Elyes HAOUAS | f7b2fe6 | 2020-05-07 12:38:15 +0200 | [diff] [blame] | 1 | # SPDX-License-Identifier: GPL-2.0-only |
Patrick Rudolph | 5fffb5e | 2019-07-25 11:55:30 +0200 | [diff] [blame] | 2 | |
Subrata Banik | 6a2495d | 2022-12-31 14:36:54 +0530 | [diff] [blame] | 3 | config INTEL_TXT_LIB |
| 4 | bool |
| 5 | default n |
| 6 | help |
| 7 | This option includes library functions related to the TXT |
| 8 | operation which SoC would still like to access without enabling |
| 9 | INTEL_TXT config. |
| 10 | |
Patrick Rudolph | 5fffb5e | 2019-07-25 11:55:30 +0200 | [diff] [blame] | 11 | config INTEL_TXT |
| 12 | bool "Intel TXT support" |
| 13 | default n |
Subrata Banik | 6a2495d | 2022-12-31 14:36:54 +0530 | [diff] [blame] | 14 | select INTEL_TXT_LIB |
Patrick Rudolph | 5fffb5e | 2019-07-25 11:55:30 +0200 | [diff] [blame] | 15 | select MRC_SETTINGS_PROTECT if CACHE_MRC_SETTINGS |
| 16 | select ENABLE_VMX if CPU_INTEL_COMMON |
| 17 | select AP_IN_SIPI_WAIT |
Arthur Heymans | eb73e5f | 2021-05-06 10:28:26 +0200 | [diff] [blame] | 18 | select TPM_MEASURED_BOOT_INIT_BOOTBLOCK if TPM_MEASURED_BOOT |
Kyösti Mälkki | f303b4f | 2021-05-27 19:33:57 +0300 | [diff] [blame] | 19 | depends on TPM |
Patrick Rudolph | 5fffb5e | 2019-07-25 11:55:30 +0200 | [diff] [blame] | 20 | depends on PLATFORM_HAS_DRAM_CLEAR |
Angel Pons | 1fc43aa | 2020-08-04 17:54:01 +0200 | [diff] [blame] | 21 | depends on (SOC_INTEL_COMMON_BLOCK_SA || HAVE_CF9_RESET) |
Patrick Rudolph | 5fffb5e | 2019-07-25 11:55:30 +0200 | [diff] [blame] | 22 | |
| 23 | if INTEL_TXT |
| 24 | |
| 25 | config INTEL_TXT_BIOSACM_FILE |
| 26 | string "BIOS ACM file" |
Patrick Rudolph | 5fffb5e | 2019-07-25 11:55:30 +0200 | [diff] [blame] | 27 | default "3rdparty/blobs/soc/intel/skylake/biosacm.bin" if SOC_INTEL_COMMON_SKYLAKE_BASE |
| 28 | help |
Philipp Deppenwiese | 5f9f776 | 2018-11-20 14:22:15 +0100 | [diff] [blame] | 29 | Intel TXT BIOS ACM file. This file can be obtained through privileged |
Patrick Rudolph | 5fffb5e | 2019-07-25 11:55:30 +0200 | [diff] [blame] | 30 | access to Intel resources. Or for some platforms found inside the |
| 31 | blob repository. |
| 32 | |
| 33 | config INTEL_TXT_SINITACM_FILE |
| 34 | string "SINIT ACM file" |
Patrick Rudolph | 5fffb5e | 2019-07-25 11:55:30 +0200 | [diff] [blame] | 35 | default "3rdparty/blobs/soc/intel/skylake/sinitacm.bin" if SOC_INTEL_COMMON_SKYLAKE_BASE |
| 36 | help |
Philipp Deppenwiese | 5f9f776 | 2018-11-20 14:22:15 +0100 | [diff] [blame] | 37 | Intel TXT SINIT ACM file. This file can be obtained through privileged |
Patrick Rudolph | 5fffb5e | 2019-07-25 11:55:30 +0200 | [diff] [blame] | 38 | access to Intel resources. Or for some platforms found inside the |
| 39 | blob repository. |
| 40 | |
Angel Pons | 5a6daa6 | 2020-10-15 23:48:25 +0200 | [diff] [blame] | 41 | config INTEL_TXT_DPR_SIZE |
| 42 | int |
| 43 | range 0 255 |
| 44 | default 3 |
| 45 | help |
| 46 | Specify the size the DPR region needs to have. On at least Haswell, |
| 47 | the MRC does not have an input to specify the size of DPR, so this |
