talos-hostboot/src/usr/secureboot/node_comm, branch 07-25-2019

Add README.md files to the secureboot component

2020-02-13T14:55:47+00:00

This commit adds a top-level README.md file to the secureboot component that then calls into new README.md files in the different sub-directories. Change-Id: I7460a0e591232c2f8387321b0251ac3f62a1c76e Reviewed-on: http://rchgit01.rchland.ibm.com/gerrit1/89025 Reviewed-by: Ilya Smirnov Reviewed-by: Nicholas E Bofferding Reviewed-by: Christopher J Engel Tested-by: Jenkins Server Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Tested-by: FSP CI Jenkins Reviewed-by: Daniel M Crowell

Move definition of TRACE_ERR_FMT and TRACE_ERR_ARGS

2020-02-03T15:22:01+00:00

Originally TRACE_ERR_FMT and TRACE_ERR_ARGS were defined in centaurScomCache.H for the P9 'master' branch. This commit puts them into the more proper errlentry.H file like they are for P10's 'master-p10' branch. Change-Id: Icb7af6ae721a15036804b7d35f49911888eb5eaf Reviewed-on: http://rchgit01.rchland.ibm.com/gerrit1/90705 Tested-by: Jenkins Server Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Tested-by: FSP CI Jenkins Reviewed-by: Zachary Clark Reviewed-by: Nicholas E Bofferding Reviewed-by: William G Hoffa

Automatically include config.h

2019-12-06T16:28:47+00:00

Rather than having to remember to include config.h anywhere we reference a CONFIG variable (and usually forgetting), this adds it to the default compiler flags so that it gets included in every source file we build. Change-Id: I53622ab4d46c55d942e98cae6ec03049fd5b3d08 Reviewed-on: http://rchgit01.rchland.ibm.com/gerrit1/87475 Tested-by: Jenkins Server Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Tested-by: FSP CI Jenkins Reviewed-by: Zachary Clark Reviewed-by: Roland Veloz Reviewed-by: Christian R Geddes Reviewed-by: Nicholas E Bofferding

Account For TPM Not Required in Node Comm

2019-07-30T20:17:31+00:00

When the TPM required policy is off, node comm path should not commit any errors as to not confuse the testers/customers. This commit silences the errors from the node comm protocol when TPM is not required. In addition, when TPM is required, we want to fail the boot if node comm is unsuccessful. Logic has been added to pass the error info up to FSP in case of any error in istep18 (when node comm runs). Change-Id: I76d48780790b6fee759b3ccc60a858f0a8835dee CQ: SW466658 Reviewed-on: http://rchgit01.rchland.ibm.com/gerrit1/80937 Tested-by: Jenkins Server Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Tested-by: FSP CI Jenkins Reviewed-by: Michael Baiocchi Reviewed-by: Glenn Miles Reviewed-by: Daniel M Crowell

Secureboot: Enhance Error Callouts For New Multinode Trustedboot Transfer

2019-03-05T14:53:09+00:00

This commit adds many checks to callout potential issues with the new multinode trustedboot transfer protocol. It also improves some TPM-related traces. Change-Id: Ice3f8be0668cc63321eeb2562bb8ffe610284b6a RTC:203642 Reviewed-on: http://rchgit01.rchland.ibm.com/gerrit1/72363 Tested-by: Jenkins Server Reviewed-by: Ilya Smirnov Tested-by: Jenkins OP Build CI Tested-by: FSP CI Jenkins Tested-by: Jenkins OP HW Reviewed-by: Nicholas E. Bofferding Reviewed-by: Daniel M. Crowell

