src/security/vboot/Makefile.mk

   1 ## SPDX-License-Identifier: GPL-2.0-only
   2
   3 ifeq ($(CONFIG_VBOOT_LIB),y)
   4
   5 bootblock-y += vboot_lib.c
   6 verstage-y += vboot_lib.c
   7 romstage-y += vboot_lib.c
   8 ramstage-y += vboot_lib.c
   9 postcar-y += vboot_lib.c
  10
  11 vboot-fixup-includes = $(patsubst -I%,-I$(top)/%,\
  12                        $(patsubst $(src)/%.h,$(top)/$(src)/%.h,\
  13                        $(filter-out -I$(obj),$(1))))
  14
  15 # call with $1 = stage name to create rules for building the library
  16 # for the stage and adding it to the stage's set of object files.
  17 define vboot-for-stage
  18 VBOOT_LIB_$(1) = $(obj)/external/vboot_reference-$(1)/vboot_fw.a
  19 VBOOT_CFLAGS_$(1) += $$(call vboot-fixup-includes,$$(CPPFLAGS_$(1)))
  20 VBOOT_CFLAGS_$(1) += $$(CFLAGS_$(1))
  21 VBOOT_CFLAGS_$(1) += $$(call vboot-fixup-includes,$$($(1)-c-ccopts))
  22 VBOOT_CFLAGS_$(1) += -I$(abspath $(obj)) -Wno-missing-prototypes
  23 VBOOT_CFLAGS_$(1) += -DVBOOT_DEBUG
  24
  25 $$(VBOOT_LIB_$(1)): $(obj)/config.h
  26         printf "    MAKE       $(subst $(obj)/,,$(@))\n"
  27         +FIRMWARE_ARCH=$$(ARCHDIR-$$(ARCH-$(1)-y)) \
  28         CC="$$(CC_$(1))" \
  29         CFLAGS="$$(VBOOT_CFLAGS_$(1))" VBOOT2="y" \
  30         EC_EFS="$(CONFIG_VBOOT_EC_EFS)" \
  31         X86_SHA_EXT="$(if $(CONFIG_ARCH_$(call toupper,$(1))_X86_32)$(CONFIG_ARCH_$(call toupper,$(1))_X86_64),$\
  32                         $(CONFIG_VBOOT_X86_SHA256_ACCELERATION))" \
  33         VB2_X86_RSA_ACCELERATION="$(if $(CONFIG_ARCH_$(call toupper,$(1))_X86_32)$(CONFIG_ARCH_$(call toupper,$(1))_X86_64),$\
  34                         $(CONFIG_VBOOT_X86_RSA_ACCELERATION))" \
  35         ARMV8_CRYPTO_EXT="$(if $(CONFIG_ARCH_$(call toupper,$(1))_ARMV8_64),$$(CONFIG_VBOOT_ARMV8_CE_SHA256_ACCELERATION))" \
  36         ARM64_RSA_ACCELERATION="$(if $(CONFIG_ARCH_$(call toupper,$(1))_ARM64),$$(CONFIG_VBOOT_ARM64_RSA_ACCELERATION))" \
  37         $(MAKE) -C $(VBOOT_SOURCE) \
  38                 BUILD=$$(abspath $$(dir $$(VBOOT_LIB_$(1)))) \
  39                 V=$(V) \
  40                 USE_FLASHROM=0 \
  41                 fwlib \
  42                 $(if $(CONFIG_SBOM_VBOOT),$$(abspath $$(dir $$(VBOOT_LIB_$(1))))/vboot_host.pc)
  43
  44 .PHONY: $$(VBOOT_LIB_$(1))
  45
  46 $(1)-srcs += $$(VBOOT_LIB_$(1))
  47
  48 endef # vboot-for-stage
  49
