xref: /linux/drivers/char/tpm/Kconfig (revision 84d4e8b613e073d9dfde782c471aedbcefdede6c)

# SPDX-License-Identifier: GPL-2.0-only
#
# TPM device configuration
#

menuconfig TCG_TPM
	tristate "TPM Hardware Support"
	depends on HAS_IOMEM
	imply SECURITYFS
	select CRYPTO
	select CRYPTO_HASH_INFO
	help
	  If you have a TPM security chip in your system, which
	  implements the Trusted Computing Group's specification,
	  say Yes and it will be accessible from within Linux.  For
	  more information see <http://www.trustedcomputinggroup.org>.
	  An implementation of the Trusted Software Stack (TSS), the
	  userspace enablement piece of the specification, can be
	  obtained at: <http://sourceforge.net/projects/trousers>.  To
	  compile this driver as a module, choose M here; the module
	  will be called tpm. If unsure, say N.
	  Notes:
	  1) For more TPM drivers enable CONFIG_PNP, CONFIG_ACPI
	  and CONFIG_PNPACPI.
	  2) Without ACPI enabled, the BIOS event log won't be accessible,
	  which is required to validate the PCR 0-7 values.

if TCG_TPM

config TCG_TPM2_HMAC
	bool "Use HMAC and encrypted transactions on the TPM bus"
	default n
	select CRYPTO_ECDH
	select CRYPTO_LIB_AESCFB
	select CRYPTO_LIB_SHA256
	select CRYPTO_LIB_UTILS
	help
	  Setting this causes us to deploy a scheme which uses request
	  and response HMACs in addition to encryption for
	  communicating with the TPM to prevent or detect bus snooping
	  and interposer attacks (see tpm-security.rst).  Saying Y
	  here adds some encryption overhead to all kernel to TPM
	  transactions.

config HW_RANDOM_TPM
	bool "TPM HW Random Number Generator support"
	depends on TCG_TPM && HW_RANDOM && !(TCG_TPM=y && HW_RANDOM=m)
	default y
	help
	  This setting exposes the TPM's Random Number Generator as a hwrng
	  device. This allows the kernel to collect randomness from the TPM at
	  boot, and provides the TPM randomines in /dev/hwrng.

	  If unsure, say Y.

config TCG_TIS_CORE
	tristate
	help
	TCG TIS TPM core driver. It implements the TPM TCG TIS logic and hooks
	into the TPM kernel APIs. Physical layers will register against it.

config TCG_TIS
	tristate "TPM Interface Specification 1.2 Interface / TPM 2.0 FIFO Interface"
	depends on X86 || OF
	select TCG_TIS_CORE
	help
	  If you have a TPM security chip that is compliant with the
	  TCG TIS 1.2 TPM specification (TPM1.2) or the TCG PTP FIFO
	  specification (TPM2.0) say Yes and it will be accessible from
	  within Linux. To compile this driver as a module, choose  M here;
	  the module will be called tpm_tis.

config TCG_TIS_SPI
	tristate "TPM Interface Specification 1.3 Interface / TPM 2.0 FIFO Interface - (SPI)"
	depends on SPI
	select TCG_TIS_CORE
	help
	  If you have a TPM security chip which is connected to a regular,
	  non-tcg SPI master (i.e. most embedded platforms) that is compliant with the
	  TCG TIS 1.3 TPM specification (TPM1.2) or the TCG PTP FIFO
	  specification (TPM2.0) say Yes and it will be accessible from
	  within Linux. To compile this driver as a module, choose  M here;
	  the module will be called tpm_tis_spi.

config TCG_TIS_SPI_CR50
	bool "Cr50 SPI Interface"
	depends on TCG_TIS_SPI
	help
	  If you have a H1 secure module running Cr50 firmware on SPI bus,
	  say Yes and it will be accessible from within Linux.

config TCG_TIS_I2C
	tristate "TPM Interface Specification 1.3 Interface / TPM 2.0 FIFO Interface - (I2C - generic)"
	depends on I2C
	select CRC_CCITT
	select TCG_TIS_CORE
	help
	  If you have a TPM security chip, compliant with the TCG TPM PTP
	  (I2C interface) specification and connected to an I2C bus master,
	  say Yes and it will be accessible from within Linux.
	  To compile this driver as a module, choose M here;
	  the module will be called tpm_tis_i2c.

config TCG_TIS_SYNQUACER
	tristate "TPM Interface Specification 1.2 Interface / TPM 2.0 FIFO Interface (MMIO - SynQuacer)"
	depends on ARCH_SYNQUACER || COMPILE_TEST
	select TCG_TIS_CORE
	help
	  If you have a TPM security chip that is compliant with the
	  TCG TIS 1.2 TPM specification (TPM1.2) or the TCG PTP FIFO
	  specification (TPM2.0) say Yes and it will be accessible from
	  within Linux on Socionext SynQuacer platform.
	  To compile this driver as a module, choose  M here;
	  the module will be called tpm_tis_synquacer.

config TCG_TIS_I2C_CR50
	tristate "TPM Interface Specification 2.0 Interface (I2C - CR50)"
	depends on I2C
	help
	  This is a driver for the Google cr50 I2C TPM interface which is a
	  custom microcontroller and requires a custom i2c protocol interface
	  to handle the limitations of the hardware.  To compile this driver
	  as a module, choose M here; the module will be called tcg_tis_i2c_cr50.

