Secure Memory Manager implementation

Support to update and manage the memory window list
Opening of HB Dump window in istep 5.1
Enabled memory filtering in mem access chip-ops

Change-Id: I72b68ac099371babe47a64689fa38927934625b7
Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/43929
Tested-by: Jenkins Server <pfd-jenkins+hostboot@us.ibm.com>
Tested-by: FSP CI Jenkins <fsp-CI-jenkins+hostboot@us.ibm.com>
Reviewed-by: AMIT J. TENDOLKAR <amit.tendolkar@in.ibm.com>
Reviewed-by: RAJA DAS <rajadas2@in.ibm.com>
Reviewed-by: Sachin Gupta <sgupta2m@in.ibm.com>

15 files changed, 770 insertions, 302 deletions

diff --git a/src/sbefw/sbeSecureMemRegionManager.C b/src/sbefw/sbeSecureMemRegionManager.C
new file mode 100644
index 00000000..189ee56b
--- /dev/null
+++ b/src/sbefw/sbeSecureMemRegionManager.C
@@ -0,0 +1,186 @@
+/* IBM_PROLOG_BEGIN_TAG                                                   */
+/* This is an automatically generated prolog.                             */
+/*                                                                        */
+/* $Source: src/sbefw/sbeSecureMemRegionManager.C $                       */
+/*                                                                        */
+/* OpenPOWER sbe Project                                                  */
+/*                                                                        */
+/* Contributors Listed Below - COPYRIGHT 2017                             */
+/*                                                                        */
+/*                                                                        */
+/* Licensed under the Apache License, Version 2.0 (the "License");        */
+/* you may not use this file except in compliance with the License.       */
+/* You may obtain a copy of the License at                                */
+/*                                                                        */
+/*     http://www.apache.org/licenses/LICENSE-2.0                         */
+/*                                                                        */
+/* Unless required by applicable law or agreed to in writing, software    */
+/* distributed under the License is distributed on an "AS IS" BASIS,      */
+/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or        */
+/* implied. See the License for the specific language governing           */
+/* permissions and limitations under the License.                         */
+/*                                                                        */
+/* IBM_PROLOG_END_TAG                                                     */
+#include "sbeSecureMemRegionManager.H"
+#include "sbetrace.H"
+#include "sbeutil.H"
+
+#ifndef __SBEFW_SEEPROM__
+
+SBESecureMemRegionManager* SBESecMemRegionManager =
+                                     &SBESecureMemRegionManager::getInstance();
+
+SBESecureMemRegionManager& SBESecureMemRegionManager::getInstance()
+{
+    static SBESecureMemRegionManager iv_instance;
+    return iv_instance;
+}
+
+secureMemRegion_t SBESecureMemRegionManager::getPartialRegionSize(
+                                            const secureMemRegion_t i_region)
+{
+    secureMemRegion_t ret = {};
+    for(size_t i = 0; i < iv_regionsOpenCnt; i++)
+    {
+        uint64_t minStartAddr = i_region.startAddress < iv_memRegions[i].startAddress ?
+                        i_region.startAddress : iv_memRegions[i].startAddress;
+        uint64_t iRegionEndAddress = i_region.startAddress + i_region.size - 1;
+        uint64_t existingRegionEndAddress = iv_memRegions[i].startAddress + iv_memRegions[i].size - 1;
+        uint64_t maxEndAddr = iRegionEndAddress >= existingRegionEndAddress ?
+                        iRegionEndAddress : existingRegionEndAddress;
+
+        // detect overlap
+        if((maxEndAddr - minStartAddr + 1) < (i_region.size + iv_memRegions[i].size))
+        {
+            ret = iv_memRegions[i];
+            // Give preference to first region
+            if(i_region.startAddress >= iv_memRegions[i].startAddress &&
+               i_region.startAddress < (iv_memRegions[i].startAddress +
+                                        iv_memRegions[i].size))
+            {
+                // Return the existing window to the extent of input window
+                ret.startAddress = i_region.startAddress;
+                ret.size = iv_memRegions[i].startAddress + iv_memRegions[i].size
+                            - i_region.startAddress;
+                if(ret.size > i_region.size)
+                    ret.size = i_region.size;
+                break;
+            }
+        }
+    }
+    return ret;
+}
+
+#endif //__SBEFW_SEEPROM__
+#ifdef __SBEFW_SEEPROM__
+
+// Public functions
+sbeSecondaryResponse SBESecureMemRegionManager::add(const uint64_t i_startAddr,
+                                                    const uint32_t i_size,
+                                                    const uint8_t i_mode)
+{
+    #define SBE_FUNC "SBESecureMemRegionManager::add"
+    sbeSecondaryResponse rc = SBE_SEC_OPERATION_SUCCESSFUL;
+    do
+    {
+        if(getPartialRegionSize({i_startAddr, i_size, i_mode}).mode)
+        {
+            SBE_ERROR(SBE_FUNC" SBE_SEC_MEM_REGION_AMEND_ATTEMPTED");
+            rc = SBE_SEC_MEM_REGION_AMEND_ATTEMPTED;
+            break;
+        }
+        if(iv_regionsOpenCnt  >= MAX_NONSECURE_MEM_REGIONS)
+        {
+            SBE_ERROR(SBE_FUNC" SBE_SEC_MAXIMUM_MEM_REGION_EXCEEDED");
+            rc = SBE_SEC_MAXIMUM_MEM_REGION_EXCEEDED;
+            break;
+        }
+        SBE_INFO(SBE_FUNC" Adding region Mem[0x%08X%08X], size[0x%08X]",
+                    SBE::higher32BWord(i_startAddr),
+                    SBE::lower32BWord(i_startAddr),
+                    i_size);
+        iv_memRegions[iv_regionsOpenCnt++] = {i_startAddr, i_size, i_mode};
+        SBE_INFO(SBE_FUNC" after addition iv_regionsOpenCnt [%d]",
+                iv_regionsOpenCnt);
+    } while(0);
+    return rc;
+    #undef SBE_FUNC
+}
+
+sbeSecondaryResponse SBESecureMemRegionManager::remove(const uint64_t i_startAddr)
+{
+    #define SBE_FUNC "SBESecureMemRegionManager::remove";
+    size_t i = 0;
+    sbeSecondaryResponse rc = SBE_SEC_OPERATION_SUCCESSFUL;
+    for(; i < iv_regionsOpenCnt; i++)
+    {
+        if(i_startAddr == iv_memRegions[i].startAddress)
+        {
+            break;
+        }
+    }
+    if(i < iv_regionsOpenCnt)
+    {
+        SBE_INFO(SBE_FUNC" Deleting region i[%d], Mem[0x%08X%08X], size[0x%08X]",
+                    i,
+                    SBE::higher32BWord(iv_memRegions[i].startAddress),
+                    SBE::lower32BWord(iv_memRegions[i].startAddress),
+                    iv_memRegions[i].size);
+        // Remove the empty slot and maintain contiguous list
+        for(size_t j = i; j < iv_regionsOpenCnt-1; j++)
+        {
+            iv_memRegions[j].startAddress = iv_memRegions[j+1].startAddress;
+            iv_memRegions[j].size = iv_memRegions[j+1].size;
+            iv_memRegions[j].mode = iv_memRegions[j+1].mode;
+        }
+
+        iv_regionsOpenCnt--;
+        SBE_INFO(SBE_FUNC" After deletion : iv_regionsOpenCnt[%d]", iv_regionsOpenCnt);
+    }
+    else
+    {
+        SBE_ERROR(SBE_FUNC" SBE_SEC_MEM_REGION_NOT_FOUND");
+        rc = SBE_SEC_MEM_REGION_NOT_FOUND;
+    }
+    return rc;
+    #undef SBE_FUNC
+}
+
+#endif //__SBEFW_SEEPROM__
+#ifndef __SBEFW_SEEPROM__
+
+sbeSecondaryResponse SBESecureMemRegionManager::isAccessAllowed(
+                                        secureMemRegion_t i_region)
+{
+    #define SBE_FUNC "SBESecureMemRegionManager::isAccessAllowed"
+    sbeSecondaryResponse rc = SBE_SEC_OPERATION_SUCCESSFUL;
+    while(i_region.size > 0)
+    {
+        secureMemRegion_t foundregion = getPartialRegionSize(i_region);
+        // Check if the found region has allowable access level
+        // and that the region overlap is from the beginning itself
+        if((i_region.mode & foundregion.mode) &&
+                (i_region.startAddress == foundregion.startAddress))
+        {
+            SBE_INFO(SBE_FUNC" foundRegion Mem[0x%08X%08X], size[0x%08X]",
+                    SBE::higher32BWord(foundregion.startAddress),
+                    SBE::lower32BWord(foundregion.startAddress),
+                    foundregion.size);
+            i_region.size -= foundregion.size;
+            i_region.startAddress += foundregion.size;
+        }
+        else
+        {
+            SBE_ERROR(SBE_FUNC" Non secure access to memory blocked "
+                      "Addr[0x%08X%08X] Size[0x%08X]",
+                      SBE::higher32BWord(i_region.startAddress),
+                      SBE::lower32BWord(i_region.startAddress),
+                      i_region.size);
+            rc = SBE_SEC_BLACKLISTED_MEM_ACCESS;
+            break;
+        }
+    }
+    return rc;
+    #undef SBE_FUNC
+}
+#endif //__SBEFW_SEEPROM__
diff --git a/src/sbefw/sbeSecureMemRegionManager.H b/src/sbefw/sbeSecureMemRegionManager.H
new file mode 100644
index 00000000..c1127643
--- /dev/null
+++ b/src/sbefw/sbeSecureMemRegionManager.H
@@ -0,0 +1,113 @@
+/* IBM_PROLOG_BEGIN_TAG                                                   */
+/* This is an automatically generated prolog.                             */
+/*                                                                        */
+/* $Source: src/sbefw/sbeSecureMemRegionManager.H $                       */
+/*                                                                        */
+/* OpenPOWER sbe Project                                                  */
+/*                                                                        */
+/* Contributors Listed Below - COPYRIGHT 2017                             */
+/*                                                                        */
+/*                                                                        */
+/* Licensed under the Apache License, Version 2.0 (the "License");        */
+/* you may not use this file except in compliance with the License.       */
+/* You may obtain a copy of the License at                                */
+/*                                                                        */
+/*     http://www.apache.org/licenses/LICENSE-2.0                         */
+/*                                                                        */
+/* Unless required by applicable law or agreed to in writing, software    */
+/* distributed under the License is distributed on an "AS IS" BASIS,      */
+/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or        */
+/* implied. See the License for the specific language governing           */
+/* permissions and limitations under the License.                         */
+/*                                                                        */
+/* IBM_PROLOG_END_TAG                                                     */
+#pragma once
+
+#include <stdint.h>
+#include <stddef.h>
+#include "sbe_sp_intf.H"
+
+enum class memRegionMode:uint8_t
+{
+    READ = 0x01,
+    WRITE = 0x02,
+};
+
+// Structure to define a mem region
+typedef struct
+{
+    uint64_t startAddress;
+    uint32_t size;
+    uint32_t mode;
+} secureMemRegion_t;
+
+constexpr size_t MAX_NONSECURE_MEM_REGIONS = 8;
+
+class SBESecureMemRegionManager
+{
+    secureMemRegion_t iv_memRegions[MAX_NONSECURE_MEM_REGIONS];
+    size_t iv_regionsOpenCnt;
+
+    SBESecureMemRegionManager():iv_memRegions{0}
+    {
+    }
+
+    /*
+     * @brief getPartialRegionSize - get the overlapping region
+     *                               if it exists.
+     *                               Also if the overlap is from the beginning,
+     *                               first region is returned
+     *
+     *
+     * @param[in] i_region           region to check for overlap
+     *
+     * @return overlapping region
+     */
+    secureMemRegion_t getPartialRegionSize(const secureMemRegion_t i_region);
+
+    public:
+    // Disable copy constructors
+    SBESecureMemRegionManager(const SBESecureMemRegionManager&) = delete;
+    SBESecureMemRegionManager& operator=(const SBESecureMemRegionManager&) = delete;
+
+    static SBESecureMemRegionManager& getInstance();
+
+    /*
+     * @brief add - Open a new memory region
+     *
+     * @param[in] i_startAddr  Start address of the memory region
+     * @param[in] i_size       Size of the memory region
+     * @param[in] i_mode       Bit mapped access mode of the memory region
+     *
+     * @return SBE secondary RC
+     */
+    sbeSecondaryResponse add(const uint64_t i_startAddr,
+                             const uint32_t i_size,
+                             const uint8_t i_mode);
+    /*
+     * @brief remove - Close a memory region
+     *
+     * @param[in] i_startAddr  Start address of the memory region
+     *
+     * @return SBE secondary RC
+     */
+    sbeSecondaryResponse remove(const uint64_t i_startAddr);
+    /*
+     * @brief isAccessAllowed - Check if the access is allowed
+     *
+     * @param[in] i_region     region to check the access for
+     *
+     * @return SBE secondary RC
+     */
+    sbeSecondaryResponse isAccessAllowed(secureMemRegion_t i_region);
+
+    /*
+     * @brief closeAllRegions - close all non-secure regions
+     */
+    void closeAllRegions()
+    {
+        iv_regionsOpenCnt = 0;
+    }
+};
+
+extern SBESecureMemRegionManager* SBESecMemRegionManager;
diff --git a/src/sbefw/sbecmdiplcontrol.C b/src/sbefw/sbecmdiplcontrol.C
index bc87e92f..e82713f1 100644
--- a/src/sbefw/sbecmdiplcontrol.C
+++ b/src/sbefw/sbecmdiplcontrol.C
@@ -109,6 +109,9 @@
 
