config-gui.sh: permit io386 platform locking to be dynamically disabled

linuxboot · Jun 19, 2023 · 7c379f7 · 7c379f7
1 parent a00a8be
commit 7c379f7
Show file tree

Hide file tree

Showing 29 changed files with 125 additions and 9 deletions.
diff --git a/boards/p8z77-m_pro-tpm1-maximized/p8z77-m_pro-tpm1-maximized.config b/boards/p8z77-m_pro-tpm1-maximized/p8z77-m_pro-tpm1-maximized.config
@@ -54,7 +54,10 @@ CONFIG_PCIUTILS=y
 CONFIG_POPT=y
 CONFIG_QRENCODE=y
 CONFIG_TPMTOTP=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
 
 # Dependencies for a graphical menu. Enable CONFIG_SLANG and CONFIG_NEWT instead
 # for a console-based menu.

diff --git a/boards/qemu-coreboot-whiptail-tpm1/qemu-coreboot-whiptail-tpm1.config b/boards/qemu-coreboot-whiptail-tpm1/qemu-coreboot-whiptail-tpm1.config
@@ -32,6 +32,10 @@ CONFIG_DROPBEAR=y
 CONFIG_MSRTOOLS=y
 #CONFIG_HOTPKEY=y
 
+#platform locking finalization (PR0)
+CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 #Uncomment only one of the following block
 #Required for graphical gui-init (FBWhiptail)
 #CONFIG_CAIRO=y

diff --git a/boards/t420-hotp-maximized/t420-hotp-maximized.config b/boards/t420-hotp-maximized/t420-hotp-maximized.config
@@ -28,7 +28,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/t420-maximized/t420-maximized.config b/boards/t420-maximized/t420-maximized.config
@@ -27,7 +27,10 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/t430-hotp-maximized/t430-hotp-maximized.config b/boards/t430-hotp-maximized/t430-hotp-maximized.config
@@ -26,7 +26,10 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/t430-maximized/t430-maximized.config b/boards/t430-maximized/t430-maximized.config
@@ -26,7 +26,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/t440p-maximized/t440p-maximized.config b/boards/t440p-maximized/t440p-maximized.config
@@ -19,7 +19,11 @@ CONFIG_PCIUTILS=y
 CONFIG_POPT=y
 CONFIG_QRENCODE=y
 CONFIG_TPMTOTP=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 # Dependencies for a graphical menu. Enable CONFIG_SLANG and CONFIG_NEWT instead
 # for a console-based menu.

diff --git a/boards/t520-hotp-maximized/t520-hotp-maximized.config b/boards/t520-hotp-maximized/t520-hotp-maximized.config
@@ -24,7 +24,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/t520-maximized/t520-maximized.config b/boards/t520-maximized/t520-maximized.config
@@ -24,7 +24,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/t530-dgpu-hotp-maximized/t530-dgpu-hotp-maximized.config b/boards/t530-dgpu-hotp-maximized/t530-dgpu-hotp-maximized.config
@@ -27,7 +27,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/t530-dgpu-maximized/t530-dgpu-maximized.config b/boards/t530-dgpu-maximized/t530-dgpu-maximized.config
@@ -27,7 +27,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/t530-hotp-maximized/t530-hotp-maximized.config b/boards/t530-hotp-maximized/t530-hotp-maximized.config
@@ -27,7 +27,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/t530-maximized/t530-maximized.config b/boards/t530-maximized/t530-maximized.config
@@ -27,7 +27,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/w530-dgpu-K1000m-hotp-maximized/w530-dgpu-K1000m-hotp-maximized.config b/boards/w530-dgpu-K1000m-hotp-maximized/w530-dgpu-K1000m-hotp-maximized.config
@@ -27,7 +27,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/w530-dgpu-K1000m-maximized/w530-dgpu-K1000m-maximized.config b/boards/w530-dgpu-K1000m-maximized/w530-dgpu-K1000m-maximized.config
@@ -27,7 +27,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/w530-dgpu-K2000m-hotp-maximized/w530-dgpu-K2000m-hotp-maximized.config b/boards/w530-dgpu-K2000m-hotp-maximized/w530-dgpu-K2000m-hotp-maximized.config
@@ -27,7 +27,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/w530-dgpu-K2000m-maximized/w530-dgpu-K2000m-maximized.config b/boards/w530-dgpu-K2000m-maximized/w530-dgpu-K2000m-maximized.config
@@ -27,7 +27,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/w530-hotp-maximized/w530-hotp-maximized.config b/boards/w530-hotp-maximized/w530-hotp-maximized.config
@@ -27,7 +27,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/w530-maximized/w530-maximized.config b/boards/w530-maximized/w530-maximized.config
@@ -27,7 +27,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/x220-hotp-maximized/x220-hotp-maximized.config b/boards/x220-hotp-maximized/x220-hotp-maximized.config
@@ -28,7 +28,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/x220-maximized/x220-maximized.config b/boards/x220-maximized/x220-maximized.config
@@ -28,7 +28,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/x230-hotp-maximized-fhd_edp/x230-hotp-maximized-fhd_edp.config b/boards/x230-hotp-maximized-fhd_edp/x230-hotp-maximized-fhd_edp.config
@@ -38,7 +38,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/x230-hotp-maximized/x230-hotp-maximized.config b/boards/x230-hotp-maximized/x230-hotp-maximized.config
@@ -26,7 +26,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/x230-hotp-maximized_usb-kb/x230-hotp-maximized_usb-kb.config b/boards/x230-hotp-maximized_usb-kb/x230-hotp-maximized_usb-kb.config
@@ -29,7 +29,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/x230-maximized-fhd_edp/x230-maximized-fhd_edp.config b/boards/x230-maximized-fhd_edp/x230-maximized-fhd_edp.config
@@ -38,7 +38,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/boards/x230-maximized/x230-maximized.config b/boards/x230-maximized/x230-maximized.config
@@ -26,7 +26,11 @@ CONFIG_UTIL_LINUX=y
 CONFIG_LVM2=y
 CONFIG_MBEDTLS=y
 CONFIG_PCIUTILS=y
+
+#platform locking finalization (PR0)
 CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=y
+
 
