Add TPM4 locality support

Change-Id: I9f16fe77ee18f3d8839d0a06f9322ca1b1e47d93
RTC: 134415
Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/35271
Tested-by: Jenkins Server <pfd-jenkins+hostboot@us.ibm.com>
Tested-by: FSP CI Jenkins <fsp-CI-jenkins+hostboot@us.ibm.com>
Tested-by: Jenkins OP Build CI <op-jenkins+hostboot@us.ibm.com>
Reviewed-by: Michael Baiocchi <mbaiocch@us.ibm.com>
Reviewed-by: Nicholas E. Bofferding <bofferdn@us.ibm.com>
Reviewed-by: Timothy R. Block <block@us.ibm.com>
Reviewed-by: William G. Hoffa <wghoffa@us.ibm.com>

6 files changed, 81 insertions, 34 deletions

diff --git a/src/usr/secureboot/trusted/test/trustedbootTest.H b/src/usr/secureboot/trusted/test/trustedbootTest.H
index 635e695ca..e4cd3e7bd 100755
--- a/src/usr/secureboot/trusted/test/trustedbootTest.H
+++ b/src/usr/secureboot/trusted/test/trustedbootTest.H
@@ -5,7 +5,7 @@
 /*                                                                        */
 /* OpenPOWER HostBoot Project                                             */
 /*                                                                        */
-/* Contributors Listed Below - COPYRIGHT 2015,2016                        */
+/* Contributors Listed Below - COPYRIGHT 2015,2017                        */
 /* [+] International Business Machines Corp.                              */
 /*                                                                        */
 /*                                                                        */
@@ -716,7 +716,8 @@ class TrustedBootTest: public CxxTest::TestSuite
             // Let's see if the requested chip is functional
             target.role = TPM_PRIMARY;
             errlHndl_t err = tpmReadAttributes (target.tpmTarget,
-                                                tpmInfo);
+                                                tpmInfo,
+                                                TPM_LOCALITY_0);
 
             if (NULL != err)
             {
diff --git a/src/usr/secureboot/trusted/trustedboot.C b/src/usr/secureboot/trusted/trustedboot.C
index a8d1f8adf..7de63e1d7 100644
--- a/src/usr/secureboot/trusted/trustedboot.C
+++ b/src/usr/secureboot/trusted/trustedboot.C
@@ -5,7 +5,7 @@
 /*                                                                        */
 /* OpenPOWER HostBoot Project                                             */
 /*                                                                        */
-/* Contributors Listed Below - COPYRIGHT 2015,2016                        */
+/* Contributors Listed Below - COPYRIGHT 2015,2017                        */
 /* [+] International Business Machines Corp.                              */
 /*                                                                        */
 /*                                                                        */
@@ -48,6 +48,7 @@
 #include <initservice/initserviceif.H>
 #include <ipmi/ipmisensor.H>
 #include <config.h>
+#include <i2c/tpmddif.H>
 #include "trustedboot.H"
 #include "trustedTypes.H"
 #include "trustedbootCmds.H"
@@ -203,7 +204,8 @@ void* host_update_master_tpm( void *io_pArgs )
             {
                 memset(&tpmData, 0, sizeof(tpmData));
                 errlHndl_t readErr = tpmReadAttributes(tpmList[tpmNum],
-                                                       tpmData);
+                                                       tpmData,
+                                                       TPM_LOCALITY_0);
                 if (NULL != readErr)
                 {
                     // We are just looking for configured TPMs here
@@ -293,7 +295,8 @@ void* host_update_master_tpm( void *io_pArgs )
             memset(&tpmInfo, 0, sizeof(tpmInfo));
             errlHndl_t tmpErr = TPMDD::tpmReadAttributes(
                                  systemTpms.tpm[TPM_BACKUP_INDEX].tpmTarget,
-                                 tpmInfo);
+                                 tpmInfo,
+                                 TPM_LOCALITY_0);
             if (NULL != tmpErr || !tpmInfo.tpmEnabled)
             {
                 TRACUCOMP( g_trac_trustedboot,
@@ -372,11 +375,17 @@ void tpmInitialize(TRUSTEDBOOT::TpmTarget & io_target)
         io_target.initAttempted = true;
         io_target.failed = false;
 
