diff options
| author | Ilya Smirnov <ismirno@us.ibm.com> | 2018-03-19 17:12:32 -0500 |
|---|---|---|
| committer | Daniel M. Crowell <dcrowell@us.ibm.com> | 2018-04-09 16:29:14 -0400 |
| commit | da8911ce095aa7d18231c9d344dc978dae7cf984 (patch) | |
| tree | bba30d639c013bdd5f77cf70a31fc560f8c33698 /src/include | |
| parent | 5192636a15d9fd36653952eaad5dac0974094f00 (diff) | |
| download | talos-hostboot-da8911ce095aa7d18231c9d344dc978dae7cf984.tar.gz talos-hostboot-da8911ce095aa7d18231c9d344dc978dae7cf984.zip | |
Secure Boot: Support Phyp debug flag in HDAT
PHYP needs a way to know if SBE security backdoor is enabled
for debug purposes. This change creates a flag in TPM instance
data structure to indicate whether the backdoor is enabled. This
flag is passed by SBE to the hb bootloader; also added the flag
to indicate whether PCR is poisoned (default of 0).
The population of this flag will be implemented on Fleetwood.
Change-Id: I22305dbc9651134ba7dfe3b0bd3c760fe53c2c85
RTC: 188961
Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/56045
Tested-by: Jenkins Server <pfd-jenkins+hostboot@us.ibm.com>
Tested-by: Jenkins OP Build CI <op-jenkins+hostboot@us.ibm.com>
Tested-by: Jenkins OP HW <op-hw-jenkins+hostboot@us.ibm.com>
Tested-by: FSP CI Jenkins <fsp-CI-jenkins+hostboot@us.ibm.com>
Reviewed-by: Nicholas E. Bofferding <bofferdn@us.ibm.com>
Reviewed-by: Michael Baiocchi <mbaiocch@us.ibm.com>
CI-Ready: Daniel M. Crowell <dcrowell@us.ibm.com>
Reviewed-by: Daniel M. Crowell <dcrowell@us.ibm.com>
Diffstat (limited to 'src/include')
| -rw-r--r-- | src/include/bootloader/bootloader_data.H | 4 | ||||
| -rw-r--r-- | src/include/bootloader/bootloaderif.H | 8 | ||||
| -rw-r--r-- | src/include/kernel/bltohbdatamgr.H | 9 | ||||
| -rw-r--r-- | src/include/usr/secureboot/service.H | 6 |
4 files changed, 22 insertions, 5 deletions
diff --git a/src/include/bootloader/bootloader_data.H b/src/include/bootloader/bootloader_data.H index 2e302c20a..9a545304b 100644 --- a/src/include/bootloader/bootloader_data.H +++ b/src/include/bootloader/bootloader_data.H @@ -5,7 +5,7 @@ /* */ /* OpenPOWER HostBoot Project */ /* */ -/* Contributors Listed Below - COPYRIGHT 2017 */ +/* Contributors Listed Below - COPYRIGHT 2017,2018 */ /* [+] International Business Machines Corp. */ /* */ /* */ @@ -91,7 +91,7 @@ namespace Bootloader{ // Object that will be stored where the SBE HB structure indicates BlToHbData blToHbData; uint8_t bl_reserved5[(512 - sizeof(BlToHbData)) % 16]; - static_assert( sizeof(BlToHbData) == 171, "BlToHbData " + static_assert( sizeof(BlToHbData) == 172, "BlToHbData " "size changed. Check bootloader_data.H alignment. " "Fix BlData.pm processing."); } blData_t; diff --git a/src/include/bootloader/bootloaderif.H b/src/include/bootloader/bootloaderif.H index 38b155230..edb8a676e 100644 --- a/src/include/bootloader/bootloaderif.H +++ b/src/include/bootloader/bootloaderif.H @@ -5,7 +5,7 @@ /* */ /* OpenPOWER HostBoot Project */ /* */ -/* Contributors Listed Below - COPYRIGHT 2017 */ +/* Contributors Listed Below - COPYRIGHT 2017,2018 */ /* [+] International Business Machines Corp. */ /* */ /* */ @@ -74,6 +74,7 @@ enum BlToHbDataVersion BLTOHB_SECURE_OVERRIDES = 0x0000000900000004, BLTOHB_SIZE = 0x0000000900000005, BLTOHB_KEYADDR = 0x0000000900000006, + BLTOHB_BACKDOOR = 0x0000000900000007, }; enum @@ -123,7 +124,8 @@ struct BlToHbData xscomBAR(MMIO_GROUP0_CHIP0_XSCOM_BASE_ADDR), lpcBAR(MMIO_GROUP0_CHIP0_LPC_BASE_ADDR), securityOverride(0), allowAttrOverrides(0), - sizeOfStructure(0), keyAddrStashData(0) {} + sizeOfStructure(0), keyAddrStashData(0), + secBackdoorBit(0) {} // Simple way to tell if data is valid uint64_t eyeCatch; @@ -157,6 +159,8 @@ struct BlToHbData size_t sizeOfStructure; //keyAddr stash data keyAddrPair_t keyAddrStashData; + // Secure Setting - SBE Security Backdoor + bool secBackdoorBit; } __attribute__((packed)); /** diff --git a/src/include/kernel/bltohbdatamgr.H b/src/include/kernel/bltohbdatamgr.H index 6dd9d55f5..99e63aeae 100644 --- a/src/include/kernel/bltohbdatamgr.H +++ b/src/include/kernel/bltohbdatamgr.H @@ -5,7 +5,7 @@ /* */ /* OpenPOWER HostBoot Project */ /* */ -/* Contributors Listed Below - COPYRIGHT 2017 */ +/* Contributors Listed Below - COPYRIGHT 2017,2018 */ /* [+] International Business Machines Corp. */ /* */ /* */ @@ -209,6 +209,13 @@ class BlToHbDataManager * @return keyAddrPair_t Key Address Pairs Struct */ const Bootloader::keyAddrPair_t getKeyAddrPairs() const; + + /* + * @brief Returns the value of SBE security backdoor enabled bit + * + * @return bool true if enabled; false otherwise + */ + const bool getSecBackdoor() const; }; // Extern global instance of the class diff --git a/src/include/usr/secureboot/service.H b/src/include/usr/secureboot/service.H index c467c3800..cb2829147 100644 --- a/src/include/usr/secureboot/service.H +++ b/src/include/usr/secureboot/service.H @@ -334,6 +334,12 @@ namespace SECUREBOOT */ bool allowAttrOverrides(); + /* + * @brief Determines if SBE security backdoor bit is set + * @return bool TRUE if SBE security backdoor is enabled; FALSE otherwise + */ + bool getSbeSecurityBackdoor(); + /* * @brief Gets the current SBE security mode value from the secureboot * subsystem |
