path: root/src/security/vboot/Kconfig

# SPDX-License-Identifier: GPL-2.0-only

menu "Verified Boot (vboot)"

config VBOOT_LIB
	bool
	help
	  Build and link the vboot library. Makes the vboot API accessible across
	  all coreboot stages, without enabling vboot verification. For verification,
	  please see the VBOOT option below.

config VBOOT
	bool "Verify firmware with vboot."
	default n
	select VBOOT_LIB
	select VBOOT_MOCK_SECDATA if !TPM
	depends on 0 = 0  # Must have a 'depends on' or board overrides will break it.
	help
	  Enabling VBOOT will use vboot to verify the components of the firmware
	  (stages, payload, etc).

if VBOOT

comment "Anti-Rollback Protection disabled because mocking secdata is enabled."
	depends on VBOOT_MOCK_SECDATA

config VBOOT_SLOTS_RW_A
	bool "Firmware RO + RW_A"
	help
	  Have one update partition beside the RO partition.

config VBOOT_SLOTS_RW_AB
	bool "Firmware RO + RW_A + RW_B"
	select VBOOT_SLOTS_RW_A
	help
	  Have two update partitions beside the RO partition.

config VBOOT_CBFS_INTEGRATION
	bool "Enable vboot and CBFS integration"
	default n
	depends on VBOOT_SLOTS_RW_A
	depends on CBFS_VERIFICATION
	select INCLUDE_CONFIG_FILE  # futility needs this to auto-detect signing type
	help
	  Say yes here to enable cryptographic verification of RW slots CBFS
	  metadata. This will replace body hash verification.

	  This option enables integration of vboot and CBFS. Verification of RW
	  slots is performed by calculation of their CBFS metadata hash.
	  It also requires CBFS_VERIFICATION to be enabled, so that CBFS files
	  contents are correctly verified.

config VBOOT_VBNV_CMOS
	bool
	default n
	depends on PC80_SYSTEM
	help
	  VBNV is stored in CMOS

config VBOOT_VBNV_OFFSET
	hex
	default 0x26
	depends on VBOOT_VBNV_CMOS
	help
	  CMOS offset for VbNv data. This value must match cmos.layout
	  in the mainboard directory, minus 14 bytes for the RTC.

config VBOOT_VBNV_CMOS_BACKUP_TO_FLASH
	bool
	default n
	depends on VBOOT_VBNV_CMOS && BOOT_DEVICE_SUPPORTS_WRITES
	help
	  Vboot non-volatile storage data will be backed up from CMOS to flash
	  and restored from flash if the CMOS is invalid due to power loss.

config VBOOT_VBNV_FLASH
	bool
	default n
	depends on BOOT_DEVICE_SUPPORTS_WRITES
	help
	  VBNV is stored in flash storage

config VBOOT_STARTS_BEFORE_BOOTBLOCK
	def_bool n
	select VBOOT_SEPARATE_VERSTAGE
	help
	  Firmware verification happens before the main processor is brought
	  online.

config VBOOT_STARTS_IN_BOOTBLOCK
	bool
	default n
	depends on SEPARATE_ROMSTAGE
	help
	  Firmware verification happens during the end of or right after the
	  bootblock. This implies that a static VBOOT2_WORK() buffer must be
	  allocated in memlayout.

config VBOOT_STARTS_IN_ROMSTAGE
	bool
	default n
	depends on !VBOOT_STARTS_IN_BOOTBLOCK
	help
	  Firmware verification happens during the end of romstage (after
	  memory initialization). This implies that the vboot work buffer is
	  in CBMEM from the start and doesn't need to be reserved in memlayout.

config VBOOT_MOCK_SECDATA
	bool "Mock secdata for firmware verification"
	default n
	help
	  Enabling VBOOT_MOCK_SECDATA will mock secdata for the firmware
	  verification to avoid access to a secdata storage (typically TPM).
	  All operations for a secdata storage will be successful. This option
	  can be used during development when a TPM is not present or broken.
	  THIS SHOULD NOT BE LEFT ON FOR PRODUCTION DEVICES.

