diff options
| -rw-r--r-- | src/security/vboot/Kconfig | 9 | ||||
| -rw-r--r-- | src/security/vboot/Makefile.inc | 70 |
2 files changed, 46 insertions, 33 deletions
diff --git a/src/security/vboot/Kconfig b/src/security/vboot/Kconfig index e03b51dd06..787cdbefb1 100644 --- a/src/security/vboot/Kconfig +++ b/src/security/vboot/Kconfig @@ -15,9 +15,18 @@ menu "Verified Boot (vboot)" +config VBOOT_LIB + bool + depends on !VENDORCODE_ELTAN_VBOOT && !VENDORCODE_ELTAN_MBOOT + help + Build and link the vboot library. Makes the vboot API accessible across + all coreboot stages, without enabling vboot verification. For verification, + please see the VBOOT option below. + config VBOOT bool "Verify firmware with vboot." default n + select VBOOT_LIB select VBOOT_MOCK_SECDATA if !TPM1 && !TPM2 depends on !MISSING_BOARD_RESET help diff --git a/src/security/vboot/Makefile.inc b/src/security/vboot/Makefile.inc index 8052549bde..a700e0051a 100644 --- a/src/security/vboot/Makefile.inc +++ b/src/security/vboot/Makefile.inc @@ -14,6 +14,43 @@ ## GNU General Public License for more details. ## +ifeq ($(CONFIG_VBOOT_LIB),y) + +vboot-fixup-includes = $(patsubst -I%,-I$(top)/%,\ + $(patsubst $(src)/%.h,$(top)/$(src)/%.h,\ + $(filter-out -I$(obj),$(1)))) + +# call with $1 = stage name to create rules for building the library +# for the stage and adding it to the stage's set of object files. +define vboot-for-stage +VBOOT_LIB_$(1) = $(obj)/external/vboot_reference-$(1)/vboot_fw.a +VBOOT_CFLAGS_$(1) += $$(call vboot-fixup-includes,$$(CPPFLAGS_$(1))) +VBOOT_CFLAGS_$(1) += $$(CFLAGS_$(1)) +VBOOT_CFLAGS_$(1) += $$(call vboot-fixup-includes,$$($(1)-c-ccopts)) +VBOOT_CFLAGS_$(1) += -I$(abspath $(obj)) -Wno-missing-prototypes +VBOOT_CFLAGS_$(1) += -DVBOOT_DEBUG + +$$(VBOOT_LIB_$(1)): $(obj)/config.h + printf " MAKE $(subst $(obj)/,,$(@))\n" + +FIRMWARE_ARCH=$$(ARCHDIR-$$(ARCH-$(1)-y)) \ + CC="$$(CC_$(1))" \ + CFLAGS="$$(VBOOT_CFLAGS_$(1))" VBOOT2="y" \ + $(MAKE) -C $(VBOOT_SOURCE) \ + BUILD=$$(abspath $$(dir $$(VBOOT_LIB_$(1)))) \ + V=$(V) \ + fwlib + +$(1)-srcs += $$(VBOOT_LIB_$(1)) + +endef # vboot-for-stage + +$(eval $(call vboot-for-stage,bootblock)) +$(eval $(call vboot-for-stage,romstage)) +$(eval $(call vboot-for-stage,ramstage)) +$(eval $(call vboot-for-stage,postcar)) + +endif # CONFIG_VBOOT_LIB + ifeq ($(CONFIG_VBOOT),y) bootblock-y += bootmode.c @@ -95,39 +132,6 @@ postcar-y += common.c romstage-$(CONFIG_FSP2_0_USES_TPM_MRC_HASH) += mrc_cache_hash_tpm.c -vboot-fixup-includes = $(patsubst -I%,-I$(top)/%,\ - $(patsubst $(src)/%.h,$(top)/$(src)/%.h,\ - $(filter-out -I$(obj),$(1)))) - -# call with $1 = stage name to create rules for building the library -# for the stage and adding it to the stage's set of object files. -define vboot-for-stage -VBOOT_LIB_$(1) = $(obj)/external/vboot_reference-$(1)/vboot_fw.a -VBOOT_CFLAGS_$(1) += $$(call vboot-fixup-includes,$$(CPPFLAGS_$(1))) -VBOOT_CFLAGS_$(1) += $$(CFLAGS_$(1)) -VBOOT_CFLAGS_$(1) += $$(call vboot-fixup-includes,$$($(1)-c-ccopts)) -VBOOT_CFLAGS_$(1) += -I$(abspath $(obj)) -Wno-missing-prototypes -VBOOT_CFLAGS_$(1) += -DVBOOT_DEBUG - -$$(VBOOT_LIB_$(1)): $(obj)/config.h - printf " MAKE $(subst $(obj)/,,$(@))\n" - +FIRMWARE_ARCH=$$(ARCHDIR-$$(ARCH-$(1)-y)) \ - CC="$$(CC_$(1))" \ - CFLAGS="$$(VBOOT_CFLAGS_$(1))" VBOOT2="y" \ - $(MAKE) -C $(VBOOT_SOURCE) \ - BUILD=$$(abspath $$(dir $$(VBOOT_LIB_$(1)))) \ - V=$(V) \ - fwlib - -$(1)-srcs += $$(VBOOT_LIB_$(1)) - -endef # vboot-for-stage - -$(eval $(call vboot-for-stage,bootblock)) -$(eval $(call vboot-for-stage,romstage)) -$(eval $(call vboot-for-stage,ramstage)) -$(eval $(call vboot-for-stage,postcar)) - ifeq ($(CONFIG_VBOOT_SEPARATE_VERSTAGE),y) $(eval $(call vboot-for-stage,verstage)) |