| 48 | field is only used to check if the programmed size is large enough. |
| 49 | |
Michał Żygowski | 85d9474 | 2021-11-21 12:11:47 +0100 | [diff] [blame] | 50 | config INTEL_TXT_BDR_VERSION |
| 51 | int "BIOS Data Region version" |
| 52 | range 2 6 |
| 53 | default 5 if TPM1 |
| 54 | default 6 if TPM2 |
| 55 | help |
| 56 | Specify the TXT heap BIOS Data Region version. Sometimes when using |
| 57 | an older Trusted Boot version, it may report unsupported BIOS Data |
| 58 | Region version and refuse to set up the measured launch environment. |
| 59 | Setting lower version may work around such issue. Allowed values |
| 60 | currently range from 2 to 6. |
| 61 | |
Angel Pons | 8a285fd8 | 2020-10-16 10:49:12 +0200 | [diff] [blame] | 62 | config INTEL_TXT_TEST_BIOS_ACM_CALLING_CODE |
| 63 | bool "Test BIOS ACM calling code with NOP function" |
| 64 | help |
| 65 | Run a NOP function of the BIOS ACM to check that the ACM calling code |
| 66 | is functioning properly. Use in pre-production environments only! |
| 67 | |
Philipp Deppenwiese | 5f9f776 | 2018-11-20 14:22:15 +0100 | [diff] [blame] | 68 | config INTEL_TXT_LOGGING |
| 69 | bool "Enable verbose logging" |
| 70 | help |
| 71 | Print more TXT related debug output. |
| 72 | Use in pre-production environments only! |
| 73 | |
Patrick Rudolph | 5fffb5e | 2019-07-25 11:55:30 +0200 | [diff] [blame] | 74 | config INTEL_TXT_BIOSACM_ALIGNMENT |
| 75 | hex |
Arthur Heymans | 94fe086 | 2020-10-15 13:57:52 +0200 | [diff] [blame] | 76 | default 0x40000 if INTEL_CBNT_SUPPORT |
Philipp Deppenwiese | 5f9f776 | 2018-11-20 14:22:15 +0100 | [diff] [blame] | 77 | default 0x20000 # 128 KiB |
Patrick Rudolph | 5fffb5e | 2019-07-25 11:55:30 +0200 | [diff] [blame] | 78 | help |
Philipp Deppenwiese | 5f9f776 | 2018-11-20 14:22:15 +0100 | [diff] [blame] | 79 | Exceptions are Ivy and Sandy Bridge with 64 KiB and Purley with 256 KiB |
| 80 | alignment size. If necessary, override from platform-specific Kconfig. |
| 81 | |
| 82 | config INTEL_TXT_CBFS_BIOS_POLICY |
| 83 | string |
| 84 | default "txt_bios_policy.bin" |
| 85 | |
| 86 | config INTEL_TXT_CBFS_BIOS_ACM |
| 87 | string |
| 88 | default "txt_bios_acm.bin" |
| 89 | |
| 90 | config INTEL_TXT_CBFS_SINIT_ACM |
| 91 | string |
| 92 | default "txt_sinit_acm.bin" |
Patrick Rudolph | 5fffb5e | 2019-07-25 11:55:30 +0200 | [diff] [blame] | 93 | |
Arthur Heymans | 9059a89 | 2020-10-23 11:08:41 +0200 | [diff] [blame] | 94 | config INTEL_TXT_SINIT_SIZE |
| 95 | hex |
| 96 | default 0x20000 |
| 97 | help |
| 98 | This is the size that will be programmed in TXT_SINIT_SIZE. |
| 99 | This needs to be at least the size of the SINIT ACM. |
| 100 | This is platform dependent. For instance on CPX this has |
| 101 | to be the ACM size + 64K. |
| 102 | |
| 103 | config INTEL_TXT_HEAP_SIZE |
| 104 | hex |
| 105 | default 0xe0000 |
| 106 | help |
| 107 | This is the size that will be programmed in TXT_HEAP_SIZE. |
| 108 | This is platform dependent. |
| 109 | |
Patrick Rudolph | 5fffb5e | 2019-07-25 11:55:30 +0200 | [diff] [blame] | 110 | endif |