config VBOOT_DISABLE_DEV_ON_RECOVERY
	bool
	default n
	help
	  When this option is enabled, the ChromeOS device leaves the
	  developer mode as soon as recovery request is detected. This is
	  handy on embedded devices with limited input capabilities.

config VBOOT_SEPARATE_VERSTAGE
	bool
	default n
	depends on VBOOT_STARTS_IN_BOOTBLOCK || VBOOT_STARTS_BEFORE_BOOTBLOCK
	help
	  If this option is set, vboot verification runs in a standalone stage
	  that is loaded from the bootblock and exits into romstage. If it is
	  not set, the verification code is linked directly into the bootblock
	  or the romstage and runs as part of that stage (cf. related options
	  VBOOT_STARTS_IN_BOOTBLOCK/_ROMSTAGE and VBOOT_RETURN_FROM_VERSTAGE).

config VBOOT_RETURN_FROM_VERSTAGE
	bool
	default n
	depends on VBOOT_SEPARATE_VERSTAGE
	help
	  If this is set, the verstage returns back to the calling stage instead
	  of exiting to the succeeding stage so that the verstage space can be
	  reused by the succeeding stage. This is useful if a RAM space is too
	  small to fit both the verstage and the succeeding stage.

config VBOOT_MUST_REQUEST_DISPLAY
	bool
	default y if VGA_ROM_RUN
	default n
	help
	  Set this option to indicate to vboot that this platform will skip its
	  display initialization on a normal (non-recovery, non-developer) boot.
	  Unless display is specifically requested, the video option ROM is not
	  loaded, and any other native display initialization code is not run.

config VBOOT_ALWAYS_ENABLE_DISPLAY
	bool "Force to always enable display"
	default n
	help
	  Set this option to indicate to vboot that display should always be enabled.

config VBOOT_ALWAYS_ALLOW_UDC
	bool "Always allow UDC"
	default n
	depends on !CHROMEOS
	help
	  This option allows UDC to be enabled regardless of the vboot state.

config VBOOT_HAS_REC_HASH_SPACE
	bool
	default y if MRC_SAVE_HASH_IN_TPM && HAS_RECOVERY_MRC_CACHE
	default n
	help
	  Set this option to indicate to vboot that recovery data hash space
	  is present in TPM.

config VBOOT_LID_SWITCH
	bool
	default n
	help
	  Whether this platform has a lid switch. If it does, vboot will not
	  decrement try counters for boot failures if the lid is closed.

config VBOOT_WIPEOUT_SUPPORTED
	bool
	default n
	help
	  When this option is enabled, the firmware provides the ability to
	  signal the application the need for factory reset (a.k.a. wipe
	  out) of the device

config VBOOT_FWID_MODEL
	string "Firmware ID model"
	default "Google_\$(CONFIG_MAINBOARD_PART_NUMBER)" if CHROMEOS
	default "\$(CONFIG_MAINBOARD_VENDOR)_\$(CONFIG_MAINBOARD_PART_NUMBER)"
	help
	  This is the first part of the FWID written to various regions of a
	  vboot firmware image to identify its version.

config VBOOT_FWID_VERSION
	string "Firmware ID version"
	default ".\$(KERNELVERSION)"
	help
	  This is the second part of the FWID written to various regions of a
	  vboot firmware image to identify its version.

config VBOOT_NO_BOARD_SUPPORT
	bool "Allow the use of vboot without board support"
	default n
	help
	  Enable weak functions for get_write_protect_state and
	  get_recovery_mode_switch in order to proceed with refactoring
	  of the vboot2 code base. Later on this code is removed and replaced
	  by interfaces.

config RO_REGION_ONLY
	string "Additional files that should not be copied to RW"
	default ""
	help
	  Add a space delimited list of filenames that should only be in the
	  RO section.

config RW_REGION_ONLY
	string
	default ""
	depends on VBOOT_SLOTS_RW_A
	help
	  Add a space delimited list of filenames that should only be in the
	  RW sections.

config RWA_REGION_ONLY
	string
	default ""
	depends on VBOOT_SLOTS_RW_AB
	help
	  Add a space-delimited list of filenames that should only be in the
	  RW-A section.