 #Remote attestation support
 #TPM based requirements

diff --git a/initrd/bin/config-gui.sh b/initrd/bin/config-gui.sh
@@ -10,6 +10,11 @@ TRACE "Under /bin/config-gui.sh"
 param=$1
 
 while true; do
+  choices=("b" "Change the /boot device" "s" "Save the current configuration to the running BIOS" "r" "Clear GPG key(s) and reset all user settings" "x" "Return to Main Menu")
+  if [ "$CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE" = "y" ];then
+    choices=("b" "Change the /boot device" "s" "Save the current configuration to the running BIOS" "r" "Clear GPG key(s) and reset all user settings" "t" "Skip Platform Locking at kexec so OS can write to firmware" "x" "Return to Main Menu")
+  fi
+
   if [ ! -z "$param" ]; then
     # use first char from parameter
     menu_choice=${param::1}
@@ -18,16 +23,18 @@ while true; do
     unset menu_choice
     whiptail $BG_COLOR_MAIN_MENU --title "Config Management Menu" \
     --menu "This menu lets you change settings for the current BIOS session.\n\nAll changes will revert after a reboot,\n\nunless you also save them to the running BIOS." 0 80 10 \
-    'b' ' Change the /boot device' \
-    's' ' Save the current configuration to the running BIOS' \
-    'r' ' Clear GPG key(s) and reset all user settings' \
-    'x' ' Return to Main Menu' \
+    "${choices[@]}" \
     2>/tmp/whiptail || recovery "GUI menu failed"
 
     menu_choice=$(cat /tmp/whiptail)
   fi
 
   case "$menu_choice" in
+    "t" )
+      export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=n
+      echo "export CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE=\"$CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE\"" >> /etc/config.user
+      combine_configs
+    ;;
     "x" )
       exit 0
     ;;

diff --git a/initrd/bin/kexec-boot b/initrd/bin/kexec-boot
@@ -150,7 +150,7 @@ if [ "$CONFIG_TPM" = "y" ]; then
 	tpmr kexec_finalize
 fi
 
-if [ -x /bin/io386 ]; then
+if [ -x /bin/io386 -a "$CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE" = "y" ]; then
 	lock_chip
 fi
 

diff --git a/initrd/bin/lock_chip b/initrd/bin/lock_chip
@@ -9,7 +9,15 @@
 . /etc/ash_functions
 
 TRACE "Under /bin/lock_chip"
-APM_CNT=0xb2
-FIN_CODE=0xcb
-echo "Finalizing chipset"
-io386 -o b -b x $APM_CNT $FIN_CODE
+if [ "$CONFIG_FINALIZE_PLATFORM_LOCKING_PRESKYLAKE" = "y" ]; then
+	APM_CNT=0xb2
+	FIN_CODE=0xcb
+fi
+
+if [ -n "$APM_CNT" -a -n "$FIN_CODE" ]; then
+	echo "Finalizing chipset"
+	io386 -o b -b x $APM_CNT $FIN_CODE
+else
+	echo "NOT Finalizing chipset"
+	echo "lock_chip called without valid APM_CNT and FIN_CODE defined under bin/lock_chip."
+fi