Elyes HAOUAS | f7b2fe6 | 2020-05-07 12:38:15 +0200 | [diff] [blame] | 1 | # SPDX-License-Identifier: GPL-2.0-only |
Philipp Deppenwiese | 64e2d19 | 2017-10-18 17:13:07 +0200 | [diff] [blame] | 2 | |
Philipp Deppenwiese | c07f8fb | 2018-02-27 19:40:52 +0100 | [diff] [blame] | 3 | source "src/security/tpm/tss/vendor/cr50/Kconfig" |
| 4 | |
Philipp Deppenwiese | 64e2d19 | 2017-10-18 17:13:07 +0200 | [diff] [blame] | 5 | menu "Trusted Platform Module" |
| 6 | |
Julius Werner | 8ad9379 | 2021-05-18 17:15:50 -0700 | [diff] [blame] | 7 | choice |
| 8 | prompt "Trusted Platform Module" |
| 9 | default TPM2 if MAINBOARD_HAS_TPM2 |
| 10 | default TPM1 if MAINBOARD_HAS_TPM1 |
| 11 | default NO_TPM |
| 12 | |
| 13 | config NO_TPM |
| 14 | bool "No TPM" |
| 15 | help |
| 16 | No TPM support. Select this option if your system doesn't have a TPM, |
| 17 | or if you don't want coreboot to communicate with your TPM in any way. |
| 18 | (If your board doesn't offer a TPM interface, this will be the only |
| 19 | possible option.) |
| 20 | |
Philipp Deppenwiese | c07f8fb | 2018-02-27 19:40:52 +0100 | [diff] [blame] | 21 | config TPM1 |
Julius Werner | 8ad9379 | 2021-05-18 17:15:50 -0700 | [diff] [blame] | 22 | bool "TPM 1.2" |
Jes B. Klinke | c6b041a1 | 2022-04-19 14:00:33 -0700 | [diff] [blame] | 23 | depends on I2C_TPM || MEMORY_MAPPED_TPM || SPI_TPM || CRB_TPM |
Julius Werner | 8ad9379 | 2021-05-18 17:15:50 -0700 | [diff] [blame] | 24 | depends on !MAINBOARD_HAS_TPM2 |
| 25 | help |
| 26 | Select this option if your TPM uses the older TPM 1.2 protocol. |
Philipp Deppenwiese | 64e2d19 | 2017-10-18 17:13:07 +0200 | [diff] [blame] | 27 | |
| 28 | config TPM2 |
Julius Werner | 8ad9379 | 2021-05-18 17:15:50 -0700 | [diff] [blame] | 29 | bool "TPM 2.0" |
Jes B. Klinke | c6b041a1 | 2022-04-19 14:00:33 -0700 | [diff] [blame] | 30 | depends on I2C_TPM || MEMORY_MAPPED_TPM || SPI_TPM || CRB_TPM |
Julius Werner | 8ad9379 | 2021-05-18 17:15:50 -0700 | [diff] [blame] | 31 | depends on !MAINBOARD_HAS_TPM1 |
| 32 | help |
| 33 | Select this option if your TPM uses the newer TPM 2.0 protocol. |
| 34 | |
| 35 | endchoice |
Philipp Deppenwiese | 64e2d19 | 2017-10-18 17:13:07 +0200 | [diff] [blame] | 36 | |
Kyösti Mälkki | d2b2a18 | 2021-04-29 15:33:07 +0300 | [diff] [blame] | 37 | config TPM |
| 38 | bool |
| 39 | default y |
| 40 | depends on TPM1 || TPM2 |
| 41 | |
Philipp Deppenwiese | c07f8fb | 2018-02-27 19:40:52 +0100 | [diff] [blame] | 42 | config MAINBOARD_HAS_TPM1 |
| 43 | bool |
Julius Werner | 8ad9379 | 2021-05-18 17:15:50 -0700 | [diff] [blame] | 44 | help |
| 45 | This option can be selected by a mainboard to represent that its TPM |
| 46 | always uses the 1.2 protocol, and that it should be on by default. |
Philipp Deppenwiese | c07f8fb | 2018-02-27 19:40:52 +0100 | [diff] [blame] | 47 | |
| 48 | config MAINBOARD_HAS_TPM2 |
| 49 | bool |
Philipp Deppenwiese | c07f8fb | 2018-02-27 19:40:52 +0100 | [diff] [blame] | 50 | help |
Julius Werner | 8ad9379 | 2021-05-18 17:15:50 -0700 | [diff] [blame] | 51 | This option can be selected by a mainboard to represent that its TPM |
| 52 | always uses the 2.0 protocol, and that it should be on by default. |
Philipp Deppenwiese | c07f8fb | 2018-02-27 19:40:52 +0100 | [diff] [blame] | 53 | |
| 54 | config TPM_DEACTIVATE |
| 55 | bool "Deactivate TPM" |
| 56 | default n |
| 57 | depends on !VBOOT |
| 58 | depends on TPM1 |
| 59 | help |
| 60 | Deactivate TPM by issuing deactivate command. |
Philipp Deppenwiese | 64e2d19 | 2017-10-18 17:13:07 +0200 | [diff] [blame] | 61 | |
| 62 | config DEBUG_TPM |
| 63 | bool "Output verbose TPM debug messages" |
| 64 | default n |