config RWB_REGION_ONLY
	string
	default ""
	depends on VBOOT_SLOTS_RW_AB
	help
	  Add a space-delimited list of filenames that should only be in the
	  RW-B section.

config CBFS_MCACHE_RW_PERCENTAGE
	int "Percentage of CBFS metadata cache used for RW CBFS"
	depends on !NO_CBFS_MCACHE
	default 50
	help
	  The amount of the CBFS_MCACHE area that's used for the RW CBFS, in
	  percent from 0 to 100. The remaining area will be used for the RO
	  CBFS. Default is an even 50/50 split. When VBOOT is disabled, this
	  will automatically be 0 (meaning the whole MCACHE is used for RO).
	  Do NOT change this value for vboot RW updates!

config VBOOT_ENABLE_CBFS_FALLBACK
	bool
	default n
	depends on VBOOT_SLOTS_RW_A
	help
	  When this option is enabled, the CBFS code will look for a file in the
	  RO (COREBOOT) region if it isn't available in the active RW region.

config VBOOT_EARLY_EC_SYNC
	bool
	default n
	depends on EC_GOOGLE_CHROMEEC
	help
	  Enables CrOS EC software sync in romstage, before memory training
	  runs. This is useful mainly as a way to achieve full USB-PD
	  negotiation earlier in the boot flow, as the EC will only do this once
	  it has made the sysjump to its RW firmware. It should not
	  significantly impact boot time, as this operation will be performed
	  later in the boot flow if it is disabled here.

config VBOOT_EC_EFS
	bool "Early firmware selection (EFS) EC"
	default n
	help
	  CrosEC can support EFS: Early Firmware Selection. If it's enabled,
	  software sync needs to also support it. This setting tells vboot to
	  perform EFS software sync.

config VBOOT_X86_SHA256_ACCELERATION
	bool "Use sha extension for sha256 hash calculation"
	default n
	depends on ARCH_X86
	help
	  Use sha256msg1, sha256msg2, sha256rnds2 instruction to accelerate
	  SHA hash calculation in vboot.

config VBOOT_ARMV8_CE_SHA256_ACCELERATION
	bool "Use ARMv8 Crypto Extension for sha256 hash calculation"
	default y if CHROMEOS
	default n
	depends on ARCH_ARM64
	help
	  Use ARMv8 Crypto Extension to accelerate SHA hash calculation in vboot.

config VBOOT_DEFINE_WIDEVINE_COUNTERS
	bool
	default n
	help
	  Set up Widevine Secure Counters in TPM NVRAM by defining space. Enabling this
	  config will only define the counter space. Counters need to be incremented
	  separately before any read operation is performed on them.

config VBOOT_HASH_BLOCK_SIZE
	hex
	default 0x400
	help
	  Set the default hash size.  Generally 1k is reasonable, but in some
	  cases it may improve hashing speed to increase the size.

	  Note that this buffer is allocated in the stack.  Although the
	  build should fail if the stack size is exceeded, it's something to
	  be aware of when changing the size.

config VBOOT_GSCVD
	bool "Generate GSC verification data"
	depends on TPM_GOOGLE
	select CBFS_VERIFICATION
	default n if TPM_GOOGLE_CR50
	default y
	help
	  Generate a Google Security Chip Verification Data (GSCVD) structure on the flash to
	  allow the GSC to verify the CBFS verification anchor. Used by default with Ti50 GSCs.
	  Requires an RO_GSCVD FMAP section.

config VBOOT_GSC_BOARD_ID
	string
	depends on VBOOT_GSCVD
	default "ZZCR"
	help
	  GSC board ID to be embedded in the GSCVD. Usually each specific mainboard variant
	  has its own. Google engineers can find these in the go/cros-dlm database ("Products").
	  The specific board IDs are filled in as part of the production signing process, so
	  this value is just a default and doesn't need to be set per-variant in coreboot.
	  (Note: This is a completely separate thing from coreboot's `board_id()` function.)

menu "GBB configuration"

config GBB_HWID
	string "Hardware ID"
	default ""
	help
	  A hardware identifier for device. On ChromeOS this is used for auto
	  update and recovery, and will be generated when manufacturing by the
	  factory software, in a strictly defined format.
	  Leave empty to get a test-only ChromeOS HWID v2 string generated.

