security/intel/cbnt: Add option to generate KM

This add an option to generate KM using the 9elements bg-prov tool
using a json config file.

The option to just include a provided KM binary is kept.

A template for the json config file can be obtained via
"bg-prov template".
Another option is to extract it from a working configuration:
"bg-prov read-config".

Change-Id: I18bbdd13047be634b8ee280a6b902096a65836e4
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/50409
Reviewed-by: Christian Walter <christian.walter@9elements.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>

2 files changed, 49 insertions, 2 deletions

diff --git a/src/security/intel/cbnt/Kconfig b/src/security/intel/cbnt/Kconfig
index 11e09200f0..8c4d999043 100644
--- a/src/security/intel/cbnt/Kconfig
+++ b/src/security/intel/cbnt/Kconfig
@@ -16,6 +16,25 @@ config INTEL_CBNT_SUPPORT
 
 if INTEL_CBNT_SUPPORT
 
+config INTEL_CBNT_GENERATE_KM
+	bool "Generate Key Manifest (KM)"
+	default y
+	select INTEL_CBNT_NEED_KM_PUB_KEY
+	select INTEL_CBNT_NEED_KM_PRIV_KEY
+	help
+	  Select y to generate the Key Manifest (KM).
+	  Select n to include a KM binary.
+
+config INTEL_CBNT_BG_PROV_CFG_FILE
+	string "CBnT json config file"
+	depends on INTEL_CBNT_GENERATE_KM
+	help
+	  Location of the bg-prov json config file.
+	  Either get a sample JSON config file:
+	  $ bg-prov template
+	  Or extract it from a working configuration:
+	  $ bg-prov read-config
+
 config INTEL_CBNT_NEED_KM_PUB_KEY
 	bool
 
@@ -54,6 +73,7 @@ config INTEL_CBNT_BPM_PRIV_KEY_FILE
 
 config INTEL_CBNT_KEY_MANIFEST_BINARY
 	string "KM (Key Manifest) binary location"
+	depends on !INTEL_CBNT_GENERATE_KM
 	help
 	  Location of the Key Manifest (KM)
 
diff --git a/src/security/intel/cbnt/Makefile.inc b/src/security/intel/cbnt/Makefile.inc
index 9f495048dd..b508974283 100644
--- a/src/security/intel/cbnt/Makefile.inc
+++ b/src/security/intel/cbnt/Makefile.inc
@@ -20,6 +20,19 @@ $(obj)/bpm_pub.pem: $(call strip_quotes, $(CONFIG_INTEL_CBNT_BPM_PUB_KEY_FILE))
 	cp $< $@
 endif
 
+BG_PROV:=$(obj)/bg-prov
+CBNT_CFG:=$(obj)/cbnt.json
+
+$(BG_PROV):
+	printf "    BG_PROV    building tool\n"
+	cd 3rdparty/intel-sec-tools; \
+	GO111MODULE=on go mod download; \
+	GO111MODULE=on go mod verify; \
+	GO111MODULE=on go build -o $(top)/$@ cmd/bg-prov/*.go
+
+$(CBNT_CFG): $(call strip_quotes, $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE))
+	cp $(CONFIG_INTEL_CBNT_BG_PROV_CFG_FILE) $@
+
 ifneq ($(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY),"")
 cbfs-files-y += boot_policy_manifest.bin
 boot_policy_manifest.bin-file := $(CONFIG_INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY)
@@ -30,9 +43,23 @@ $(call add_intermediate, add_bpm_fit, $(IFITTOOL) set_fit_ptr)
 	$(IFITTOOL) -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s $(CONFIG_CPU_INTEL_NUM_FIT_ENTRIES) -f $<
 endif
 
-ifneq ($(CONFIG_INTEL_CBNT_KEY_MANIFEST_BINARY),"")
+ifeq ($(CONFIG_INTEL_CBNT_GENERATE_KM),y)
+$(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(BG_PROV) $(CBNT_CFG)
+	printf "    BG_PROV    creating unsigned KM using config file\n"
+	$(BG_PROV) km-gen $@ $< --config=$(CBNT_CFG)
+
+$(obj)/km.bin: $(obj)/km_unsigned.bin $(BG_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE))
+	printf "    BG_PROV    signing KM\n"
+	$(BG_PROV) km-sign $< $@ $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE) ""
+
+KM_FILE=$(obj)/km.bin
+else
+KM_FILE=$(CONFIG_INTEL_CBNT_KEY_MANIFEST_BINARY)
+endif
+
+ifneq ($(KM_FILE),"")
 cbfs-files-y += key_manifest.bin
-key_manifest.bin-file := $(CONFIG_INTEL_CBNT_KEY_MANIFEST_BINARY)
+key_manifest.bin-file := $(KM_FILE)
 key_manifest.bin-type := raw
 key_manifest.bin-align := 0x10