[mirror_edk2.git] / SecurityPkg / VariableAuthenticated / SecureBootConfigDxe / SecureBootConfigNvData.h

/** @file\r
  Header file for NV data structure definition.\r
\r
Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution.  The full text of the license may be found at\r
http://opensource.org/licenses/bsd-license.php\r
\r
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
\r
**/\r
\r
#ifndef __SECUREBOOT_CONFIG_NV_DATA_H__\r
#define __SECUREBOOT_CONFIG_NV_DATA_H__\r
\r
#include <Guid/HiiPlatformSetupFormset.h>\r
#include <Guid/SecureBootConfigHii.h>\r
\r
//\r
// Used by VFR for form or button identification\r
//\r
#define SECUREBOOT_CONFIGURATION_VARSTORE_ID  0x0001\r
#define SECUREBOOT_CONFIGURATION_FORM_ID      0x01\r
#define FORMID_SECURE_BOOT_OPTION_FORM        0x02\r
#define FORMID_SECURE_BOOT_PK_OPTION_FORM     0x03\r
#define FORMID_SECURE_BOOT_KEK_OPTION_FORM    0x04\r
#define FORMID_SECURE_BOOT_DB_OPTION_FORM     0x05\r
#define FORMID_SECURE_BOOT_DBX_OPTION_FORM    0x06\r
#define FORMID_ENROLL_PK_FORM                 0x07\r
#define SECUREBOOT_ADD_PK_FILE_FORM_ID        0x08\r
#define FORMID_ENROLL_KEK_FORM                0x09\r
#define FORMID_DELETE_KEK_FORM                0x0a\r
#define SECUREBOOT_ENROLL_SIGNATURE_TO_DB     0x0b\r
#define SECUREBOOT_DELETE_SIGNATURE_FROM_DB   0x0c\r
#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBX    0x0d\r
#define FORMID_SECURE_BOOT_DBT_OPTION_FORM    0x14\r
#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBT    0x15\r
#define SECUREBOOT_DELETE_SIGNATURE_FROM_DBT  0x16\r
#define SECUREBOOT_DELETE_SIGNATURE_LIST_FORM 0x17\r
#define SECUREBOOT_DELETE_SIGNATURE_DATA_FORM 0x18\r
\r
#define SECURE_BOOT_MODE_CUSTOM               0x01\r
#define SECURE_BOOT_MODE_STANDARD             0x00\r
\r
#define KEY_SECURE_BOOT_ENABLE                0x1000\r
#define KEY_SECURE_BOOT_MODE                  0x1001\r
#define KEY_VALUE_SAVE_AND_EXIT_DB            0x1002\r
#define KEY_VALUE_NO_SAVE_AND_EXIT_DB         0x1003\r
#define KEY_VALUE_SAVE_AND_EXIT_PK            0x1004\r
#define KEY_VALUE_NO_SAVE_AND_EXIT_PK         0x1005\r
#define KEY_VALUE_SAVE_AND_EXIT_KEK           0x1008\r
#define KEY_VALUE_NO_SAVE_AND_EXIT_KEK        0x1009\r
#define KEY_VALUE_SAVE_AND_EXIT_DBX           0x100a\r
#define KEY_VALUE_NO_SAVE_AND_EXIT_DBX        0x100b\r
#define KEY_HIDE_SECURE_BOOT                  0x100c\r
#define KEY_VALUE_SAVE_AND_EXIT_DBT           0x100d\r
#define KEY_VALUE_NO_SAVE_AND_EXIT_DBT        0x100e\r
\r
#define KEY_VALUE_FROM_DBX_TO_LIST_FORM       0x100f\r
\r
#define KEY_SECURE_BOOT_OPTION                0x1100\r
#define KEY_SECURE_BOOT_PK_OPTION             0x1101\r
#define KEY_SECURE_BOOT_KEK_OPTION            0x1102\r
#define KEY_SECURE_BOOT_DB_OPTION             0x1103\r
#define KEY_SECURE_BOOT_DBX_OPTION            0x1104\r
#define KEY_SECURE_BOOT_DELETE_PK             0x1105\r
#define KEY_ENROLL_PK                         0x1106\r
#define KEY_ENROLL_KEK                        0x1107\r
#define KEY_DELETE_KEK                        0x1108\r
#define KEY_SECURE_BOOT_KEK_GUID              0x110a\r
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DB     0x110b\r
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX    0x110c\r
#define KEY_SECURE_BOOT_DBT_OPTION            0x110d\r
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBT    0x110e\r
#define KEY_SECURE_BOOT_DELETE_ALL_LIST       0x110f\r
#define KEY_SECURE_BOOT_DELETE_ALL_DATA       0x1110\r
#define KEY_SECURE_BOOT_DELETE_CHECK_DATA     0x1111\r
\r
#define LABEL_KEK_DELETE                      0x1200\r
#define LABEL_DB_DELETE                       0x1201\r
