From 6362df3f5ef6ebe4e1228962bcd09273cd57ce57 Mon Sep 17 00:00:00 2001 From: Arthur Heymans Date: Wed, 17 Mar 2021 12:23:20 +0100 Subject: security/intel/cbnt: Add option to generate an unsigned BPM Change-Id: Ic1b941f06b44bd3067e5b071af8f7a02499d7827 Signed-off-by: Arthur Heymans Reviewed-on: https://review.coreboot.org/c/coreboot/+/51573 Reviewed-by: Christian Walter Reviewed-by: Angel Pons Tested-by: build bot (Jenkins) --- src/security/intel/cbnt/Kconfig | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'src/security/intel/cbnt/Kconfig') diff --git a/src/security/intel/cbnt/Kconfig b/src/security/intel/cbnt/Kconfig index 7df09b4b1b..c018212311 100644 --- a/src/security/intel/cbnt/Kconfig +++ b/src/security/intel/cbnt/Kconfig @@ -50,11 +50,24 @@ config INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE config INTEL_CBNT_GENERATE_BPM bool "Generate Boot Policy Manifest (BPM)" default y - select INTEL_CBNT_NEED_BPM_PRIV_KEY + select INTEL_CBNT_NEED_BPM_PRIV_KEY if !INTEL_CBNT_BPM_ONLY_UNSIGNED help Select y to generate the Boot Policy Manifest (BPM). Select n to include a BPM binary. +config INTEL_CBNT_BPM_ONLY_UNSIGNED + bool "Only unsigned boot policy manifest (BPM)" + depends on INTEL_CBNT_GENERATE_BPM + help + Skip signing the BPM. + The resulting unsigned BPM will be placed at build/bpm_unsigned.bin. + The resulting coreboot image will not be functional with CBnT. + After the unsigned BPM is signed externally you can add it to cbfs + and fit: + "$ cbfstool build/coreboot.rom add -f bpm.bin -n boot_policy_manifest.bin -t raw -a 16" + "$ ifittool -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s 12 -f build/coreboot.rom" + '-s 12' where 12 is CONFIG_CPU_INTEL_NUM_FIT_ENTRIES. + config INTEL_CBNT_BG_PROV_CFG_FILE string "CBnT json config file" depends on INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE || INTEL_CBNT_GENERATE_BPM -- cgit v1.2.3