  50 $(eval $(call vboot-for-stage,bootblock))
  51 ifeq ($(CONFIG_SEPARATE_ROMSTAGE),y)
  52 $(eval $(call vboot-for-stage,romstage))
  53 endif
  54 $(eval $(call vboot-for-stage,ramstage))
  55 $(eval $(call vboot-for-stage,postcar))
  56
  57 endif # CONFIG_VBOOT_LIB
  58
  59 ifeq ($(CONFIG_VBOOT),y)
  60
  61 bootblock-y += bootmode.c
  62 romstage-y += bootmode.c
  63 ramstage-y += bootmode.c
  64 verstage-y += bootmode.c
  65 postcar-y += bootmode.c
  66
  67 verstage-generic-ccopts += -D__VERSTAGE__
  68
  69 bootblock-y += vbnv.c
  70 verstage-y += vbnv.c
  71 romstage-y += vbnv.c
  72 ramstage-y += vbnv.c
  73 postcar-y += vbnv.c
  74
  75 romstage-$(CONFIG_VBOOT_EARLY_EC_SYNC) += ec_sync.c
  76
  77 bootblock-$(CONFIG_VBOOT_VBNV_CMOS) += vbnv_cmos.c
  78 verstage-$(CONFIG_VBOOT_VBNV_CMOS) += vbnv_cmos.c
  79 romstage-$(CONFIG_VBOOT_VBNV_CMOS) += vbnv_cmos.c
  80 ramstage-$(CONFIG_VBOOT_VBNV_CMOS) += vbnv_cmos.c
  81 postcar-$(CONFIG_VBOOT_VBNV_CMOS) += vbnv_cmos.c
  82
  83 bootblock-$(CONFIG_VBOOT_VBNV_CMOS_BACKUP_TO_FLASH) += vbnv_flash.c
  84 verstage-$(CONFIG_VBOOT_VBNV_CMOS_BACKUP_TO_FLASH) += vbnv_flash.c
  85 romstage-$(CONFIG_VBOOT_VBNV_CMOS_BACKUP_TO_FLASH) += vbnv_flash.c
  86 ramstage-$(CONFIG_VBOOT_VBNV_CMOS_BACKUP_TO_FLASH) += vbnv_flash.c
  87 postcar-$(CONFIG_VBOOT_VBNV_CMOS_BACKUP_TO_FLASH) += vbnv_flash.c
  88
  89 bootblock-$(CONFIG_VBOOT_VBNV_FLASH) += vbnv_flash.c
  90 verstage-$(CONFIG_VBOOT_VBNV_FLASH) += vbnv_flash.c
  91 romstage-$(CONFIG_VBOOT_VBNV_FLASH) += vbnv_flash.c
  92 ramstage-$(CONFIG_VBOOT_VBNV_FLASH) += vbnv_flash.c
  93 postcar-$(CONFIG_VBOOT_VBNV_FLASH) += vbnv_flash.c
  94
  95 bootblock-y += vboot_loader.c
  96 romstage-y += vboot_loader.c
  97 ramstage-y += vboot_loader.c
  98 verstage-y += vboot_loader.c
  99 postcar-y += vboot_loader.c
 100
 101 bootblock-y += vboot_common.c
 102 verstage-y += vboot_common.c
 103 romstage-y += vboot_common.c
 104 ramstage-y += vboot_common.c
 105 postcar-y += vboot_common.c
 106
 107 bootblock-y += common.c
 108 verstage-y += vboot_logic.c
 109 verstage-y += common.c
 110 ifeq ($(CONFIG_VBOOT_STARTS_BEFORE_BOOTBLOCK),)
 111 verstage-$(CONFIG_VBOOT_SEPARATE_VERSTAGE) += verstage.c
 112 endif
 113 ifeq (${CONFIG_VBOOT_MOCK_SECDATA},y)
 114 verstage-y += secdata_mock.c
 115 romstage-y += secdata_mock.c
 116 ramstage-y += secdata_mock.c
 117 else
 118 verstage-y += secdata_tpm.c
 119 romstage-y += secdata_tpm.c
