From 15412c0681970e49ea34715a6efbfc43dfc87e60 Mon Sep 17 00:00:00 2001 From: Arthur Heymans Date: Mon, 8 Feb 2021 22:38:40 +0100 Subject: security/intel/cbnt: Add option to generate BPM This add an option to generate BPM using the 9elements bg-prov tool using a json config file. A template for the json config file can be obtained via "bg-prov template". Another option is to extract it from a working configuration: "bg-prov read-config". The option to just include a provided BPM binary is kept. Change-Id: I38808ca56953b80bac36bd186932d6286a79bebe Signed-off-by: Arthur Heymans Reviewed-on: https://review.coreboot.org/c/coreboot/+/50411 Reviewed-by: Angel Pons Reviewed-by: Christian Walter Tested-by: build bot (Jenkins) --- src/security/intel/cbnt/Kconfig | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) (limited to 'src/security/intel/cbnt/Kconfig') diff --git a/src/security/intel/cbnt/Kconfig b/src/security/intel/cbnt/Kconfig index 6142a2498e..7df09b4b1b 100644 --- a/src/security/intel/cbnt/Kconfig +++ b/src/security/intel/cbnt/Kconfig @@ -47,9 +47,17 @@ config INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE Select y to generate KM from a json config file. Select n to generate KM from Kconfig options +config INTEL_CBNT_GENERATE_BPM + bool "Generate Boot Policy Manifest (BPM)" + default y + select INTEL_CBNT_NEED_BPM_PRIV_KEY + help + Select y to generate the Boot Policy Manifest (BPM). + Select n to include a BPM binary. + config INTEL_CBNT_BG_PROV_CFG_FILE string "CBnT json config file" - depends on INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE + depends on INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE || INTEL_CBNT_GENERATE_BPM help Location of the bg-prov json config file. Either get a sample JSON config file: @@ -140,6 +148,7 @@ config INTEL_CBNT_KEY_MANIFEST_BINARY config INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY string "BPM (Boot Policy Manifest) binary location" + depends on !INTEL_CBNT_GENERATE_BPM help Location of the Boot Policy Manifest (BPM) -- cgit v1.2.3