GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security/intel/cbnt: Prepare for KM/BPM generation 

Private and/or public keys will be provided as user input via Kconfig.
As a private key also contains the public key, only ask what is required.

Change-Id: I86d129bb1d13d833a26281defad2a1cb5bf86595
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/51576
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Christian Walter <christian.walter@9elements.com>
This commit is contained in:
Arthur Heymans 2021-03-17 15:33:26 +01:00 committed by Patrick Georgi
parent 6482b16c7f
commit 21176ddd57
2 changed files with 54 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
src/security/intel/cbnt/Kconfig
View File

@ -16,6 +16,42 @@ config INTEL_CBNT_SUPPORT
if INTEL_CBNT_SUPPORT
config INTEL_CBNT_NEED_KM_PUB_KEY
bool
config INTEL_CBNT_NEED_KM_PRIV_KEY
bool
config INTEL_CBNT_KM_PUB_KEY_FILE
string "Key manifest (KM) public key"
depends on INTEL_CBNT_NEED_KM_PUB_KEY && !INTEL_CBNT_NEED_KM_PRIV_KEY
help
Location of the key manifest (KM) public key file in .pem format.
config INTEL_CBNT_KM_PRIV_KEY_FILE
string "Key manifest (KM) private key"
depends on INTEL_CBNT_NEED_KM_PRIV_KEY
help
Location of the key manifest (KM) private key file in .pem format.
config INTEL_CBNT_NEED_BPM_PUB_KEY
bool
config INTEL_CBNT_NEED_BPM_PRIV_KEY
bool
config INTEL_CBNT_BPM_PUB_KEY_FILE
string "Boot policy manifest (BPM) public key"
depends on INTEL_CBNT_NEED_BPM_PUB_KEY && !INTEL_CBNT_NEED_BPM_PRIV_KEY
help
Location of the boot policy manifest (BPM) public key file in .pem format.
config INTEL_CBNT_BPM_PRIV_KEY_FILE
string "Boot policy manifest (BPM) private key"
depends on INTEL_CBNT_NEED_BPM_PRIV_KEY
help
Location of the boot policy manifest (BPM) private key file in .pem format.
config INTEL_CBNT_KEY_MANIFEST_BINARY
string "KM (Key Manifest) binary location"
help

18
src/security/intel/cbnt/Makefile.inc
View File

@ -2,6 +2,24 @@ ifeq ($(CONFIG_INTEL_CBNT_SUPPORT),y)
ramstage-y += cmos.c
# The private key also contains the public key, so use that if a private key is provided.
ifeq ($(CONFIG_INTEL_CBNT_NEED_KM_PRIV_KEY),y)
$(obj)/km_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE))
openssl pkey -in $< -pubout > $@
else ifeq ($(CONFIG_INTEL_CBNT_NEED_KM_PUB_KEY),y)
$(obj)/km_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PUB_KEY_FILE))
cp $< $@
endif
# The private key also contains the public key, so use that if a private key is provided.
ifeq ($(CONFIG_INTEL_CBNT_NEED_BPM_PRIV_KEY),y)
$(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE))
openssl pkey -in $< -pubout > $@
else ifeq ($(CONFIG_INTEL_CBNT_NEED_BPM_PUB_KEY),y)
$(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PUB_KEY_FILE))
cp $< $@
endif
ifneq ($(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY),"")
cbfs-files-y += boot_policy_manifest.bin
boot_policy_manifest.bin-file := $(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY)