1# SPDX-License-Identifier: GPL-2.0-only 2 3config INTEL_CBNT_SUPPORT 4 bool "Intel CBnT support" 5 default n 6 depends on CPU_INTEL_FIRMWARE_INTERFACE_TABLE 7 #depends on PLATFORM_HAS_DRAM_CLEAR 8 select INTEL_TXT 9 # With CBnT the bootblock is set up as a CBnT IBB and needs a fixed size 10 select TPM_MEASURED_BOOT_INIT_BOOTBLOCK if TPM_MEASURED_BOOT 11 help 12 Enables Intel Converged Bootguard and Trusted Execution Technology 13 Support. This will enable one to add a Key Manifest (KM) and a Boot 14 Policy Manifest (BPM) to the filesystem. It will also wrap a FIT around 15 the firmware and update appropriate entries. 16 17if INTEL_CBNT_SUPPORT 18 19config INTEL_CBNT_LOGGING 20 bool "Enable verbose CBnT logging" 21 help 22 Print more CBnT related debug output. 23 Use in pre-production environments only! 24 25config INTEL_CBNT_GENERATE_KM 26 bool "Generate Key Manifest (KM)" 27 default y 28 select INTEL_CBNT_NEED_KM_PUB_KEY 29 select INTEL_CBNT_NEED_KM_PRIV_KEY if !INTEL_CBNT_KM_ONLY_UNSIGNED 30 select INTEL_CBNT_NEED_BPM_PUB_KEY if !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE 31 help 32 Select y to generate the Key Manifest (KM). 33 Select n to include a KM binary. 34 35config INTEL_CBNT_KM_ONLY_UNSIGNED 36 bool "Only unsigned key manifest (KM)" 37 depends on INTEL_CBNT_GENERATE_KM 38 help 39 Skip signing the KM. 40 The resulting unsigned KM will be placed at build/km_unsigned.bin. 41 The resulting coreboot image will not be functional with CBnT. 42 After the unsigned KM is signed externally you can either rebuild 43 coreboot using that binary or add it to cbfs and fit: 44 "$ cbfstool build/coreboot.rom add -f km.bin -n key_manifest.bin -t raw -a 16" 45 "$ ifittool -r COREBOOT -a -n key_manifest.bin -t 11 -s 12 -f build/coreboot.rom" 46 '-s 12' where 12 is CONFIG_CPU_INTEL_NUM_FIT_ENTRIES. 47 48config INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE 49 bool "KM: use a CBnT json config file" 50 depends on INTEL_CBNT_GENERATE_KM 51 default y 52 help 53 Select y to generate KM from a json config file. 54 Select n to generate KM from Kconfig options 55 56config INTEL_CBNT_GENERATE_BPM 57 bool "Generate Boot Policy Manifest (BPM)" 58 default y 59 select INTEL_CBNT_NEED_BPM_PRIV_KEY if !INTEL_CBNT_BPM_ONLY_UNSIGNED 60 help 61 Select y to generate the Boot Policy Manifest (BPM). 62 Select n to include a BPM binary. 63 64config INTEL_CBNT_BPM_ONLY_UNSIGNED 65 bool "Only unsigned boot policy manifest (BPM)" 66 depends on INTEL_CBNT_GENERATE_BPM 67 help 68 Skip signing the BPM. 69 The resulting unsigned BPM will be placed at build/bpm_unsigned.bin. 70 The resulting coreboot image will not be functional with CBnT. 71 After the unsigned BPM is signed externally you can add it to cbfs 72 and fit: 73 "$ cbfstool build/coreboot.rom add -f bpm.bin -n boot_policy_manifest.bin -t raw -a 16" 74 "$ ifittool -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s 12 -f build/coreboot.rom" 75 '-s 12' where 12 is CONFIG_CPU_INTEL_NUM_FIT_ENTRIES. 76 77config INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE 78 bool "BPM: use a CBnT json config file" 79 depends on INTEL_CBNT_GENERATE_BPM 80 default y 81 help 82 Select y to generate BPM from a json config file. 83 Select n to generate BPM from Kconfig options 84 85config INTEL_CBNT_CBNT_PROV_CFG_FILE 86 string "CBnT json config file" 87 depends on INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE || INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE 88 help 89 Location of the bg-prov json config file. 90 Either get a sample JSON config file: 91 $ bg-prov template 92 Or extract it from a working configuration: 93 $ bg-prov read-config 94 95config INTEL_CBNT_PROV_EXTERNAL_BIN 96 bool "Use an external cbnt-prov binary" 97 default n 98 depends on INTEL_CBNT_GENERATE_BPM || INTEL_CBNT_GENERATE_KM 99 help 100 Building cbnt-prov requires godeps which makes it impossible to build 101 it in an offline environment. A solution is to use an external binary. 102 103config INTEL_CBNT_PROV_EXTERNAL_BIN_PATH 104 string "cbnt-prov path" 105 depends on INTEL_CBNT_PROV_EXTERNAL_BIN 106 help 107 Path to the cbnt-prov binary. 108 109config INTEL_CBNT_NEED_KM_PUB_KEY 110 bool 111 112config INTEL_CBNT_NEED_KM_PRIV_KEY 113 bool 114 115config INTEL_CBNT_KM_PUB_KEY_FILE 116 string "Key manifest (KM) public key" 117 depends on INTEL_CBNT_NEED_KM_PUB_KEY && !INTEL_CBNT_NEED_KM_PRIV_KEY 118 help 119 Location of the key manifest (KM) public key file in .pem format. 