Change in coreboot[master]: tpm: Remove USER_TPMx options, make TPM1/TPM2 menuconfig visible
Julius Werner has submitted this change. ( https://review.coreboot.org/c/coreboot/+/54641 )
Change subject: tpm: Remove USER_TPMx options, make TPM1/TPM2 menuconfig visible ......................................................................
tpm: Remove USER_TPMx options, make TPM1/TPM2 menuconfig visible
We would like to have an easy way to completely disable TPM support on a board. For boards that don't pre-select a TPM protocol via the MAINBOARD_HAS_TPMx options, this is already possible with the USER_NO_TPM option. In order to make this available for all boards, this patch just removes the whole USER_TPMx option group and directly makes the TPM1 and TPM2 options visible to menuconfig. The MAINBOARD_HAS_TPMx options can still be used to select defaults and to prevent selection of a protocol that the TPM is known to not support, but the NO_TPM option always remains available.
Also fix some mainboards that selected TPM2 directly, which they're not supposed to do (that's what MAINBOARD_HAS_TPM2 is for), and add a missing dependency to TPM_CR50 so it is set correctly for a NO_TPM scenario.
Signed-off-by: Julius Werner jwerner@chromium.org Change-Id: Ib0a73da3c42fa4e8deffecb53f29ee38cbb51a93 Reviewed-on: https://review.coreboot.org/c/coreboot/+/54641 Tested-by: build bot (Jenkins) no-reply@coreboot.org Reviewed-by: Aaron Durbin adurbin@chromium.org Reviewed-by: Christian Walter christian.walter@9elements.com --- M configs/config.asrock_b85m_pro4.tpm2_txt_placeholder_acms M configs/config.libretrend_lt1000 M src/mainboard/google/drallion/Kconfig M src/mainboard/protectli/vault_kbl/Kconfig M src/security/tpm/Kconfig M src/security/tpm/tss/vendor/cr50/Kconfig 6 files changed, 33 insertions(+), 43 deletions(-)
Approvals: build bot (Jenkins): Verified Aaron Durbin: Looks good to me, approved Christian Walter: Looks good to me, approved
diff --git a/configs/config.asrock_b85m_pro4.tpm2_txt_placeholder_acms b/configs/config.asrock_b85m_pro4.tpm2_txt_placeholder_acms index 856701f..4edeb0c 100644 --- a/configs/config.asrock_b85m_pro4.tpm2_txt_placeholder_acms +++ b/configs/config.asrock_b85m_pro4.tpm2_txt_placeholder_acms @@ -3,7 +3,7 @@ # Used ACMs were extracted from a Supermicro X10SLH firmware update. CONFIG_VENDOR_ASROCK=y CONFIG_BOARD_ASROCK_B85M_PRO4=y -CONFIG_USER_TPM2=y +CONFIG_TPM2=y CONFIG_INTEL_TXT=y CONFIG_INTEL_TXT_BIOSACM_FILE="3rdparty/blobs/cpu/intel/stm/stm.bin" CONFIG_INTEL_TXT_SINITACM_FILE="3rdparty/blobs/cpu/intel/stm/stm.bin" diff --git a/configs/config.libretrend_lt1000 b/configs/config.libretrend_lt1000 index f12ae3f..33159f1 100644 --- a/configs/config.libretrend_lt1000 +++ b/configs/config.libretrend_lt1000 @@ -1,5 +1,5 @@ CONFIG_VENDOR_LIBRETREND=y CONFIG_POWER_STATE_OFF_AFTER_FAILURE=y CONFIG_GENERIC_LINEAR_FRAMEBUFFER=y -CONFIG_USER_TPM2=y +CONFIG_TPM2=y CONFIG_SEABIOS_ADD_SERCON_PORT_FILE=y diff --git a/src/mainboard/google/drallion/Kconfig b/src/mainboard/google/drallion/Kconfig index 31cac26..9499a60 100644 --- a/src/mainboard/google/drallion/Kconfig +++ b/src/mainboard/google/drallion/Kconfig @@ -21,7 +21,6 @@ select SOC_INTEL_COMMON_BLOCK_HDA_VERB select SOC_INTEL_COMMON_BLOCK_SMM_ESPI_DISABLE select SYSTEM_TYPE_LAPTOP - select TPM2 select MAINBOARD_USES_IFD_EC_REGION select HAVE_SPD_IN_CBFS