-        // TPM_STARTUP
-        err = tpmCmdStartup(&io_target);
-        if (NULL != err)
+        bool drtm = false;
+        /// @todo #157140 Add ability to check for DRTM
+        // Don't run STARTUP during DRTM
+        if (!drtm)
         {
-            break;
+            // TPM_STARTUP
+            err = tpmCmdStartup(&io_target);
+            if (NULL != err)
+            {
+                break;
+            }
         }
 
         // TPM_GETCAPABILITY to read FW Version
@@ -386,6 +395,11 @@ void tpmInitialize(TRUSTEDBOOT::TpmTarget & io_target)
             break;
         }
 
+        // For a DRTM we need to reset PCRs 17-22
+        if (drtm)
+        {
+            /// @todo Implement PCR reset
+        }
 
     } while ( 0 );
 
diff --git a/src/usr/secureboot/trusted/trustedbootCmds.C b/src/usr/secureboot/trusted/trustedbootCmds.C
index f454aca73..9e5875933 100644
--- a/src/usr/secureboot/trusted/trustedbootCmds.C
+++ b/src/usr/secureboot/trusted/trustedbootCmds.C
@@ -5,7 +5,7 @@
 /*                                                                        */
 /* OpenPOWER HostBoot Project                                             */
 /*                                                                        */
-/* Contributors Listed Below - COPYRIGHT 2015,2016                        */
+/* Contributors Listed Below - COPYRIGHT 2015,2017                        */
 /* [+] International Business Machines Corp.                              */
 /*                                                                        */
 /*                                                                        */
@@ -54,7 +54,8 @@ namespace TRUSTEDBOOT
 
 errlHndl_t tpmTransmitCommand(TpmTarget * io_target,
                               uint8_t* io_buffer,
-                              size_t i_bufsize )
+                              size_t i_bufsize,
+                              tpm_locality_t i_locality)
 {
     errlHndl_t err = TB_SUCCESS;
     uint8_t* transmitBuf = NULL;
@@ -87,7 +88,8 @@ errlHndl_t tpmTransmitCommand(TpmTarget * io_target,
         err = tpmTransmit(io_target,
                           transmitBuf,
                           cmdSize,
-                          dataSize);
+                          dataSize,
+                          i_locality);
 
         if (TB_SUCCESS != err)
         {
@@ -244,6 +246,7 @@ errlHndl_t tpmMarshalCommandData(TPM2_BaseIn* i_cmd,
                    * @userdata1      Command Code
                    * @userdata2      0
                    * @devdesc        Unsupported command code during marshal
+                   * @custdesc       Failure detected in security subsystem
                    */
                   err = tpmCreateErrorLog(MOD_TPM_MARSHALCMDDATA,
                                           RC_TPM_MARSHAL_INVALID_CMD,
@@ -284,6 +287,7 @@ errlHndl_t tpmMarshalCommandData(TPM2_BaseIn* i_cmd,
          * @userdata1      stage
          * @userdata2      0
          * @devdesc        Marshaling error detected
+         * @custdesc       Failure detected in security subsystem
          */
         err = tpmCreateErrorLog(MOD_TPM_MARSHALCMDDATA,
                                 RC_TPM_MARSHALING_FAIL,
@@ -391,6 +395,7 @@ errlHndl_t tpmUnmarshalResponseData(uint32_t i_commandCode,
                    * @userdata1      commandcode
                    * @userdata2      stage
                    * @devdesc        Unsupported command code during unmarshal
+                   * @custdesc       Failure detected in security subsystem
                    */
                   err = tpmCreateErrorLog(MOD_TPM_UNMARSHALRESPDATA,
                                           RC_TPM_UNMARSHAL_INVALID_CMD,
@@ -415,6 +420,7 @@ errlHndl_t tpmUnmarshalResponseData(uint32_t i_commandCode,
          * @userdata1      Stage
          * @userdata2      Remaining response buffer size
          * @devdesc        Unmarshaling error detected
+         * @custdesc       Failure detected in security subsystem
          */
         err = tpmCreateErrorLog(MOD_TPM_UNMARSHALRESPDATA,
                                 RC_TPM_UNMARSHALING_FAIL,
@@ -462,7 +468,8 @@ errlHndl_t tpmCmdStartup(TpmTarget* io_target)
 
         err = tpmTransmitCommand(io_target,
                                  dataBuf,
-                                 sizeof(dataBuf));
+                                 sizeof(dataBuf),
+                                 TPM_LOCALITY_0);
 
         if (TB_SUCCESS != err)
         {
@@ -474,7 +481,7 @@ errlHndl_t tpmCmdStartup(TpmTarget* io_target)
         else if (TPM_SUCCESS != resp->responseCode)
         {
             TRACFCOMP( g_trac_trustedboot,
-                       "TPM STARTUP OP Fail %X : ",
+                       "TPM STARTUP OP Fail Ret(0x%X) : ",
                        resp->responseCode);
 
