Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 1 | # SPDX-License-Identifier: GPL-2.0-only |
| 2 | |
| 3 | config INTEL_CBNT_SUPPORT |
| 4 | bool "Intel CBnT support" |
| 5 | default n |
| 6 | depends on CPU_INTEL_FIRMWARE_INTERFACE_TABLE |
| 7 | #depends on PLATFORM_HAS_DRAM_CLEAR |
| 8 | select INTEL_TXT |
Arthur Heymans | cbce390 | 2021-01-28 18:25:58 +0100 | [diff] [blame] | 9 | # With CBnT the bootblock is set up as a CBnT IBB and needs a fixed size |
Arthur Heymans | 6f8e944 | 2021-03-29 14:23:53 +0200 | [diff] [blame] | 10 | select TPM_MEASURED_BOOT_INIT_BOOTBLOCK if TPM_MEASURED_BOOT |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 11 | help |
| 12 | Enables Intel Converged Bootguard and Trusted Execution Technology |
| 13 | Support. This will enable one to add a Key Manifest (KM) and a Boot |
| 14 | Policy Manifest (BPM) to the filesystem. It will also wrap a FIT around |
| 15 | the firmware and update appropriate entries. |
| 16 | |
| 17 | if INTEL_CBNT_SUPPORT |
| 18 | |
Arthur Heymans | ee55d71 | 2021-05-12 16:22:05 +0200 | [diff] [blame] | 19 | config INTEL_CBNT_LOGGING |
| 20 | bool "Enable verbose CBnT logging" |
| 21 | help |
| 22 | Print more CBnT related debug output. |
| 23 | Use in pre-production environments only! |
| 24 | |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame] | 25 | config INTEL_CBNT_GENERATE_KM |
| 26 | bool "Generate Key Manifest (KM)" |
| 27 | default y |
| 28 | select INTEL_CBNT_NEED_KM_PUB_KEY |
Arthur Heymans | 5e0119e | 2021-03-17 12:03:39 +0100 | [diff] [blame] | 29 | select INTEL_CBNT_NEED_KM_PRIV_KEY if !INTEL_CBNT_KM_ONLY_UNSIGNED |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 30 | select INTEL_CBNT_NEED_BPM_PUB_KEY if !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame] | 31 | help |
| 32 | Select y to generate the Key Manifest (KM). |
| 33 | Select n to include a KM binary. |
| 34 | |
Arthur Heymans | 5e0119e | 2021-03-17 12:03:39 +0100 | [diff] [blame] | 35 | config INTEL_CBNT_KM_ONLY_UNSIGNED |
| 36 | bool "Only unsigned key manifest (KM)" |
| 37 | depends on INTEL_CBNT_GENERATE_KM |
| 38 | help |
| 39 | Skip signing the KM. |
| 40 | The resulting unsigned KM will be placed at build/km_unsigned.bin. |
| 41 | The resulting coreboot image will not be functional with CBnT. |
| 42 | After the unsigned KM is signed externally you can either rebuild |
| 43 | coreboot using that binary or add it to cbfs and fit: |
| 44 | "$ cbfstool build/coreboot.rom add -f km.bin -n key_manifest.bin -t raw -a 16" |
| 45 | "$ ifittool -r COREBOOT -a -n key_manifest.bin -t 11 -s 12 -f build/coreboot.rom" |
| 46 | '-s 12' where 12 is CONFIG_CPU_INTEL_NUM_FIT_ENTRIES. |
| 47 | |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 48 | config INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE |
Arthur Heymans | 0514324 | 2021-02-08 19:41:23 +0100 | [diff] [blame] | 49 | bool "KM: use a CBnT json config file" |
| 50 | depends on INTEL_CBNT_GENERATE_KM |
| 51 | default y |
| 52 | help |
| 53 | Select y to generate KM from a json config file. |
| 54 | Select n to generate KM from Kconfig options |
| 55 | |
