Arthur Heymans has submitted this change. ( https://review.coreboot.org/c/coreboot/+/50411 )
Change subject: security/intel/cbnt: Add option to generate BPM ......................................................................
security/intel/cbnt: Add option to generate BPM
This add an option to generate BPM using the 9elements bg-prov tool using a json config file.
A template for the json config file can be obtained via "bg-prov template". Another option is to extract it from a working configuration: "bg-prov read-config".
The option to just include a provided BPM binary is kept.
Change-Id: I38808ca56953b80bac36bd186932d6286a79bebe Signed-off-by: Arthur Heymans arthur@aheymans.xyz Reviewed-on: https://review.coreboot.org/c/coreboot/+/50411 Reviewed-by: Angel Pons th3fanbus@gmail.com Reviewed-by: Christian Walter christian.walter@9elements.com Tested-by: build bot (Jenkins) no-reply@coreboot.org --- M src/security/intel/cbnt/Kconfig M src/security/intel/cbnt/Makefile.inc 2 files changed, 28 insertions(+), 1 deletion(-)
Approvals: build bot (Jenkins): Verified Angel Pons: Looks good to me, but someone else must approve Christian Walter: Looks good to me, approved
diff --git a/src/security/intel/cbnt/Kconfig b/src/security/intel/cbnt/Kconfig index 6142a24..7df09b4 100644 --- a/src/security/intel/cbnt/Kconfig +++ b/src/security/intel/cbnt/Kconfig @@ -47,9 +47,17 @@ Select y to generate KM from a json config file. Select n to generate KM from Kconfig options
+config INTEL_CBNT_GENERATE_BPM + bool "Generate Boot Policy Manifest (BPM)" + default y + select INTEL_CBNT_NEED_BPM_PRIV_KEY + help + Select y to generate the Boot Policy Manifest (BPM). + Select n to include a BPM binary. + config INTEL_CBNT_BG_PROV_CFG_FILE string "CBnT json config file" - depends on INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE + depends on INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE || INTEL_CBNT_GENERATE_BPM help Location of the bg-prov json config file. Either get a sample JSON config file: @@ -140,6 +148,7 @@
config INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY string "BPM (Boot Policy Manifest) binary location" + depends on !INTEL_CBNT_GENERATE_BPM help Location of the Boot Policy Manifest (BPM)
diff --git a/src/security/intel/cbnt/Makefile.inc b/src/security/intel/cbnt/Makefile.inc index eae3079..b73a7ea 100644 --- a/src/security/intel/cbnt/Makefile.inc +++ b/src/security/intel/cbnt/Makefile.inc @@ -33,6 +33,23 @@ $(CBNT_CFG): $(call strip_quotes, $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE)) cp $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE) $@
+ifeq ($(CONFIG_INTEL_CBNT_GENERATE_BPM),y) +$(obj)/bpm_unsigned.bin: $(obj)/coreboot.rom $(BG_PROV) $(CBNT_CFG) + printf " BG_PROV creating unsigned BPM using config file\n" + $(BG_PROV) bpm-gen $@ $< --config=$(CBNT_CFG) --cut + +$(obj)/bpm.bin: $(obj)/bpm_unsigned.bin $(BG_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE)) + printf " BG_PROV signing real BPM\n" + $(BG_PROV) bpm-sign $< $@ $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE) "" + +# Add BPM at the end of the build when all files have been added +files_added:: $(obj)/bpm.bin + printf " CBNT Adding BPM\n" + $(CBFSTOOL) $(obj)/coreboot.rom add -f $< -n boot_policy_manifest.bin -a 0x10 -t raw + printf " IFITTOOL Adding BPM\n" + $(IFITTOOL) -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $(obj)/coreboot.rom + +else # CONFIG_INTEL_CBNT_GENERATE_BPM ifneq ($(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY),"") cbfs-files-y += boot_policy_manifest.bin boot_policy_manifest.bin-file := $(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY) @@ -42,6 +59,7 @@ $(call add_intermediate, add_bpm_fit, $(IFITTOOL) set_fit_ptr) $(IFITTOOL) -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $< endif +endif # CONFIG_INTEL_CBNT_GENERATE_BPM
ifeq ($(CONFIG_INTEL_CBNT_GENERATE_KM),y) ifeq ($(CONFIG_INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE),y)