             /*@
@@ -484,7 +491,8 @@ errlHndl_t tpmCmdStartup(TpmTarget* io_target)
              * @moduleid       MOD_TPM_CMD_STARTUP
              * @userdata1      responseCode
              * @userdata2      0
-             * @devdesc        Invalid operation type.
+             * @devdesc        TPM_Startup operation failure.
+             * @custdesc       Failure detected in security subsystem
              */
             err = tpmCreateErrorLog(MOD_TPM_CMD_STARTUP,
                                     RC_TPM_START_FAIL,
@@ -533,7 +541,8 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target)
 
         err = tpmTransmitCommand(io_target,
                                  dataBuf,
-                                 sizeof(dataBuf));
+                                 sizeof(dataBuf),
+                                 TPM_LOCALITY_0);
 
         if (TB_SUCCESS != err)
         {
@@ -546,7 +555,7 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target)
         if (TPM_SUCCESS != resp->base.responseCode)
         {
             TRACFCOMP( g_trac_trustedboot,
-                       "TPM GETCAP OP Fail %X Size(%d) ",
+                       "TPM GETCAP OP Fail Ret(0x%X) Size(%d) ",
                        resp->base.responseCode,
                        (int)dataSize);
 
@@ -558,6 +567,7 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target)
              * @userdata1      responseCode
              * @userdata2      0
              * @devdesc        Command failure reading TPM FW version.
+             * @custdesc       Failure detected in security subsystem
              */
             err = tpmCreateErrorLog(MOD_TPM_CMD_GETCAPFWVERSION,
                                     RC_TPM_GETCAP_FAIL,
@@ -591,6 +601,7 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target)
                  * @userdata1      capability
                  * @userdata2      property
                  * @devdesc        Command failure reading TPM FW version.
+                 * @custdesc       Failure detected in security subsystem
                  */
                 err = tpmCreateErrorLog(MOD_TPM_CMD_GETCAPFWVERSION,
                                         RC_TPM_GETCAP_FW_INVALID_RESP,
@@ -625,7 +636,8 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target)
 
         err = tpmTransmitCommand(io_target,
                                  dataBuf,
-                                 sizeof(dataBuf));
+                                 sizeof(dataBuf),
+                                 TPM_LOCALITY_0);
 
         if (TB_SUCCESS != err)
         {
@@ -639,7 +651,7 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target)
             (TPM_SUCCESS != resp->base.responseCode))
         {
             TRACFCOMP( g_trac_trustedboot,
-                       "TPM GETCAP2 OP Fail %X Size(%d) ",
+                       "TPM GETCAP2 OP Fail Ret(0x%X) Size(%d) ",
                        resp->base.responseCode,
                        (int)dataSize);
 
@@ -651,6 +663,7 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target)
              * @userdata1      responseCode
              * @userdata2      0
              * @devdesc        Command failure reading TPM FW version.
+             * @custdesc       Failure detected in security subsystem
              */
             err = tpmCreateErrorLog(MOD_TPM_CMD_GETCAPFWVERSION,
                                     RC_TPM_GETCAP2_FAIL,
@@ -684,6 +697,7 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target)
                  * @userdata1      capability
                  * @userdata2      property
                  * @devdesc        Command failure reading TPM FW version.
+                 * @custdesc       Failure detected in security subsystem
                  */
                 err = tpmCreateErrorLog(MOD_TPM_CMD_GETCAPFWVERSION,
                                         RC_TPM_GETCAP2_FW_INVALID_RESP,
@@ -797,7 +811,8 @@ errlHndl_t tpmCmdPcrExtend2Hash(TpmTarget * io_target,
              * @userdata2[0:15] Full Digest Size 1
              * @userdata2[16:31] Full Digest Size 2
              * @userdata2[32:63] PCR
-             * @devdesc        Unmarshaling error detected
+             * @devdesc        PCR Extend invalid arguments detected
+             * @custdesc       Failure detected in security subsystem
              */
             err = tpmCreateErrorLog(MOD_TPM_CMD_PCREXTEND,
                                     RC_TPM_INVALID_ARGS,
@@ -831,7 +846,8 @@ errlHndl_t tpmCmdPcrExtend2Hash(TpmTarget * io_target,
 