 #include "sbeXipUtils.H" // For getting hbbl offset
 #include "sbeutil.H" // For getting SBE_TO_NEST_FREQ_FACTOR
+
+#include "p9_fbc_utils.H"
+#include "sbeSecureMemRegionManager.H"
 // Forward declaration
 using namespace fapi2;
 
@@ -828,6 +831,7 @@ ReturnCode istepWithCoreConditional( sbeIstepHwp_t i_hwp)
 }
 
 //----------------------------------------------------------------------------
+constexpr uint32_t HB_MEM_WINDOW_SIZE = 32*1024*1024; //32 MB
 ReturnCode istepLoadBootLoader( sbeIstepHwp_t i_hwp)
 {
     ReturnCode rc = FAPI2_RC_SUCCESS;
@@ -842,12 +846,50 @@ ReturnCode istepLoadBootLoader( sbeIstepHwp_t i_hwp)
     P9XipHeader *hdr = getXipHdr();
     P9XipSection *hbblSection =  &(hdr->iv_section[P9_XIP_SECTION_SBE_HBBL]);
 
-    // Update the ATTR_SBE_ADDR_KEY_STASH_ADDR before calling the bootloader,
-    // since it is going to access these data from inside.
-    uint64_t addr = SBE_GLOBAL->sbeKeyAddrPair.fetchStashAddrAttribute();
-    FAPI_ATTR_SET(fapi2::ATTR_SBE_ADDR_KEY_STASH_ADDR, sysTgt, addr); 
-    SBE_EXEC_HWP(rc, p9_sbe_load_bootloader, proc, exTgt, hbblSection->iv_size,
-                 getSectionAddr(hbblSection))
+    uint64_t drawer_base_address_nm0, drawer_base_address_nm1;
+    uint64_t drawer_base_address_m;
+    uint64_t drawer_base_address_mmio;
+    uint64_t l_hostboot_hrmor_offset;
+    do
+    {
+        // Update the ATTR_SBE_ADDR_KEY_STASH_ADDR before calling the bootloader,
+        // since it is going to access these data from inside.
+        uint64_t addr = SBE_GLOBAL->sbeKeyAddrPair.fetchStashAddrAttribute();
+        FAPI_ATTR_SET(fapi2::ATTR_SBE_ADDR_KEY_STASH_ADDR, sysTgt, addr); 
+        SBE_EXEC_HWP(rc, p9_sbe_load_bootloader, proc, exTgt, hbblSection->iv_size,
+                     getSectionAddr(hbblSection))
+        if(rc != FAPI2_RC_SUCCESS)
+        {
+            SBE_ERROR(" p9_sbe_load_bootloader failed");
+            break;
+        }
+
+        // Open HB Dump memory Region
+        fapi2::Target<fapi2::TARGET_TYPE_SYSTEM> FAPI_SYSTEM;
+        FAPI_ATTR_GET(fapi2::ATTR_HOSTBOOT_HRMOR_OFFSET,
+                      FAPI_SYSTEM,
+                      l_hostboot_hrmor_offset);
+        rc = p9_fbc_utils_get_chip_base_address(
+                                    proc,
+                                    ABS_FBC_GRP_ID_ONLY,
+                                    drawer_base_address_nm0,
+                                    drawer_base_address_nm1,
+                                    drawer_base_address_m,
+                                    drawer_base_address_mmio);
+        if(rc != FAPI2_RC_SUCCESS)
+        {
+            SBE_ERROR(" p9_fbc_utils_get_chip_base_address failed");
+            break;
+        }
+        drawer_base_address_nm0 += l_hostboot_hrmor_offset;
+        SBE_INFO("istep 5.1 HB Dump mem Region [0x%08X%08X]",
+                                SBE::higher32BWord(drawer_base_address_nm0),
+                                SBE::lower32BWord(drawer_base_address_nm0));
+        SBESecMemRegionManager->add(drawer_base_address_nm0,
+                                    HB_MEM_WINDOW_SIZE,
+                                    static_cast<uint8_t>(memRegionMode::READ));
+
+    } while(0);
     return rc;
 }
 
