security/intel/cbnt: Add option to generate an unsigned BPM
Change-Id: Ic1b941f06b44bd3067e5b071af8f7a02499d7827 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/51573 Reviewed-by: Christian Walter <christian.walter@9elements.com> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This commit is contained in:
parent
15412c0681
commit
6362df3f5e
|
@ -50,11 +50,24 @@ config INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE
|
||||||
config INTEL_CBNT_GENERATE_BPM
|
config INTEL_CBNT_GENERATE_BPM
|
||||||
bool "Generate Boot Policy Manifest (BPM)"
|
bool "Generate Boot Policy Manifest (BPM)"
|
||||||
default y
|
default y
|
||||||
select INTEL_CBNT_NEED_BPM_PRIV_KEY
|
select INTEL_CBNT_NEED_BPM_PRIV_KEY if !INTEL_CBNT_BPM_ONLY_UNSIGNED
|
||||||
help
|
help
|
||||||
Select y to generate the Boot Policy Manifest (BPM).
|
Select y to generate the Boot Policy Manifest (BPM).
|
||||||
Select n to include a BPM binary.
|
Select n to include a BPM binary.
|
||||||
|
|
||||||
|
config INTEL_CBNT_BPM_ONLY_UNSIGNED
|
||||||
|
bool "Only unsigned boot policy manifest (BPM)"
|
||||||
|
depends on INTEL_CBNT_GENERATE_BPM
|
||||||
|
help
|
||||||
|
Skip signing the BPM.
|
||||||
|
The resulting unsigned BPM will be placed at build/bpm_unsigned.bin.
|
||||||
|
The resulting coreboot image will not be functional with CBnT.
|
||||||
|
After the unsigned BPM is signed externally you can add it to cbfs
|
||||||
|
and fit:
|
||||||
|
"$ cbfstool build/coreboot.rom add -f bpm.bin -n boot_policy_manifest.bin -t raw -a 16"
|
||||||
|
"$ ifittool -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s 12 -f build/coreboot.rom"
|
||||||
|
'-s 12' where 12 is CONFIG_CPU_INTEL_NUM_FIT_ENTRIES.
|
||||||
|
|
||||||
config INTEL_CBNT_BG_PROV_CFG_FILE
|
config INTEL_CBNT_BG_PROV_CFG_FILE
|
||||||
string "CBnT json config file"
|
string "CBnT json config file"
|
||||||
depends on INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE || INTEL_CBNT_GENERATE_BPM
|
depends on INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE || INTEL_CBNT_GENERATE_BPM
|
||||||
|
|
|
@ -38,6 +38,15 @@ $(obj)/bpm_unsigned.bin: $(obj)/coreboot.rom $(BG_PROV) $(CBNT_CFG)
|
||||||
printf " BG_PROV creating unsigned BPM using config file\n"
|
printf " BG_PROV creating unsigned BPM using config file\n"
|
||||||
$(BG_PROV) bpm-gen $@ $< --config=$(CBNT_CFG) --cut
|
$(BG_PROV) bpm-gen $@ $< --config=$(CBNT_CFG) --cut
|
||||||
|
|
||||||
|
ifeq ($(CONFIG_INTEL_CBNT_BPM_ONLY_UNSIGNED),y)
|
||||||
|
build_complete:: $(obj)/bpm_unsigned.bin
|
||||||
|
@printf "\n** WARNING **\n"
|
||||||
|
@printf "Build generated an unsigned BPM image: build/bpm_unsigned.bin.\n"
|
||||||
|
@printf "The resulting image will not work with CBnT.\n"
|
||||||
|
@printf "After you have externally signed the image you can add it to the coreboot image:\n"
|
||||||
|
@printf "$$ cbfstool build/coreboot.rom add -f bpm.bin -n boot_policy_manifest.bin -t raw -a 16\n"
|
||||||
|
@printf "$$ ifittool -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s 12 -f build/coreboot.rom\n"
|
||||||
|
else
|
||||||
$(obj)/bpm.bin: $(obj)/bpm_unsigned.bin $(BG_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE))
|
$(obj)/bpm.bin: $(obj)/bpm_unsigned.bin $(BG_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE))
|
||||||
printf " BG_PROV signing real BPM\n"
|
printf " BG_PROV signing real BPM\n"
|
||||||
$(BG_PROV) bpm-sign $< $@ $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE) ""
|
$(BG_PROV) bpm-sign $< $@ $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE) ""
|
||||||
|
@ -49,7 +58,10 @@ files_added:: $(obj)/bpm.bin
|
||||||
printf " IFITTOOL Adding BPM\n"
|
printf " IFITTOOL Adding BPM\n"
|
||||||
$(IFITTOOL) -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $(obj)/coreboot.rom
|
$(IFITTOOL) -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $(obj)/coreboot.rom
|
||||||
|
|
||||||
|
endif # CONFIG_INTEL_CBNT_BPM_ONLY_UNSIGNED
|
||||||
|
|
||||||
else # CONFIG_INTEL_CBNT_GENERATE_BPM
|
else # CONFIG_INTEL_CBNT_GENERATE_BPM
|
||||||
|
|
||||||
ifneq ($(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY),"")
|
ifneq ($(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY),"")
|
||||||
cbfs-files-y += boot_policy_manifest.bin
|
cbfs-files-y += boot_policy_manifest.bin
|
||||||
boot_policy_manifest.bin-file := $(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY)
|
boot_policy_manifest.bin-file := $(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY)
|
||||||
|
|
Loading…
Reference in New Issue