 120 ramstage-y += secdata_tpm.c
 121
 122 verstage-$(CONFIG_TPM1) += secdata_tpm1.c
 123 romstage-$(CONFIG_TPM1) += secdata_tpm1.c
 124 ramstage-$(CONFIG_TPM1) += secdata_tpm1.c
 125
 126 verstage-$(CONFIG_TPM2) += secdata_tpm2.c
 127 romstage-$(CONFIG_TPM2) += secdata_tpm2.c
 128 ramstage-$(CONFIG_TPM2) += secdata_tpm2.c
 129 endif
 130
 131 verstage-$(CONFIG_TPM) += tpm_common.c
 132
 133 romstage-y += common.c
 134
 135 ramstage-y += common.c
 136 postcar-y += common.c
 137
 138 romstage-$(CONFIG_MRC_SAVE_HASH_IN_TPM) += mrc_cache_hash_tpm.c
 139 ramstage-$(CONFIG_MRC_SAVE_HASH_IN_TPM) += mrc_cache_hash_tpm.c
 140
 141 ramstage-$(CONFIG_SOC_AMD_GFX_CACHE_VBIOS_IN_FMAP) += vbios_cache_hash_tpm.c
 142
 143 ifeq ($(CONFIG_VBOOT_X86_RSA_ACCELERATION),y)
 144 CPPFLAGS_common += -DVB2_X86_RSA_ACCELERATION
 145 endif
 146
 147 ifeq ($(CONFIG_VBOOT_SEPARATE_VERSTAGE),y)
 148
 149 $(eval $(call vboot-for-stage,verstage))
 150
 151 ifeq ($(CONFIG_VBOOT_STARTS_BEFORE_BOOTBLOCK),)
 152 cbfs-files-$(CONFIG_VBOOT_SEPARATE_VERSTAGE) += $(CONFIG_CBFS_PREFIX)/verstage
 153 $(CONFIG_CBFS_PREFIX)/verstage-file := $(objcbfs)/verstage.elf
 154 $(CONFIG_CBFS_PREFIX)/verstage-type := stage
 155 $(CONFIG_CBFS_PREFIX)/verstage-compression := $(CBFS_PRERAM_COMPRESS_FLAG)
 156 endif   # CONFIG_VBOOT_STARTS_BEFORE_BOOTBLOCK
 157
 158 ifeq ($(CONFIG_ARCH_VERSTAGE_X86_32)$(CONFIG_ARCH_VERSTAGE_X86_64),y)
 159 $(CONFIG_CBFS_PREFIX)/verstage-options := -a 64
 160 ifeq ($(CONFIG_NO_XIP_EARLY_STAGES),y)
 161 $(CONFIG_CBFS_PREFIX)/verstage-options += -S ".car.data"
 162 else
 163 $(CONFIG_CBFS_PREFIX)/verstage-options += -S ".car.data,.data"
 164 endif
 165
 166 # If CAR does not support execution of code, verstage on x86 is expected to be
 167 # xip.
 168 ifneq ($(CONFIG_NO_XIP_EARLY_STAGES),y)
 169 $(CONFIG_CBFS_PREFIX)/verstage-options += --xip
 170 endif
 171
 172 endif
 173 $(CONFIG_CBFS_PREFIX)/verstage-options += $(TXTIBB)
 174
 175 else # CONFIG_VBOOT_SEPARATE_VERSTAGE
 176 ifeq ($(CONFIG_VBOOT_STARTS_IN_BOOTBLOCK),y)
 177 postinclude-hooks += $$(eval bootblock-srcs += $$(verstage-srcs))
 178 else
 179 ifeq ($(CONFIG_SEPARATE_ROMSTAGE),y)
 180 postinclude-hooks += $$(eval romstage-srcs += $$(verstage-srcs))
 181 else
 182 postinclude-hooks += $$(eval bootblock-srcs += $$(verstage-srcs))
 183 endif
 184 endif
 185 endif # CONFIG_VBOOT_SEPARATE_VERSTAGE
 186
 187 #RO-Partition is always there!