@@ -1172,6 +1214,8 @@ ReturnCode istepStartMpipl( sbeIstepHwp_t i_hwp)
             SBE_ENTER_MPIPL_EVENT);
     // Set MPIPL mode bit in Scratch Reg 3
     (void)SbeRegAccess::theSbeRegAccess().setMpIplMode(true);
+    // Close all non-secure memory regions
+    SBESecMemRegionManager->closeAllRegions();
 
     do
     {
diff --git a/src/sbefw/sbecmdmemaccess.C b/src/sbefw/sbecmdmemaccess.C
index 911f9c4d..a62b4de6 100644
--- a/src/sbefw/sbecmdmemaccess.C
+++ b/src/sbefw/sbecmdmemaccess.C
@@ -37,6 +37,7 @@
 #include "sbeutil.H"
 #include "sbeHostUtils.H"
 #include "sbeglobals.H"
+#include "sbeSecureMemRegionManager.H"
 
 #include "fapi2.H"
 
@@ -57,6 +58,7 @@ constexpr uint32_t PBA_SIZE_MULTIPLIER_FOR_LEN_ALIGNMENT = 32;
  */
 constexpr uint32_t SBE_ADU_LOCK_TRIES = 3;
 
+#ifndef __SBEFW_SEEPROM__
 ///////////////////////////////////////////////////////////////////////
 // @brief align4ByteWordLength - Internal Method to this file
 //        Align the length passed and return number of words
@@ -132,15 +134,15 @@ inline uint32_t sbeAduLenInUpStreamFifo(uint32_t i_numGranules,
 // @brief flushUpstreamFifo - Internal Method to this file, to flush
 //        out the upstream fifo
 //
-// @param [in] i_fapiRc, Fapi RC
+// @param [in] i_primaryStatus, Fapi RC
 //
 // @return  RC from the underlying FIFO utility
 ///////////////////////////////////////////////////////////////////////
-inline uint32_t flushUpstreamFifo (const uint32_t &i_fapiRc)
+inline uint32_t flushUpstreamFifo (const uint32_t &i_primaryStatus)
 {
     uint32_t l_len2dequeue = 0;
     uint32_t l_rc = SBE_SEC_OPERATION_SUCCESSFUL;
-    if ( i_fapiRc != FAPI2_RC_SUCCESS )
+    if ( i_primaryStatus != SBE_PRI_OPERATION_SUCCESSFUL)
     {
         l_rc = sbeUpFifoDeq_mult(l_len2dequeue, NULL,
                              true, true);
@@ -178,133 +180,147 @@ uint32_t processPbaRequest(const sbeMemAccessReqMsgHdr_t &i_hdr,
     // Default for PBA
     uint32_t l_granuleSize = sbeMemAccessInterface::PBA_GRAN_SIZE_BYTES;
     uint64_t l_addr = 0;
+    // Keeps track of number of granules sent to HWP
+    uint64_t l_granulesCompleted = 0;
+    // Input Data length in alignment with PBA (128 Bytes)
+    uint64_t l_lenCacheAligned = 0;
 
-    // If not Host Pass through command, simply set the addr from the command
-    if(!i_hdr.isPbaHostPassThroughModeSet())
-    {
-        l_addr = i_hdr.getAddr();
-    }
-    // If it is Host Pass through command, set the address using the Host pass
-    // through address already set in the global and using the addr here in the
-    // command as index to that address
-    else
+    do
     {
-        l_addr = SBE_GLOBAL->hostPassThroughCmdAddr.addr + i_hdr.getAddr();
-        // Check if the size pass in the command is less than the size mentioned
-        // in the Host Pass Through globals
-        if((i_hdr.getAddr() + i_hdr.len) > SBE_GLOBAL->hostPassThroughCmdAddr.size)
+        // If not Host Pass through command, simply set the addr from the command
+        if(!i_hdr.isPbaHostPassThroughModeSet())
         {
-            // Break out, Invalid Size
-            SBE_ERROR("User size[0x%08X] exceeds the Host Pass Through Mode "
-                "size[0x%08X] Start Index[0x%08X %08X]", 
-                i_hdr.len, SBE_GLOBAL->hostPassThroughCmdAddr.size,
-                SBE::higher32BWord(i_hdr.getAddr()),
-                SBE::lower32BWord(i_hdr.getAddr()));
-            l_respHdr.setStatus( SBE_PRI_INVALID_DATA,
-                                 SBE_SEC_GENERIC_FAILURE_IN_EXECUTION );
+            l_addr = i_hdr.getAddr();
+            // Check if the access to the address is allowed
+            l_respHdr.secondaryStatus = SBESecMemRegionManager->isAccessAllowed(
+                                               {l_addr,
+                                                i_hdr.len,
+                 (i_isFlagRead ? static_cast<uint8_t>(memRegionMode::READ):
+                                 static_cast<uint8_t>(memRegionMode::WRITE))});
+            if(l_respHdr.secondaryStatus != SBE_SEC_OPERATION_SUCCESSFUL)
+            {
+                l_respHdr.primaryStatus = SBE_PRI_UNSECURE_ACCESS_DENIED;
+                break;
+            }
+        }
+        // If it is Host Pass through command, set the address using the Host pass
+        // through address already set in the global and using the addr here in the
+        // command as index to that address
+        else
+        {
+            l_addr = SBE_GLOBAL->hostPassThroughCmdAddr.addr + i_hdr.getAddr();
+            // Check if the size pass in the command is less than the size mentioned
+            // in the Host Pass Through globals
+            if((i_hdr.getAddr() + i_hdr.len) > SBE_GLOBAL->hostPassThroughCmdAddr.size)
+            {
+                // Break out, Invalid Size
+                SBE_ERROR("User size[0x%08X] exceeds the Host Pass Through Mode "
+                    "size[0x%08X] Start Index[0x%08X %08X]", 
+                    i_hdr.len, SBE_GLOBAL->hostPassThroughCmdAddr.size,
+                    SBE::higher32BWord(i_hdr.getAddr()),
+                    SBE::lower32BWord(i_hdr.getAddr()));
+                l_respHdr.setStatus( SBE_PRI_INVALID_DATA,
+                                     SBE_SEC_GENERIC_FAILURE_IN_EXECUTION );
+            }
         }
-    }
-
-    // Default EX Target Init..Not changing it for the time being
-    Target<TARGET_TYPE_EX> l_ex(
-            plat_getTargetHandleByChipletNumber<TARGET_TYPE_EX>(
-                sbeMemAccessInterface::PBA_DEFAULT_EX_CHIPLET_ID));
-
-    p9_PBA_oper_flag l_myPbaFlag;
-    // Determine the access flags
-    // Fast mode flag
-    if(i_hdr.isFastModeSet())
-    {
-        l_myPbaFlag.setFastMode(true);
-        SBE_INFO(SBE_FUNC "Fast Mode is set");
-    }
-
-    // inject mode flag
-    if(i_hdr.isPbaInjectModeSet())
-    {
-        l_myPbaFlag.setOperationType(p9_PBA_oper_flag::INJ); // Inject operation
-        SBE_INFO(SBE_FUNC "inject Mode is set");
-    }
-
-    // By default, ex_chipletId printed below won't be used unless accompanied
-    // by LCO_mode (LCO Mode for PBA-Put)
-    if(i_hdr.isPbaLcoModeSet())
-    {
-        SBE_INFO(SBE_INFO "LCO Mode is set with Ex ChipletId[%d]",
-            (i_hdr.coreChipletId)/2);
-        //Derive the EX target from the input Core Chiplet Id
-        //Core0/1 -> EX0, Core2/3 -> EX1, Core4/5 -> EX2, Core6/7 -> EX3
-        //..so on
-        l_ex = plat_getTargetHandleByChipletNumber<fapi2::TARGET_TYPE_EX>
-                (i_hdr.coreChipletId);
-        l_myPbaFlag.setOperationType(p9_PBA_oper_flag::LCO); // LCO operation
-    }
 