config GBB_BMPFV_FILE
	string "Path to bmpfv image"
	default ""

config GBB_FLAG_DEV_SCREEN_SHORT_DELAY
	bool "Reduce dev screen delay"
	default n

config GBB_FLAG_LOAD_OPTION_ROMS
	bool "Load option ROMs"
	default n

config GBB_FLAG_ENABLE_ALTERNATE_OS
	bool "Allow booting a non-ChromeOS kernel if dev switch is on"
	default n

config GBB_FLAG_FORCE_DEV_SWITCH_ON
	bool "Force dev switch on"
	default n

config GBB_FLAG_FORCE_DEV_BOOT_USB
	bool "Allow booting from USB in dev mode even if dev_boot_usb=0"
	default y

config GBB_FLAG_DISABLE_FW_ROLLBACK_CHECK
	bool "Disable firmware rollback protection"
	default y

config GBB_FLAG_ENTER_TRIGGERS_TONORM
	bool "Return to normal boot with Enter"
	default n

config GBB_FLAG_FORCE_DEV_BOOT_ALTFW
	bool "Allow booting altfw in dev mode even if dev_boot_altfw=0"
	default n

config GBB_FLAG_RUNNING_FAFT
	bool "Running FAFT tests; used as a hint to disable other debug features"
	default n

config GBB_FLAG_DISABLE_EC_SOFTWARE_SYNC
	bool "Disable EC software sync"
	default n

config GBB_FLAG_DEFAULT_DEV_BOOT_ALTFW
	bool "Default to booting altfw in dev mode"
	default n

config GBB_FLAG_DISABLE_PD_SOFTWARE_SYNC
	bool "Disable PD software sync"
	default n

config GBB_FLAG_DISABLE_LID_SHUTDOWN
	bool "Disable shutdown on closed lid"
	default n

config GBB_FLAG_FORCE_MANUAL_RECOVERY
	bool "Always assume manual recovery in recovery mode"
	default n

config GBB_FLAG_DISABLE_FWMP
	bool "Disable Firmware Management Parameters (FWMP)"
	default n

config GBB_FLAG_ENABLE_UDC
	bool "Enable USB Device Controller"
	default n

endmenu # GBB

menu "Vboot Keys"
config VBOOT_ROOT_KEY
	string "Root key (public)"
	default "\$(VBOOT_SOURCE)/tests/devkeys/root_key.vbpubk"

config VBOOT_RECOVERY_KEY
	string "Recovery key (public)"
	default "\$(VBOOT_SOURCE)/tests/devkeys/recovery_key.vbpubk"

config VBOOT_FIRMWARE_PRIVKEY
	string "Firmware key (private)"
	default "\$(VBOOT_SOURCE)/tests/devkeys/firmware_data_key.vbprivk"

config VBOOT_KERNEL_KEY
	string "Kernel subkey (public)"
	default "\$(VBOOT_SOURCE)/tests/devkeys/kernel_subkey.vbpubk"

config VBOOT_KEYBLOCK
	string "Keyblock to use for the RW regions"
	default "\$(VBOOT_SOURCE)/tests/devkeys/firmware.keyblock"

config VBOOT_KEYBLOCK_VERSION
	int "Keyblock version number"
	default 1

config VBOOT_KEYBLOCK_PREAMBLE_FLAGS
	hex "Keyblock preamble flags"
	default 0x0

if VBOOT_GSCVD

config VBOOT_GSCVD_ROOT_PUBKEY
	string "GSCVD root key (public)"
	default "\$(VBOOT_SOURCE)/tests/devkeys/arv_root.vbpubk"

config VBOOT_GSCVD_PLATFORM_PRIVKEY
	string "GSCVD platform key (private)"
	default "\$(VBOOT_SOURCE)/tests/devkeys/arv_platform.vbprivk"

config VBOOT_GSCVD_PLATFORM_KEYBLOCK
	string "GSCVD platform keyblock (public)"
	default "\$(VBOOT_SOURCE)/tests/devkeys/arv_platform.keyblock"

endif # VBOOT_GSCVD

endmenu # Keys
endif # VBOOT
endmenu # Verified Boot (vboot)