<commit_before>/* IBM_PROLOG_BEGIN_TAG                                                   */
/* This is an automatically generated prolog.                             */
/*                                                                        */
/* $Source: src/usr/isteps/istep10/call_host_secureboot_lockdown.C $      */
/*                                                                        */
/* OpenPOWER HostBoot Project                                             */
/*                                                                        */
/* Contributors Listed Below - COPYRIGHT 2020,2021                        */
/* [+] International Business Machines Corp.                              */
/*                                                                        */
/*                                                                        */
/* Licensed under the Apache License, Version 2.0 (the "License");        */
/* you may not use this file except in compliance with the License.       */
/* You may obtain a copy of the License at                                */
/*                                                                        */
/*     http://www.apache.org/licenses/LICENSE-2.0                         */
/*                                                                        */
/* Unless required by applicable law or agreed to in writing, software    */
/* distributed under the License is distributed on an "AS IS" BASIS,      */
/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or        */
/* implied. See the License for the specific language governing           */
/* permissions and limitations under the License.                         */
/*                                                                        */
/* IBM_PROLOG_END_TAG                                                     */
/**
   @file call_host_secureboot_lockdown.C
 *
 *  Support file for IStep: host_secureboot_lockdown
 *    This istep will do these things:
 *      1) Check for TPM policies are valid
 *      2) Check for secureboot consistency between procs
 *      3) Set the SUL security bit so that SBE image cannot be updated
 *      4) Ensure that the SAB security bit is read only
 *      5) If a TPM is non functional, set the TDP (TPM Deconfig Protection)
 *         to prevent attack vector
 *      6) Check for a reason, such as a Key Clear Request, to re-IPL the
 *         system so the system owner can assert physical presence
 *
 */

// For istep and error logging support
#include <isteps/hwpisteperror.H>
#include <isteps/istep_reasoncodes.H>
#include <initservice/initserviceif.H>
#include <istepHelperFuncs.H>
#include <errl/errlentry.H>
#include <errl/errlmanager.H>

// For Secureboot, Trustedboot support
#include <secureboot/service.H>
#include <secureboot/phys_presence_if.H>
#include <secureboot/service_ext.H>
#include <secureboot/trustedbootif.H>

// Secureboot lockdown HWP
#include <plat_hwp_invoker.H>
#include <p10_update_security_ctrl.H>

namespace ISTEP_10
{

void* call_host_secureboot_lockdown (void *io_pArgs)
{
    TRACFCOMP(ISTEPS_TRACE::g_trac_isteps_trace,
                ENTER_MRK"call_host_secureboot_lockdown");

    ISTEP_ERROR::IStepError l_istepError;
#ifndef CONFIG_VPO_COMPILE
    errlHndl_t l_err = nullptr;

    do {

    // Attempt to initialize the backup TPM.
    TRUSTEDBOOT::initBackupTpm();

    // Always poison the backup TPM because we want to ensure
    // it varies from the primary.
    l_err = TRUSTEDBOOT::poisonBackupTpm();

    if(l_err)
    {
        TRACFCOMP(ISTEPS_TRACE::g_trac_isteps_trace,
                  "call_host_secureboot_lockdown: poisonBackupTpm returned an error"
                  TRACE_ERR_FMT,
                  TRACE_ERR_ARGS(l_err));
        l_istepError.addErrorDetails(l_err);
        TARGETING::Target * backup_tpm = nullptr;
        TRUSTEDBOOT::getBackupTpm(backup_tpm);
        assert(backup_tpm != nullptr, "call_host_secureboot_lockdown: poisonBackupTpm returned an error when no backup tpm available");
        // tpmMarkFailed will ensure there is at minimum a deconfig callout for the backup
        // TPM and also set the deconfig bit to force fencing if security is enabled
        TRUSTEDBOOT::tpmMarkFailed(backup_tpm, l_err);
    }

#ifdef CONFIG_SECUREBOOT

    if(SECUREBOOT::enabled())
    {
        TARGETING::TargetHandleList l_procList;
        TARGETING::TargetHandleList l_tpmList;

        getAllChips(l_procList,TARGETING::TYPE_PROC);
        getAllChips(l_tpmList,TARGETING::TYPE_TPM,false);