-    // Keeps track of number of granules sent to HWP
-    uint64_t l_granulesCompleted = 0;
+        // Default EX Target Init..Not changing it for the time being
+        Target<TARGET_TYPE_EX> l_ex(
+                plat_getTargetHandleByChipletNumber<TARGET_TYPE_EX>(
+                    sbeMemAccessInterface::PBA_DEFAULT_EX_CHIPLET_ID));
 
-    // Input Data length in alignment with PBA (128 Bytes)
-    uint64_t l_lenCacheAligned = i_hdr.getDataLenCacheAlign();
-    SBE_DEBUG(SBE_FUNC "Data Aligned Len / Number of data granules = %d",
-        l_lenCacheAligned);
-
-    sbeMemAccessInterface l_PBAInterface(SBE_MEM_ACCESS_PBA,
-                                         l_addr,
-                                         &l_myPbaFlag,
-                                         (i_isFlagRead ?
-                                          SBE_MEM_ACCESS_READ:
-                                          SBE_MEM_ACCESS_WRITE),
-                                         l_granuleSize,
-                                         l_ex);
-
-    while (l_granulesCompleted < l_lenCacheAligned)
-    {
-        // Breaking out here if invalid size
-        if(l_respHdr.primaryStatus != SBE_PRI_OPERATION_SUCCESSFUL)
+        p9_PBA_oper_flag l_myPbaFlag;
+        // Determine the access flags
+        // Fast mode flag
+        if(i_hdr.isFastModeSet())
         {
-            break;
+            l_myPbaFlag.setFastMode(true);
+            SBE_INFO(SBE_FUNC "Fast Mode is set");
         }
 
-        // If this is putmem request, read input data from the upstream FIFO
-        if (!i_isFlagRead)
+        // inject mode flag
+        if(i_hdr.isPbaInjectModeSet())
         {
-            // l_sizeMultiplier * 4B Upstream FIFO = Granule size 128B
-            uint32_t l_len2dequeue = sbeMemAccessInterface::PBA_GRAN_SIZE_BYTES
-                                                            / sizeof(uint32_t);
-            l_rc = sbeUpFifoDeq_mult (l_len2dequeue,
-                    (uint32_t *)l_PBAInterface.getBuffer(),
-                    false);
-            CHECK_SBE_RC_AND_BREAK_IF_NOT_SUCCESS(l_rc);
+            l_myPbaFlag.setOperationType(p9_PBA_oper_flag::INJ); // Inject operation
+            SBE_INFO(SBE_FUNC "inject Mode is set");
         }
 
-        // Call the PBA HWP
-        l_fapiRc = l_PBAInterface.accessGranule(
-                            l_granulesCompleted==(l_lenCacheAligned-1));
-        // if error
-        if(l_fapiRc != FAPI2_RC_SUCCESS)
+        // By default, ex_chipletId printed below won't be used unless accompanied
+        // by LCO_mode (LCO Mode for PBA-Put)
+        if(i_hdr.isPbaLcoModeSet())
         {
-            // Respond with HWP FFDC
-            l_respHdr.setStatus( SBE_PRI_GENERIC_EXECUTION_FAILURE,
-                                 SBE_SEC_GENERIC_FAILURE_IN_EXECUTION );
-            l_ffdc.setRc(l_fapiRc);
-            break;
+            SBE_INFO(SBE_INFO "LCO Mode is set with Ex ChipletId[%d]",
+                (i_hdr.coreChipletId)/2);
+            //Derive the EX target from the input Core Chiplet Id
+            //Core0/1 -> EX0, Core2/3 -> EX1, Core4/5 -> EX2, Core6/7 -> EX3
+            //..so on
+            l_ex = plat_getTargetHandleByChipletNumber<fapi2::TARGET_TYPE_EX>
+                    (i_hdr.coreChipletId);
+            l_myPbaFlag.setOperationType(p9_PBA_oper_flag::LCO); // LCO operation
         }
 
-        // If this is a getmem request,
-        // need to push the data into the downstream FIFO
-        if (i_isFlagRead)
+        l_lenCacheAligned = i_hdr.getDataLenCacheAlign();
+        SBE_DEBUG(SBE_FUNC "Data Aligned Len / Number of data granules = %d",
+            l_lenCacheAligned);
+
+        sbeMemAccessInterface l_PBAInterface(SBE_MEM_ACCESS_PBA,
+                                             l_addr,
+                                             &l_myPbaFlag,
+                                             (i_isFlagRead ?
+                                              SBE_MEM_ACCESS_READ:
+                                              SBE_MEM_ACCESS_WRITE),
+                                             l_granuleSize,
+                                             l_ex);
+
+        while (l_granulesCompleted < l_lenCacheAligned)
         {
-            // Number of 4Bytes to put, to align with Granule Size
-            // l_len*4 = Granule Size
-            uint32_t l_len = sbeMemAccessInterface::PBA_GRAN_SIZE_BYTES
-                                                            / sizeof(uint32_t);
-            l_rc = sbeDownFifoEnq_mult (l_len,
-                                (uint32_t *)l_PBAInterface.getBuffer());
-            CHECK_SBE_RC_AND_BREAK_IF_NOT_SUCCESS(l_rc);
-        }
+            // Breaking out here if invalid size
+            if(l_respHdr.primaryStatus != SBE_PRI_OPERATION_SUCCESSFUL)
+            {
+                break;
+            }
+
+            // If this is putmem request, read input data from the upstream FIFO
+            if (!i_isFlagRead)
+            {
+                // l_sizeMultiplier * 4B Upstream FIFO = Granule size 128B
+                uint32_t l_len2dequeue = sbeMemAccessInterface::PBA_GRAN_SIZE_BYTES
+                                                                / sizeof(uint32_t);
+                l_rc = sbeUpFifoDeq_mult (l_len2dequeue,
+                        (uint32_t *)l_PBAInterface.getBuffer(),
+                        false);
+                CHECK_SBE_RC_AND_BREAK_IF_NOT_SUCCESS(l_rc);
+            }
+
+            // Call the PBA HWP
+            l_fapiRc = l_PBAInterface.accessGranule(
+                                l_granulesCompleted==(l_lenCacheAligned-1));
+            // if error
+            if(l_fapiRc != FAPI2_RC_SUCCESS)
+            {
+                // Respond with HWP FFDC
+                l_respHdr.setStatus( SBE_PRI_GENERIC_EXECUTION_FAILURE,
+                                     SBE_SEC_GENERIC_FAILURE_IN_EXECUTION );
+                l_ffdc.setRc(l_fapiRc);
+                break;
+            }
+
+            // If this is a getmem request,
+            // need to push the data into the downstream FIFO
+            if (i_isFlagRead)
+            {
+                // Number of 4Bytes to put, to align with Granule Size
+                // l_len*4 = Granule Size
+                uint32_t l_len = sbeMemAccessInterface::PBA_GRAN_SIZE_BYTES
+                                                                / sizeof(uint32_t);
+                l_rc = sbeDownFifoEnq_mult (l_len,
+                                    (uint32_t *)l_PBAInterface.getBuffer());
+                CHECK_SBE_RC_AND_BREAK_IF_NOT_SUCCESS(l_rc);
+            }
 
-        l_granulesCompleted++;
-    } // End..while (l_granulesCompleted < l_lenCacheAligned);
+            l_granulesCompleted++;
+        } // End..while (l_granulesCompleted < l_lenCacheAligned);
+    } while(0);
 
