Secureboot: Inhibit attribute overrides and sync exposures

For Secureboot purposes, we don't consider the FSP a secure source.  So
this commit inhibts attribute overrides and any sort of attribute syncing
from the FSP.

Change-Id: I941ab5083d3055bc29237839aaaf4b723a2b0e90
RTC:175071
Reviewed-on: http://ralgit01.raleigh.ibm.com/gerrit1/42687
Reviewed-by: Nicholas E. Bofferding <bofferdn@us.ibm.com>
Tested-by: Jenkins Server <pfd-jenkins+hostboot@us.ibm.com>
Tested-by: Jenkins OP Build CI <op-jenkins+hostboot@us.ibm.com>
Reviewed-by: Stephen M. Cprek <smcprek@us.ibm.com>
Tested-by: FSP CI Jenkins <fsp-CI-jenkins+hostboot@us.ibm.com>
Tested-by: Jenkins OP HW <op-hw-jenkins+hostboot@us.ibm.com>
Reviewed-by: Daniel M. Crowell <dcrowell@us.ibm.com>

1 files changed, 32 insertions, 0 deletions

diff --git a/src/usr/secureboot/base/service.C b/src/usr/secureboot/base/service.C
index fc4498908..6d0bf8ff3 100644
--- a/src/usr/secureboot/base/service.C
+++ b/src/usr/secureboot/base/service.C
@@ -41,6 +41,7 @@
 #include "purge.H"
 #include <kernel/misc.H>
 #include <kernel/console.H>
+#include <kernel/bltohbdatamgr.H>
 #include <console/consoleif.H>
 #include <util/misc.H>
 
@@ -559,4 +560,35 @@ void addSecureUserDetailsToErrolog(errlHndl_t & io_err)
     //Note: adding UdTargetHwKeyHash left to Extended image
 }
 
+#ifndef __HOSTBOOT_RUNTIME
+bool allowAttrOverrides()
+{
+    bool retVal = false;
+
+    if (enabled())
+    {
+        if (g_BlToHbDataManager.getAllowAttrOverrides())
+        {
+            retVal = true;
+            SB_INF("allowAttrOverrides: Allowing Attr Overrides in "
+                   "Secure Mode: retVal=%d", retVal);
+        }
+        else
+        {
+            retVal = false;
+            SB_INF("allowAttrOverrides: DO NOT Allow Attr Overrides in "
+                   "Secure Mode: retVal=%d", retVal);
+        }
+    }
+    else
+    {
+        retVal = true;
+        SB_DBG("allowAttrOverrides: Allow Attr Overrides in "
+                "Unsecure Mode: retVal=%d", retVal);
+    }
+
+    return retVal;
+};
+#endif
+
 } //namespace SECUREBOOT