From 5784da25300866c71551f1f0411d469eb3a3c922 Mon Sep 17 00:00:00 2001 From: Chris Engel Date: Mon, 23 Jan 2017 14:00:25 -0600 Subject: Add TPM4 locality support Change-Id: I9f16fe77ee18f3d8839d0a06f9322ca1b1e47d93 RTC: 134415 Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/35271 Tested-by: Jenkins Server Tested-by: FSP CI Jenkins Tested-by: Jenkins OP Build CI Reviewed-by: Michael Baiocchi Reviewed-by: Nicholas E. Bofferding Reviewed-by: Timothy R. Block Reviewed-by: William G. Hoffa --- src/usr/secureboot/trusted/test/trustedbootTest.H | 5 +- src/usr/secureboot/trusted/trustedboot.C | 28 +++++++++--- src/usr/secureboot/trusted/trustedbootCmds.C | 56 +++++++++++++++-------- src/usr/secureboot/trusted/trustedbootCmds.H | 8 +++- src/usr/secureboot/trusted/trustedbootUtils.C | 8 ++-- src/usr/secureboot/trusted/trustedbootUtils.H | 10 +++- 6 files changed, 81 insertions(+), 34 deletions(-) (limited to 'src/usr/secureboot') diff --git a/src/usr/secureboot/trusted/test/trustedbootTest.H b/src/usr/secureboot/trusted/test/trustedbootTest.H index 635e695ca..e4cd3e7bd 100755 --- a/src/usr/secureboot/trusted/test/trustedbootTest.H +++ b/src/usr/secureboot/trusted/test/trustedbootTest.H @@ -5,7 +5,7 @@ /* */ /* OpenPOWER HostBoot Project */ /* */ -/* Contributors Listed Below - COPYRIGHT 2015,2016 */ +/* Contributors Listed Below - COPYRIGHT 2015,2017 */ /* [+] International Business Machines Corp. */ /* */ /* */ @@ -716,7 +716,8 @@ class TrustedBootTest: public CxxTest::TestSuite // Let's see if the requested chip is functional target.role = TPM_PRIMARY; errlHndl_t err = tpmReadAttributes (target.tpmTarget, - tpmInfo); + tpmInfo, + TPM_LOCALITY_0); if (NULL != err) { diff --git a/src/usr/secureboot/trusted/trustedboot.C b/src/usr/secureboot/trusted/trustedboot.C index a8d1f8adf..7de63e1d7 100644 --- a/src/usr/secureboot/trusted/trustedboot.C +++ b/src/usr/secureboot/trusted/trustedboot.C @@ -5,7 +5,7 @@ /* */ /* OpenPOWER HostBoot Project */ /* */ -/* Contributors Listed Below - COPYRIGHT 2015,2016 */ +/* Contributors Listed Below - COPYRIGHT 2015,2017 */ /* [+] International Business Machines Corp. */ /* */ /* */ @@ -48,6 +48,7 @@ #include #include #include +#include #include "trustedboot.H" #include "trustedTypes.H" #include "trustedbootCmds.H" @@ -203,7 +204,8 @@ void* host_update_master_tpm( void *io_pArgs ) { memset(&tpmData, 0, sizeof(tpmData)); errlHndl_t readErr = tpmReadAttributes(tpmList[tpmNum], - tpmData); + tpmData, + TPM_LOCALITY_0); if (NULL != readErr) { // We are just looking for configured TPMs here @@ -293,7 +295,8 @@ void* host_update_master_tpm( void *io_pArgs ) memset(&tpmInfo, 0, sizeof(tpmInfo)); errlHndl_t tmpErr = TPMDD::tpmReadAttributes( systemTpms.tpm[TPM_BACKUP_INDEX].tpmTarget, - tpmInfo); + tpmInfo, + TPM_LOCALITY_0); if (NULL != tmpErr || !tpmInfo.tpmEnabled) { TRACUCOMP( g_trac_trustedboot, @@ -372,11 +375,17 @@ void