From 31591a027b6d76be0cd081d3bcce2e746fdc7623 Mon Sep 17 00:00:00 2001 From: Santosh Balasubramanian Date: Wed, 5 Oct 2016 02:48:54 -0400 Subject: HWP L2 delivery for p9_update_security_ctrl Change-Id: If5b90954babffc40a81ae0bc82fe2b27d9fe96d2 Original-Change-Id: Ib3df7e0c315e86dd8d8668d2dd278aaf95dd25f3 Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/30740 Tested-by: PPE CI Reviewed-by: Soma Bhanutej Tested-by: Jenkins Server Tested-by: Hostboot CI Reviewed-by: Nicholas E. Bofferding Reviewed-by: PARVATHI RACHAKONDA Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/35675 Tested-by: FSP CI Jenkins Tested-by: Jenkins OP Build CI Reviewed-by: Daniel M. Crowell --- .../procedures/hwp/perv/p9_update_security_ctrl.C | 92 ++++++++++++++++++++++ .../procedures/hwp/perv/p9_update_security_ctrl.H | 58 ++++++++++++++ 2 files changed, 150 insertions(+) create mode 100644 src/import/chips/p9/procedures/hwp/perv/p9_update_security_ctrl.C create mode 100644 src/import/chips/p9/procedures/hwp/perv/p9_update_security_ctrl.H (limited to 'src') diff --git a/src/import/chips/p9/procedures/hwp/perv/p9_update_security_ctrl.C b/src/import/chips/p9/procedures/hwp/perv/p9_update_security_ctrl.C new file mode 100644 index 000000000..1c1d2d7e3 --- /dev/null +++ b/src/import/chips/p9/procedures/hwp/perv/p9_update_security_ctrl.C @@ -0,0 +1,92 @@ +/* IBM_PROLOG_BEGIN_TAG */ +/* This is an automatically generated prolog. */ +/* */ +/* $Source: src/import/chips/p9/procedures/hwp/perv/p9_update_security_ctrl.C $ */ +/* */ +/* OpenPOWER HostBoot Project */ +/* */ +/* Contributors Listed Below - COPYRIGHT 2016,2017 */ +/* [+] International Business Machines Corp. */ +/* */ +/* */ +/* Licensed under the Apache License, Version 2.0 (the "License"); */ +/* you may not use this file except in compliance with the License. */ +/* You may obtain a copy of the License at */ +/* */ +/* http://www.apache.org/licenses/LICENSE-2.0 */ +/* */ +/* Unless required by applicable law or agreed to in writing, software */ +/* distributed under the License is distributed on an "AS IS" BASIS, */ +/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or */ +/* implied. See the License for the specific language governing */ +/* permissions and limitations under the License. */ +/* */ +/* IBM_PROLOG_END_TAG */ +//------------------------------------------------------------------------------ +/// @file p9_update_security_ctrl.C +/// +/// @brief To set SUL(Secure Update Lock) bit to lock down SAB + SBE SEEPROM and to set TDP(TPM Deconfig Protect) Bit +/// Decision to set SUL is based on if Chip is in Secure mode(SAB bit is 1) +/// Decision to set TDP is based on an attribute : ATTR_SECUREBOOT_PROTECT_DECONFIGURED_TPM +/// +//------------------------------------------------------------------------------ +// *HWP HW Owner : Santosh Balasubramanian +// *HWP HW Backup Owner : Srinivas V Naga +// *HWP FW Owner : Dan Crowell +// *HWP Team : Perv +// *HWP Level : 2 +// *HWP Consumed by : HB +//------------------------------------------------------------------------------ + + +//------------------------------------------------------------------------------ +// Includes +//------------------------------------------------------------------------------ +#include +#include +#include +#include "p9_update_security_ctrl.H" + + +fapi2::ReturnCode p9_update_security_ctrl(const fapi2::Target& i_target_chip) +{ + FAPI_INF("p9_update_security_ctrl : Entering ..."); + + uint8_t l_set_tdp = 0; + fapi2::buffer l_data64; + bool l_in_secure_mode = false; + + //Attribute for setting TDP bit - TPM Deconfig Protection 0x00 = No protection, 0x01 = Set TDP bit(Bit 12) + FAPI_TRY(FAPI_ATTR_GET(fapi2::ATTR_SECUREBOOT_PROTECT_DECONFIGURED_TPM, i_target_chip, l_set_tdp)); + FAPI_INF("TPM Deconfig Attribute value : %#02x", l_set_tdp); + + + //Get value of SAB bit to see if chip is in secure mode + FAPI_TRY(fapi2::getScom(i_target_chip, PU_SECURITY_SWITCH_REGISTER_SCOM, l_data64)); + + l_in_secure_mode = l_data64.getBit(); + + if (l_in_secure_mode == 1) //Chip in Secure mode + { + //Set bit 4 to set SUL + l_data64.setBit(); + + if (l_set_tdp == 1) //Check if TDP needs to be set + { + //Set bit 12 to set TDP + l_data64.setBit(); + } + + FAPI_TRY(fapi2::putScom(i_target_chip, PU_SECURITY_SWITCH_REGISTER_SCOM, l_data64)); + } + else + { + FAPI_INF("Chip not in secure mode - No need to set SUL/TDP bits"); + } + + FAPI_INF("p9_update_security_ctrl : Exiting ..."); + +fapi_try_exit: + return fapi2::current_err; + +} diff --git a/src/import/chips/p9/procedures/hwp/perv/p9_update_security_ctrl.H b/src/import/chips/p9/procedures/hwp/perv/p9_update_security_ctrl.H new file mode 100644 index 000000000..3bc6a3018 --- /dev/null +++ b/src/import/chips/p9/procedures/hwp/perv/p9_update_security_ctrl.H @@ -0,0 +1,58 @@ +/* IBM_PROLOG_BEGIN_TAG */ +/* This is an automatically generated prolog. */ +/* */ +/* $Source: src/import/chips/p9/procedures/hwp/perv/p9_update_security_ctrl.H $ */ +/* */ +/* OpenPOWER HostBoot Project */ +/* */ +/* Contributors Listed Below - COPYRIGHT 2016,2017 */ +/* [+] International Business Machines Corp. */ +/* */ +/* */ +/* Licensed under the Apache License, Version 2.0 (the "License"); */ +/* you may not use this file except in compliance with the License. */ +/* You may obtain a copy of the License at */ +/* */ +/* http://www.apache.org/licenses/LICENSE-2.0 */ +/* */ +/* Unless required by applicable law or agreed to in writing, software */ +/* distributed under the License is distributed on an "AS IS" BASIS, */ +/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or */ +/* implied. See the License for the specific language governing */ +/* permissions and limitations under the License. */ +/* */ +/* IBM_PROLOG_END_TAG */ +//------------------------------------------------------------------------------ +/// @file p9_update_security_ctrl.H +/// +/// @brief To set SUL(Secure Update Lock) bit to lock down SAB + SBE SEEPROM and to set TDP(TPM Deconfig Protect) Bit +/// Decision to set SUL is based on if Chip is in Secure mode(SAB bit is 1) +/// Decision to set TDP is based on an attribute : ATTR_SECUREBOOT_PROTECT_DECONFIGURED_TPM +/// +//------------------------------------------------------------------------------ +// *HWP HW Owner : Santosh Balasubramanian +// *HWP HW Backup Owner : Srinivas V Naga +// *HWP FW Owner : Dan Crowell +// *HWP Team : Perv +// *HWP Level : 2 +// *HWP Consumed by : HB +//------------------------------------------------------------------------------ + +#ifndef P9_UPDATE_SECURITY_CTRL_H_ +#define P9_UPDATE_SECURITY_CTRL_H_ + + +#include + + +typedef fapi2::ReturnCode (*p9_update_security_ctrl_FP_t)(const fapi2::Target&); + +/// +/// @param[in] i_target_chip Reference to TARGET_TYPE_PROC_CHIP target +/// @return FAPI2_RC_SUCCESS if success, else error code. +extern "C" +{ + fapi2::ReturnCode p9_update_security_ctrl(const fapi2::Target& i_target_chip); +} + +#endif -- cgit v1.2.3