summaryrefslogtreecommitdiff
path: root/src/security/intel/cbnt/Kconfig
AgeCommit message (Collapse)Author
2021-06-25security/intel/cbnt: Remove fixed size requirementArthur Heymans
The CBnT provisioning tooling in intel-sec-tools are now cbfs aware and don't need to have a fixed size at buildtime. Tested on OCP/Deltalake with CBnT enabled. Change-Id: I446b5045fe65f51c5fa011895cd56dbd25b6ccc7 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/55821 Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Christopher Meis <christopher.meis@9elements.com> Reviewed-by: Christian Walter <christian.walter@9elements.com> Reviewed-by: Kyösti Mälkki <kyosti.malkki@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-06-21security/intel/cbnt: Add loggingArthur Heymans
This decodes and logs the CBnT status and error registers. Change-Id: I8b57132bedbd944b9861ab0e2e0d14723cb61635 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/54093 Reviewed-by: Angel Pons <th3fanbus@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-05-11security/intel/cbnt: Allow to use an externally provided cbnt-prov binArthur Heymans
Building the cbnt-prov tool requires godeps which does not work if offline. Therefore, add an option to provide this binary via Kconfig. It's the responsibility of the user to use a compatible binary then. Change-Id: I06ff4ee01bf58cae45648ddb8a30a30b9a7e027a Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/51982 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-05-10security/intel/cbnt: Rename bg-prov to cbnt-provArthur Heymans
This prepares for updating the intel-sec-tools submodule pointer. In that submodule bg-prov got renamed to cbnt-prov as Intel Bootguard uses different structures and will require a different tool. Change-Id: I54a9f458e124d355d50b5edd8694dee39657bc0d Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/52970 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-05-06security/tpm: Add option to init TPM in bootblockArthur Heymans
When using a hardware assisted root of trust measurement, like Intel TXT/CBnT, the TPM init needs to happen inside the bootblock to form a proper chain of trust. Change-Id: Ifacba5d9ab19b47968b4f2ed5731ded4aac55022 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/51923 Reviewed-by: Christian Walter <christian.walter@9elements.com> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-03-30security/intel/cbnt: Add options to generate BPM from KconfigArthur Heymans
Use Kconfig options to set BPM fields. Change-Id: I9f5ffa0f692b06265f992b07a44763ff1aa8dfa7 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/50928 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com>
2021-03-30security/intel/cbnt: Add option to generate an unsigned BPMArthur Heymans
Change-Id: Ic1b941f06b44bd3067e5b071af8f7a02499d7827 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/51573 Reviewed-by: Christian Walter <christian.walter@9elements.com> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-03-30security/intel/cbnt: Add option to generate BPMArthur Heymans
This add an option to generate BPM using the 9elements bg-prov tool using a json config file. A template for the json config file can be obtained via "bg-prov template". Another option is to extract it from a working configuration: "bg-prov read-config". The option to just include a provided BPM binary is kept. Change-Id: I38808ca56953b80bac36bd186932d6286a79bebe Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/50411 Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Christian Walter <christian.walter@9elements.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-03-30security/intel/cbnt: Add an option to generate an unsigned KMArthur Heymans
This is useful if you have external infrastructure to sign KM. Change-Id: If5e9306366230b75d97e4e1fb271bcd7615abd5f Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/51572 Reviewed-by: Christian Walter <christian.walter@9elements.com> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-03-28security/intel/cbnt: Generate KM from Kconfig symbolsArthur Heymans
Add an option to generate the Key Manifest from Kconfig options. Change-Id: I3a448f37c81148625c7879dcb64da4d517567067 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/50410 Reviewed-by: Christian Walter <christian.walter@9elements.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-03-28security/intel/cbnt: Add option to generate KMArthur Heymans
This add an option to generate KM using the 9elements bg-prov tool using a json config file. The option to just include a provided KM binary is kept. A template for the json config file can be obtained via "bg-prov template". Another option is to extract it from a working configuration: "bg-prov read-config". Change-Id: I18bbdd13047be634b8ee280a6b902096a65836e4 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/50409 Reviewed-by: Christian Walter <christian.walter@9elements.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
2021-03-28security/intel/cbnt: Prepare for KM/BPM generationArthur Heymans
Private and/or public keys will be provided as user input via Kconfig. As a private key also contains the public key, only ask what is required. Change-Id: I86d129bb1d13d833a26281defad2a1cb5bf86595 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/51576 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Christian Walter <christian.walter@9elements.com>
2021-03-19security/intel/cbnt: Make CBNT compatible with CMOS option tableArthur Heymans
Make sure the bytes in RTC cmos used by CBNT don't collide with the option table. This depends on what is set up in the BPM, Boot Policy Manifest. When the BPM is provided as a binary the Kconfig needs to be adapted accordingly. A later patch will use this when generating the BPM. Change-Id: I246ada8a64ad5f831705a4293d87ab7adc5ef3aa Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/51538 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Patrick Georgi <pgeorgi@google.com>
2021-02-01drivers/security/cbnt: Fix bootblock sizeArthur Heymans
Change-Id: Ic5ad9d29f247b6f828501bfacc27a8af08761d55 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/50082 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Jonathan Zhang <jonzhang@fb.com> Reviewed-by: Patrick Rudolph <siro@das-labor.org> Reviewed-by: Angel Pons <th3fanbus@gmail.com> Reviewed-by: Kyösti Mälkki <kyosti.malkki@gmail.com>
2020-11-10sec/intel/cbnt: Stitch in ACMs in the coreboot imageArthur Heymans
Actual support CBnT will be added later on. Change-Id: Icc35c5e6c74d002efee43cc05ecc8023e00631e0 Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Reviewed-on: https://review.coreboot.org/c/coreboot/+/46456 Reviewed-by: Angel Pons <th3fanbus@gmail.com> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-17 08:46:58 +0000