Secureboot: Enhanced Multinode Comm: TPM_POISONED

2019-03-01T21:06:57+00:00

This commit introduces a new attribute TPM_POISONED used to indicate that a certain TPM was poisoned during the boot. This attribute is also used to adjust the trustedboot flag in HDAT: if the primary TPM was poisoned during the IPL, the trustedboot setting is turned off in HDAT. Change-Id: I32ff6e79ebba0e38c0e8b4b9bd4aa0f52a250d9a RTC: 203645 Reviewed-on: http://rchgit01.rchland.ibm.com/gerrit1/72129 Reviewed-by: Michael Baiocchi Tested-by: Jenkins Server Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Tested-by: FSP CI Jenkins Reviewed-by: Nicholas E. Bofferding Reviewed-by: Daniel M. Crowell

Secureboot: Enhanced Multinode Comm: Add size of quote & signature to slv quote

2019-02-26T21:55:47+00:00

This commit adds the size of the quote and signature fields returned from the TPM as part of enhanced multinode comm to the generated slave quote. This will make it easier to process the slave quote for remote attestation. Change-Id: Iab0d66bf5c34f49441fec346c6964458c58cff1f RTC: 203645 Reviewed-on: http://rchgit01.rchland.ibm.com/gerrit1/72357 Tested-by: Jenkins Server Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Reviewed-by: Michael Baiocchi Reviewed-by: Nicholas E. Bofferding Tested-by: FSP CI Jenkins Reviewed-by: Daniel M. Crowell

Secureboot: Enable New Multinode Trustedboot Transfer

2019-02-22T16:03:08+00:00

This commit adds a new exchange of data between the master and slave nodes to further enhance our Trustedboot IPL. It builds upon updates to the transfer mechanism between the nodes and new TPM commands on the nodes. Change-Id: I18bd152e4bd3aeb9b79eb9ec774fc80871874155 RTC:203642 Reviewed-on: http://rchgit01.rchland.ibm.com/gerrit1/71903 Tested-by: Jenkins Server Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Tested-by: FSP CI Jenkins Reviewed-by: Nicholas E. Bofferding Reviewed-by: Ilya Smirnov Reviewed-by: Daniel M. Crowell

Secureboot: Enhanced Multinode Comm: Master Node

2019-02-20T17:38:57+00:00

This commit introduces the logic to create the master node nodecomm request to the slave nodes and logic to process the responses from the slave nodes. The data from the slave nodes (the slave quote) is hashed and extended into PCR1. The binary quote blob is also included in the TPM log as a log message. Additional changes: the logic to relocate the TPM log to increase its size, and the logic to allow uint8_t* instead of char* as the TPM log message. Change-Id: Ide4465f0d4a91aec815c9db5d765cdbde231dcd3 RTC: 203644 Reviewed-on: http://rchgit01.rchland.ibm.com/gerrit1/71407 Reviewed-by: Michael Baiocchi Reviewed-by: Christopher J. Engel Reviewed-by: Nicholas E. Bofferding Tested-by: Jenkins Server Tested-by: Jenkins OP Build CI Tested-by: FSP CI Jenkins Tested-by: Jenkins OP HW Reviewed-by: Daniel M. Crowell

Secureboot: Enhanced Multinode Comm: Slave Node

2019-02-19T22:56:50+00:00

This commit introduces the logic to create the slave response for the new enhanced multinode comm protocol. The slave response consists of an eye catcher, node ID, quote and signature data from TPM, PCR contents of the slave node TPM, Attestation Key Certificate, and the TPM log. All of the above data is packaged into a binary blob to be sent back to the master node. Change-Id: I927c6ca937e6c07af4185cf54c782697c5d822f6 RTC: 203643 Reviewed-on: http://rchgit01.rchland.ibm.com/gerrit1/70791 Tested-by: Jenkins Server Reviewed-by: Michael Baiocchi Tested-by: Jenkins OP Build CI Tested-by: FSP CI Jenkins Reviewed-by: Nicholas E. Bofferding Reviewed-by: Marshall J. Wilks Reviewed-by: Christopher J. Engel Tested-by: Jenkins OP HW Reviewed-by: Daniel M. Crowell