blob: 9d4849049acc7b40cd8adb2fc7f97dcc3d45a08d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
|
# SPDX-License-Identifier: GPL-2.0-only
config INTEL_CBNT_SUPPORT
bool "Intel CBnT support"
default n
depends on CPU_INTEL_FIRMWARE_INTERFACE_TABLE
#depends on PLATFORM_HAS_DRAM_CLEAR
select INTEL_TXT
# With CBnT the bootblock is set up as a CBnT IBB and needs a fixed size
select FIXED_BOOTBLOCK_SIZE
select TPM_MEASURED_BOOT_INIT_BOOTBLOCK if TPM_MEASURED_BOOT
help
Enables Intel Converged Bootguard and Trusted Execution Technology
Support. This will enable one to add a Key Manifest (KM) and a Boot
Policy Manifest (BPM) to the filesystem. It will also wrap a FIT around
the firmware and update appropriate entries.
if INTEL_CBNT_SUPPORT
config INTEL_CBNT_GENERATE_KM
bool "Generate Key Manifest (KM)"
default y
select INTEL_CBNT_NEED_KM_PUB_KEY
select INTEL_CBNT_NEED_KM_PRIV_KEY if !INTEL_CBNT_KM_ONLY_UNSIGNED
select INTEL_CBNT_NEED_BPM_PUB_KEY if !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE
help
Select y to generate the Key Manifest (KM).
Select n to include a KM binary.
config INTEL_CBNT_KM_ONLY_UNSIGNED
bool "Only unsigned key manifest (KM)"
depends on INTEL_CBNT_GENERATE_KM
help
Skip signing the KM.
The resulting unsigned KM will be placed at build/km_unsigned.bin.
The resulting coreboot image will not be functional with CBnT.
After the unsigned KM is signed externally you can either rebuild
coreboot using that binary or add it to cbfs and fit:
"$ cbfstool build/coreboot.rom add -f km.bin -n key_manifest.bin -t raw -a 16"
"$ ifittool -r COREBOOT -a -n key_manifest.bin -t 11 -s 12 -f build/coreboot.rom"
'-s 12' where 12 is CONFIG_CPU_INTEL_NUM_FIT_ENTRIES.
config INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE
bool "KM: use a CBnT json config file"
depends on INTEL_CBNT_GENERATE_KM
default y
help
Select y to generate KM from a json config file.
Select n to generate KM from Kconfig options
config INTEL_CBNT_GENERATE_BPM
bool "Generate Boot Policy Manifest (BPM)"
default y
select INTEL_CBNT_NEED_BPM_PRIV_KEY if !INTEL_CBNT_BPM_ONLY_UNSIGNED
help
Select y to generate the Boot Policy Manifest (BPM).
Select n to include a BPM binary.
config INTEL_CBNT_BPM_ONLY_UNSIGNED
bool "Only unsigned boot policy manifest (BPM)"
depends on INTEL_CBNT_GENERATE_BPM
help
Skip signing the BPM.
The resulting unsigned BPM will be placed at build/bpm_unsigned.bin.
The resulting coreboot image will not be functional with CBnT.
After the unsigned BPM is signed externally you can add it to cbfs
and fit:
"$ cbfstool build/coreboot.rom add -f bpm.bin -n boot_policy_manifest.bin -t raw -a 16"
"$ ifittool -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s 12 -f build/coreboot.rom"
'-s 12' where 12 is CONFIG_CPU_INTEL_NUM_FIT_ENTRIES.
config INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE
bool "BPM: use a CBnT json config file"
depends on INTEL_CBNT_GENERATE_BPM
default y
help
Select y to generate BPM from a json config file.
Select n to generate BPM from Kconfig options
config INTEL_CBNT_CBNT_PROV_CFG_FILE
string "CBnT json config file"
depends on INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE || INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE
help
Location of the bg-prov json config file.
Either get a sample JSON config file:
$ bg-prov template
Or extract it from a working configuration:
$ bg-prov read-config
config INTEL_CBNT_PROV_EXTERNAL_BIN
bool "Use an external cbnt-prov binary"
default n
depends on INTEL_CBNT_GENERATE_BPM || INTEL_CBNT_GENERATE_KM
help
Building cbnt-prov requires godeps which makes it impossible to build
it in an offline environment. A solution is to use an external binary.
config INTEL_CBNT_PROV_EXTERNAL_BIN_PATH
string "cbnt-prov path"
depends on INTEL_CBNT_PROV_EXTERNAL_BIN
help
Path to the cbnt-prov binary.
config INTEL_CBNT_NEED_KM_PUB_KEY
bool
config INTEL_CBNT_NEED_KM_PRIV_KEY
bool
config INTEL_CBNT_KM_PUB_KEY_FILE
string "Key manifest (KM) public key"
depends on INTEL_CBNT_NEED_KM_PUB_KEY && !INTEL_CBNT_NEED_KM_PRIV_KEY
help
Location of the key manifest (KM) public key file in .pem format.
config INTEL_CBNT_KM_PRIV_KEY_FILE
string "Key manifest (KM) private key"
depends on INTEL_CBNT_NEED_KM_PRIV_KEY
help
Location of the key manifest (KM) private key file in .pem format.
config INTEL_CBNT_NEED_BPM_PUB_KEY
bool
config INTEL_CBNT_NEED_BPM_PRIV_KEY
bool
config INTEL_CBNT_BPM_PUB_KEY_FILE
string "Boot policy manifest (BPM) public key"
depends on INTEL_CBNT_NEED_BPM_PUB_KEY && !INTEL_CBNT_NEED_BPM_PRIV_KEY
help
Location of the boot policy manifest (BPM) public key file in .pem format.
config INTEL_CBNT_BPM_PRIV_KEY_FILE
string "Boot policy manifest (BPM) private key"
depends on INTEL_CBNT_NEED_BPM_PRIV_KEY
help
Location of the boot policy manifest (BPM) private key file in .pem format.
if !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE && INTEL_CBNT_GENERATE_KM
menu "KM options"
config INTEL_CBNT_KM_REVISION
int "KM revision"
default 1
help
Version of the Key Manifest defined by the Platform Manufacturer.
The actual value is transparent to Boot Guard and is not processed by Boot Guard.
config INTEL_CBNT_KM_SVN
int "KM security Version Number"
range 0 15
default 0
help
This value is determined by the Platform Manufacturer.
Boot Guard uses this to compare it to the Key Manifest
Revocation Value (Revocation.KMSVN) in FPF.
If KMSVN < Revocation.KMSVN, the KM will be revoked. It will trigger ENF (the
enforcement policy).
IF KMSVN > Revocation.KMSVN, the Revocation.KMSVN will be set to the KMSVN.
Note: Once the value reaches 0Fh, revocation saturates and one can no longer
revoke newer KMs.
config INTEL_CBNT_KM_ID
int "KM ID"
default 1
help
This identifies the Key Manifest to be used for a platform.
This must match the Key Manifest Identifier programmed in
the field programmable fuses.
endmenu
endif # !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE
if !INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE && INTEL_CBNT_GENERATE_BPM
menu "BPM options"
config INTEL_CBNT_BPM_REVISION
int "BPM revision"
default 1
help
Version of the Key Manifest defined by the Platform Manufacturer.
The actual value is transparent to Boot Guard and is not processed by Boot Guard.
config INTEL_CBNT_BPM_SVN
int "BPM Security Version Number"
default 0
help
This value is determined by the Platform Manufacturer.
config INTEL_CBNT_ACM_SVN
int "S-ACM Security Version Number"
default 2
help
This defines the minimum version the S-ACM must have.
config INTEL_CBNT_NUM_NEM_PAGES
int
default 32
help
Set the amount of 4K pages of CAR required.
config INTEL_CBNT_PBET
int "PBET value in s"
default 15
help
Protect BIOS Environment Timer (PBET) value.
Factor used by CSE to compute PBE timer value.
Actual PBE timer value is set by CSE using formula:
PBE timer value = 5 sec + PBETValue.
config INTEL_CBNT_IBB_FLAGS
int "IBB flags"
default 7
help
IBB Control flags.
3: Don't extend PCR 0
7: extend PCR 7
config INTEL_CBNT_SINIT_SVN
int "SINIT ACM security version number"
default 0
help
Minimum required version for the SINIT ACM.
config INTEL_CBNT_PD_INTERVAL
int
default 60
help
Duration of Power Down in 5 sec increments.
endmenu
endif # !INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE
config INTEL_CBNT_KEY_MANIFEST_BINARY
string "KM (Key Manifest) binary location"
depends on !INTEL_CBNT_GENERATE_KM
help
Location of the Key Manifest (KM)
config INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY
string "BPM (Boot Policy Manifest) binary location"
depends on !INTEL_CBNT_GENERATE_BPM
help
Location of the Boot Policy Manifest (BPM)
config INTEL_CBNT_CMOS_OFFSET
hex
default 0x7e
help
Address in RTC CMOS used by CBNT. Uses 2 bytes. If using an option table
adapt the cmos.layout accordingly. The bytes should not be checksummed.
endif # INTEL_CBNT_SUPPORT
|