     // Now build and enqueue response into downstream FIFO
     do
@@ -316,7 +332,7 @@ uint32_t processPbaRequest(const sbeMemAccessReqMsgHdr_t &i_hdr,
         // need to Flush out upstream FIFO, until EOT arrives
         if (!i_isFlagRead)
         {
-            l_rc = flushUpstreamFifo(l_fapiRc);
+            l_rc = flushUpstreamFifo(l_respHdr.primaryStatus);
             CHECK_SBE_RC_AND_BREAK_IF_NOT_SUCCESS(l_rc);
         }
 
@@ -452,6 +468,17 @@ uint32_t processAduRequest(const sbeMemAccessReqMsgHdr_t &i_hdr,
                                               SBE_MEM_ACCESS_READ :
                                               SBE_MEM_ACCESS_WRITE),
                                     sbeMemAccessInterface::ADU_GRAN_SIZE_BYTES);
+        // Check if the access to the address is allowed
+        l_respHdr.secondaryStatus = SBESecMemRegionManager->isAccessAllowed(
+                                           {l_addr,
+                                            i_hdr.len,
+             (i_isFlagRead ? static_cast<uint8_t>(memRegionMode::READ):
+                             static_cast<uint8_t>(memRegionMode::WRITE))});
+        if(l_respHdr.secondaryStatus != SBE_SEC_OPERATION_SUCCESSFUL)
+        {
+            l_respHdr.primaryStatus = SBE_PRI_UNSECURE_ACCESS_DENIED;
+            break;
+        }
         // 8Byte granule for ADU access
         uint64_t l_dataFifo[MAX_ADU_BUFFER] = {0};
         while (l_granulesCompleted < l_lenCacheAligned)
@@ -610,7 +637,7 @@ uint32_t processAduRequest(const sbeMemAccessReqMsgHdr_t &i_hdr,
         // need to Flush out upstream FIFO, until EOT arrives
         if (!i_isFlagRead)
         {
-            l_rc = flushUpstreamFifo(l_fapiRc);
+            l_rc = flushUpstreamFifo(l_respHdr.primaryStatus);
             CHECK_SBE_RC_AND_BREAK_IF_NOT_SUCCESS(l_rc);
         }
 
@@ -703,12 +730,14 @@ uint32_t sbeGetMem (uint8_t *i_pArg)
 {
     return sbeMemAccess_Wrap (true);
 }
+#endif //not __SBEFW_SEEPROM__
+#ifdef __SBEFW_SEEPROM__
 
 uint32_t sbeUpdateMemAccessRegion (uint8_t *i_pArg)
 {
     #define SBE_FUNC "sbeManageMemAccessRegion"
     SBE_ENTER(SBE_FUNC);
-    uint32_t rc = SBE_SEC_OPERATION_SUCCESSFUL;
+    uint32_t rc = SBE_SEC_GENERIC_FAILURE_IN_EXECUTION;
     uint32_t fapiRc = FAPI2_RC_SUCCESS;
     sbeMemRegionReq_t req = {};
 
@@ -730,6 +759,35 @@ uint32_t sbeUpdateMemAccessRegion (uint8_t *i_pArg)
                   SBE::lower32BWord(req.startAddress),
                   req.size,
                   SBE_GLOBAL->sbePsu2SbeCmdReqHdr.flags);
+
+        uint16_t mode = SBE_GLOBAL->sbePsu2SbeCmdReqHdr.flags & 0x00FF;
+        if(mode == SBE_MEM_REGION_CLOSE)
+        {
+            SBE_GLOBAL->sbeSbe2PsuRespHdr.secStatus =
+            SBESecMemRegionManager->remove(req.startAddress);
+        }
+        else
+        {
+            uint8_t memMode = 0;
+            if(mode == SBE_MEM_REGION_OPEN_RO)
+            {
+                memMode = static_cast<uint8_t>(memRegionMode::READ);
+            }
+            else if(mode == SBE_MEM_REGION_OPEN_RW)
+            {
+                memMode = static_cast<uint8_t>(memRegionMode::READ) |
+                          static_cast<uint8_t>(memRegionMode::WRITE);
+            }
+            SBE_GLOBAL->sbeSbe2PsuRespHdr.secStatus =
+            SBESecMemRegionManager->add(req.startAddress,
+                                        req.size,
+                                        memMode);
+        }
+        if(SBE_GLOBAL->sbeSbe2PsuRespHdr.secStatus !=
+                                    SBE_SEC_OPERATION_SUCCESSFUL)
+        {
+            SBE_GLOBAL->sbeSbe2PsuRespHdr.primStatus = SBE_PRI_USER_ERROR;
+        }
     } while(false);
 
     // Send the response
@@ -739,3 +797,4 @@ uint32_t sbeUpdateMemAccessRegion (uint8_t *i_pArg)
     return rc;
     #undef SBE_FUNC
 }
+#endif //__SBEFW_SEEPROM__
diff --git a/src/sbefw/sbefwfiles.mk b/src/sbefw/sbefwfiles.mk
index 6d8978ae..439c4bb6 100644
--- a/src/sbefw/sbefwfiles.mk
+++ b/src/sbefw/sbefwfiles.mk
@@ -53,6 +53,7 @@ SBEFW-CPP-SOURCES += sbeHostMsg.C
 SBEFW-CPP-SOURCES += sbeSpMsg.C
 SBEFW-CPP-SOURCES += sbeglobals.C
 SBEFW-CPP-SOURCES += sbeMemAccessInterface.C
+SBEFW-CPP-SOURCES += sbeSecureMemRegionManager.C
 
 SBEFW-C-SOURCES =
 SBEFW-S-SOURCES =
diff --git a/src/sbefw/sbefwseepromfiles.mk b/src/sbefw/sbefwseepromfiles.mk
index 24a1a1d6..24f92393 100644
--- a/src/sbefw/sbefwseepromfiles.mk
+++ b/src/sbefw/sbefwseepromfiles.mk
@@ -24,6 +24,8 @@
 # IBM_PROLOG_END_TAG
 SBEFWSEEPROM-CPP-SOURCES = sbecmdgeneric.C
 SBEFWSEEPROM-CPP-SOURCES += sbecmdmpipl.C
+SBEFWSEEPROM-CPP-SOURCES += sbecmdmemaccess.C
+SBEFWSEEPROM-CPP-SOURCES += sbeSecureMemRegionManager.C
 
