Makefile 5.81 KB
Newer Older
1 2 3 4 5
CC		= $(CROSS_COMPILE)gcc
LD		= $(CROSS_COMPILE)ld
OBJCOPY		= $(CROSS_COMPILE)objcopy

ARCH		= $(shell $(CC) -dumpmachine | cut -f1 -d- | sed s,i[3456789]86,ia32,)
Matthew Garrett's avatar
Matthew Garrett committed
6

7
SUBDIRS		= Cryptlib lib
Matthew Garrett's avatar
Matthew Garrett committed
8

Peter Jones's avatar
Peter Jones committed
9 10
LIB_PATH	= /usr/lib64

11
EFI_INCLUDE	:= /usr/include/efi
12
EFI_INCLUDES	= -nostdinc -ICryptlib -ICryptlib/Include -I$(EFI_INCLUDE) -I$(EFI_INCLUDE)/$(ARCH) -I$(EFI_INCLUDE)/protocol -Iinclude
Peter Jones's avatar
Peter Jones committed
13
EFI_PATH	:= /usr/lib64/gnuefi
Matthew Garrett's avatar
Matthew Garrett committed
14 15

LIB_GCC		= $(shell $(CC) -print-libgcc-file-name)
Matthew Garrett's avatar
Matthew Garrett committed
16
EFI_LIBS	= -lefi -lgnuefi --start-group Cryptlib/libcryptlib.a Cryptlib/OpenSSL/libopenssl.a --end-group $(LIB_GCC) 
Matthew Garrett's avatar
Matthew Garrett committed
17

Peter Jones's avatar
Peter Jones committed
18
EFI_CRT_OBJS 	= $(EFI_PATH)/crt0-efi-$(ARCH).o
19
EFI_LDS		= elf_$(ARCH)_efi.lds
Matthew Garrett's avatar
Matthew Garrett committed
20

21
DEFAULT_LOADER	:= \\\\grub.efi
22
CFLAGS		= -ggdb -O0 -fno-stack-protector -fno-strict-aliasing -fpic \
23
		  -fshort-wchar -Wall -Wsign-compare -Werror -fno-builtin \
24 25
		  "-DDEFAULT_LOADER=L\"$(DEFAULT_LOADER)\"" \
		  "-DDEFAULT_LOADER_CHAR=\"$(DEFAULT_LOADER)\"" \
Matthew Garrett's avatar
Matthew Garrett committed
26
		  $(EFI_INCLUDES)
27 28 29 30

ifneq ($(origin OVERRIDE_SECURITY_POLICY), undefined)
	CFLAGS	+= -DOVERRIDE_SECURITY_POLICY
endif
31

Matthew Garrett's avatar
Matthew Garrett committed
32
ifeq ($(ARCH),x86_64)
33 34
	CFLAGS	+= -mno-mmx -mno-sse -mno-red-zone -nostdinc -maccumulate-outgoing-args \
		-DEFI_FUNCTION_WRAPPER -DGNU_EFI_USE_MS_ABI
Matthew Garrett's avatar
Matthew Garrett committed
35
endif
36
ifeq ($(ARCH),ia32)
37
	CFLAGS	+= -mno-mmx -mno-sse -mno-red-zone -nostdinc -maccumulate-outgoing-args -m32
38
endif
39

40 41 42 43
ifeq ($(ARCH),aarch64)
	CFLAGS	+= -ffreestanding -I$(shell $(CC) -print-file-name=include)
endif

44 45 46 47
ifeq ($(ARCH),arm)
	CFLAGS	+= -ffreestanding -I$(shell $(CC) -print-file-name=include)
endif

48 49 50
ifneq ($(origin VENDOR_CERT_FILE), undefined)
	CFLAGS += -DVENDOR_CERT_FILE=\"$(VENDOR_CERT_FILE)\"
endif
51 52 53
ifneq ($(origin VENDOR_DBX_FILE), undefined)
	CFLAGS += -DVENDOR_DBX_FILE=\"$(VENDOR_DBX_FILE)\"
endif
54

Peter Jones's avatar
Peter Jones committed
55
LDFLAGS		= -nostdlib -znocombreloc -T $(EFI_LDS) -shared -Bsymbolic -L$(EFI_PATH) -L$(LIB_PATH) -LCryptlib -LCryptlib/OpenSSL $(EFI_CRT_OBJS)
Matthew Garrett's avatar
Matthew Garrett committed
56

