blob: 499fea5eb087b456193b5b97c7a4fbff027a6ba9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
|
/* IBM_PROLOG_BEGIN_TAG */
/* This is an automatically generated prolog. */
/* */
/* $Source: src/usr/secureboot/settings.H $ */
/* */
/* OpenPOWER HostBoot Project */
/* */
/* Contributors Listed Below - COPYRIGHT 2013,2016 */
/* [+] International Business Machines Corp. */
/* */
/* */
/* Licensed under the Apache License, Version 2.0 (the "License"); */
/* you may not use this file except in compliance with the License. */
/* You may obtain a copy of the License at */
/* */
/* http://www.apache.org/licenses/LICENSE-2.0 */
/* */
/* Unless required by applicable law or agreed to in writing, software */
/* distributed under the License is distributed on an "AS IS" BASIS, */
/* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or */
/* implied. See the License for the specific language governing */
/* permissions and limitations under the License. */
/* */
/* IBM_PROLOG_END_TAG */
#ifndef __SECUREBOOT_SETTINGS_H
#define __SECUREBOOT_SETTINGS_H
#include <stdint.h>
namespace SECUREBOOT
{
/** @class Settings
*
* @brief Caches and parses the hardware settings for Secureboot.
*/
class Settings
{
public:
Settings() : iv_enabled(false) { _init(); };
~Settings() {};
/** @brief Determine if Secureboot is enabled. */
bool getEnabled() const;
/** @brief Get security switch register value */
uint64_t getSecuritySwitch() const;
/** @brief Returns the state of the secure jumper as reported by the
* master processor.
*
* @par Detailed Description:
* Returns the state of the secure jumper as reported by the
* master processor. This should NOT be used to determine
* whether security is enabled, because several conditions are
* aggregated together to determine that. To query whether
* security is actually enabled or not, call the enabled() API.
* This is a limited-use API intended to be called by trusted
* boot code to determine whether a system shipped with a
* secure jumper applied or removed, in order to decide
* whether to enforce the "TPM Required" policy or not.
* @return Boolean indicating acting master processor's secure
* jumper state
* @retval true Jumper is configured to request HW security. This
* does not necessarily imply security is enabled, because an
* open SBE can override the HW policy. Use the getEnabled()
* API to determine whether security is actually enabled.
* @retval false Jumper is configured to disble HW security.
*/
bool getJumperState() const;
private:
void _init();
/** helper function to encapsulate the details of register reads */
uint64_t readSecurityRegister(const uint64_t i_scomAddress) const;
/** Cached secure boot enabled value */
bool iv_enabled;
};
}
#endif
|