Arthur Heymans | 15412c0 | 2021-02-08 22:38:40 +0100 | [diff] [blame] | 56 | config INTEL_CBNT_GENERATE_BPM |
| 57 | bool "Generate Boot Policy Manifest (BPM)" |
| 58 | default y |
Arthur Heymans | 6362df3 | 2021-03-17 12:23:20 +0100 | [diff] [blame] | 59 | select INTEL_CBNT_NEED_BPM_PRIV_KEY if !INTEL_CBNT_BPM_ONLY_UNSIGNED |
Arthur Heymans | 15412c0 | 2021-02-08 22:38:40 +0100 | [diff] [blame] | 60 | help |
| 61 | Select y to generate the Boot Policy Manifest (BPM). |
| 62 | Select n to include a BPM binary. |
| 63 | |
Arthur Heymans | 6362df3 | 2021-03-17 12:23:20 +0100 | [diff] [blame] | 64 | config INTEL_CBNT_BPM_ONLY_UNSIGNED |
| 65 | bool "Only unsigned boot policy manifest (BPM)" |
| 66 | depends on INTEL_CBNT_GENERATE_BPM |
| 67 | help |
| 68 | Skip signing the BPM. |
| 69 | The resulting unsigned BPM will be placed at build/bpm_unsigned.bin. |
| 70 | The resulting coreboot image will not be functional with CBnT. |
| 71 | After the unsigned BPM is signed externally you can add it to cbfs |
| 72 | and fit: |
| 73 | "$ cbfstool build/coreboot.rom add -f bpm.bin -n boot_policy_manifest.bin -t raw -a 16" |
| 74 | "$ ifittool -r COREBOOT -a -n boot_policy_manifest.bin -t 12 -s 12 -f build/coreboot.rom" |
| 75 | '-s 12' where 12 is CONFIG_CPU_INTEL_NUM_FIT_ENTRIES. |
| 76 | |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 77 | config INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE |
Arthur Heymans | 3d5319e | 2021-02-19 19:39:56 +0100 | [diff] [blame] | 78 | bool "BPM: use a CBnT json config file" |
| 79 | depends on INTEL_CBNT_GENERATE_BPM |
| 80 | default y |
| 81 | help |
| 82 | Select y to generate BPM from a json config file. |
| 83 | Select n to generate BPM from Kconfig options |
| 84 | |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 85 | config INTEL_CBNT_CBNT_PROV_CFG_FILE |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame] | 86 | string "CBnT json config file" |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 87 | depends on INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE || INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame] | 88 | help |
| 89 | Location of the bg-prov json config file. |
| 90 | Either get a sample JSON config file: |
| 91 | $ bg-prov template |
| 92 | Or extract it from a working configuration: |
| 93 | $ bg-prov read-config |
| 94 | |
Arthur Heymans | 0250a78 | 2021-03-31 16:54:37 +0200 | [diff] [blame] | 95 | config INTEL_CBNT_PROV_EXTERNAL_BIN |
| 96 | bool "Use an external cbnt-prov binary" |
| 97 | default n |
| 98 | depends on INTEL_CBNT_GENERATE_BPM || INTEL_CBNT_GENERATE_KM |
| 99 | help |
| 100 | Building cbnt-prov requires godeps which makes it impossible to build |
| 101 | it in an offline environment. A solution is to use an external binary. |
| 102 | |
| 103 | config INTEL_CBNT_PROV_EXTERNAL_BIN_PATH |
| 104 | string "cbnt-prov path" |
| 105 | depends on INTEL_CBNT_PROV_EXTERNAL_BIN |
| 106 | help |
| 107 | Path to the cbnt-prov binary. |
| 108 | |
Arthur Heymans | 21176dd | 2021-03-17 15:33:26 +0100 | [diff] [blame] | 109 | config INTEL_CBNT_NEED_KM_PUB_KEY |
| 110 | bool |
| 111 | |
| 112 | config INTEL_CBNT_NEED_KM_PRIV_KEY |