Peter Jones's avatar
Peter Jones committed
57
VERSION		= 0.7
58

Peter Jones's avatar
Peter Jones committed
59
TARGET	= shim.efi MokManager.efi.signed fallback.efi.signed
60
OBJS	= shim.o netboot.o cert.o replacements.o version.o
61
KEYS	= shim_cert.h ocsp.* ca.* shim.crt shim.csr shim.p12 shim.pem shim.key shim.cer
62
SOURCES	= shim.c shim.h netboot.c include/PeImage.h include/wincert.h include/console.h replacements.c replacements.h version.c version.h
63
MOK_OBJS = MokManager.o PasswordCrypt.o crypt_blowfish.o
64
MOK_SOURCES = MokManager.c shim.h include/console.h PasswordCrypt.c PasswordCrypt.h crypt_blowfish.c crypt_blowfish.h
65 66
FALLBACK_OBJS = fallback.o
FALLBACK_SRCS = fallback.c
Matthew Garrett's avatar
Matthew Garrett committed
67

Matthew Garrett's avatar
Matthew Garrett committed
68
all: $(TARGET)
Matthew Garrett's avatar
Matthew Garrett committed
69

70 71 72 73 74 75 76 77 78 79 80
shim.crt:
	./make-certs shim shim@xn--u4h.net all codesign 1.3.6.1.4.1.311.10.3.1 </dev/null

shim.cer: shim.crt
	openssl x509 -outform der -in $< -out $@

shim_cert.h: shim.cer
	echo "static UINT8 shim_cert[] = {" > $@
	hexdump -v -e '1/1 "0x%02x, "' $< >> $@
	echo "};" >> $@

81 82 83 84 85 86
version.c : version.c.in
	sed	-e "s,@@VERSION@@,$(VERSION)," \
		-e "s,@@UNAME@@,$(shell uname -a)," \
		-e "s,@@COMMIT@@,$(shell if [ -d .git ] ; then git log -1 --pretty=format:%H ; elif [ -f commit ]; then cat commit ; else echo commit id not available; fi)," \
		< version.c.in > version.c

87 88 89 90 91 92
certdb/secmod.db: shim.crt
	-mkdir certdb
	pk12util -d certdb/ -i shim.p12 -W "" -K ""
	certutil -d certdb/ -A -i shim.crt -n shim -t u

shim.o: $(SOURCES) shim_cert.h
Matthew Garrett's avatar
Matthew Garrett committed
93

94 95 96
cert.o : cert.S
	$(CC) $(CFLAGS) -c -o $@ $<

Peter Jones's avatar
Peter Jones committed
97
shim.so: $(OBJS) Cryptlib/libcryptlib.a Cryptlib/OpenSSL/libopenssl.a lib/lib.a
Matthew Garrett's avatar
Matthew Garrett committed
98 99
	$(LD) -o $@ $(LDFLAGS) $^ $(EFI_LIBS)

100 101
fallback.o: $(FALLBACK_SRCS)

Peter Jones's avatar
Peter Jones committed
102
fallback.so: $(FALLBACK_OBJS) Cryptlib/libcryptlib.a Cryptlib/OpenSSL/libopenssl.a lib/lib.a
103 104
	$(LD) -o $@ $(LDFLAGS) $^ $(EFI_LIBS)

105
MokManager.o: $(MOK_SOURCES)
106

Peter Jones's avatar
Peter Jones committed
107
MokManager.so: $(MOK_OBJS) Cryptlib/libcryptlib.a Cryptlib/OpenSSL/libopenssl.a lib/lib.a
108
	$(LD) -o $@ $(LDFLAGS) $^ $(EFI_LIBS) lib/lib.a
109

Matthew Garrett's avatar
Matthew Garrett committed
110
Cryptlib/libcryptlib.a:
111
	$(MAKE) -C Cryptlib
Matthew Garrett's avatar
Matthew Garrett committed
112 113

Cryptlib/OpenSSL/libopenssl.a:
114
	$(MAKE) -C Cryptlib/OpenSSL
Matthew Garrett's avatar
Matthew Garrett committed
115

