From 53164ba286dad6fbf5328ec8cacc346ee660ebdb Mon Sep 17 00:00:00 2001 From: Arthur Heymans Date: Thu, 6 May 2021 11:15:32 +0200 Subject: security/intel/cbnt: Rename bg-prov to cbnt-prov This prepares for updating the intel-sec-tools submodule pointer. In that submodule bg-prov got renamed to cbnt-prov as Intel Bootguard uses different structures and will require a different tool. Change-Id: I54a9f458e124d355d50b5edd8694dee39657bc0d Signed-off-by: Arthur Heymans Reviewed-on: https://review.coreboot.org/c/coreboot/+/52970 Tested-by: build bot (Jenkins) Reviewed-by: Angel Pons --- src/security/intel/cbnt/Kconfig | 18 ++++++------- src/security/intel/cbnt/Makefile.inc | 50 ++++++++++++++++++------------------ 2 files changed, 34 insertions(+), 34 deletions(-) diff --git a/src/security/intel/cbnt/Kconfig b/src/security/intel/cbnt/Kconfig index 9208ab42cefc..a602cca1f62d 100644 --- a/src/security/intel/cbnt/Kconfig +++ b/src/security/intel/cbnt/Kconfig @@ -22,7 +22,7 @@ config INTEL_CBNT_GENERATE_KM default y select INTEL_CBNT_NEED_KM_PUB_KEY select INTEL_CBNT_NEED_KM_PRIV_KEY if !INTEL_CBNT_KM_ONLY_UNSIGNED - select INTEL_CBNT_NEED_BPM_PUB_KEY if !INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE + select INTEL_CBNT_NEED_BPM_PUB_KEY if !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE help Select y to generate the Key Manifest (KM). Select n to include a KM binary. @@ -40,7 +40,7 @@ config INTEL_CBNT_KM_ONLY_UNSIGNED "$ ifittool -r COREBOOT -a -n key_manifest.bin -t 11 -s 12 -f build/coreboot.rom" '-s 12' where 12 is CONFIG_CPU_INTEL_NUM_FIT_ENTRIES. -config INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE +config INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE bool "KM: use a CBnT json config file" depends on INTEL_CBNT_GENERATE_KM default y @@ -69,7 +69,7 @@ config INTEL_CBNT_BPM_ONLY_UNSIGNED "$ ifittool -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s 12 -f build/coreboot.rom" '-s 12' where 12 is CONFIG_CPU_INTEL_NUM_FIT_ENTRIES. -config INTEL_CBNT_BG_PROV_BPM_USE_CFG_FILE +config INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE bool "BPM: use a CBnT json config file" depends on INTEL_CBNT_GENERATE_BPM default y @@ -77,9 +77,9 @@ config INTEL_CBNT_BG_PROV_BPM_USE_CFG_FILE Select y to generate BPM from a json config file. Select n to generate BPM from Kconfig options -config INTEL_CBNT_BG_PROV_CFG_FILE +config INTEL_CBNT_CBNT_PROV_CFG_FILE string "CBnT json config file" - depends on INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE || INTEL_CBNT_BG_PROV_BPM_USE_CFG_FILE + depends on INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE || INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE help Location of the bg-prov json config file. Either get a sample JSON config file: @@ -123,7 +123,7 @@ config INTEL_CBNT_BPM_PRIV_KEY_FILE help Location of the boot policy manifest (BPM) private key file in .pem format. -if !INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE && INTEL_CBNT_GENERATE_KM +if !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE && INTEL_CBNT_GENERATE_KM menu "KM options" @@ -160,9 +160,9 @@ config INTEL_CBNT_KM_ID endmenu -endif # !INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE +endif # !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE -if !INTEL_CBNT_BG_PROV_BPM_USE_CFG_FILE && INTEL_CBNT_GENERATE_BPM +if !INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE && INTEL_CBNT_GENERATE_BPM menu "BPM options" config INTEL_CBNT_BPM_REVISION @@ -221,7 +221,7 @@ config INTEL_CBNT_PD_INTERVAL endmenu -endif # !INTEL_CBNT_BG_PROV_BPM_USE_CFG_FILE +endif # !INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE config INTEL_CBNT_KEY_MANIFEST_BINARY string "KM (Key Manifest) binary location" diff --git a/src/security/intel/cbnt/Makefile.inc b/src/security/intel/cbnt/Makefile.inc index 0eea0a7b6cd5..93c2aff0f23d 100644 --- a/src/security/intel/cbnt/Makefile.inc +++ b/src/security/intel/cbnt/Makefile.inc @@ -20,29 +20,29 @@ $(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PUB_KEY_FILE)) cp $< $@ endif -BG_PROV:=$(obj)/bg-prov +CBNT_PROV:=$(obj)/cbnt-prov CBNT_CFG:=$(obj)/cbnt.json -$(BG_PROV): - printf " BG_PROV building tool\n" +$(CBNT_PROV): + printf " CBNT_PROV building tool\n" cd 3rdparty/intel-sec-tools; \ GO111MODULE=on go mod download; \ GO111MODULE=on go mod verify; \ GO111MODULE=on go build -o $(top)/$@ cmd/bg-prov/*.go -$(CBNT_CFG): $(call strip_quotes, $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE)) - cp $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE) $@ +$(CBNT_CFG): $(call strip_quotes, $(CONFIG_INTEL_CBNT_CBNT_PROV_CFG_FILE)) + cp $(CONFIG_INTEL_CBNT_CBNT_PROV_CFG_FILE) $@ ifeq ($(CONFIG_INTEL_CBNT_GENERATE_BPM),y) -ifeq ($(CONFIG_INTEL_CBNT_BG_PROV_BPM_USE_CFG_FILE),y) -$(obj)/bpm_unsigned.bin: $(obj)/coreboot.rom $(BG_PROV) $(CBNT_CFG) - printf " BG_PROV creating unsigned BPM using config file\n" - $(BG_PROV) bpm-gen $@ $< --config=$(CBNT_CFG) --cut +ifeq ($(CONFIG_INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE),y) +$(obj)/bpm_unsigned.bin: $(obj)/coreboot.rom $(CBNT_PROV) $(CBNT_CFG) + printf " CBNT_PROV creating unsigned BPM using config file\n" + $(CBNT_PROV) bpm-gen $@ $< --config=$(CBNT_CFG) --cut else -$(obj)/bpm_unsigned.bin: $(obj)/coreboot.rom $(BG_PROV) - printf " BG_PROV creating unsigned BPM\n" +$(obj)/bpm_unsigned.bin: $(obj)/coreboot.rom $(CBNT_PROV) + printf " CBNT_PROV creating unsigned BPM\n" # SHA256, SHA1, SHA384 for digest - $(BG_PROV) bpm-gen $@ $< --revision=$(CONFIG_INTEL_CBNT_BPM_REVISION) \ + $(CBNT_PROV) bpm-gen $@ $< --revision=$(CONFIG_INTEL_CBNT_BPM_REVISION) \ --svn=$(CONFIG_INTEL_CBNT_BPM_SVN) \ --acmsvn=$(CONFIG_INTEL_CBNT_ACM_SVN) \ --nems=$(CONFIG_INTEL_CBNT_NUM_NEM_PAGES) \ @@ -73,9 +73,9 @@ build_complete:: $(obj)/bpm_unsigned.bin @printf "$$ cbfstool build/coreboot.rom add -f bpm.bin -n boot_policy_manifest.bin -t raw -a 16\n" @printf "$$ ifittool -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s 12 -f build/coreboot.rom\n" else -$(obj)/bpm.bin: $(obj)/bpm_unsigned.bin $(BG_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE)) - printf " BG_PROV signing real BPM\n" - $(BG_PROV) bpm-sign $< $@ $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE) "" +$(obj)/bpm.bin: $(obj)/bpm_unsigned.bin $(CBNT_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE)) + printf " CBNT_PROV signing real BPM\n" + $(CBNT_PROV) bpm-sign $< $@ $(CONFIG_INTEL_CBNT_BPM_PRIV_KEY_FILE) "" # Add BPM at the end of the build when all files have been added files_added:: $(obj)/bpm.bin @@ -100,15 +100,15 @@ endif endif # CONFIG_INTEL_CBNT_GENERATE_BPM ifeq ($(CONFIG_INTEL_CBNT_GENERATE_KM),y) -ifeq ($(CONFIG_INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE),y) -$(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(BG_PROV) $(CBNT_CFG) - printf " BG_PROV creating unsigned KM using config file\n" - $(BG_PROV) km-gen $@ $< --config=$(CBNT_CFG) +ifeq ($(CONFIG_INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE),y) +$(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(CBNT_PROV) $(CBNT_CFG) + printf " CBNT_PROV creating unsigned KM using config file\n" + $(CBNT_PROV) km-gen $@ $< --config=$(CBNT_CFG) else PK_HASH_ALG_SHA256:=11 # Hardcode as no other options are available for CBnT -$(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(obj)/bpm_pub.pem $(BG_PROV) - printf " BG_PROV creating unsigned KM\n" - $(BG_PROV) km-gen $@ $< --revision=$(CONFIG_INTEL_CBNT_KM_REVISION) \ +$(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(obj)/bpm_pub.pem $(CBNT_PROV) + printf " CBNT_PROV creating unsigned KM\n" + $(CBNT_PROV) km-gen $@ $< --revision=$(CONFIG_INTEL_CBNT_KM_REVISION) \ --svn=$(CONFIG_INTEL_CBNT_KM_SVN) \ --id=$(CONFIG_INTEL_CBNT_KM_ID) \ --pkhashalg=$(PK_HASH_ALG_SHA256) \ @@ -117,9 +117,9 @@ $(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(obj)/bpm_pub.pem $(BG_PROV) --out=$(obj)/km_cfg.json endif -$(obj)/km.bin: $(obj)/km_unsigned.bin $(BG_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE)) - printf " BG_PROV signing KM\n" - $(BG_PROV) km-sign $< $@ $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE) "" +$(obj)/km.bin: $(obj)/km_unsigned.bin $(CBNT_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE)) + printf " CBNT_PROV signing KM\n" + $(CBNT_PROV) km-sign $< $@ $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE) "" KM_FILE=$(obj)/km.bin else -- cgit v1.2.3