| 113 | bool |
| 114 | |
| 115 | config INTEL_CBNT_KM_PUB_KEY_FILE |
| 116 | string "Key manifest (KM) public key" |
| 117 | depends on INTEL_CBNT_NEED_KM_PUB_KEY && !INTEL_CBNT_NEED_KM_PRIV_KEY |
| 118 | help |
| 119 | Location of the key manifest (KM) public key file in .pem format. |
| 120 | |
| 121 | config INTEL_CBNT_KM_PRIV_KEY_FILE |
| 122 | string "Key manifest (KM) private key" |
| 123 | depends on INTEL_CBNT_NEED_KM_PRIV_KEY |
| 124 | help |
| 125 | Location of the key manifest (KM) private key file in .pem format. |
| 126 | |
| 127 | config INTEL_CBNT_NEED_BPM_PUB_KEY |
| 128 | bool |
| 129 | |
| 130 | config INTEL_CBNT_NEED_BPM_PRIV_KEY |
| 131 | bool |
| 132 | |
| 133 | config INTEL_CBNT_BPM_PUB_KEY_FILE |
| 134 | string "Boot policy manifest (BPM) public key" |
| 135 | depends on INTEL_CBNT_NEED_BPM_PUB_KEY && !INTEL_CBNT_NEED_BPM_PRIV_KEY |
| 136 | help |
| 137 | Location of the boot policy manifest (BPM) public key file in .pem format. |
| 138 | |
| 139 | config INTEL_CBNT_BPM_PRIV_KEY_FILE |
| 140 | string "Boot policy manifest (BPM) private key" |
| 141 | depends on INTEL_CBNT_NEED_BPM_PRIV_KEY |
| 142 | help |
| 143 | Location of the boot policy manifest (BPM) private key file in .pem format. |
| 144 | |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 145 | if !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE && INTEL_CBNT_GENERATE_KM |
Arthur Heymans | 0514324 | 2021-02-08 19:41:23 +0100 | [diff] [blame] | 146 | |
| 147 | menu "KM options" |
| 148 | |
| 149 | config INTEL_CBNT_KM_REVISION |
| 150 | int "KM revision" |
| 151 | default 1 |
| 152 | help |
| 153 | Version of the Key Manifest defined by the Platform Manufacturer. |
| 154 | The actual value is transparent to Boot Guard and is not processed by Boot Guard. |
| 155 | |
| 156 | config INTEL_CBNT_KM_SVN |
| 157 | int "KM security Version Number" |
| 158 | range 0 15 |
| 159 | default 0 |
| 160 | help |
| 161 | This value is determined by the Platform Manufacturer. |
| 162 | Boot Guard uses this to compare it to the Key Manifest |
| 163 | Revocation Value (Revocation.KMSVN) in FPF. |
| 164 | |
| 165 | If KMSVN < Revocation.KMSVN, the KM will be revoked. It will trigger ENF (the |
| 166 | enforcement policy). |
| 167 | IF KMSVN > Revocation.KMSVN, the Revocation.KMSVN will be set to the KMSVN. |
| 168 | |
| 169 | Note: Once the value reaches 0Fh, revocation saturates and one can no longer |
| 170 | revoke newer KMs. |
| 171 | |
| 172 | config INTEL_CBNT_KM_ID |
| 173 | int "KM ID" |
| 174 | default 1 |
| 175 | help |
| 176 | This identifies the Key Manifest to be used for a platform. |
| 177 | This must match the Key Manifest Identifier programmed in |
| 178 | the field programmable fuses. |
| 179 | |
| 180 | endmenu |
| 181 | |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 182 | endif # !INTEL_CBNT_CBNT_PROV_KM_USE_CFG_FILE |
Arthur Heymans | 0514324 | 2021-02-08 19:41:23 +0100 | [diff] [blame] | 183 | |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 184 | if !INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE && INTEL_CBNT_GENERATE_BPM |
Arthur Heymans | 3d5319e | 2021-02-19 19:39:56 +0100 | [diff] [blame] | 185 | menu "BPM options" |
