talos-hostboot/src/usr/secureboot/trusted, branch master

New API to Retrieve Random Number from the TPM

2018-05-11T01:49:40+00:00

A new programming interface allows us to obtain random numbers from the TPM more easily (i.e. in a more high-level way). Change-Id: Ibd3d3b320411bea146d6eab4d1a59ca760bc726c RTC:191000 Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/57802 Reviewed-by: ILYA SMIRNOV Tested-by: Jenkins Server Reviewed-by: Michael Baiocchi Tested-by: Jenkins OP Build CI Tested-by: FSP CI Jenkins Reviewed-by: Nicholas E. Bofferding Tested-by: Jenkins OP HW Reviewed-by: Daniel M. Crowell

Primary TPM Required Policy

2018-05-03T20:02:25+00:00

Change the "TPM Required" policy to "Primary TPM Required," wherein only the presence and functionality of the primary TPM (attached to the acting master proc) will be considered when evaluating the TPM required condition. The presence and functionality of the backup TPM will not play a role in this policy. Change-Id: Id968123d0fc399c531da7429fdb8efabfa66c53c Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/57843 Tested-by: Jenkins Server Reviewed-by: Michael Baiocchi Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Tested-by: FSP CI Jenkins Reviewed-by: Nicholas E. Bofferding Reviewed-by: William G. Hoffa

Secure Boot: Basic Support For Redundant TPM

2018-05-02T20:03:48+00:00

This change implements the detection and initialization of the backup TPM in istep 10.14. The backup TPM is presence-detected and initialized; the logs of the primary TPM are extended into the secondary TPM in istep 10.14. After the initialization of the secondary TPM, all events are extended into both TPMs. A test was created to test whether the backup TPM is initialized correctly. Change-Id: I305500c9f680115e684ab153fc882b8d5364b0d4 RTC: 134912 Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/57374 Tested-by: Jenkins Server Reviewed-by: Michael Baiocchi Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Reviewed-by: Nicholas E. Bofferding Reviewed-by: Daniel M. Crowell

Reset Host-mode Processor I2C Masters connected to the TPMs

2018-03-30T21:07:19+00:00

This commit resets the I2C buses connected to the TPMs early in the IPL since the FSP can't do the reset for us as they lack a FSI I2C connection to the TPMs. Change-Id: I4b4893da447f3c567c04a8d0c2b647f2927ec0ab RTC:188956 Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/56188 Reviewed-by: ILYA SMIRNOV Reviewed-by: Nicholas E. Bofferding Tested-by: Jenkins Server Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Tested-by: FSP CI Jenkins Reviewed-by: Daniel M. Crowell

Add FFDC to 'No Functional TPM' Fails

2018-03-19T15:40:49+00:00

When no functional TPMs are detected, but TPMs are required, this commit will capture the Security Registers of each processor in the system and add them to the error log. It also updates how the tpmMarkFailed() function links and commits various error logs. Change-Id: I2e95bbfcb6ab3f3dff26149f234c219d4280e1fb CQ:SW417814 Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/54808 CI-Ready: Michael Baiocchi Reviewed-by: Nicholas E. Bofferding Reviewed-by: ILYA SMIRNOV Tested-by: Jenkins Server Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Tested-by: FSP CI Jenkins Reviewed-by: Daniel M. Crowell

Add Reset to TPM's I2C Bus for MPIPLs

2018-03-01T14:51:04+00:00

This commit updates the general I2C reset function to only reset certain engine(s) of the I2C master. This new functionality is then used to reset all of the processor I2C engines that can drive the TPMs on MPIPLs. Change-Id: Ie19e93233b5012b69d59bfc3f485ce2914d665da CQ:SW419116 Backport:release-fips910 Backport:release-fips900 Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/54840 CI-Ready: Nicholas E. Bofferding CI-Ready: Marshall J. Wilks CI-Ready: Michael Baiocchi Reviewed-by: Nicholas E. Bofferding Tested-by: Jenkins Server Tested-by: Jenkins OP Build CI Reviewed-by: Marshall J. Wilks Tested-by: Jenkins OP HW Tested-by: FSP CI Jenkins Reviewed-by: ILYA SMIRNOV Reviewed-by: Daniel M. Crowell

Secure Boot: On get jumper state error path, save PLID before committing

2018-02-25T02:33:06+00:00

When SECUREBOOT::getJumperState() returns error, save off the error PLID before committing it, to avoid a segfault condition Change-Id: I968c73de11abf580b19720c4ee9689e38c155bb6 Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/54596 Reviewed-by: ILYA SMIRNOV Reviewed-by: Richard J. Knight Tested-by: Jenkins Server Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Tested-by: FSP CI Jenkins Reviewed-by: Daniel M. Crowell

Fix developer and customer descriptions for TPM required policy

2018-02-10T17:26:10+00:00

Adds more useful information to the developer and customer descriptions of error logs that are created when the TPM required policy is broken. Change-Id: Ib2c42c85cb5689b5a791ab96709dc40f4bbd85d4 CQ:SW415447 Backport:release-fips910 Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/52848 Reviewed-by: Nicholas E. Bofferding Reviewed-by: ILYA SMIRNOV Tested-by: Jenkins Server Reviewed-by: Michael Baiocchi Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Reviewed-by: Daniel M. Crowell

Verify ComponentID and Extend PAYLOAD

2018-02-01T22:59:52+00:00

While verifying the PAYLOAD in memory before moving it to its final location, this commit parses the PAYLOAD's header and verifies that it has the correct componentId. It also extends the PAYLOAD information to the TPM. Change-Id: Ie333d1ba5919b36919b207f25ad60806359ed710 RTC:168745 Backport: release-fips910 Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/52837 Reviewed-by: Nicholas E. Bofferding Tested-by: Jenkins Server Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Reviewed-by: Stephen M. Cprek Tested-by: FSP CI Jenkins Reviewed-by: Daniel M. Crowell

Secure Boot: Remove cyclic dependency in TPM daemon shutdown path

2018-01-19T16:40:03+00:00

Change-Id: Id2bd6597e930015dfad0ae4196aa326948bdee8e Backport: release-fips910 Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/52095 Tested-by: Jenkins Server Reviewed-by: Stephen M. Cprek Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Tested-by: FSP CI Jenkins Reviewed-by: Timothy R. Block Reviewed-by: Michael Baiocchi Reviewed-by: Christopher J. Engel Reviewed-by: Daniel M. Crowell