 188 VBOOT_PARTITIONS := COREBOOT
 189 # Check for RW_A partition
 190 ifeq ($(CONFIG_VBOOT_SLOTS_RW_A),y)
 191 VBOOT_PARTITIONS += FW_MAIN_A
 192 RW_PARTITIONS := FW_MAIN_A
 193 endif
 194 # Check for RW_B partition
 195 ifeq ($(CONFIG_VBOOT_SLOTS_RW_AB),y)
 196 VBOOT_PARTITIONS += FW_MAIN_B
 197 RW_PARTITIONS += FW_MAIN_B
 198 endif
 199
 200 # Return the regions a specific file should be placed in. The files listed below and the ones
 201 # that are specified in CONFIG_RO_REGION_ONLY, are only specified in the RO region. The files
 202 # specified in the CONFIG_RW_REGION_ONLY are placed in all RW regions.  Files specified
 203 # in CONFIG_RWA_REGION_ONLY or CONFIG_RWB_REGION_ONLY get placed only in those sections.
 204 # All other files will be installed into RO and RW regions
 205 # Use $(sort) to cut down on extra spaces that would be translated to commas
 206 regions-for-file = $(subst $(spc),$(comma),$(sort \
 207         $(if $(value regions-for-file-$(1)), \
 208                 $(regions-for-file-$(1)), \
 209                 $(if $(filter $(if $(filter y,$(CONFIG_VBOOT_STARTS_IN_ROMSTAGE)), \
 210                         %/romstage,) \
 211                 header_pointer \
 212                 cbfs_master_header \
 213                 mts \
 214                 %/verstage \
 215                 locales \
 216                 locale_%.bin \
 217                 font.bin \
 218                 vbgfx.bin \
 219                 rmu.bin \
 220                 cmos_layout.bin \
 221                 cmos.default \
 222                 intel_fit \
 223                 intel_fit_ts \
 224                 fspt.bin \
 225                 pagetables \
 226                 $(call strip_quotes,$(CONFIG_RO_REGION_ONLY)) \
 227                 ,$(1)),COREBOOT,\
 228                 $(if $(filter \
 229                 $(call strip_quotes,$(CONFIG_RWA_REGION_ONLY)) \
 230                 ,$(1)), FW_MAIN_A, \
 231                 $(if $(filter \
 232                         $(call strip_quotes,$(CONFIG_RWB_REGION_ONLY)) \
 233                         ,$(1)), FW_MAIN_B, \
 234                 $(if $(filter \
 235                         $(call strip_quotes,$(CONFIG_RW_REGION_ONLY)) \
 236                         ,$(1)), $(RW_PARTITIONS), $(VBOOT_PARTITIONS) ) \
 237                 ))))))
 238
 239 CONFIG_GBB_HWID := $(call strip_quotes,$(CONFIG_GBB_HWID))
 240 CONFIG_GBB_BMPFV_FILE := $(call strip_quotes,$(CONFIG_GBB_BMPFV_FILE))
 241 CONFIG_VBOOT_KEYBLOCK := $(call strip_quotes,$(CONFIG_VBOOT_KEYBLOCK))
 242 CONFIG_VBOOT_FIRMWARE_PRIVKEY := $(call strip_quotes,$(CONFIG_VBOOT_FIRMWARE_PRIVKEY))
 243 CONFIG_VBOOT_KERNEL_KEY := $(call strip_quotes,$(CONFIG_VBOOT_KERNEL_KEY))