Philipp Deppenwiese | c07f8fb | 2018-02-27 19:40:52 +0100 | [diff] [blame] | 65 | select DRIVER_TPM_DISPLAY_TIS_BYTES if I2C_TPM |
Kyösti Mälkki | f303b4f | 2021-05-27 19:33:57 +0300 | [diff] [blame] | 66 | depends on TPM |
Philipp Deppenwiese | 64e2d19 | 2017-10-18 17:13:07 +0200 | [diff] [blame] | 67 | help |
| 68 | This option enables additional TPM related debug messages. |
| 69 | |
Philipp Deppenwiese | c07f8fb | 2018-02-27 19:40:52 +0100 | [diff] [blame] | 70 | config TPM_RDRESP_NEED_DELAY |
| 71 | bool "Enable Delay Workaround for TPM" |
Philipp Deppenwiese | 64e2d19 | 2017-10-18 17:13:07 +0200 | [diff] [blame] | 72 | default n |
Jes B. Klinke | c6b041a1 | 2022-04-19 14:00:33 -0700 | [diff] [blame] | 73 | depends on MEMORY_MAPPED_TPM |
Philipp Deppenwiese | 64e2d19 | 2017-10-18 17:13:07 +0200 | [diff] [blame] | 74 | help |
Philipp Deppenwiese | c07f8fb | 2018-02-27 19:40:52 +0100 | [diff] [blame] | 75 | Certain TPMs seem to need some delay when reading response |
| 76 | to work around a race-condition-related issue, possibly |
| 77 | caused by ill-programmed TPM firmware. |
Philipp Deppenwiese | 64e2d19 | 2017-10-18 17:13:07 +0200 | [diff] [blame] | 78 | |
Arthur Heymans | 6d5fcf4 | 2019-10-14 17:06:27 +0200 | [diff] [blame] | 79 | config TPM_STARTUP_IGNORE_POSTINIT |
| 80 | bool |
| 81 | help |
| 82 | Select this to ignore POSTINIT INVALID return codes on TPM |
| 83 | startup. This is useful on platforms where a previous stage |
| 84 | issued a TPM startup. Examples of use cases are Intel TXT |
Angel Pons | 31b7ee4 | 2020-02-17 14:04:28 +0100 | [diff] [blame] | 85 | or VBOOT on the Intel Arrandale processor, which issues a |
Arthur Heymans | 6d5fcf4 | 2019-10-14 17:06:27 +0200 | [diff] [blame] | 86 | CPU-only reset during the romstage. |
| 87 | |
Bill XIE | c79e96b | 2019-08-22 20:28:36 +0800 | [diff] [blame] | 88 | config TPM_MEASURED_BOOT |
| 89 | bool "Enable Measured Boot" |
| 90 | default n |
| 91 | select VBOOT_LIB |
Kyösti Mälkki | f303b4f | 2021-05-27 19:33:57 +0300 | [diff] [blame] | 92 | depends on TPM |
Bill XIE | c79e96b | 2019-08-22 20:28:36 +0800 | [diff] [blame] | 93 | depends on !VBOOT_RETURN_FROM_VERSTAGE |
| 94 | help |
| 95 | Enables measured boot (experimental) |
| 96 | |
Sergii Dmytruk | 97fe17f | 2022-10-23 00:24:37 +0300 | [diff] [blame^] | 97 | choice |
| 98 | prompt "TPM event log format" |
| 99 | depends on TPM_MEASURED_BOOT |
| 100 | default TPM_LOG_CB |
| 101 | |
| 102 | config TPM_LOG_CB |
| 103 | bool "coreboot's custom format" |
| 104 | help |
| 105 | Custom coreboot-specific format of the log derived from TPM1 log format. |
| 106 | |
| 107 | endchoice |
| 108 | |
Arthur Heymans | 6f8e944 | 2021-03-29 14:23:53 +0200 | [diff] [blame] | 109 | config TPM_MEASURED_BOOT_INIT_BOOTBLOCK |
| 110 | bool |
| 111 | depends on TPM_MEASURED_BOOT && !VBOOT |
| 112 | help |
| 113 | Initialize TPM inside the bootblock instead of ramstage. This is |
| 114 | useful with some form of hardware assisted root of trust |
| 115 | measurement like Intel TXT/CBnT. |
| 116 | |
Bill XIE | c79e96b | 2019-08-22 20:28:36 +0800 | [diff] [blame] | 117 | config TPM_MEASURED_BOOT_RUNTIME_DATA |
| 118 | string "Runtime data whitelist" |
| 119 | default "" |
| 120 | depends on TPM_MEASURED_BOOT |
| 121 | help |
| 122 | Runtime data whitelist of cbfs filenames. Needs to be a |
harshit | aae1633 | 2020-05-12 12:55:39 +0530 | [diff] [blame] | 123 | space delimited list |
Bill XIE | c79e96b | 2019-08-22 20:28:36 +0800 | [diff] [blame] | 124 | |
Philipp Deppenwiese | 64e2d19 | 2017-10-18 17:13:07 +0200 | [diff] [blame] | 125 | endmenu # Trusted Platform Module (tpm) |