTOOL) -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $< $(IFITTOOL) -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $<
endif endif
endif # CONFIG_INTEL_CBNT_GENERATE_BPM
ifeq ($(CONFIG_INTEL_CBNT_GENERATE_KM),y) ifeq ($(CONFIG_INTEL_CBNT_GENERATE_KM),y)
ifeq ($(CONFIG_INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE),y) ifeq ($(CONFIG_INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE),y)