        for(const auto& l_proc : l_procList)<commit_msg>Secure Boot: Disable backup TPM init<commit_after>/* IBM_PROLOG_BEGIN_TAG                                                   */
/* This is an automatically generated prolog.                             */
/*                                                                        */
/* $Source: src/usr/isteps/istep10/call_host_secureboot_lockdown.C $      */
/*                                                                        */
/* OpenPOWER HostBoot Project                                             */
/*                                                                        */
/* Contributors Listed Below - COPYRIGHT 2020,2021                        */
/* [+] International Business Machines Corp.                              */
/*                                                                        */
/*                                                                        */
/* Licensed under the Apache License, Version 2.0 (the "License");        */
/* you may not use this file except in compliance with the License.       */
/* You may obtain a copy of the License at                                */
/*                                                                        */
/*     http://www.apache.org/licenses/LICENSE-2.0                         */
/*                                                                        */
/* Unless required by applicable law or agreed to in writing, software    */
/* distributed under the License is distributed on an "AS IS" BASIS,      */
/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or        */
/* implied. See the License for the specific language governing           */
/* permissions and limitations under the License.                         */
/*                                                                        */
/* IBM_PROLOG_END_TAG                                                     */
/**
   @file call_host_secureboot_lockdown.C
 *
 *  Support file for IStep: host_secureboot_lockdown
 *    This istep will do these things:
 *      1) Check for TPM policies are valid
 *      2) Check for secureboot consistency between procs
 *      3) Set the SUL security bit so that SBE image cannot be updated
 *      4) Ensure that the SAB security bit is read only
 *      5) If a TPM is non functional, set the TDP (TPM Deconfig Protection)
 *         to prevent attack vector
 *      6) Check for a reason, such as a Key Clear Request, to re-IPL the
 *         system so the system owner can assert physical presence
 *
 */

// For istep and error logging support
#include <isteps/hwpisteperror.H>
#include <isteps/istep_reasoncodes.H>
#include <initservice/initserviceif.H>
#include <istepHelperFuncs.H>
#include <errl/errlentry.H>
#include <errl/errlmanager.H>

// For Secureboot, Trustedboot support
#include <secureboot/service.H>
#include <secureboot/phys_presence_if.H>
#include <secureboot/service_ext.H>
#include <secureboot/trustedbootif.H>

// Secureboot lockdown HWP
#include <plat_hwp_invoker.H>
#include <p10_update_security_ctrl.H>

namespace ISTEP_10
{

void* call_host_secureboot_lockdown (void *io_pArgs)
{
    TRACFCOMP(ISTEPS_TRACE::g_trac_isteps_trace,
                ENTER_MRK"call_host_secureboot_lockdown");

    ISTEP_ERROR::IStepError l_istepError;
#ifndef CONFIG_VPO_COMPILE
    errlHndl_t l_err = nullptr;

    do {

    // @TODO RTC 269646: Re-enable backup TPM when there is higher confidence
    // it will work
    #if 0
    // Attempt to initialize the backup TPM.
    TRUSTEDBOOT::initBackupTpm();

    // Always poison the backup TPM because we want to ensure
    // it varies from the primary.
    l_err = TRUSTEDBOOT::poisonBackupTpm();

    if(l_err)
    {
        TRACFCOMP(ISTEPS_TRACE::g_trac_isteps_trace,
                  "call_host_secureboot_lockdown: poisonBackupTpm returned an error"
                  TRACE_ERR_FMT,
                  TRACE_ERR_ARGS(l_err));
        l_istepError.addErrorDetails(l_err);
        TARGETING::Target * backup_tpm = nullptr;
        TRUSTEDBOOT::getBackupTpm(backup_tpm);
        assert(backup_tpm != nullptr, "call_host_secureboot_lockdown: poisonBackupTpm returned an error when no backup tpm available");
        // tpmMarkFailed will ensure there is at minimum a deconfig callout for the backup
        // TPM and also set the deconfig bit to force fencing if security is enabled
        TRUSTEDBOOT::tpmMarkFailed(backup_tpm, l_err);
    }
    #endif

#ifdef CONFIG_SECUREBOOT

    if(SECUREBOOT::enabled())
    {
        TARGETING::TargetHandleList l_procList;
        TARGETING::TargetHandleList l_tpmList;

        getAllChips(l_procList,TARGETING::TYPE_PROC);
        getAllChips(l_tpmList,TARGETING::TYPE_TPM,false);

        for(const auto& l_proc : l_procList)
{'fraction_non_alphanumeric': 0.0768409818569904, 'fraction_numerical': 0.005869797225186766, 'mean_word_length': 1.6264013452914798, 'pattern_counts': {'":': 0, '<': 27, '<?xml version=': 0, '>': 27, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 62, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4551265', 'n_tokens_mistral': 2465, 'n_tokens_neox': 2406, 'n_words': 695}