         err = tpmTransmitCommand(io_target,
                                  dataBuf,
-                                 sizeof(dataBuf));
+                                 sizeof(dataBuf),
+                                 TPM_LOCALITY_0);
 
         if (TB_SUCCESS != err)
         {
@@ -844,7 +860,7 @@ errlHndl_t tpmCmdPcrExtend2Hash(TpmTarget * io_target,
                  || (TPM_SUCCESS != resp->responseCode))
         {
             TRACFCOMP( g_trac_trustedboot,
-                       "TPM PCRExtend OP Fail Ret(%X) ExSize(%d) Size(%d) ",
+                       "TPM PCRExtend OP Fail Ret(0x%X) ExSize(%d) Size(%d) ",
                        resp->responseCode,
                        (int)sizeof(TPM2_BaseOut),
                        (int)dataSize);
@@ -856,7 +872,8 @@ errlHndl_t tpmCmdPcrExtend2Hash(TpmTarget * io_target,
              * @moduleid       MOD_TPM_CMD_PCREXTEND
              * @userdata1      responseCode
              * @userdata2      dataSize
-             * @devdesc        Command failure reading TPM FW version.
+             * @devdesc        Command failure performing PCR extend.
+             * @custdesc       Failure detected in security subsystem
              */
             err = tpmCreateErrorLog(MOD_TPM_CMD_PCREXTEND,
                                     RC_TPM_COMMAND_FAIL,
@@ -921,7 +938,8 @@ errlHndl_t tpmCmdPcrRead(TpmTarget* io_target,
              * @userdata1      Digest Ptr
              * @userdata2[0:31] Full Digest Size
              * @userdata2[32:63] PCR
-             * @devdesc        Unmarshaling error detected
+             * @devdesc        pcr read invalid arguments
+             * @custdesc       Failure detected in security subsystem
              */
             err = tpmCreateErrorLog(MOD_TPM_CMD_PCRREAD,
                                     RC_TPM_INVALID_ARGS,
@@ -944,7 +962,8 @@ errlHndl_t tpmCmdPcrRead(TpmTarget* io_target,
 
         err = tpmTransmitCommand(io_target,
                                  dataBuf,
-                                 sizeof(dataBuf));
+                                 sizeof(dataBuf),
+                                 TPM_LOCALITY_0);
 
         if (TB_SUCCESS != err)
         {
@@ -959,7 +978,7 @@ errlHndl_t tpmCmdPcrRead(TpmTarget* io_target,
                  (resp->pcrValues.digests[0].size != fullDigestSize))
         {
             TRACFCOMP( g_trac_trustedboot,
-                       "TPM PCRRead OP Fail Ret(%X) ExSize(%d) "
+                       "TPM PCRRead OP Fail Ret(0x%X) ExSize(%d) "
                        "Size(%d) Cnt(%d) DSize(%d)",
                        resp->base.responseCode,
                        (int)sizeof(TPM2_BaseOut),
@@ -974,7 +993,8 @@ errlHndl_t tpmCmdPcrRead(TpmTarget* io_target,
              * @moduleid       MOD_TPM_CMD_PCRREAD
              * @userdata1      responseCode
              * @userdata2      dataSize
-             * @devdesc        Command failure reading TPM FW version.
+             * @devdesc        Command failure performing PCR read.
+             * @custdesc       Failure detected in security subsystem
              */
             err = tpmCreateErrorLog(MOD_TPM_CMD_PCRREAD,
                                     RC_TPM_COMMAND_FAIL,
diff --git a/src/usr/secureboot/trusted/trustedbootCmds.H b/src/usr/secureboot/trusted/trustedbootCmds.H
index 1f03eeb0e..b1c1ef0dd 100644
--- a/src/usr/secureboot/trusted/trustedbootCmds.H
+++ b/src/usr/secureboot/trusted/trustedbootCmds.H
@@ -5,7 +5,7 @@
 /*                                                                        */
 /* OpenPOWER HostBoot Project                                             */
 /*                                                                        */
-/* Contributors Listed Below - COPYRIGHT 2015,2016                        */
+/* Contributors Listed Below - COPYRIGHT 2015,2017                        */
 /* [+] International Business Machines Corp.                              */
 /*                                                                        */
 /*                                                                        */
@@ -39,6 +39,8 @@
 // -----------------------------------------------
 #ifdef __HOSTBOOT_MODULE
 #include <secureboot/trustedbootif.H>
+#include <i2c/tpmddif.H>
+using namespace TPMDD;
 #endif
 #include "trustedboot.H"
 #include "trustedTypes.H"
@@ -59,12 +61,14 @@ enum
  * @param[in/out] io_target Current TPM target structure
  * @param[in/out] io_buffer Input the command buffer to send, response on exit
  * @param[in] i_bufsize Size of io_buffer in bytes
+ * @param[in] i_locality TPM locality to use
  * @return errlHndl_t NULL if successful, otherwise a pointer to the
  *       error log.
  */
 errlHndl_t tpmTransmitCommand(TpmTarget* io_target,
                               uint8_t* io_buffer,
-                              size_t i_bufsize );
+                              size_t i_bufsize,
+                              tpm_locality_t i_locality);
 