 244 CONFIG_VBOOT_FWID_MODEL := $(call strip_quotes,$(CONFIG_VBOOT_FWID_MODEL))
 245 CONFIG_VBOOT_FWID_VERSION := $(call strip_quotes,$(CONFIG_VBOOT_FWID_VERSION))
 246
 247 # bool-to-mask(var, value)
 248 # return "value" if var is "y", 0 otherwise
 249 bool-to-mask = $(if $(filter y,$(1)),$(2),0)
 250
 251 GBB_FLAGS := $(call int-add, \
 252         $(call bool-to-mask,$(CONFIG_GBB_FLAG_DEV_SCREEN_SHORT_DELAY),0x1) \
 253         $(call bool-to-mask,$(CONFIG_GBB_FLAG_LOAD_OPTION_ROMS),0x2) \
 254         $(call bool-to-mask,$(CONFIG_GBB_FLAG_ENABLE_ALTERNATE_OS),0x4) \
 255         $(call bool-to-mask,$(CONFIG_GBB_FLAG_FORCE_DEV_SWITCH_ON),0x8) \
 256         $(call bool-to-mask,$(CONFIG_GBB_FLAG_FORCE_DEV_BOOT_USB),0x10) \
 257         $(call bool-to-mask,$(CONFIG_GBB_FLAG_DISABLE_FW_ROLLBACK_CHECK),0x20) \
 258         $(call bool-to-mask,$(CONFIG_GBB_FLAG_ENTER_TRIGGERS_TONORM),0x40) \
 259         $(call bool-to-mask,$(CONFIG_GBB_FLAG_FORCE_DEV_BOOT_ALTFW),0x80) \
 260         $(call bool-to-mask,$(CONFIG_GBB_FLAG_RUNNING_FAFT),0x100) \
 261         $(call bool-to-mask,$(CONFIG_GBB_FLAG_DISABLE_EC_SOFTWARE_SYNC),0x200) \
 262         $(call bool-to-mask,$(CONFIG_GBB_FLAG_DEFAULT_DEV_BOOT_ALTFW),0x400) \
 263         $(call bool-to-mask,$(CONFIG_GBB_FLAG_DISABLE_PD_SOFTWARE_SYNC),0x800) \
 264         $(call bool-to-mask,$(CONFIG_GBB_FLAG_DISABLE_LID_SHUTDOWN),0x1000) \
 265         $(call bool-to-mask,$(CONFIG_GBB_FLAG_FORCE_MANUAL_RECOVERY),0x4000) \
 266         $(call bool-to-mask,$(CONFIG_GBB_FLAG_DISABLE_FWMP),0x8000) \
 267         $(call bool-to-mask,$(CONFIG_GBB_FLAG_ENABLE_UDC),0x10000) \
 268         $(call bool-to-mask,$(CONFIG_GBB_FLAG_FORCE_CSE_SYNC),0x20000) \
 269         )
 270
 271 ifneq ($(CONFIG_GBB_BMPFV_FILE),)
 272 $(obj)/gbb.sizetmp: $(obj)/coreboot.rom
 273         $(CBFSTOOL) $< read -r GBB -f $@
 274
 275 $(obj)/gbb.stub: $(obj)/coreboot.rom $(FUTILITY) $(obj)/gbb.sizetmp
 276         @printf "    CREATE GBB (with BMPFV)\n"
 277         $(FUTILITY) gbb_utility -c 0x100,0x1000,$(call int-subtract,$(call file-size,$(obj)/gbb.sizetmp) 0x2180),0x1000 $@.tmp
 278         mv $@.tmp $@
 279 else
 280 $(obj)/gbb.stub: $(obj)/coreboot.rom $(FUTILITY)
 281         @printf "    CREATE GBB (without BMPFV)\n"
 282         $(FUTILITY) gbb_utility -c 0x100,0x1000,0,0x1000 $@.tmp
 283         mv $@.tmp $@
 284 endif
 285
 286 # Generate a test-only HWID
 287 ifeq ($(CONFIG_GBB_HWID),)
 288 CONFIG_GBB_HWID := $$($(top)/util/chromeos/gen_test_hwid.sh "$(CONFIG_MAINBOARD_PART_NUMBER)")
 289 endif
 290
 291 $(obj)/gbb.region: $(obj)/gbb.stub
 292         @printf "    SETUP GBB\n"
 293         cp $< $@.tmp
