4129c2614c
At this moment, only GBB flags are moved from PCR-0 to PCR-1 when vboot-compatibility is not enabled. Change-Id: Ib3a192d902072f6f8d415c2952a36522b5bf09f9 Ticket: https://ticket.coreboot.org/issues/424 Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com> Reviewed-on: https://review.coreboot.org/c/coreboot/+/68750 Tested-by: build bot (Jenkins) <no-reply@coreboot.org> Reviewed-by: Michał Żygowski <michal.zygowski@3mdeb.com>
174 lines
4.1 KiB
Text
174 lines
4.1 KiB
Text
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
source "src/security/tpm/tss/vendor/cr50/Kconfig"
|
|
|
|
menu "Trusted Platform Module"
|
|
|
|
choice
|
|
prompt "Trusted Platform Module"
|
|
default TPM2 if MAINBOARD_HAS_TPM2
|
|
default TPM1 if MAINBOARD_HAS_TPM1
|
|
default NO_TPM
|
|
|
|
config NO_TPM
|
|
bool "No TPM"
|
|
help
|
|
No TPM support. Select this option if your system doesn't have a TPM,
|
|
or if you don't want coreboot to communicate with your TPM in any way.
|
|
(If your board doesn't offer a TPM interface, this will be the only
|
|
possible option.)
|
|
|
|
config TPM1
|
|
bool "TPM 1.2"
|
|
depends on I2C_TPM || MEMORY_MAPPED_TPM || SPI_TPM || CRB_TPM
|
|
depends on !MAINBOARD_HAS_TPM2
|
|
help
|
|
Select this option if your TPM uses the older TPM 1.2 protocol.
|
|
|
|
config TPM2
|
|
bool "TPM 2.0"
|
|
depends on I2C_TPM || MEMORY_MAPPED_TPM || SPI_TPM || CRB_TPM
|
|
depends on !MAINBOARD_HAS_TPM1
|
|
help
|
|
Select this option if your TPM uses the newer TPM 2.0 protocol.
|
|
|
|
endchoice
|
|
|
|
config TPM
|
|
bool
|
|
default y
|
|
depends on TPM1 || TPM2
|
|
|
|
config MAINBOARD_HAS_TPM1
|
|
bool
|
|
help
|
|
This option can be selected by a mainboard to represent that its TPM
|
|
always uses the 1.2 protocol, and that it should be on by default.
|
|
|
|
config MAINBOARD_HAS_TPM2
|
|
bool
|
|
help
|
|
This option can be selected by a mainboard to represent that its TPM
|
|
always uses the 2.0 protocol, and that it should be on by default.
|
|
|
|
config TPM_DEACTIVATE
|
|
bool "Deactivate TPM"
|
|
default n
|
|
depends on !VBOOT
|
|
depends on TPM1
|
|
help
|
|
Deactivate TPM by issuing deactivate command.
|
|
|
|
config DEBUG_TPM
|
|
bool "Output verbose TPM debug messages"
|
|
default n
|
|
select DRIVER_TPM_DISPLAY_TIS_BYTES if I2C_TPM
|
|
depends on TPM
|
|
help
|
|
This option enables additional TPM related debug messages.
|
|
|
|
config TPM_RDRESP_NEED_DELAY
|
|
bool "Enable Delay Workaround for TPM"
|
|
default n
|
|
depends on MEMORY_MAPPED_TPM
|
|
help
|
|
Certain TPMs seem to need some delay when reading response
|
|
to work around a race-condition-related issue, possibly
|
|
caused by ill-programmed TPM firmware.
|
|
|
|
config TPM_STARTUP_IGNORE_POSTINIT
|
|
bool
|
|
help
|
|
Select this to ignore POSTINIT INVALID return codes on TPM
|
|
startup. This is useful on platforms where a previous stage
|
|
issued a TPM startup. Examples of use cases are Intel TXT
|
|
or VBOOT on the Intel Arrandale processor, which issues a
|
|
CPU-only reset during the romstage.
|
|
|
|
config TPM_MEASURED_BOOT
|
|
bool "Enable Measured Boot"
|
|
default n
|
|
select VBOOT_LIB
|
|
depends on TPM
|
|
depends on !VBOOT_RETURN_FROM_VERSTAGE
|
|
help
|
|
Enables measured boot (experimental)
|
|
|
|
choice
|
|
prompt "TPM event log format"
|
|
depends on TPM_MEASURED_BOOT
|
|
default TPM_LOG_TPM1 if TPM1
|
|
default TPM_LOG_TPM2 if TPM2
|
|
|
|
config TPM_LOG_CB
|
|
bool "coreboot's custom format"
|
|
help
|
|
Custom coreboot-specific format of the log derived from TPM1 log format.
|
|
config TPM_LOG_TPM1
|
|
bool "TPM 1.2 format"
|
|
depends on TPM1
|
|
help
|
|
Log per TPM 1.2 specification.
|
|
See "TCG PC Client Specific Implementation Specification for Conventional BIOS".
|
|
config TPM_LOG_TPM2
|
|
bool "TPM 2.0 format"
|
|
depends on TPM2
|
|
help
|
|
Log per TPM 2.0 specification.
|
|
See "TCG PC Client Platform Firmware Profile Specification".
|
|
|
|
endchoice
|
|
|
|
choice
|
|
prompt "TPM2 hashing algorithm"
|
|
depends on TPM_MEASURED_BOOT && TPM_LOG_TPM2
|
|
default TPM_HASH_SHA1 if TPM1
|
|
default TPM_HASH_SHA256 if TPM2
|
|
|
|
config TPM_HASH_SHA1
|
|
bool "SHA1"
|
|
config TPM_HASH_SHA256
|
|
bool "SHA256"
|
|
config TPM_HASH_SHA384
|
|
bool "SHA384"
|
|
config TPM_HASH_SHA512
|
|
bool "SHA512"
|
|
|
|
endchoice
|
|
|
|
config TPM_MEASURED_BOOT_INIT_BOOTBLOCK
|
|
bool
|
|
depends on TPM_MEASURED_BOOT && !VBOOT
|
|
help
|
|
Initialize TPM inside the bootblock instead of ramstage. This is
|
|
useful with some form of hardware assisted root of trust
|
|
measurement like Intel TXT/CBnT.
|
|
|
|
config TPM_MEASURED_BOOT_RUNTIME_DATA
|
|
string "Runtime data whitelist"
|
|
default ""
|
|
depends on TPM_MEASURED_BOOT
|
|
help
|
|
Runtime data whitelist of cbfs filenames. Needs to be a
|
|
space delimited list
|
|
|
|
config PCR_BOOT_MODE
|
|
int
|
|
default 0 if CHROMEOS
|
|
default 1
|
|
|
|
config PCR_HWID
|
|
int
|
|
default 1
|
|
|
|
config PCR_SRTM
|
|
int
|
|
default 2
|
|
|
|
# PCR for measuring data which changes during runtime
|
|
# e.g. CMOS, NVRAM...
|
|
config PCR_RUNTIME_DATA
|
|
int
|
|
default 3
|
|
|
|
endmenu # Trusted Platform Module (tpm)
|