From 4129c2614c2bb774b7d43a7cfc12130121f90c55 Mon Sep 17 00:00:00 2001 From: Sergii Dmytruk Date: Mon, 24 Oct 2022 01:17:41 +0300 Subject: security/tpm: make usage of PCRs configurable via Kconfig MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit At this moment, only GBB flags are moved from PCR-0 to PCR-1 when vboot-compatibility is not enabled. Change-Id: Ib3a192d902072f6f8d415c2952a36522b5bf09f9 Ticket: https://ticket.coreboot.org/issues/424 Signed-off-by: Sergii Dmytruk Reviewed-on: https://review.coreboot.org/c/coreboot/+/68750 Tested-by: build bot (Jenkins) Reviewed-by: Michał Żygowski --- src/security/tpm/Kconfig | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'src/security/tpm/Kconfig') diff --git a/src/security/tpm/Kconfig b/src/security/tpm/Kconfig index 8466d80dbe..39134c1c71 100644 --- a/src/security/tpm/Kconfig +++ b/src/security/tpm/Kconfig @@ -152,4 +152,23 @@ config TPM_MEASURED_BOOT_RUNTIME_DATA Runtime data whitelist of cbfs filenames. Needs to be a space delimited list +config PCR_BOOT_MODE + int + default 0 if CHROMEOS + default 1 + +config PCR_HWID + int + default 1 + +config PCR_SRTM + int + default 2 + +# PCR for measuring data which changes during runtime +# e.g. CMOS, NVRAM... +config PCR_RUNTIME_DATA + int + default 3 + endmenu # Trusted Platform Module (tpm) -- cgit v1.2.3