 SBEFWSEEPROM-C-SOURCES =
 SBEFWSEEPROM-S-SOURCES =
diff --git a/src/test/testcases/test.xml b/src/test/testcases/test.xml
index 677cf9b2..0b3f432a 100755
--- a/src/test/testcases/test.xml
+++ b/src/test/testcases/test.xml
@@ -32,16 +32,14 @@
           </testcase>
           <include>../simics/targets/p9_nimbus/sbeTest/testPSUSetStashPair.xml</include>
           <include>../simics/targets/p9_nimbus/sbeTest/testIstep.xml</include>
-          <include>../simics/targets/p9_nimbus/sbeTest/testMatchStashPair.xml</include>
           <include>../simics/targets/p9_nimbus/sbeTest/testSuspendIO.xml</include>
           <include>../simics/targets/p9_nimbus/sbeTest/testScom.xml</include>
           <include>../simics/targets/p9_nimbus/sbeTest/testGeneric.xml</include>
           <!-- Memory access testcases -->
-          <include>../simics/targets/p9_nimbus/sbeTest/testUnsecureMemRegionsOpen.xml</include>
+          <include>../simics/targets/p9_nimbus/sbeTest/testUnsecureMemRegions.xml</include>
           <include>../simics/targets/p9_nimbus/sbeTest/testPutGetMem.xml</include>
           <include>../simics/targets/p9_nimbus/sbeTest/testAduMem.xml</include>
           <include>../simics/targets/p9_nimbus/sbeTest/testPSUSetFFDCAddr.xml</include>
-          <include>../simics/targets/p9_nimbus/sbeTest/testUnsecureMemRegionsClose.xml</include>
           <include>../simics/targets/p9_nimbus/sbeTest/testSram.xml</include>
           <!-- TODO add testCntlInstruction.xml -->
           <include>../simics/targets/p9_nimbus/sbeTest/testRegAccess.xml</include>
diff --git a/src/test/testcases/testIstep.xml b/src/test/testcases/testIstep.xml
index 86fa6a35..00362545 100644
--- a/src/test/testcases/testIstep.xml
+++ b/src/test/testcases/testIstep.xml
@@ -5,7 +5,7 @@
 <!--                                                                        -->
 <!-- OpenPOWER sbe Project                                                  -->
 <!--                                                                        -->
-<!-- Contributors Listed Below - COPYRIGHT 2015,2016                        -->
+<!-- Contributors Listed Below - COPYRIGHT 2015,2017                        -->
 <!-- [+] International Business Machines Corp.                              -->
 <!--                                                                        -->
 <!--                                                                        -->
@@ -321,6 +321,11 @@
           <simcmd>sbe-istep 5 2</simcmd>
           <exitonerror>yes</exitonerror>
       </testcase>
+      <!-- Stash address test case -->
+      <testcase>
+          <simcmd>run-python-file targets/p9_nimbus/sbeTest/testMatchStashPair.py</simcmd>
+          <exitonerror>yes</exitonerror>
+      </testcase>
       <!-- Invalid Istep Test case -->
       <testcase>
           <simcmd>run-python-file targets/p9_nimbus/sbeTest/testIstepInvalid.py</simcmd>
diff --git a/src/test/testcases/testMatchStashPair.xml b/src/test/testcases/testMatchStashPair.xml
deleted file mode 100755
index 56e1d0a1..00000000
--- a/src/test/testcases/testMatchStashPair.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<!-- IBM_PROLOG_BEGIN_TAG                                                   -->
-<!-- This is an automatically generated prolog.                             -->
-<!--                                                                        -->
-<!-- $Source: src/test/testcases/testMatchStashPair.xml $                   -->
-<!--                                                                        -->
-<!-- OpenPOWER sbe Project                                                  -->
-<!--                                                                        -->
-<!-- Contributors Listed Below - COPYRIGHT 2017                             -->
-<!--                                                                        -->
-<!--                                                                        -->
-<!-- Licensed under the Apache License, Version 2.0 (the "License");        -->
-<!-- you may not use this file except in compliance with the License.       -->
-<!-- You may obtain a copy of the License at                                -->
-<!--                                                                        -->
-<!--     http://www.apache.org/licenses/LICENSE-2.0                         -->
-<!--                                                                        -->
-<!-- Unless required by applicable law or agreed to in writing, software    -->
-<!-- distributed under the License is distributed on an "AS IS" BASIS,      -->
-<!-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or        -->
-<!-- implied. See the License for the specific language governing           -->
-<!-- permissions and limitations under the License.                         -->
-<!--                                                                        -->
-<!-- IBM_PROLOG_END_TAG                                                     -->
-<?xml version="1.0" encoding="UTF-8"?>
-
-      <testcase>
-          <simcmd>run-python-file targets/p9_nimbus/sbeTest/testMatchStashPair.py</simcmd>
-          <exitonerror>yes</exitonerror>
-      </testcase>
-
diff --git a/src/test/testcases/testMemUtil.py b/src/test/testcases/testMemUtil.py
index 1014f46c..fce1eae2 100644
--- a/src/test/testcases/testMemUtil.py
+++ b/src/test/testcases/testMemUtil.py
@@ -89,7 +89,35 @@ def putmem(addr, data, flags, ecc=0):
     testUtil.readDsFifo(expData)
     testUtil.readEot( )
 
+def putmem_failure(addr, data, flags, responseWord, ecc=0):
+    lenInBytes = len(data)
+    if(len(data) < 8):
+        data = data+[0]*(4-len(data))
+    totalLen = 5 + len(data)/4
+    coreChipletId = 0x00
+    if (flags & 0x0040):
+        # LCO mode is set, so chiplet id - 0x20
+        coreChipletId = 0x20
+    req = (getsingleword(totalLen)
+          +[ 0,0,0xA4,0x02]
+          +[coreChipletId, ecc]
+          +gethalfword(flags)
+          #0,0,0x0,0xA5] #CoreChipletId/EccByte/Flags -> NoEccOverride/CacheInhibit/FastMode/NoTag/NoEcc/AutoIncr/Adu/Proc
+          + getdoubleword(addr)
+          + getsingleword(lenInBytes)  # length of data
+          + data)
+    testUtil.writeUsFifo(req)
+    testUtil.writeEot( )
+    testUtil.runCycles( 10000000 )
+    expResp =  ([0x0, 0x0, 0x0, 0x0]
+    + [0xc0,0xde,0xa4,0x02]
+    + getsingleword(responseWord)
+    + [0x0,0x0,0x0,0x03])
+    testUtil.readDsFifo(expResp)
+    testUtil.readEot( )
+
 def getmem(addr, len, flags):
+    testUtil.runCycles( 10000000 )
     req = (getsingleword(6)
          + [0, 0, 0xA4, 0x01]
          + getsingleword(flags)
@@ -122,6 +150,7 @@ def getmem(addr, len, flags):
     return data[:lenExp]
 
 def getmem_failure(addr, len, flags, responseWord):
+    testUtil.runCycles( 10000000 )
     req = (getsingleword(6)
          + [0, 0, 0xA4, 0x01]
          + getsingleword(flags)
@@ -137,6 +166,7 @@ def getmem_failure(addr, len, flags, responseWord):
     testUtil.readEot( )
 
 def setUnsecureMemRegion(addr, size, controlFlag, responseWord):
+    testUtil.runCycles( 10000000 )
     req = (["write", reg.REG_MBOX0,"0"*(8-len(hex(controlFlag).split('0x')[-1]))+hex(controlFlag).split('0x')[-1] +"00F0D601", 8, "None", "Writing to MBOX0 address"],
            ["write", reg.REG_MBOX1, "0"*(16-len(hex(size).split('0x')[-1]))+hex(size).split('0x')[-1], 8, "None", "Writing to MBOX1 address"],
            ["write", reg.REG_MBOX2, "0"*(16-len(hex(addr).split('0x')[-1]))+hex(addr).split('0x')[-1], 8, "None", "Writing to MBOX1 address"],
diff --git a/src/test/testcases/testUnsecureMemRegions.py b/src/test/testcases/testUnsecureMemRegions.py
index 129b80c4..7087e32e 100644
--- a/src/test/testcases/testUnsecureMemRegions.py
+++ b/src/test/testcases/testUnsecureMemRegions.py
@@ -6,6 +6,7 @@
 # OpenPOWER sbe Project
 #
 # Contributors Listed Below - COPYRIGHT 2017
+# [+] International Business Machines Corp.
 #
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -34,5 +35,206 @@ err = False
 def main():
     testUtil.runCycles( 10000000 )
 