tpmInitialize(TRUSTEDBOOT::TpmTarget & io_target) io_target.initAttempted = true; io_target.failed = false; - // TPM_STARTUP - err = tpmCmdStartup(&io_target); - if (NULL != err) + bool drtm = false; + /// @todo #157140 Add ability to check for DRTM + // Don't run STARTUP during DRTM + if (!drtm) { - break; + // TPM_STARTUP + err = tpmCmdStartup(&io_target); + if (NULL != err) + { + break; + } } // TPM_GETCAPABILITY to read FW Version @@ -386,6 +395,11 @@ void tpmInitialize(TRUSTEDBOOT::TpmTarget & io_target) break; } + // For a DRTM we need to reset PCRs 17-22 + if (drtm) + { + /// @todo Implement PCR reset + } } while ( 0 ); diff --git a/src/usr/secureboot/trusted/trustedbootCmds.C b/src/usr/secureboot/trusted/trustedbootCmds.C index f454aca73..9e5875933 100644 --- a/src/usr/secureboot/trusted/trustedbootCmds.C +++ b/src/usr/secureboot/trusted/trustedbootCmds.C @@ -5,7 +5,7 @@ /* */ /* OpenPOWER HostBoot Project */ /* */ -/* Contributors Listed Below - COPYRIGHT 2015,2016 */ +/* Contributors Listed Below - COPYRIGHT 2015,2017 */ /* [+] International Business Machines Corp. */ /* */ /* */ @@ -54,7 +54,8 @@ namespace TRUSTEDBOOT errlHndl_t tpmTransmitCommand(TpmTarget * io_target, uint8_t* io_buffer, - size_t i_bufsize ) + size_t i_bufsize, + tpm_locality_t i_locality) { errlHndl_t err = TB_SUCCESS; uint8_t* transmitBuf = NULL; @@ -87,7 +88,8 @@ errlHndl_t tpmTransmitCommand(TpmTarget * io_target, err = tpmTransmit(io_target, transmitBuf, cmdSize, - dataSize); + dataSize, + i_locality); if (TB_SUCCESS != err) { @@ -244,6 +246,7 @@ errlHndl_t tpmMarshalCommandData(TPM2_BaseIn* i_cmd, * @userdata1 Command Code * @userdata2 0 * @devdesc Unsupported command code during marshal + * @custdesc Failure detected in security subsystem */ err = tpmCreateErrorLog(MOD_TPM_MARSHALCMDDATA, RC_TPM_MARSHAL_INVALID_CMD, @@ -284,6 +287,7 @@ errlHndl_t tpmMarshalCommandData(TPM2_BaseIn* i_cmd, * @userdata1 stage * @userdata2 0 * @devdesc Marshaling error detected + * @custdesc Failure detected in security subsystem */ err = tpmCreateErrorLog(MOD_TPM_MARSHALCMDDATA, RC_TPM_MARSHALING_FAIL, @@ -391,6 +395,7 @@ errlHndl_t tpmUnmarshalResponseData(uint32_t i_commandCode, * @userdata1 commandcode * @userdata2 stage * @devdesc Unsupported command code during unmarshal + * @custdesc Failure detected in security subsystem */ err = tpmCreateErrorLog(MOD_TPM_UNMARSHALRESPDATA, RC_TPM_UNMARSHAL_INVALID_CMD, @@ -415,6 +420,7 @@ errlHndl_t tpmUnmarshalResponseData(uint32_t i_commandCode, * @userdata1 Stage * @userdata2 Remaining response buffer size * @devdesc Unmarshaling error detected + * @custdesc Failure detected in security subsystem */ err = tpmCreateErrorLog(MOD_TPM_UNMARSHALRESPDATA, RC_TPM_UNMARSHALING_FAIL, @@ -462,7 +468,8 @@ errlHndl_t tpmCmdStartup(TpmTarget* io_target) err = tpmTransmitCommand(io_target, dataBuf, - sizeof(dataBuf)); + sizeof(dataBuf), + TPM_LOCALITY_0); if (TB_SUCCESS != err) { @@ -474,7 +481,7 @@ errlHndl_t tpmCmdStartup(TpmTarget* io_target) else if (TPM_SUCCESS != resp->responseCode) { TRACFCOMP( g_trac_trustedboot, - "TPM STARTUP OP Fail %X : ", + "TPM STARTUP OP Fail Ret(0x%X) : ", resp->responseCode); /*@ @@ -484,7 +491,8 @@ errlHndl_t tpmCmdStartup(TpmTarget* io_target) * @moduleid MOD_TPM_CMD_STARTUP * @userdata1 responseCode * @userdata2 0 - * @devdesc Invalid operation type. + * @devdesc TPM_Startup operation failure. + * @custdesc Failure detected in security subsystem */ err = tpmCreateErrorLog(MOD_TPM_CMD_STARTUP, RC_TPM_START_FAIL, @@ -533,7 +541,8 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target) err = tpmTransmitCommand(io_target, dataBuf, - sizeof(dataBuf)); + sizeof(dataBuf), + TPM_LOCALITY_0); if (TB_SUCCESS != err) { @@ -546,7 +555,7 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target) if (TPM_SUCCESS != resp->base.responseCode) { TRACFCOMP( g_trac_trustedboot, - "TPM GETCAP OP Fail %X Size(%d) ", + "TPM GETCAP OP Fail Ret(0x%X) Size(%d) ", resp->base.responseCode, (int)dataSize); @@ -558,6 +567,7 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target) * @userdata1 responseCode * @userdata2 0 * @devdesc Command failure reading TPM FW version. + * @custdesc Failure detected in security subsystem */ err = tpmCreateErrorLog(MOD_TPM_CMD_GETCAPFWVERSION, RC_TPM_GETCAP_FAIL, @@ -591,6 +601,7 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target) * @userdata1 capability * @userdata2 property * @devdesc Command failure reading TPM FW version. + * @custdesc Failure detected in security subsystem */ err = tpmCreateErrorLog(MOD_TPM_CMD_GETCAPFWVERSION, RC_TPM_GETCAP_FW_INVALID_RESP, @@ -625,7 +636,8 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target) err = tpmTransmitCommand(io_target, dataBuf, - sizeof(dataBuf)); + sizeof(dataBuf), + TPM_LOCALITY_0); if (TB_SUCCESS != err) { @@ -639,7 +651,7 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target) (TPM_SUCCESS != resp->base.responseCode)) { TRACFCOMP( g_trac_trustedboot, - "TPM GETCAP2 OP Fail %X Size(%d) ", + "TPM GETCAP2 OP Fail Ret(0x%X) Size(%d) ", resp->base.responseCode, (int)dataSize); @@ -651,6 +663,7 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target) * @userdata1 responseCode * @userdata2 0 * @devdesc Command failure reading TPM FW version. + * @custdesc Failure detected in security subsystem */ err = tpmCreateErrorLog(MOD_TPM_CMD_GETCAPFWVERSION, RC_TPM_GETCAP2_FAIL, @@ -684,6 +697,7 @@ errlHndl_t tpmCmdGetCapFwVersion(TpmTarget* io_target) * @userdata1 capability * @userdata2 property * @devdesc Command failure reading TPM FW version. + * @custdesc Failure detected in security subsystem */ err = tpmCreateErrorLog(MOD_TPM_CMD_GETCAPFWVERSION, RC_TPM_GETCAP2_FW_INVALID_RESP, @@ -797,7 +811,8 @@ errlHndl_t tpmCmdPcrExtend2Hash(TpmTarget * io_target, * @userdata2[0:15] Full Digest Size 1 * @userdata2[16:31] Full Digest Size 