 /**
  * @brief Take structure pointed to by cmd and format for input into TPM
diff --git a/src/usr/secureboot/trusted/trustedbootUtils.C b/src/usr/secureboot/trusted/trustedbootUtils.C
index 90915030d..0e29468ac 100644
--- a/src/usr/secureboot/trusted/trustedbootUtils.C
+++ b/src/usr/secureboot/trusted/trustedbootUtils.C
@@ -5,7 +5,7 @@
 /*                                                                        */
 /* OpenPOWER HostBoot Project                                             */
 /*                                                                        */
-/* Contributors Listed Below - COPYRIGHT 2015,2016                        */
+/* Contributors Listed Below - COPYRIGHT 2015,2017                        */
 /* [+] International Business Machines Corp.                              */
 /*                                                                        */
 /*                                                                        */
@@ -56,7 +56,8 @@ namespace TRUSTEDBOOT
 errlHndl_t tpmTransmit(TpmTarget * io_target,
                        uint8_t* io_buffer,
                        size_t i_cmdSize,
-                       size_t i_bufsize )
+                       size_t i_bufsize,
+                       tpm_locality_t i_locality)
 {
     errlHndl_t err = NULL;
 
@@ -67,7 +68,8 @@ errlHndl_t tpmTransmit(TpmTarget * io_target,
                          io_buffer,
                          i_bufsize,
                          DEVICE_TPM_ADDRESS(TPMDD::TPM_OP_TRANSMIT,
-                                            i_cmdSize));
+                                            i_cmdSize,
+                                            i_locality));
         if (NULL != err)
         {
             break;
diff --git a/src/usr/secureboot/trusted/trustedbootUtils.H b/src/usr/secureboot/trusted/trustedbootUtils.H
index 73bc38743..78ae7e053 100644
--- a/src/usr/secureboot/trusted/trustedbootUtils.H
+++ b/src/usr/secureboot/trusted/trustedbootUtils.H
@@ -5,7 +5,7 @@
 /*                                                                        */
 /* OpenPOWER HostBoot Project                                             */
 /*                                                                        */
-/* Contributors Listed Below - COPYRIGHT 2015,2016                        */
+/* Contributors Listed Below - COPYRIGHT 2015,2017                        */
 /* [+] International Business Machines Corp.                              */
 /*                                                                        */
 /*                                                                        */
@@ -39,6 +39,10 @@
 // -----------------------------------------------
 // Includes
 // -----------------------------------------------
+#ifdef __HOSTBOOT_MODULE
+#include <i2c/tpmddif.H>
+using namespace TPMDD;
+#endif
 #include "trustedTypes.H"
 
 #ifdef __cplusplus
@@ -52,13 +56,15 @@ namespace TRUSTEDBOOT
  * @param[in/out] io_buffer Input the command buffer to send, response on exit
  * @param[in] i_cmdSize Size of provided command in bytes
  * @param[in] i_bufsize Size of io_buffer in bytes
+ * @param[in] i_locality TPM locality to use
  * @return errlHndl_t NULL if successful, otherwise a pointer to the
  *       error log.
  */
 errlHndl_t tpmTransmit(TpmTarget * io_target,
                        uint8_t* io_buffer,
                        size_t i_cmdSize,
-                       size_t i_bufsize );
+                       size_t i_bufsize,
+                       tpm_locality_t i_locality);
 
 /**
  * @brief Create an error log entry for potential logging