GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security/intel/cbnt: Generate KM from Kconfig symbols 

Add an option to generate the Key Manifest from Kconfig options.

Change-Id: I3a448f37c81148625c7879dcb64da4d517567067
Signed-off-by: Arthur Heymans <arthur@aheymans.xyz>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/50410
Reviewed-by: Christian Walter <christian.walter@9elements.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This commit is contained in:
Arthur Heymans 2021-02-08 19:41:23 +01:00 committed by Patrick Georgi
parent 2ef2e4793a
commit 0514324724
2 changed files with 62 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
src/security/intel/cbnt/Kconfig
View File

@ -21,13 +21,22 @@ config INTEL_CBNT_GENERATE_KM
default y
select INTEL_CBNT_NEED_KM_PUB_KEY
select INTEL_CBNT_NEED_KM_PRIV_KEY
select INTEL_CBNT_NEED_BPM_PUB_KEY if !INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE
help
Select y to generate the Key Manifest (KM).
Select n to include a KM binary.
config INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE
bool "KM: use a CBnT json config file"
depends on INTEL_CBNT_GENERATE_KM
default y
help
Select y to generate KM from a json config file.
Select n to generate KM from Kconfig options
config INTEL_CBNT_BG_PROV_CFG_FILE
string "CBnT json config file"
depends on INTEL_CBNT_GENERATE_KM
depends on INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE
help
Location of the bg-prov json config file.
Either get a sample JSON config file:
@ -71,6 +80,45 @@ config INTEL_CBNT_BPM_PRIV_KEY_FILE
help
Location of the boot policy manifest (BPM) private key file in .pem format.
if !INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE && INTEL_CBNT_GENERATE_KM
menu "KM options"
config INTEL_CBNT_KM_REVISION
int "KM revision"
default 1
help
Version of the Key Manifest defined by the Platform Manufacturer.
The actual value is transparent to Boot Guard and is not processed by Boot Guard.
config INTEL_CBNT_KM_SVN
int "KM security Version Number"
range 0 15
default 0
help
This value is determined by the Platform Manufacturer.
Boot Guard uses this to compare it to the Key Manifest
Revocation Value (Revocation.KMSVN) in FPF.
If KMSVN < Revocation.KMSVN, the KM will be revoked. It will trigger ENF (the
enforcement policy).
IF KMSVN > Revocation.KMSVN, the Revocation.KMSVN will be set to the KMSVN.
Note: Once the value reaches 0Fh, revocation saturates and one can no longer
revoke newer KMs.
config INTEL_CBNT_KM_ID
int "KM ID"
default 1
help
This identifies the Key Manifest to be used for a platform.
This must match the Key Manifest Identifier programmed in
the field programmable fuses.
endmenu
endif # !INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE
config INTEL_CBNT_KEY_MANIFEST_BINARY
string "KM (Key Manifest) binary location"
depends on !INTEL_CBNT_GENERATE_KM

13
src/security/intel/cbnt/Makefile.inc
View File

@ -44,9 +44,22 @@ $(call add_intermediate, add_bpm_fit, $(IFITTOOL) set_fit_ptr)
endif
ifeq ($(CONFIG_INTEL_CBNT_GENERATE_KM),y)
ifeq ($(CONFIG_INTEL_CBNT_BG_PROV_KM_USE_CFG_FILE),y)
$(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(BG_PROV) $(CBNT_CFG)
printf " BG_PROV creating unsigned KM using config file\n"
$(BG_PROV) km-gen $@ $< --config=$(CBNT_CFG)
else
PK_HASH_ALG_SHA256:=11 # Hardcode as no other options are available for CBnT
$(obj)/km_unsigned.bin: $(obj)/km_pub.pem $(obj)/bpm_pub.pem $(BG_PROV)
printf " BG_PROV creating unsigned KM\n"
$(BG_PROV) km-gen $@ $< --revision=$(CONFIG_INTEL_CBNT_KM_REVISION) \
--svn=$(CONFIG_INTEL_CBNT_KM_SVN) \
--id=$(CONFIG_INTEL_CBNT_KM_ID) \
--pkhashalg=$(PK_HASH_ALG_SHA256) \
--bpmpubkey=$(obj)/bpm_pub.pem \
--bpmhashalgo=$(PK_HASH_ALG_SHA256) \
--out=$(obj)/km_cfg.json
endif
$(obj)/km.bin: $(obj)/km_unsigned.bin $(BG_PROV) $(call strip_quotes, $(CONFIG_INTEL_CBNT_KM_PRIV_KEY_FILE))
printf " BG_PROV signing KM\n"