116
lib/lib.a:
117 118
	$(MAKE) -C lib

119 120 121 122 123 124
ifeq ($(ARCH),aarch64)
FORMAT		:= -O binary
SUBSYSTEM	:= 0xa
LDFLAGS		+= --defsym=EFI_SUBSYSTEM=$(SUBSYSTEM)
endif

125 126 127 128 129 130
ifeq ($(ARCH),arm)
FORMAT		:= -O binary
SUBSYSTEM	:= 0xa
LDFLAGS		+= --defsym=EFI_SUBSYSTEM=$(SUBSYSTEM)
endif

131
FORMAT		?= --target efi-app-$(ARCH)
132

Matthew Garrett's avatar
Matthew Garrett committed
133
%.efi: %.so
134 135 136
	$(OBJCOPY) -j .text -j .sdata -j .data \
		-j .dynamic -j .dynsym  -j .rel* \
		-j .rela* -j .reloc -j .eh_frame \
137
		-j .vendor_cert \
138 139 140 141
		$(FORMAT)  $^ $@
	$(OBJCOPY) -j .text -j .sdata -j .data \
		-j .dynamic -j .dynsym  -j .rel* \
		-j .rela* -j .reloc -j .eh_frame \
Matthew Garrett's avatar
Matthew Garrett committed
142 143
		-j .debug_info -j .debug_abbrev -j .debug_aranges \
		-j .debug_line -j .debug_str -j .debug_ranges \
144
		$(FORMAT) $^ $@.debug
Matthew Garrett's avatar
Matthew Garrett committed
145

146 147 148
%.efi.signed: %.efi certdb/secmod.db
	pesign -n certdb -i $< -c "shim" -s -o $@ -f

Matthew Garrett's avatar
Matthew Garrett committed
149
clean:
Matthew Garrett's avatar
Matthew Garrett committed
150 151
	$(MAKE) -C Cryptlib clean
	$(MAKE) -C Cryptlib/OpenSSL clean
Gary Ching-Pang Lin's avatar
Gary Ching-Pang Lin committed
152
	$(MAKE) -C lib clean
153
	rm -rf $(TARGET) $(OBJS) $(MOK_OBJS) $(FALLBACK_OBJS) $(KEYS) certdb
154
	rm -f *.debug *.so *.efi *.tar.* version.c
155 156 157 158 159 160 161 162 163

GITTAG = $(VERSION)

test-archive:
	@rm -rf /tmp/shim-$(VERSION) /tmp/shim-$(VERSION)-tmp
	@mkdir -p /tmp/shim-$(VERSION)-tmp
	@git archive --format=tar $(shell git branch | awk '/^*/ { print $$2 }') | ( cd /tmp/shim-$(VERSION)-tmp/ ; tar x )
	@git diff | ( cd /tmp/shim-$(VERSION)-tmp/ ; patch -s -p1 -b -z .gitdiff )
	@mv /tmp/shim-$(VERSION)-tmp/ /tmp/shim-$(VERSION)/
164
	@git log -1 --pretty=format:%H > /tmp/shim-$(VERSION)/commit
165 166 167 168
	@dir=$$PWD; cd /tmp; tar -c --bzip2 -f $$dir/shim-$(VERSION).tar.bz2 shim-$(VERSION)
	@rm -rf /tmp/shim-$(VERSION)
	@echo "The archive is in shim-$(VERSION).tar.bz2"

169 170 171 172
tag:
	git tag --sign $(GITTAG) refs/heads/master

archive: tag
173 174 175 176
	@rm -rf /tmp/shim-$(VERSION) /tmp/shim-$(VERSION)-tmp
	@mkdir -p /tmp/shim-$(VERSION)-tmp
	@git archive --format=tar $(GITTAG) | ( cd /tmp/shim-$(VERSION)-tmp/ ; tar x )
	@mv /tmp/shim-$(VERSION)-tmp/ /tmp/shim-$(VERSION)/
177
	@git log -1 --pretty=format:%H > /tmp/shim-$(VERSION)/commit
178 179 180
	@dir=$$PWD; cd /tmp; tar -c --bzip2 -f $$dir/shim-$(VERSION).tar.bz2 shim-$(VERSION)
	@rm -rf /tmp/shim-$(VERSION)
	@echo "The archive is in shim-$(VERSION).tar.bz2"
181 182

export ARCH CC LD OBJCOPY EFI_INCLUDE