Makefile.psw_tdx

#
# Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
#   * Redistributions of source code must retain the above copyright
#     notice, this list of conditions and the following disclaimer.
#   * Redistributions in binary form must reproduce the above copyright
#     notice, this list of conditions and the following disclaimer in
#     the documentation and/or other materials provided with the
#     distribution.
#   * Neither the name of Intel Corporation nor the names of its
#     contributors may be used to endorse or promote products derived
#     from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#

define DIR_EXISTS
$(shell test -d $(1) && echo "$(1)")
endef

# Repo-local SDK install (vs /opt/intel/sgxsdk system SDK): avoids permission issues in rpmbuild, and each rpmbuild gets its own SDK under BUILD/<pkg>/build/. Override with SGX_SDK=...
SGX_SDK ?= $(ROOT_DIR)/build/sgxsdk
export SGX_SDK

include buildenv.mk

.PHONY: build psw dcap install clean sdk install_sdk ippcp enclave_runtime

build: psw dcap

# The TDX runtime only needs the enclave runtime (uRTS), which moved into the
# SDK submodule's enclave_runtime; the rest of PSW is provided by DCAP.
psw: install_sdk enclave_runtime

# uRTS / enclave_common now live in the SDK submodule's enclave_runtime.
# Must run AFTER install_sdk: the SDK build does destructive `make -C sdk/ clean`
# passes (LOAD/CF/default mitigation flavors) that wipe the shared sdk/build/linux.
# Building the enclave runtime afterwards keeps its libs in build/linux, which the
# installer step then packages. The order-only prereq makes this safe under -j.
enclave_runtime: | install_sdk
	@$(MAKE) -C sdk/ enclave_runtime SGX_SDK_VERSION=$(SGX_VERSION)

dcap: install_sdk
	# Workaround until fixed in DCAP: prebuild race-prone targets, then skip
	# re-entering them in the full DCAP build.
	@$(MAKE) -C external/dcap_source/external
	@$(MAKE) -j1 -C external/dcap_source/ QuoteVerification
	@$(MAKE) -j1 -C external/dcap_source/ PCKCertSelection
	# WinPle targets build Windows PLE artifacts, not Linux RPM content.
	#  Note: if wanting to build them, and using OpenSSL 3x CLI, make sure to use --traditional for PLE signing key generation
	@$(MAKE) -C external/dcap_source/ -o ThirdParty -o QuoteVerification -o PCKCertSelection -o PckClientTool -o WinPle -o WinPleIntel

install:
	@$(MAKE) -I linux/installer/common/psw-tdx -f linux/installer/common/psw-tdx/Makefile SRCDIR=. DESTDIR=$(DESTDIR) install

clean:
	@$(MAKE) -C external/dcap_source/ clean
	@$(MAKE) -C sdk/                  clean
	@# Only uninstall a REPO-LOCAL SDK built under $(ROOT_DIR)/build/. A writable check
	@# is NOT sufficient: when the build runs as root (e.g. in a container) a system SDK
	@# such as /opt/intel/sgxsdk is also writable and must never be torn down. Gate on
	@# the SDK path being inside $(ROOT_DIR)/build/ and require an executable
	@# uninstall.sh. Non-fatal (leading '-'): this runs in rpmbuild %clean after packaging.
	-@sdk_abs="$(abspath $(SGX_SDK))"; build_abs="$(abspath $(ROOT_DIR)/build)"; \
	 case "$$sdk_abs/" in \
	   "$$build_abs"/*) [ -x "$$sdk_abs/uninstall.sh" ] && "$$sdk_abs/uninstall.sh" || : ;; \
	   *) : ;; \
	 esac

# IPP now lives inside the SDK submodule; proxy the build to it.
ippcp:
	$(MAKE) -C sdk/ ipp SGX_SDK_VERSION=$(SGX_VERSION)

# The SDK build is proxied to the SDK submodule (its default target only
# prints tips, so the 'sdk' target must be requested explicitly).
sdk: ippcp
	$(MAKE) -C sdk/ sdk SGX_SDK_VERSION=$(SGX_VERSION)

# Build the SDK installer via the SDK submodule (the top-level build-installpkg.sh
# no longer supports 'sdk'). The .bin lands in linux/installer/bin/ via
# PKG_OUT_ROOT_DIR; install it under SGX_SDK if not present yet.
install_sdk: sdk
	$(MAKE) -C sdk/ sdk_install_pkg SGX_SDK_VERSION=$(SGX_VERSION) PKG_OUT_ROOT_DIR="$(ROOT_DIR)/linux/installer"
ifeq ($(call DIR_EXISTS,$(SGX_SDK)),)
	@mkdir -p $(dir $(SGX_SDK))
	./linux/installer/bin/sgx_linux_x64_sdk_*.bin --prefix=$(dir $(SGX_SDK))
endif