| 186 | |
| 187 | config INTEL_CBNT_BPM_REVISION |
| 188 | int "BPM revision" |
| 189 | default 1 |
| 190 | help |
| 191 | Version of the Key Manifest defined by the Platform Manufacturer. |
| 192 | The actual value is transparent to Boot Guard and is not processed by Boot Guard. |
| 193 | |
| 194 | config INTEL_CBNT_BPM_SVN |
| 195 | int "BPM Security Version Number" |
| 196 | default 0 |
| 197 | help |
| 198 | This value is determined by the Platform Manufacturer. |
| 199 | |
| 200 | config INTEL_CBNT_ACM_SVN |
| 201 | int "S-ACM Security Version Number" |
| 202 | default 2 |
| 203 | help |
| 204 | This defines the minimum version the S-ACM must have. |
| 205 | |
| 206 | config INTEL_CBNT_NUM_NEM_PAGES |
| 207 | int |
| 208 | default 32 |
| 209 | help |
| 210 | Set the amount of 4K pages of CAR required. |
| 211 | |
| 212 | config INTEL_CBNT_PBET |
| 213 | int "PBET value in s" |
| 214 | default 15 |
| 215 | help |
| 216 | Protect BIOS Environment Timer (PBET) value. |
| 217 | Factor used by CSE to compute PBE timer value. |
| 218 | Actual PBE timer value is set by CSE using formula: |
| 219 | PBE timer value = 5 sec + PBETValue. |
| 220 | |
| 221 | config INTEL_CBNT_IBB_FLAGS |
| 222 | int "IBB flags" |
| 223 | default 7 |
| 224 | help |
| 225 | IBB Control flags. |
| 226 | 3: Don't extend PCR 0 |
| 227 | 7: extend PCR 7 |
| 228 | |
| 229 | config INTEL_CBNT_SINIT_SVN |
| 230 | int "SINIT ACM security version number" |
| 231 | default 0 |
| 232 | help |
| 233 | Minimum required version for the SINIT ACM. |
| 234 | |
| 235 | config INTEL_CBNT_PD_INTERVAL |
| 236 | int |
| 237 | default 60 |
| 238 | help |
| 239 | Duration of Power Down in 5 sec increments. |
| 240 | |
| 241 | endmenu |
| 242 | |
Arthur Heymans | 53164ba | 2021-05-06 11:15:32 +0200 | [diff] [blame] | 243 | endif # !INTEL_CBNT_CBNT_PROV_BPM_USE_CFG_FILE |
Arthur Heymans | 3d5319e | 2021-02-19 19:39:56 +0100 | [diff] [blame] | 244 | |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 245 | config INTEL_CBNT_KEY_MANIFEST_BINARY |
| 246 | string "KM (Key Manifest) binary location" |
Arthur Heymans | 2ef2e47 | 2021-02-08 14:28:03 +0100 | [diff] [blame] | 247 | depends on !INTEL_CBNT_GENERATE_KM |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 248 | help |
| 249 | Location of the Key Manifest (KM) |
| 250 | |
| 251 | config INTEL_CBNT_BOOT_POLICY_MANIFEST_BINARY |
| 252 | string "BPM (Boot Policy Manifest) binary location" |
Arthur Heymans | 15412c0 | 2021-02-08 22:38:40 +0100 | [diff] [blame] | 253 | depends on !INTEL_CBNT_GENERATE_BPM |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 254 | help |
| 255 | Location of the Boot Policy Manifest (BPM) |
| 256 | |
Arthur Heymans | 2390754 | 2021-03-16 19:28:50 +0100 | [diff] [blame] | 257 | config INTEL_CBNT_CMOS_OFFSET |
| 258 | hex |
| 259 | default 0x7e |
| 260 | help |
| 261 | Address in RTC CMOS used by CBNT. Uses 2 bytes. If using an option table |
| 262 | adapt the cmos.layout accordingly. The bytes should not be checksummed. |
| 263 | |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 264 | endif # INTEL_CBNT_SUPPORT |