security/intel/cbnt: Rename bg-prov to cbnt-prov
This prepares for updating the intel-sec-tools submodule pointer. In that submodule bg-prov got renamed to cbnt-prov as Intel Bootguard uses different structures and will require a different tool. Change-Id: I54a9f458e124d355d50b5edd8694dee39657bc0d Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/52970 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
This commit is contained in:
Arthur Heymans
parent
91b2024bae
commit
53164ba286
|
|
@ -22,7 +22,7 @@ config INTEL_CBNT_GENERATE_KM
|
|||
default y
|
||||
select INTEL_CBNT_NEED_KM_PUB_KEY
|
||||
select INTEL_CBNT_NEED_KM_PRIV_KEY if !INTEL_CBNT_KM_ONLY_UNSIGNED
|
||||
select INTEL_CBNT_NEED_BPM_PUB_KEY if !INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE
|
||||
select INTEL_CBNT_NEED_BPM_PUB_KEY if !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE
|
||||
help
|
||||
Select y to generate the Key Manifest (KM).
|
||||
Select n to include a KM binary.
|
||||
|
|
@ -40,7 +40,7 @@ config INTEL_CBNT_KM_ONLY_UNSIGNED
|
|||
"$ ifittool -r COREBOOT -a -n key_manifest.bin -t 11 -s 12 -f build/coreboot.rom"
|
||||
'-s 12' where 12 is CONFIG_CPU_INTEL_NUM_FIT_ENTRIES.
|
||||
|
||||
config INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE
|
||||
config INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE
|
||||
bool "KM: use a CBnT json config file"
|
||||
depends on INTEL_CBNT_GENERATE_KM
|
||||
default y
|
||||
|
|
@ -69,7 +69,7 @@ config INTEL_CBNT_BPM_ONLY_UNSIGNED
|
|||
"$ ifittool -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s 12 -f build/coreboot.rom"
|
||||
'-s 12' where 12 is CONFIG_CPU_INTEL_NUM_FIT_ENTRIES.
|
||||
|
||||
config INTEL_CBNT_BG_PROV_BPM_USE_CFG_FILE
|
||||
config INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE
|
||||
bool "BPM: use a CBnT json config file"
|
||||
depends on INTEL_CBNT_GENERATE_BPM
|
||||
default y
|
||||
|
|
@ -77,9 +77,9 @@ config INTEL_CBNT_BG_PROV_BPM_USE_CFG_FILE
|
|||
Select y to generate BPM from a json config file.
|
||||
Select n to generate BPM from Kconfig options
|
||||
|
||||
config INTEL_CBNT_BG_PROV_CFG_FILE
|
||||
config INTEL_CBNT_CBNT_PROV_CFG_FILE
|
||||
string "CBnT json config file"
|
||||
depends on INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE || INTEL_CBNT_BG_PROV_BPM_USE_CFG_FILE
|
||||
depends on INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE || INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE
|
||||
help
|
||||
Location of the bg-prov json config file.
|
||||
Either get a sample JSON config file:
|
||||
|
|
@ -123,7 +123,7 @@ config INTEL_CBNT_BPM_PRIV_KEY_FILE
|
|||
help
|
||||
Location of the boot policy manifest (BPM) private key file in .pem format.
|
||||
|
||||
if !INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE && INTEL_CBNT_GENERATE_KM
|
||||
if !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE && INTEL_CBNT_GENERATE_KM
|
||||
|
||||
menu "KM options"
|
||||
|
||||
|
|
@ -160,9 +160,9 @@ config INTEL_CBNT_KM_ID
|
|||
|
||||
endmenu
|
||||
|
||||
endif # !INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE
|
||||
endif # !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE
|
||||
|
||||
if !INTEL_CBNT_BG_PROV_BPM_USE_CFG_FILE && INTEL_CBNT_GENERATE_BPM
|
||||
if !INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE && INTEL_CBNT_GENERATE_BPM
|
||||
menu "BPM options"
|
||||
|
||||
config INTEL_CBNT_BPM_REVISION
|
||||
|
|
@ -221,7 +221,7 @@ config INTEL_CBNT_PD_INTERVAL
|
|||
|
||||
endmenu
|
||||
|
||||
endif # !INTEL_CBNT_BG_PROV_BPM_USE_CFG_FILE
|
||||
endif # !INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE
|
||||
|
||||
config INTEL_CBNT_KEY_MANIFEST_BINARY
|
||||
string "KM (Key Manifest) binary location"
|
||||
|
|
|
|||
|
|
@ -20,29 +20,29 @@ $(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PUB_KEY_FILE))
|
|||
cp $< $@
|
||||
endif
|
||||
|
||||
BG_PROV:=$(obj)/bg-prov
|
||||
CBNT_PROV:=$(obj)/cbnt-prov
|
||||
CBNT_CFG:=$(obj)/cbnt.json
|
||||
|
||||
$(BG_PROV):
|
||||
printf " BG_PROV building tool\n"
|
||||
$(CBNT_PROV):
|
||||
printf " CBNT_PROV building tool\n"
|
||||
cd 3rdparty/intel-sec-tools; \
|
||||
GO111MODULE=on go mod download; \
|
||||
GO111MODULE=on go mod verify; \
|
||||
GO111MODULE=on go build -o $(top)/$@ cmd/bg-prov/*.go
|
||||
|
||||
$(CBNT_CFG): $(call strip_quotes, $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE))
|
||||