config TCG_TIS_I2C_ATMEL
	tristate "TPM Interface Specification 1.2 Interface (I2C - Atmel)"
	depends on I2C
	help
	  If you have an Atmel I2C TPM security chip say Yes and it will be
	  accessible from within Linux.
	  To compile this driver as a module, choose M here; the module will
	  be called tpm_tis_i2c_atmel.

config TCG_TIS_I2C_INFINEON
	tristate "TPM Interface Specification 1.2 Interface (I2C - Infineon)"
	depends on I2C
	help
	  If you have a TPM security chip that is compliant with the
	  TCG TIS 1.2 TPM specification and Infineon's I2C Protocol Stack
	  Specification 0.20 say Yes and it will be accessible from within
	  Linux.
	  To compile this driver as a module, choose M here; the module
	  will be called tpm_i2c_infineon.

config TCG_TIS_I2C_NUVOTON
	tristate "TPM Interface Specification 1.2 Interface (I2C - Nuvoton)"
	depends on I2C
	help
	  If you have a TPM security chip with an I2C interface from
	  Nuvoton Technology Corp. say Yes and it will be accessible
	  from within Linux.
	  To compile this driver as a module, choose M here; the module
	  will be called tpm_i2c_nuvoton.

config TCG_NSC
	tristate "National Semiconductor TPM Interface"
	depends on X86
	help
	  If you have a TPM security chip from National Semiconductor
	  say Yes and it will be accessible from within Linux.  To
	  compile this driver as a module, choose M here; the module
	  will be called tpm_nsc.

config TCG_ATMEL
	tristate "Atmel TPM Interface"
	depends on HAS_IOPORT_MAP
	depends on HAS_IOPORT
	help
	  If you have a TPM security chip from Atmel say Yes and it
	  will be accessible from within Linux.  To compile this driver
	  as a module, choose M here; the module will be called tpm_atmel.

config TCG_INFINEON
	tristate "Infineon Technologies TPM Interface"
	depends on PNP || COMPILE_TEST
	help
	  If you have a TPM security chip from Infineon Technologies
	  (either SLD 9630 TT 1.1 or SLB 9635 TT 1.2) say Yes and it
	  will be accessible from within Linux.
	  To compile this driver as a module, choose M here; the module
	  will be called tpm_infineon.
	  Further information on this driver and the supported hardware
	  can be found at http://www.trust.rub.de/projects/linux-device-driver-infineon-tpm/

config TCG_IBMVTPM
	tristate "IBM VTPM Interface"
	depends on PPC_PSERIES
	help
	  If you have IBM virtual TPM (VTPM) support say Yes and it
	  will be accessible from within Linux.  To compile this driver
	  as a module, choose M here; the module will be called tpm_ibmvtpm.

config TCG_LOONGSON
	tristate "Loongson TPM Interface"
	depends on MFD_LOONGSON_SE
	help
	  If you want to make Loongson TPM support available, say Yes and
	  it will be accessible from within Linux. To compile this
	  driver as a module, choose M here; the module will be called
	  tpm_loongson.

config TCG_XEN
	tristate "XEN TPM Interface"
	depends on TCG_TPM && XEN
	select XEN_XENBUS_FRONTEND
	help
	  If you want to make TPM support available to a Xen user domain,
	  say Yes and it will be accessible from within Linux. See
	  the manpages for xl, xl.conf, and docs/misc/vtpm.txt in
	  the Xen source repository for more details.
	  To compile this driver as a module, choose M here; the module
	  will be called xen-tpmfront.

config TCG_CRB
	tristate "TPM 2.0 CRB Interface"
	depends on ACPI
	help
	  If you have a TPM security chip that is compliant with the
	  TCG CRB 2.0 TPM specification say Yes and it will be accessible
	  from within Linux.  To compile this driver as a module, choose
	  M here; the module will be called tpm_crb.

config TCG_ARM_CRB_FFA
	tristate "TPM CRB over Arm FF-A Transport"
	depends on ARM_FFA_TRANSPORT && TCG_CRB
	default TCG_CRB
	help
	  If the Arm FF-A transport is used to access the TPM say Yes.
	  To compile this driver as a module, choose M here; the module
	  will be called tpm_crb_ffa.

config TCG_VTPM_PROXY
	tristate "VTPM Proxy Interface"
	depends on TCG_TPM
	help
	  This driver proxies for an emulated TPM (vTPM) running in userspace.
	  A device /dev/vtpmx is provided that creates a device pair
	  /dev/vtpmX and a server-side file descriptor on which the vTPM
	  can receive commands.

config TCG_FTPM_TEE
	tristate "TEE based fTPM Interface"
	depends on TEE && OPTEE
	help
	  This driver proxies for firmware TPM running in TEE.

config TCG_SVSM
	tristate "SNP SVSM vTPM interface"
	depends on AMD_MEM_ENCRYPT
	help
	  This is a driver for the AMD SVSM vTPM protocol that a SEV-SNP guest
	  OS can use to discover and talk to a vTPM emulated by the Secure VM
	  Service Module (SVSM) in the guest context, but at a more privileged
	  level (usually VMPL0).  To compile this driver as a module, choose M
	  here; the module will be called tpm_svsm.

source "drivers/char/tpm/st33zp24/Kconfig"
endif # TCG_TPM