From da8911ce095aa7d18231c9d344dc978dae7cf984 Mon Sep 17 00:00:00 2001 From: Ilya Smirnov Date: Mon, 19 Mar 2018 17:12:32 -0500 Subject: Secure Boot: Support Phyp debug flag in HDAT PHYP needs a way to know if SBE security backdoor is enabled for debug purposes. This change creates a flag in TPM instance data structure to indicate whether the backdoor is enabled. This flag is passed by SBE to the hb bootloader; also added the flag to indicate whether PCR is poisoned (default of 0). The population of this flag will be implemented on Fleetwood. Change-Id: I22305dbc9651134ba7dfe3b0bd3c760fe53c2c85 RTC: 188961 Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/56045 Tested-by: Jenkins Server Tested-by: Jenkins OP Build CI Tested-by: Jenkins OP HW Tested-by: FSP CI Jenkins Reviewed-by: Nicholas E. Bofferding Reviewed-by: Michael Baiocchi CI-Ready: Daniel M. Crowell Reviewed-by: Daniel M. Crowell --- src/include/usr/secureboot/service.H | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'src/include/usr/secureboot') diff --git a/src/include/usr/secureboot/service.H b/src/include/usr/secureboot/service.H index c467c3800..cb2829147 100644 --- a/src/include/usr/secureboot/service.H +++ b/src/include/usr/secureboot/service.H @@ -334,6 +334,12 @@ namespace SECUREBOOT */ bool allowAttrOverrides(); + /* + * @brief Determines if SBE security backdoor bit is set + * @return bool TRUE if SBE security backdoor is enabled; FALSE otherwise + */ + bool getSbeSecurityBackdoor(); + /* * @brief Gets the current SBE security mode value from the secureboot * subsystem -- cgit v1.2.3