-    # Test case 1: open RO mem region - success
-    testMemProcUtil.setUnsecureMemRegion(0x08000000, 1024, 0x0000)
+    try:
+        # Close the HB dump region
+        testMemProcUtil.setUnsecureMemRegion(0x08000000, 32*1024*1024, 0x0120, 0)
+
+        # Test case 1: open RO mem region - success
+        testcase = 1
+        testMemProcUtil.setUnsecureMemRegion(0x07000000, 1024, 0x0111, 0)
+        # Test case 2: open RW mem region - success
+        # This region is kept open for mem testcases - will be closed by
+        # testUnsecureMemRegionsClose.py
+        testcase = 2
+        testMemProcUtil.setUnsecureMemRegion(0x08000000, 0x2000, 0x0112, 0)
+        # Test case 3: close RO mem region - success
+        testcase = 3
+        testMemProcUtil.setUnsecureMemRegion(0x07000000, 1024, 0x0120, 0)
+
+        # Test case 4: open 9th window - failure
+        testcase = 4
+        # 2
+        testMemProcUtil.setUnsecureMemRegion(0x07000000, 0x10, 0x0111, 0)
+        # 3
+        testMemProcUtil.setUnsecureMemRegion(0x07000010, 0x10, 0x0111, 0)
+        # 4
+        testMemProcUtil.setUnsecureMemRegion(0x07000020, 0x10, 0x0111, 0)
+        # 5
+        testMemProcUtil.setUnsecureMemRegion(0x07000030, 0x10, 0x0111, 0)
+        # 6
+        testMemProcUtil.setUnsecureMemRegion(0x07000040, 0x10, 0x0111, 0)
+        # 7
+        testMemProcUtil.setUnsecureMemRegion(0x07000050, 0x10, 0x0111, 0)
+        # 8
+        testMemProcUtil.setUnsecureMemRegion(0x07000060, 0x10, 0x0111, 0)
+        # 9 - failed - response expected -
+        # SBE_PRI_USER_ERROR = 0x03
+        # SBE_SEC_MAXIMUM_MEM_REGION_EXCEEDED = 0x16
+        testMemProcUtil.setUnsecureMemRegion(0x07000070, 0x10, 0x0111, 0x00030016)
+        # Test case 5: open existing window - failure
+        testcase = 5
+        # response expected
+        # SBE_PRI_USER_ERROR = 0x03
+        # SBE_SEC_MEM_REGION_AMEND_ATTEMPTED = 0x17
+        testMemProcUtil.setUnsecureMemRegion(0x07000060, 0x10, 0x0111, 0x00030017)
+        # Test case 6: close non-existing window - failure
+        testcase = 6
+        # response expected
+        # SBE_PRI_USER_ERROR = 0x03
+        # SBE_SEC_MEM_REGION_NOT_FOUND = 0x15
+        testMemProcUtil.setUnsecureMemRegion(0x07000070, 0x10, 0x0120, 0x00030015)
+        # Test case 7: remove a window in between - adding it again should pass
+        testcase = 7
+        testMemProcUtil.setUnsecureMemRegion(0x07000020, 0x10, 0x0120, 0)
+        testMemProcUtil.setUnsecureMemRegion(0x07000020, 0x10, 0x0111, 0)
+        # Test case 8: remove all and open again to validate removal
+        testcase = 8
+        # 1
+        testMemProcUtil.setUnsecureMemRegion(0x08000000, 0x2000, 0x0120, 0)
+        # Open Window with start address not exsting, but size spanning across
+        # existing window
+        # failed - response expected -
+        # SBE_PRI_USER_ERROR = 0x03
+        # SBE_SEC_MEM_REGION_AMEND_ATTEMPTED = 0x17
+        testMemProcUtil.setUnsecureMemRegion(0x06FFFFF0, 0x20, 0x0111, 0x00030017)
+        # 2
+        testMemProcUtil.setUnsecureMemRegion(0x07000000, 0x10, 0x0120, 0)
+        # 3
+        testMemProcUtil.setUnsecureMemRegion(0x07000010, 0x10, 0x0120, 0)
+        # 4
+        testMemProcUtil.setUnsecureMemRegion(0x07000020, 0x10, 0x0120, 0)
+        # 5
+        testMemProcUtil.setUnsecureMemRegion(0x07000030, 0x10, 0x0120, 0)
+        # 6
+        testMemProcUtil.setUnsecureMemRegion(0x07000040, 0x10, 0x0120, 0)
+        # 7
+        testMemProcUtil.setUnsecureMemRegion(0x07000050, 0x10, 0x0120, 0)
+        # 8
+        testMemProcUtil.setUnsecureMemRegion(0x07000060, 0x10, 0x0120, 0)
+        # 1
+        testMemProcUtil.setUnsecureMemRegion(0x08000000, 0x2000, 0x0112, 0)
+        # 2
+        testMemProcUtil.setUnsecureMemRegion(0x07000000, 0x10, 0x0111, 0)
+        testcase = "8: new window subsuming exsiting windows"
+        # failed - response expected -
+        # SBE_PRI_USER_ERROR = 0x03
+        # SBE_SEC_MEM_REGION_AMEND_ATTEMPTED = 0x17
+        testMemProcUtil.setUnsecureMemRegion(0x06FFFFF0, 0x30, 0x0111, 0x00030017)
+        testcase = "8"
+        # 3
+        testMemProcUtil.setUnsecureMemRegion(0x07000010, 0x10, 0x0111, 0)
+        # 4
+        testMemProcUtil.setUnsecureMemRegion(0x07000020, 0x10, 0x0111, 0)
+        # 5
+        testMemProcUtil.setUnsecureMemRegion(0x07000030, 0x10, 0x0111, 0)
+        # 6
+        testMemProcUtil.setUnsecureMemRegion(0x07000040, 0x10, 0x0111, 0)
+        # 7
+        testMemProcUtil.setUnsecureMemRegion(0x07000050, 0x10, 0x0111, 0)
+        # 8
+        testMemProcUtil.setUnsecureMemRegion(0x07000060, 0x10, 0x0111, 0)
+        # 9 - failed - response expected -
+        # SBE_PRI_USER_ERROR = 0x03
+        # SBE_SEC_MAXIMUM_MEM_REGION_EXCEEDED = 0x16
+        testMemProcUtil.setUnsecureMemRegion(0x07000070, 0x10, 0x0111, 0x00030016)
+
+        # Cleanup - close all the windows open except the one for mem testcases
+        # 2
+        testMemProcUtil.setUnsecureMemRegion(0x07000000, 0x10, 0x0120, 0)
+        # 3
+        testMemProcUtil.setUnsecureMemRegion(0x07000010, 0x10, 0x0120, 0)
+        # 4
+        testMemProcUtil.setUnsecureMemRegion(0x07000020, 0x10, 0x0120, 0)
+        # 5
+        testMemProcUtil.setUnsecureMemRegion(0x07000030, 0x10, 0x0120, 0)
+        # 6
+        testMemProcUtil.setUnsecureMemRegion(0x07000040, 0x10, 0x0120, 0)
+        # 7
+        testMemProcUtil.setUnsecureMemRegion(0x07000050, 0x10, 0x0120, 0)
+        # 8
+        testMemProcUtil.setUnsecureMemRegion(0x07000060, 0x10, 0x0120, 0)
+
+        # Test case 9: access memory in unopened window - ADU
+        testcase = 9
+        testMemProcUtil.getmem_failure(0x07000060, 0x40, 0xA5, 0x00050014)
+        # Test case 10: access memory in unopened window - PBA
+        testcase = 10
+        testMemProcUtil.getmem_failure(0x07000080, 0x80, 0x02, 0x00050014)
+
+        # Test case 11: access memory spanning across two windows
+        testcase = 11
+        testMemProcUtil.setUnsecureMemRegion(0x07000040, 0x40, 0x0111, 0)
+        testUtil.runCycles(100000)
+        testMemProcUtil.setUnsecureMemRegion(0x07000080, 0x40, 0x0111, 0)
+        testUtil.runCycles(100000)
+        testMemProcUtil.setUnsecureMemRegion(0x070000C0, 0x40, 0x0111, 0)
+        testUtil.runCycles(1000000)
+        # start and end on edges
+        testMemProcUtil.getmem(0x07000040, 0x80, 0xA5)
+        testUtil.runCycles(100000)
+        # start in between and end on edge
+        testMemProcUtil.getmem(0x07000060, 0x60, 0xA5)
+        testUtil.runCycles(100000)
+        # start on edge and end in between
+        testMemProcUtil.getmem(0x07000040, 0x60, 0xA5)
+        testUtil.runCycles(100000)
+        # start on edge and end in between - 3rd window
+        testMemProcUtil.getmem(0x07000040, 0xA0, 0xA5)
+        testUtil.runCycles(100000)
+
+        testMemProcUtil.setUnsecureMemRegion(0x07000040, 0x40, 0x0120, 0)
+        testUtil.runCycles(100000)
+        testMemProcUtil.setUnsecureMemRegion(0x07000080, 0x40, 0x0120, 0)
+        testUtil.runCycles(100000)
+        testMemProcUtil.setUnsecureMemRegion(0x070000C0, 0x40, 0x0120, 0)
+        testUtil.runCycles(100000)
+
+        # Test case 12: read access in read-write window - ADU
+        testcase = 12
+        testMemProcUtil.setUnsecureMemRegion(0x07000080, 128, 0x0112, 0)
+        testMemProcUtil.getmem(0x07000080, 128, 0xA5)
+        testMemProcUtil.setUnsecureMemRegion(0x07000080, 128, 0x0120, 0)
+        # Test case 13: read access in read-write window - PBA
+        testcase = 13
+        testMemProcUtil.getmem(0x08000080, 128, 0x02)
+
+        # Test case 14: write access in read-only window - ADU
+        testcase = 14
+        testMemProcUtil.setUnsecureMemRegion(0x07000080, 128, 0x0111, 0)
+        data = os.urandom(8)
+        data = [ord(c) for c in data]
+        testMemProcUtil.putmem_failure(0x07000080, data, 0xA5, 0x00050014)
+        # Test case 15: write access in read-only window - PBA
+        testcase = 15
+        data = os.urandom(128)
+        data = [ord(c) for c in data]
+        testMemProcUtil.putmem_failure(0x07000080, data, 0x02, 0x00050014)
+        testMemProcUtil.setUnsecureMemRegion(0x07000080, 128, 0x0120, 0)
+        # Test case 16: access memory for which a partial window is open
+        testcase = 16
+        testUtil.runCycles(1000000)
+        testMemProcUtil.setUnsecureMemRegion(0x07000040, 0x30, 0x0111, 0)
+        # start in between and end outside
+        testUtil.runCycles(1000000)
+        testMemProcUtil.getmem_failure(0x07000060, 0x40, 0xA5, 0x00050014)
+        # start on edge and end outside
+        testUtil.runCycles(1000000)
+        testMemProcUtil.getmem_failure(0x07000040, 0x40, 0xA5, 0x00050014)
+        # start and end within
+        testUtil.runCycles(1000000)
+        testMemProcUtil.getmem(0x07000050, 0x10, 0xA5)
+        testMemProcUtil.setUnsecureMemRegion(0x07000040, 0x30, 0x0120, 0)
+    except:
+        print "FAILED Test Case:"+str(testcase)
+        raise Exception('Failure')
+#-------------------------------------------------
+# Calling all test code
+#-------------------------------------------------
+main()
+
+if err:
+    print ("\nTest Suite completed with error(s)")
+    #sys.exit(1)
+else:
+    print ("\nTest Suite completed with no errors")
+    #sys.exit(0);
diff --git a/src/test/testcases/testUnsecureMemRegionsOpen.xml b/src/test/testcases/testUnsecureMemRegions.xml
index 010f4779..588cf358 100644
--- a/src/test/testcases/testUnsecureMemRegionsOpen.xml
+++ b/src/test/testcases/testUnsecureMemRegions.xml
@@ -1,7 +1,7 @@
 <!-- IBM_PROLOG_BEGIN_TAG                                                   -->
 <!-- This is an automatically generated prolog.                             -->
 <!--                                                                        -->
-<!-- $Source: src/test/testcases/testUnsecureMemRegionsOpen.xml $           -->
+<!-- $Source: src/test/testcases/testUnsecureMemRegions.xml $               -->
 <!--                                                                        -->
 <!-- OpenPOWER sbe Project                                                  -->
 <!--                                                                        -->
@@ -24,7 +24,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
       <testcase>
-          <simcmd>run-python-file targets/p9_nimbus/sbeTest/testUnsecureMemRegionsOpen.py</simcmd>
+          <simcmd>run-python-file targets/p9_nimbus/sbeTest/testUnsecureMemRegions.py</simcmd>
           <exitonerror>yes</exitonerror>
       </testcase>
 