 294         $(FUTILITY) gbb_utility -s \
 295                 --hwid="$(CONFIG_GBB_HWID)" \
 296                 --rootkey="$(CONFIG_VBOOT_ROOT_KEY)" \
 297                 --recoverykey="$(CONFIG_VBOOT_RECOVERY_KEY)" \
 298                 --flags=$(GBB_FLAGS) \
 299                 $@.tmp
 300 ifneq ($(CONFIG_GBB_BMPFV_FILE),)
 301         $(FUTILITY) gbb_utility -s \
 302                 --bmpfv="$(CONFIG_GBB_BMPFV_FILE)" \
 303                 $@.tmp
 304 endif
 305         mv $@.tmp $@
 306
 307 $(obj)/fwid.version:
 308         echo -n "$(CONFIG_VBOOT_FWID_VERSION)" > $@
 309
 310 $(obj)/fwid.region: $(obj)/fwid.version
 311         printf "%s%s\0" \
 312                 "$(CONFIG_VBOOT_FWID_MODEL)" \
 313                 "$$(cat "$(obj)/fwid.version")" > $@
 314
 315 build_complete:: $(obj)/gbb.region $(obj)/fwid.region
 316         @printf "    WRITE GBB\n"
 317         $(CBFSTOOL) $(obj)/coreboot.rom write -u -r GBB -i 0 -f $(obj)/gbb.region
 318         $(CBFSTOOL) $(obj)/coreboot.rom write -u -r RO_FRID -i 0 -f $(obj)/fwid.region
 319 ifeq ($(CONFIG_VBOOT_SLOTS_RW_A),y)
 320         $(CBFSTOOL) $(obj)/coreboot.rom write -u -r RW_FWID_A -i 0 -f $(obj)/fwid.region
 321 endif
 322 ifeq ($(CONFIG_VBOOT_SLOTS_RW_AB),y)
 323         $(CBFSTOOL) $(obj)/coreboot.rom write -u -r RW_FWID_B -i 0 -f $(obj)/fwid.region
 324 endif
 325
 326 ifneq ($(shell grep "SHARED_DATA" "$(CONFIG_FMDFILE)"),)
 327 build_complete::
 328         printf "\0" > $(obj)/shared_data.region
 329         $(CBFSTOOL) $(obj)/coreboot.rom write -u -r SHARED_DATA -i 0 -f $(obj)/shared_data.region
 330 endif
 331
 332 fmap-section-offset-cmd = $(FUTILITY) dump_fmap -p $(obj)/coreboot.rom | \
 333                                         grep '^$(1) ' | cut '-d ' -f2
 334 fmap-section-size-cmd =   $(FUTILITY) dump_fmap -p $(obj)/coreboot.rom | \
 335                                         grep '^$(1) ' | cut '-d ' -f3
 336
 337 ifeq ($(CONFIG_VBOOT_GSCVD),y)
 338 #
 339 # vboot-gscvd-ranges
 340 #
 341 # This variable expands to the list of ranges that will be verified by the GSC
 342 # before releasing the SoC from reset. It needs to cover all security-relevant
 343 # ranges of the flash that CBFS verification cannot cover itself. By default
 344 # this is the `GBB` FMAP section (not handled here but through the special `-G`
 345 # parameter to `futility gscvd` below) and the bootblock. Here we are
 346 # initializing the variable to expansions that produce ranges for both the
 347 # `BOOTBLOCK` FMAP section (filled up to the real size of
 348 # `$(objcbfs)/bootblock.bin`) and the `bootblock` file in the primary CBFS --
 349 # only one of those two should normally exist on a given platform.
