Replace reset BMC authentication with factory reset

Due to security concerns, replace the command that performs a
reset of the BMC authentication mechanism to perform a full
BMC reset so that any potential sensitive data is erased when
the authentication mechanism needs to be reset.

Tested: Verified the host was powered off and the BMC was
factory reset as part of this command.

Change-Id: I71dead237538d410e88710d2b7a53cea30de1426
Signed-off-by: Adriana Kobylak <anoo@us.ibm.com>
6 files changed
tree: 3c7e21eb8075ab1d810872d8adfa35d3a7de777e
  1. org/
  2. scripts/
  3. .clang-format
  4. .gitignore
  5. bootstrap.sh
  6. configure.ac
  7. elog-errors.hpp
  8. host-interface.cpp
  9. host-interface.hpp
  10. LICENSE
  11. MAINTAINERS
  12. Makefile.am
  13. oemhandler.cpp
  14. oemhandler.hpp
  15. README.md
README.md

This .so file is designed to support the OpenPOWER's BIOS OEM commands. Documentation can be found by contacting the OpenPOWER mailing list @ https://github.com/open-power/op-build

To Build

To build this package, do the following steps:

    1. ./bootstrap.sh
    2. ./configure ${CONFIGURE_FLAGS}
    3. make

To clean the repository run `./bootstrap.sh clean`.

Supported Commands

  • Partial Add
  • Prepare for host update
  • BMC Factory Reset

Command Documentation

BMC Factory Reset

Netfun: 0x3a Command: 0x11

This command will call to reset the BMC to its factory default. See here for the factory reset implementation details.

This includes:

  1. Power the chassis off. The host needs to be powered off because the factory reset deletes the inventory items, which are needed for the BMC during the power on path, causing the power on to fail. The inventory items are repopulated during a host power on. An enhancement to OpenBMC would be to handle missing inventory items during a BMC reboot when the host is on.
  2. Set the BMC to perform factory reset on reboot.
  3. Reboot the BMC for the factory reset to take effect.

Because the chassis is powered off, the host does not receive a return code when successful.

This command is not allowed when the IPMI restriction mode is set to 'Whitelist'. See here for more information.