| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Address errata 80 from E2600-11.pdf for the IPS configuration. This is
analogous to commit 352822eb45af which updated the IBM configuration.
Change-Id: Ie0036a4895619cb9324f58232d93fd61e73044fa
Signed-off-by: Joel Stanley <joel@jms.id.au>
|
|
IBM observed consistent hangs in the `uart_otp` tool when programming
the OTP image into the SoC. This was root-caused by Aspeed:
> Message-ID: <TYZPR06MB677027C95FCFABCDA6F81C4D800DA@TYZPR06MB6770.apcprd06.prod.outlook.com>
> From: Neal Liu <neal_liu@aspeedtech.com>
> Subject: Server Management technical issue by Rose.Drehmel@us.ibm.com
>
> Hi Andrew,
>
> It’s okay, I found the problem.
>
> The utility timeout is because it programs key retire bits in
> OTPCFG4[7:0] without enabling secure boot.
>
> In the case of secure boot is enabled, the hardware would detect the
> current boot up key number #id, and it can only retire the number
> which is smaller than the current boot up key #id.
> If not, the OTP status will keep busy, and the utility stocks in
> polling loop.
>
> If you still want to disable key #0 without enabling secure boot,
> OTPCFG0[5] can be another option for you.
>
> I also provide a new programmer.bin to fix this infinite loop problem
> in case user thought BMC is crashed.
>
> You can try it with this command:
>
> $ uart_otp -s 2600 -p ast2600_otp_programmer.bin /dev/ttyUSBx
>
> Thanks
>
> Best Regards,
>
> -Neal
In discussion with Chris we determined that we were not intentionally
attempting to retire the development / low-security key, rather were
just trying to be complete in the specification of our configuration.
Neal responded to our request of how to avoid programming a key
retirement in the configuration file:
> Message-ID: <TYZPR06MB67700B238DB429A51E048E328010A@TYZPR06MB6770.apcprd06.prod.outlook.com>
> From: Neal Liu <neal_liu@aspeedtech.com>
> Subject: Server Management technical issue by Rose.Drehmel@us.ibm.com
>
> Hi Andrew,
>
> Just delete line #72 as unspecified value.
>
> Thanks
>
> Best Regards,
>
> -Neal
>>
>> From: Andrew Jeffery <andrewrj@au1.ibm.com>
>> To: Neal Liu <neal_liu@aspeedtech.com>
>> Subject: Re: Server Management technical issue by Rose.Drehmel@us.ibm.com
>>
>> Hi Neal,
>>
>> I've discussed your findings with Chris Engel, who is our platform
>> security person. We determined that we do not want to mark the low
>> security key as retired in the OTP as we're handling that via the
>> FWSPIMISO strapping pin.
>>
>> What change should I make to our OTP configuration so that we don't
>> retire key 0 during programming?
>>
>> Andrew
Line 72 in this case refers to our OTP configuration file:
https://github.com/openbmc/openbmc/blob/2a25492c13e2b768f94b864a51f84e82e4238aef/meta-ibm/recipes-bsp/u-boot/u-boot-aspeed-sdk/p10bmc/ibm.json#L72
Leave "Keys Retire ID" unspecified to avoid leaving the OTP engine busy.
Cc: Chris Engel <cjengel@us.ibm.com>
Cc: Rose Drehmel <Rose.Drehmel@us.ibm.com>
Cc: Briana Foxworth <befoxwor@us.ibm.com>
Cc: Nicole Nett <nschwart@us.ibm.com>
Change-Id: Ib6b75a40f5debd5ba1166f0f69a07114b76d9c34
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
|
|
Address errata 80 from E2600-11.pdf
Change-Id: I039ae8bb16452f18810cc43febd9ea87c7988166
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
|
|
Configure U-Boot for p10bmc machines to enable the "AST2600 IBM" board
and disable conflicting options.
Follow the pattern used by the Qualcomm layer of putting the snippet in
files, which has the added bonus of saving a level of directory nesting.
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Change-Id: I30a2822b65c5ff826f9f5b3fa71bcec9d402c74c
|
|
The IPS systems will use the same OTP configuration but different RoT
keys.
Change-Id: I73ca9a79092cdd74bef509824a4123445ecbd003
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
|
|
Better communicate whose P10 systems are the target of the
configuration.
Change-Id: I561750df9b32512753d9ce644088c2130ebb6a55
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
|
|
Enable generating multiple OTP binaries by specifying multiple OTP
configuration files.
Change-Id: I1ce81cd2c1d0f501578b927eb31cce5a37cdcf1f
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
|
|
u-boot has been updated to refer to p10bmc instead of rainier. Given
this file is also shared between everest and rainier change the name.
Change-Id: I6a643e09b782dcdbe86bc5a39c0fd14a82be45d8
Signed-off-by: Joel Stanley <joel@jms.id.au>
|
|
Some cards were built without TPMs populated. However, we signed builds
for these cards. Remove the key corresponding to the signatures on these
builds and sign builds for cards with TPMs populated with a subsequent
key to prevent non-TPM builds from being used on TPM-enabled systems.
Change-Id: I511a310750319b0e3dc2e028285a77d8cf07d7c7
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
|
|
Some addition development details must be managed in this bbappend due
to co-development of the AST2600 and IBM p10bmc designs. IBM did bringup
of secure-boot on pre-production AST2600 silicon and this shaped how the
platform's OTP was configured.
The PEM files represent the public portion of the IBM signing key-pairs
for p10bmc systems. These are included to provide a canonical location
for the production OTP image artifact.
Change-Id: I7caa6cfd5848b1d671ef95f8031b76088673900a
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
|