120 121config INTEL_CBNT_KM_PRIV_KEY_FILE 122 string "Key manifest (KM) private key" 123 depends on INTEL_CBNT_NEED_KM_PRIV_KEY 124 help 125 Location of the key manifest (KM) private key file in .pem format. 126 127config INTEL_CBNT_NEED_BPM_PUB_KEY 128 bool 129 130config INTEL_CBNT_NEED_BPM_PRIV_KEY 131 bool 132 133config INTEL_CBNT_BPM_PUB_KEY_FILE 134 string "Boot policy manifest (BPM) public key" 135 depends on INTEL_CBNT_NEED_BPM_PUB_KEY && !INTEL_CBNT_NEED_BPM_PRIV_KEY 136 help 137 Location of the boot policy manifest (BPM) public key file in .pem format. 138 139config INTEL_CBNT_BPM_PRIV_KEY_FILE 140 string "Boot policy manifest (BPM) private key" 141 depends on INTEL_CBNT_NEED_BPM_PRIV_KEY 142 help 143 Location of the boot policy manifest (BPM) private key file in .pem format. 144 145if !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE && INTEL_CBNT_GENERATE_KM 146 147menu "KM options" 148 149config INTEL_CBNT_KM_REVISION 150 int "KM revision" 151 default 1 152 help 153 Version of the Key Manifest defined by the Platform Manufacturer. 154 The actual value is transparent to Boot Guard and is not processed by Boot Guard. 155 156config INTEL_CBNT_KM_SVN 157 int "KM security Version Number" 158 range 0 15 159 default 0 160 help 161 This value is determined by the Platform Manufacturer. 162 Boot Guard uses this to compare it to the Key Manifest 163 Revocation Value (Revocation.KMSVN) in FPF. 164 165 If KMSVN < Revocation.KMSVN, the KM will be revoked. It will trigger ENF (the 166 enforcement policy). 167 IF KMSVN > Revocation.KMSVN, the Revocation.KMSVN will be set to the KMSVN. 168 169 Note: Once the value reaches 0Fh, revocation saturates and one can no longer 170 revoke newer KMs. 171 172config INTEL_CBNT_KM_ID 173 int "KM ID" 174 default 1 175 help 176 This identifies the Key Manifest to be used for a platform. 177 This must match the Key Manifest Identifier programmed in 178 the field programmable fuses. 179 180endmenu 181 182endif # !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE 183 184if !INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE && INTEL_CBNT_GENERATE_BPM 185menu "BPM options" 186 187config INTEL_CBNT_BPM_REVISION 188 int "BPM revision" 189 default 1 190 help 191 Version of the Key Manifest defined by the Platform Manufacturer. 192 The actual value is transparent to Boot Guard and is not processed by Boot Guard. 193 194config INTEL_CBNT_BPM_SVN 195 int "BPM Security Version Number" 196 default 0 197 help 198 This value is determined by the Platform Manufacturer. 199 200config INTEL_CBNT_ACM_SVN 201 int "S-ACM Security Version Number" 202 default 2 203 help 204 This defines the minimum version the S-ACM must have. 205 206config INTEL_CBNT_NUM_NEM_PAGES 207 int 208 default 32 209 help 210 Set the amount of 4K pages of CAR required. 211 212config INTEL_CBNT_PBET 213 int "PBET value in s" 214 default 15 215 help 216 Protect BIOS Environment Timer (PBET) value. 217 Factor used by CSE to compute PBE timer value. 218 Actual PBE timer value is set by CSE using formula: 219 PBE timer value = 5 sec + PBETValue. 220 221config INTEL_CBNT_IBB_FLAGS 222 int "IBB flags" 223 default 7 224 help 225 IBB Control flags. 226 3: Don't extend PCR 0 227 7: extend PCR 7 228 229config INTEL_CBNT_SINIT_SVN 230 int "SINIT ACM security version number" 231 default 0 232 help 233 Minimum required version for the SINIT ACM. 234 235config INTEL_CBNT_PD_INTERVAL 236 int 237 default 60 238 help 239 Duration of Power Down in 5 sec increments. 240 241endmenu 242 243endif # !INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE 244 245config INTEL_CBNT_KEY_MANIFEST_BINARY 246 string "KM (Key Manifest) binary location" 247 depends on !INTEL_CBNT_GENERATE_KM 248 help 249 Location of the Key Manifest (KM) 250 251config INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY 252 string "BPM (Boot Policy Manifest) binary location" 253 depends on !INTEL_CBNT_GENERATE_BPM 254 help 255 Location of the Boot Policy Manifest (BPM) 256 257config INTEL_CBNT_CMOS_OFFSET 258 hex 259 default 0x7e 260 help 261 Address in RTC CMOS used by CBNT. Uses 2 bytes. If using an option table 262 adapt the cmos.layout accordingly. The bytes should not be checksummed. 263 264endif # INTEL_CBNT_SUPPORT 265