 350 #
 351 # Platforms where the bootblock isn't the first and only thing loaded by the
 352 # hardware or which otherwise have special security-relevant flash areas that
 353 # cannot be covered normally by CBFS verification will need to manually add
 354 # ranges to this variable in their own Makefiles, in the format produced by
 355 # printf("%x:%x", start_offset, size). The variable is only expanded once in a
 356 # recipe of the `files_added` target, so $(shell) expansions that depend on
 357 # inspecting $(obj)/coreboot.rom (or any of its dependencies) are valid.
 358 #
 359 vboot-gscvd-ranges += $(shell ( \
 360         offset=$$($(call fmap-section-offset-cmd,BOOTBLOCK)) ;\
 361         if [ -n "$$offset" ]; then \
 362                 size=$$(wc -c < $(objcbfs)/bootblock.bin) ;\
 363                 printf "%x:%x" $$offset $$size ;\
 364         fi ;\
 365 ))
 366 vboot-gscvd-ranges += $(shell ( \
 367         line=$$($(CBFSTOOL) $(obj)/coreboot.rom print -k | grep '^bootblock[[:space:]]') ;\
 368         if [ -n "$$line" ]; then \
 369                 cbfs_start=$$($(call fmap-section-offset-cmd,COREBOOT)) ;\
 370                 offset=$$(printf "$$line" | cut -f2) ;\
 371                 size=$$(printf "$$line" | cut -f6) ;\
 372                 printf "%x:%x" $$((cbfs_start + offset)) $$size ;\
 373         fi ;\
 374 ))
 375 files_added:: $(FUTILITY)
 376         @printf "    WRITE GSCVD\n"
 377         gscvd_range_args="$(foreach range,$(vboot-gscvd-ranges),-R $(range))" ;\
 378         if [ -z "$$gscvd_range_args" ]; then \
 379                 echo "ERROR: No valid GSCVD ranges detected in image!" ;\
 380                 exit 1 ;\
 381         fi ;\
 382         $(FUTILITY) gscvd -G $$gscvd_range_args -b $(CONFIG_VBOOT_GSC_BOARD_ID) \
 383                 -r "$(CONFIG_VBOOT_GSCVD_ROOT_PUBKEY)" \
 384                 -p "$(CONFIG_VBOOT_GSCVD_PLATFORM_PRIVKEY)" \
 385                 -k "$(CONFIG_VBOOT_GSCVD_PLATFORM_KEYBLOCK)" \
 386                 $(obj)/coreboot.rom
 387 endif
 388
 389 ifneq (,$(filter y,$(CONFIG_VBOOT_SLOTS_RW_A) $(CONFIG_VBOOT_SLOTS_RW_AB)))
 390 files_added:: $(obj)/coreboot.rom $(FUTILITY) $(CBFSTOOL)
 391         CBFSTOOL="$(CBFSTOOL)" \
 392         $(FUTILITY) sign \
 393                 --signprivate "$(CONFIG_VBOOT_FIRMWARE_PRIVKEY)" \
 394                 --keyblock "$(CONFIG_VBOOT_KEYBLOCK)" \
 395                 --kernelkey "$(CONFIG_VBOOT_KERNEL_KEY)" \
 396                 --version $(CONFIG_VBOOT_KEYBLOCK_VERSION) \
 397                 --flags $(CONFIG_VBOOT_KEYBLOCK_PREAMBLE_FLAGS) \
 398                 $(obj)/coreboot.rom
 399         if [ "$(CONFIG_VBOOT_SLOTS_RW_AB)" = 'y' ]; then \
 400                 printf "    FLASHMAP Layout generated for RO, A and B partition.\n"; \
 401         elif [ "$(CONFIG_VBOOT_SLOTS_RW_A)" = 'y' ]; then \
 402                 printf "    FLASHMAP Layout generated for RO and A partition.\n"; \
 403         fi
 404 else
 405 show_notices::
 406         @printf "    FLASHMAP Layout generated for RO partition only.\n"
 407         @printf "             Beware that there is no failure safety in case of update now!\n"
 408 endif
 409
 410 endif # CONFIG_VBOOT