diff --git a/src/mainboard/protectli/vault_kbl/Kconfig b/src/mainboard/protectli/vault_kbl/Kconfig index 7cf80e0..7aa78aa 100644 --- a/src/mainboard/protectli/vault_kbl/Kconfig +++ b/src/mainboard/protectli/vault_kbl/Kconfig @@ -13,7 +13,7 @@ select SUPERIO_ITE_IT8772F select MAINBOARD_HAS_CRB_TPM select HAVE_INTEL_PTT - select TPM2 + select MAINBOARD_HAS_TPM2
config IRQ_SLOT_COUNT int diff --git a/src/security/tpm/Kconfig b/src/security/tpm/Kconfig index 96ab2e6..e228a3d 100644 --- a/src/security/tpm/Kconfig +++ b/src/security/tpm/Kconfig @@ -4,22 +4,42 @@
menu "Trusted Platform Module"
+choice + prompt "Trusted Platform Module" + default TPM2 if MAINBOARD_HAS_TPM2 + default TPM1 if MAINBOARD_HAS_TPM1 + default NO_TPM + +config NO_TPM + bool "No TPM" + help + No TPM support. Select this option if your system doesn't have a TPM, + or if you don't want coreboot to communicate with your TPM in any way. + (If your board doesn't offer a TPM interface, this will be the only + possible option.) + config TPM1 - bool - default y if MAINBOARD_HAS_TPM1 || USER_TPM1 + bool "TPM 1.2" depends on MAINBOARD_HAS_LPC_TPM || \ MAINBOARD_HAS_I2C_TPM_GENERIC || \ MAINBOARD_HAS_I2C_TPM_ATMEL + depends on !MAINBOARD_HAS_TPM2 + help + Select this option if your TPM uses the older TPM 1.2 protocol.
config TPM2 - bool - default y if MAINBOARD_HAS_TPM2 || USER_TPM2 + bool "TPM 2.0" depends on MAINBOARD_HAS_I2C_TPM_GENERIC || \ MAINBOARD_HAS_LPC_TPM || \ MAINBOARD_HAS_I2C_TPM_ATMEL || \ MAINBOARD_HAS_I2C_TPM_CR50 || \ MAINBOARD_HAS_SPI_TPM || \ MAINBOARD_HAS_CRB_TPM + depends on !MAINBOARD_HAS_TPM1 + help + Select this option if your TPM uses the newer TPM 2.0 protocol. + +endchoice
config TPM bool @@ -28,45 +48,15 @@
config MAINBOARD_HAS_TPM1 bool + help + This option can be selected by a mainboard to represent that its TPM + always uses the 1.2 protocol, and that it should be on by default.
config MAINBOARD_HAS_TPM2 bool - -if !MAINBOARD_HAS_TPM1 && !MAINBOARD_HAS_TPM2 - -choice - prompt "Trusted Platform Module" - default USER_NO_TPM - -config USER_NO_TPM - bool "disabled" - -config USER_TPM1 - bool "1.2" - depends on MAINBOARD_HAS_LPC_TPM || \ - MAINBOARD_HAS_I2C_TPM_GENERIC || \ - MAINBOARD_HAS_I2C_TPM_ATMEL help - Enable this option to enable TPM 1.0 - 1.2 support in coreboot. - - If unsure, say N. - -config USER_TPM2 - bool "2.0" - depends on MAINBOARD_HAS_I2C_TPM_GENERIC || \ - MAINBOARD_HAS_LPC_TPM || \ - MAINBOARD_HAS_I2C_TPM_ATMEL || \ - MAINBOARD_HAS_I2C_TPM_CR50 || \ - MAINBOARD_HAS_SPI_TPM || \ - MAINBOARD_HAS_CRB_TPM - help - Enable this option to enable TPM 2.0 support in coreboot. - - If unsure, say N. - -endchoice - -endif + This option can be selected by a mainboard to represent that its TPM + always uses the 2.0 protocol, and that it should be on by default.
config TPM_DEACTIVATE bool "Deactivate TPM" diff --git a/src/security/tpm/tss/vendor/cr50/Kconfig b/src/security/tpm/tss/vendor/cr50/Kconfig index 52c7385..c4ecdef 100644 --- a/src/security/tpm/tss/vendor/cr50/Kconfig +++ b/src/security/tpm/tss/vendor/cr50/Kconfig @@ -2,6 +2,7 @@
config TPM_CR50 bool + depends on TPM2 default y if MAINBOARD_HAS_I2C_TPM_CR50 || MAINBOARD_HAS_SPI_TPM_CR50
if TPM_CR50
-
Julius Werner (Code Review)