cp $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE) $@
|
||||
$(CBNT_CFG): $(call strip_quotes, $(CONFIG_INTEL_CBNT_CBNT_PROV_CFG_FILE))
|
||||
cp $(CONFIG_INTEL_CBNT_CBNT_PROV_CFG_FILE) $@
|
||||
|
||||
ifeq ($(CONFIG_INTEL_CBNT_GENERATE_BPM),y)
|
||||
ifeq ($(CONFIG_INTEL_CBNT_BG_PROV_BPM_USE_CFG_FILE),y)
|
||||
$(obj)/bpm_unsigned.bin: $(obj)/coreboot.rom $(BG_PROV) $(CBNT_CFG)
|
||||
printf " BG_PROV creating unsigned BPM using config file\n"
|
||||
$(BG_PROV) bpm-gen $@ $< --config=$(CBNT_CFG) --cut
|
||||
ifeq ($(CONFIG_INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE),y)
|
||||
$(obj)/bpm_unsigned.bin: $(obj)/coreboot.rom $(CBNT_PROV) $(CBNT_CFG)
|
||||
printf " CBNT_PROV creating unsigned BPM using config file\n"
|
||||
$(CBNT_PROV) bpm-gen $@ $< --config=$(CBNT_CFG) --cut
|
||||
else
|
||||
$(obj)/bpm_unsigned.bin: $(obj)/coreboot.rom $(BG_PROV)
|
||||
printf " BG_PROV creating unsigned BPM\n"
|
||||
$(obj)/bpm_unsigned.bin: $(obj)/coreboot.rom $(CBNT_PROV)
|
||||
printf " CBNT_PROV creating unsigned BPM\n"
|
||||
# SHA256, SHA1, SHA384 for digest
|
||||
$(BG_PROV) bpm-gen $@ $< --revision=$(CONFIG_INTEL_CBNT_BPM_REVISION) \
|
||||
$(CBNT_PROV) bpm-gen $@ $< --revision=$(CONFIG_INTEL_CBNT_BPM_REVISION) \
|
||||
--svn=$(CONFIG_INTEL_CBNT_BPM_SVN) \
|
||||
--acmsvn=$(CONFIG_INTEL_CBNT_ACM_SVN) \
|
||||
--nems=$(CONFIG_INTEL_CBNT_NUM_NEM_PAGES) \
|
||||
|
|
@ -73,9 +73,9 @@ build_complete:: $(obj)/bpm_unsigned.bin
|
|||
@printf "$$ cbfstool build/coreboot.rom add -f bpm.bin -n boot_policy_manifest.bin -t raw -a 16\n"
|
||||
@printf "$$ ifittool -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s 12 -f build/coreboot.rom\n"
|
||||
else
|
||||
$(obj)/bpm.bin: $(obj)/bpm_unsigned.bin $(BG_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE))
|
||||
printf " BG_PROV signing real BPM\n"
|
||||
$(BG_PROV) bpm-sign $< $@ $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE) ""
|
||||
$(obj)/bpm.bin: $(obj)/bpm_unsigned.bin $(CBNT_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE))
|
||||
printf " CBNT_PROV signing real BPM\n"
|
||||
$(CBNT_PROV) bpm-sign $< $@ $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE) ""
|
||||
|
||||
# Add BPM at the end of the build when all files have been added
|
||||
files_added:: $(obj)/bpm.bin
|
||||
|
|
@ -100,15 +100,15 @@ endif
|
|||
endif # CONFIG_INTEL_CBNT_GENERATE_BPM
|
||||
|
||||
ifeq ($(CONFIG_INTEL_CBNT_GENERATE_KM),y)
|
||||
ifeq ($(CONFIG_INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE),y)
|
||||
$(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(BG_PROV) $(CBNT_CFG)
|
||||
printf " BG_PROV creating unsigned KM using config file\n"
|
||||
$(BG_PROV) km-gen $@ $< --config=$(CBNT_CFG)
|
||||
ifeq ($(CONFIG_INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE),y)
|
||||
$(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(CBNT_PROV) $(CBNT_CFG)
|
||||
printf " CBNT_PROV creating unsigned KM using config file\n"
|
||||
$(CBNT_PROV) km-gen $@ $< --config=$(CBNT_CFG)
|
||||
else
|
||||
PK_HASH_ALG_SHA256:=11 # Hardcode as no other options are available for CBnT
|
||||
$(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(obj)/bpm_pub.pem $(BG_PROV)
|
||||
printf " BG_PROV creating unsigned KM\n"
|
||||
$(BG_PROV) km-gen $@ $< --revision=$(CONFIG_INTEL_CBNT_KM_REVISION) \
|
||||
$(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(obj)/bpm_pub.pem $(CBNT_PROV)
|
||||
printf " CBNT_PROV creating unsigned KM\n"
|
||||
$(CBNT_PROV) km-gen $@ $< --revision=$(CONFIG_INTEL_CBNT_KM_REVISION) \
|
||||
--svn=$(CONFIG_INTEL_CBNT_KM_SVN) \
|
||||
--id=$(CONFIG_INTEL_CBNT_KM_ID) \
|
||||
--pkhashalg=$(PK_HASH_ALG_SHA256) \
|
||||
|
|
@ -117,9 +117,9 @@ $(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(obj)/bpm_pub.pem $(BG_PROV)
|
|||
--out=$(obj)/km_cfg.json
|
||||
endif
|
||||
|
||||
$(obj)/km.bin: $(obj)/km_unsigned.bin $(BG_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE))
|
||||
printf " BG_PROV signing KM\n"
|
||||
$(BG_PROV) km-sign $< $@ $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE) ""
|
||||
$(obj)/km.bin: $(obj)/km_unsigned.bin $(CBNT_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE))
|
||||
printf " CBNT_PROV signing KM\n"
|
||||
$(CBNT_PROV) km-sign $< $@ $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE) ""
|
||||
|
||||
KM_FILE=$(obj)/km.bin
|
||||
else
|
||||
|
|
|
|||
Loading…
Reference in New Issue