2 * @userdata2[32:63] PCR - * @devdesc Unmarshaling error detected + * @devdesc PCR Extend invalid arguments detected + * @custdesc Failure detected in security subsystem */ err = tpmCreateErrorLog(MOD_TPM_CMD_PCREXTEND, RC_TPM_INVALID_ARGS, @@ -831,7 +846,8 @@ errlHndl_t tpmCmdPcrExtend2Hash(TpmTarget * io_target, err = tpmTransmitCommand(io_target, dataBuf, - sizeof(dataBuf)); + sizeof(dataBuf), + TPM_LOCALITY_0); if (TB_SUCCESS != err) { @@ -844,7 +860,7 @@ errlHndl_t tpmCmdPcrExtend2Hash(TpmTarget * io_target, || (TPM_SUCCESS != resp->responseCode)) { TRACFCOMP( g_trac_trustedboot, - "TPM PCRExtend OP Fail Ret(%X) ExSize(%d) Size(%d) ", + "TPM PCRExtend OP Fail Ret(0x%X) ExSize(%d) Size(%d) ", resp->responseCode, (int)sizeof(TPM2_BaseOut), (int)dataSize); @@ -856,7 +872,8 @@ errlHndl_t tpmCmdPcrExtend2Hash(TpmTarget * io_target, * @moduleid MOD_TPM_CMD_PCREXTEND * @userdata1 responseCode * @userdata2 dataSize - * @devdesc Command failure reading TPM FW version. + * @devdesc Command failure performing PCR extend. + * @custdesc Failure detected in security subsystem */ err = tpmCreateErrorLog(MOD_TPM_CMD_PCREXTEND, RC_TPM_COMMAND_FAIL, @@ -921,7 +938,8 @@ errlHndl_t tpmCmdPcrRead(TpmTarget* io_target, * @userdata1 Digest Ptr * @userdata2[0:31] Full Digest Size * @userdata2[32:63] PCR - * @devdesc Unmarshaling error detected + * @devdesc pcr read invalid arguments + * @custdesc Failure detected in security subsystem */ err = tpmCreateErrorLog(MOD_TPM_CMD_PCRREAD, RC_TPM_INVALID_ARGS, @@ -944,7 +962,8 @@ errlHndl_t tpmCmdPcrRead(TpmTarget* io_target, err = tpmTransmitCommand(io_target, dataBuf, - sizeof(dataBuf)); + sizeof(dataBuf), + TPM_LOCALITY_0); if (TB_SUCCESS != err) { @@ -959,7 +978,7 @@ errlHndl_t tpmCmdPcrRead(TpmTarget* io_target, (resp->pcrValues.digests[0].size != fullDigestSize)) { TRACFCOMP( g_trac_trustedboot, - "TPM PCRRead OP Fail Ret(%X) ExSize(%d) " + "TPM PCRRead OP Fail Ret(0x%X) ExSize(%d) " "Size(%d) Cnt(%d) DSize(%d)", resp->base.responseCode, (int)sizeof(TPM2_BaseOut), @@ -974,7 +993,8 @@ errlHndl_t tpmCmdPcrRead(TpmTarget* io_target, * @moduleid MOD_TPM_CMD_PCRREAD * @userdata1 responseCode * @userdata2 dataSize - * @devdesc Command failure reading TPM FW version. + * @devdesc Command failure performing PCR read. + * @custdesc Failure detected in security subsystem */ err = tpmCreateErrorLog(MOD_TPM_CMD_PCRREAD, RC_TPM_COMMAND_FAIL, diff --git a/src/usr/secureboot/trusted/trustedbootCmds.H b/src/usr/secureboot/trusted/trustedbootCmds.H index 1f03eeb0e..b1c1ef0dd 100644 --- a/src/usr/secureboot/trusted/trustedbootCmds.H +++ b/src/usr/secureboot/trusted/trustedbootCmds.H @@ -5,7 +5,7 @@ /* */ /* OpenPOWER HostBoot Project */ /* */ -/* Contributors Listed Below - COPYRIGHT 2015,2016 */ +/* Contributors Listed Below - COPYRIGHT 2015,2017 */ /* [+] International Business Machines Corp. */ /* */ /* */ @@ -39,6 +39,8 @@ // ----------------------------------------------- #ifdef __HOSTBOOT_MODULE #include +#include +using namespace TPMDD; #endif #include "trustedboot.H" #include "trustedTypes.H" @@ -59,12 +61,14 @@ enum * @param[in/out] io_target Current TPM target structure * @param[in/out] io_buffer Input the command buffer to send, response on exit * @param[in] i_bufsize Size of io_buffer in bytes + * @param[in] i_locality TPM locality to use * @return errlHndl_t NULL if successful, otherwise a pointer to the * error log. */ errlHndl_t tpmTransmitCommand(TpmTarget* io_target, uint8_t* io_buffer, - size_t i_bufsize ); + size_t i_bufsize, + tpm_locality_t i_locality); /** * @brief Take structure pointed to by cmd and format for input into TPM diff --git a/src/usr/secureboot/trusted/trustedbootUtils.C b/src/usr/secureboot/trusted/trustedbootUtils.C index 90915030d..0e29468ac 100644 --- a/src/usr/secureboot/trusted/trustedbootUtils.C +++ b/src/usr/secureboot/trusted/trustedbootUtils.C @@ -5,7 +5,7 @@ /* */ /* OpenPOWER HostBoot Project */ /* */ -/* Contributors Listed Below - COPYRIGHT 2015,2016 */ +/* Contributors Listed Below - COPYRIGHT 2015,2017 */ /* [+] International Business Machines Corp. */ /* */ /* */ @@ -56,7 +56,8 @@ namespace TRUSTEDBOOT errlHndl_t tpmTransmit(TpmTarget * io_target, uint8_t* io_buffer, size_t i_cmdSize, - size_t i_bufsize ) + size_t i_bufsize, + tpm_locality_t i_locality) { errlHndl_t err = NULL; @@ -67,7 +68,8 @@ errlHndl_t tpmTransmit(TpmTarget * io_target, io_buffer, i_bufsize, DEVICE_TPM_ADDRESS(TPMDD::TPM_OP_TRANSMIT, - i_cmdSize)); + i_cmdSize, + i_locality)); if (NULL != err) { break; diff --git a/src/usr/secureboot/trusted/trustedbootUtils.H b/src/usr/secureboot/trusted/trustedbootUtils.H index 73bc38743..78ae7e053 100644 --- a/src/usr/secureboot/trusted/trustedbootUtils.H +++ b/src/usr/secureboot/trusted/trustedbootUtils.H @@ -5,7 +5,7 @@ /* */ /* OpenPOWER HostBoot Project */ /* */ -/* Contributors Listed Below - COPYRIGHT 2015,2016 */ +/* Contributors Listed Below - COPYRIGHT 2015,2017 */ /* [+] International Business Machines Corp. */ /* */ /* */ @@ -39,6 +39,10 @@ // ----------------------------------------------- // Includes // ----------------------------------------------- +#ifdef __HOSTBOOT_MODULE +#include +using namespace TPMDD; +#endif #include "trustedTypes.H" #ifdef __cplusplus @@ -52,13 +56,15 @@ namespace TRUSTEDBOOT * @param[in/out] io_buffer Input the command buffer to send, response on exit * @param[in] i_cmdSize Size of provided command in bytes * @param[in] i_bufsize Size of io_buffer in bytes + * @param[in] i_locality TPM locality to use * @return errlHndl_t NULL if successful, otherwise a pointer to the * error log. */ errlHndl_t tpmTransmit(TpmTarget * io_target, uint8_t* io_buffer, size_t i_cmdSize, - size_t i_bufsize ); + size_t i_bufsize, + tpm_locality_t i_locality); /** * @brief Create an error log entry for potential logging -- cgit v1.2.1