Remove Secure Boot workarounds

- Removing the magic number checks that would block sb functionality
  if things didn't appear secure
- Remove Best Effort Policy and all of its related code
- Remove the legacy PCR extension
- Remove the non-secure header preservation path.
- Always load HB base image header from the bl to hb data path
  vs settings unsecurely out of pnor

Change-Id: Ie638384ac50ed47850985c959ea7a32e5757d64e
RTC: 178520
RTC: 155374
RTC: 173489
Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/49925
Tested-by: Jenkins Server <pfd-jenkins+hostboot@us.ibm.com>
Tested-by: Jenkins OP Build CI <op-jenkins+hostboot@us.ibm.com>
Reviewed-by: Nicholas E. Bofferding <bofferdn@us.ibm.com>
Tested-by: FSP CI Jenkins <fsp-CI-jenkins+hostboot@us.ibm.com>
Tested-by: Jenkins OP HW <op-hw-jenkins+hostboot@us.ibm.com>
Reviewed-by: Michael Baiocchi <mbaiocch@us.ibm.com>
Reviewed-by: Daniel M. Crowell <dcrowell@us.ibm.com>

1 files changed, 11 insertions, 37 deletions

diff --git a/src/usr/pnor/pnor_utils.C b/src/usr/pnor/pnor_utils.C
index bf8a195c2..9e0753066 100644
--- a/src/usr/pnor/pnor_utils.C
+++ b/src/usr/pnor/pnor_utils.C
@@ -321,42 +321,21 @@ PNOR::parseEntries (ffs_hdr* i_ffs_hdr,
                                 ((io_TOC[secId].size * 8 ) / 9);
         }
 
-        // @TODO RTC 173489
-        // Remove once FSP fully supports signing of PNOR sections that did
-        // not previously have a sha512 header.  Until then, turn off the SHA512
-        // bit if it doesn't match known header types
-#ifndef BOOTLOADER
-        if(io_TOC[secId].version & FFS_VERS_SHA512)
-        {
-            bool hasKnownHeader = true;
-            l_errhdl = PNOR::hasKnownHeader(static_cast<SectionId>(secId),
-                io_TOC[secId],hasKnownHeader);
-            if(l_errhdl)
-            {
-                break;
-            }
-
-            if(!hasKnownHeader)
-            {
-                io_TOC[secId].version &= ~FFS_VERS_SHA512;
-            }
-        }
-#endif
-
-#ifdef BOOTLOADER
+        // isEnforcedSecureSection should always handle SB compiled in or not,
+        // but if that ever changes, force flag to false in PNOR TOC.
+#ifdef CONFIG_SECUREBOOT
         io_TOC[secId].secure = PNOR::isEnforcedSecureSection(secId);
 #else
-        // Check if PNOR section has a secureHeader or not.
-        l_errhdl = PNOR::setSecure(secId, io_TOC);
-        if (l_errhdl)
-        {
-            break;
-        }
+        io_TOC[secId].secure = false;
 #endif
 
-        if (PNOR::hasNonSecureHeader(io_TOC[secId]))
+        // If secureboot is compiled in, skip header if not a secure section
+        // Otherwise always skip header as the secure flag is always false and
+        // SpnorRp will not handle skipping the header if one is indicated in PNOR
+        if ( (io_TOC[secId].version & FFS_VERS_SHA512)
+              && !io_TOC[secId].secure)
         {
-              //increment flash addr for sha header
+            //increment flash addr for sha header
             if (io_TOC[secId].integrity == FFS_INTEG_ECC_PROTECT)
             {
                 io_TOC[secId].flashAddr += PAGESIZE_PLUS_ECC ;
@@ -370,6 +349,7 @@ PNOR::parseEntries (ffs_hdr* i_ffs_hdr,
             // adjust the size to reflect that
             io_TOC[secId].size -= PAGESIZE;
         }
+
     } // For TOC Entries
 
 #ifndef BOOTLOADER
@@ -510,9 +490,3 @@ bool PNOR::cmpSecurebootMagicNumber(const uint8_t* i_vaddr)
 
     return memcmp(&ROM_MAGIC_NUMBER, i_vaddr, sizeof(ROM_MAGIC_NUMBER))==0;
 }
-
-bool PNOR::hasNonSecureHeader(const PNOR::SectionData_t& i_secInfo)
-{
-    return (i_secInfo.version & FFS_VERS_SHA512) &&
-           !i_secInfo.secure;
-}