diff --git a/src/test/testcases/testUnsecureMemRegionsClose.py b/src/test/testcases/testUnsecureMemRegionsClose.py
deleted file mode 100644
index 3d7b04b4..00000000
--- a/src/test/testcases/testUnsecureMemRegionsClose.py
+++ /dev/null
@@ -1,53 +0,0 @@
-# IBM_PROLOG_BEGIN_TAG
-# This is an automatically generated prolog.
-#
-# $Source: src/test/testcases/testUnsecureMemRegionsClose.py $
-#
-# OpenPOWER sbe Project
-#
-# Contributors Listed Below - COPYRIGHT 2017
-#
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied. See the License for the specific language governing
-# permissions and limitations under the License.
-#
-# IBM_PROLOG_END_TAG
-import sys
-import os
-import struct
-sys.path.append("targets/p9_nimbus/sbeTest" )
-import testUtil
-import testMemUtil as testMemProcUtil
-err = False
-
-# MAIN Test Run Starts Here...
-#-------------------------------------------------
-def main():
-    testUtil.runCycles( 10000000 )
-
-    # Test case 1: close RW mem region - success
-    # This region is kept closed after mem testcases - it is opened by
-    # testUnsecureMemRegionsOpen.py
-    testMemProcUtil.setUnsecureMemRegion(0x08000000, 1024, 0x0120, 0)
-    print ("Success - setUnsecureMemRegion - close RW")
-
-#-------------------------------------------------
-# Calling all test code
-#-------------------------------------------------
-main()
-
-if err:
-    print ("\nTest Suite completed with error(s)")
-    #sys.exit(1)
-else:
-    print ("\nTest Suite completed with no errors")
-    #sys.exit(0);
diff --git a/src/test/testcases/testUnsecureMemRegionsClose.xml b/src/test/testcases/testUnsecureMemRegionsClose.xml
deleted file mode 100644
index 925b108e..00000000
--- a/src/test/testcases/testUnsecureMemRegionsClose.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<!-- IBM_PROLOG_BEGIN_TAG                                                   -->
-<!-- This is an automatically generated prolog.                             -->
-<!--                                                                        -->
-<!-- $Source: src/test/testcases/testUnsecureMemRegionsClose.xml $          -->
-<!--                                                                        -->
-<!-- OpenPOWER sbe Project                                                  -->
-<!--                                                                        -->
-<!-- Contributors Listed Below - COPYRIGHT 2016,2017                        -->
-<!--                                                                        -->
-<!--                                                                        -->
-<!-- Licensed under the Apache License, Version 2.0 (the "License");        -->
-<!-- you may not use this file except in compliance with the License.       -->
-<!-- You may obtain a copy of the License at                                -->
-<!--                                                                        -->
-<!--     http://www.apache.org/licenses/LICENSE-2.0                         -->
-<!--                                                                        -->
-<!-- Unless required by applicable law or agreed to in writing, software    -->
-<!-- distributed under the License is distributed on an "AS IS" BASIS,      -->
-<!-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or        -->
-<!-- implied. See the License for the specific language governing           -->
-<!-- permissions and limitations under the License.                         -->
-<!--                                                                        -->
-<!-- IBM_PROLOG_END_TAG                                                     -->
-<?xml version="1.0" encoding="UTF-8"?>
-
-      <testcase>
-          <simcmd>run-python-file targets/p9_nimbus/sbeTest/testUnsecureMemRegionsClose.py</simcmd>
-          <exitonerror>yes</exitonerror>
-      </testcase>
-
diff --git a/src/test/testcases/testUnsecureMemRegionsOpen.py b/src/test/testcases/testUnsecureMemRegionsOpen.py
deleted file mode 100644
index 2f5dddde..00000000
--- a/src/test/testcases/testUnsecureMemRegionsOpen.py
+++ /dev/null
@@ -1,59 +0,0 @@
-# IBM_PROLOG_BEGIN_TAG
-# This is an automatically generated prolog.
-#
-# $Source: src/test/testcases/testUnsecureMemRegionsOpen.py $
-#
-# OpenPOWER sbe Project
-#
-# Contributors Listed Below - COPYRIGHT 2017
-#
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied. See the License for the specific language governing
-# permissions and limitations under the License.
-#
-# IBM_PROLOG_END_TAG
-import sys
-import os
-import struct
-sys.path.append("targets/p9_nimbus/sbeTest" )
-import testUtil
-import testMemUtil as testMemProcUtil
-err = False
-
-# MAIN Test Run Starts Here...
-#-------------------------------------------------
-def main():
-    testUtil.runCycles( 10000000 )
-
-    # Test case 1: open RO mem region - success
-    testMemProcUtil.setUnsecureMemRegion(0x07000000, 1024, 0x0111, 0)
-    print ("Success - setUnsecureMemRegion - open RO")
-    # Test case 2: close RW mem region - success
-    # This region is kept open for mem testcases - will be closed by
-    # testUnsecureMemRegionsClose.py
-    testMemProcUtil.setUnsecureMemRegion(0x08000000, 1024, 0x0112, 0)
-    print ("Success - setUnsecureMemRegion - open RW")
-    # Test case 3: close RO mem region - success
-    testMemProcUtil.setUnsecureMemRegion(0x07000000, 1024, 0x0120, 0)
-    print ("Success - setUnsecureMemRegion - close RO")
-
-#-------------------------------------------------
-# Calling all test code
-#-------------------------------------------------
-main()
-
-if err:
-    print ("\nTest Suite completed with error(s)")
-    #sys.exit(1)
-else:
-    print ("\nTest Suite completed with no errors")
-    #sys.exit(0);