#define LABEL_SIGNATURE_LIST_START            0x1202\r
#define LABEL_DBT_DELETE                      0x1203\r
#define LABEL_SIGNATURE_DATA_START            0x1204\r
#define LABEL_DELETE_ALL_LIST_BUTTON          0x1300\r
#define LABEL_END                             0xffff\r
\r
#define SECURE_BOOT_MAX_ATTEMPTS_NUM          255\r
\r
#define CONFIG_OPTION_OFFSET                  0x2000\r
\r
#define OPTION_CONFIG_QUESTION_ID             0x2000\r
#define OPTION_CONFIG_RANGE                   0x1000\r
\r
//\r
// Question ID 0x2000 ~ 0x2FFF is for KEK\r
//\r
#define OPTION_DEL_KEK_QUESTION_ID            0x2000\r
//\r
// Question ID 0x3000 ~ 0x3FFF is for DB\r
//\r
#define OPTION_DEL_DB_QUESTION_ID             0x3000\r
//\r
// Question ID 0x4000 ~ 0x4FFF is for signature list.\r
//\r
#define OPTION_SIGNATURE_LIST_QUESTION_ID     0X4000\r
//\r
// Question ID 0x6000 ~ 0x6FFF is for signature data.\r
//\r
#define OPTION_SIGNATURE_DATA_QUESTION_ID     0x6000\r
\r
//\r
// Question ID 0x5000 ~ 0x5FFF is for DBT\r
//\r
#define OPTION_DEL_DBT_QUESTION_ID            0x5000\r
\r
#define SECURE_BOOT_GUID_SIZE                 36\r
#define SECURE_BOOT_GUID_STORAGE_SIZE         37\r
\r
#define UNKNOWN_FILE_TYPE                     0\r
#define X509_CERT_FILE_TYPE                   1\r
#define PE_IMAGE_FILE_TYPE                    2\r
#define AUTHENTICATION_2_FILE_TYPE            3\r
\r
//\r
// Nv Data structure referenced by IFR\r
//\r
typedef struct {\r
  BOOLEAN AttemptSecureBoot;   // Attempt to enable/disable Secure Boot\r
  BOOLEAN HideSecureBoot;      // Hiden Attempt Secure Boot\r
  CHAR16  SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE];\r
  BOOLEAN PhysicalPresent;     // If a Physical Present User\r
  UINT8   SecureBootMode;      // Secure Boot Mode: Standard Or Custom\r
  BOOLEAN DeletePk;\r
  BOOLEAN HasPk;               // If Pk is existed it is true\r
  BOOLEAN AlwaysRevocation;    // If the certificate is always revoked. Revocation time is hidden\r
  UINT8   CertificateFormat;   // The type of the certificate\r
  EFI_HII_DATE RevocationDate; // The revocation date of the certificate\r
  EFI_HII_TIME RevocationTime; // The revocation time of the certificate\r
  UINT8   FileEnrollType;      // File type of sigunature enroll\r
  UINT32  ListCount;           // The count of signature list.\r
  UINT32  CheckedDataCount;    // The count of checked signature data.\r
} SECUREBOOT_CONFIGURATION;\r
\r
#endif\r
Commit	Line	Data
beda2356	1	/** @file\r
	2	Header file for NV data structure definition.\r
	3	\r
4de754e1	4	Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.<BR>\r
20333c6d QL	5	This program and the accompanying materials\r
	6	are licensed and made available under the terms and conditions of the BSD License\r
	7	which accompanies this distribution. The full text of the license may be found at\r
beda2356	8	http://opensource.org/licenses/bsd-license.php\r
beda2356	9	\r
20333c6d	10	THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
beda2356	11	WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
	12	\r
	13	**/\r
	14	\r
	15	#ifndef __SECUREBOOT_CONFIG_NV_DATA_H__\r
	16	#define __SECUREBOOT_CONFIG_NV_DATA_H__\r
	17	\r
	18	#include <Guid/HiiPlatformSetupFormset.h>\r
	19	#include <Guid/SecureBootConfigHii.h>\r
	20	\r
ecc722ad	21	//\r
	22	// Used by VFR for form or button identification\r
	23	//\r
beda2356	24	#define SECUREBOOT_CONFIGURATION_VARSTORE_ID 0x0001\r
ecc722ad	25	#define SECUREBOOT_CONFIGURATION_FORM_ID 0x01\r
	26	#define FORMID_SECURE_BOOT_OPTION_FORM 0x02\r
	27	#define FORMID_SECURE_BOOT_PK_OPTION_FORM 0x03\r
	28	#define FORMID_SECURE_BOOT_KEK_OPTION_FORM 0x04\r
	29	#define FORMID_SECURE_BOOT_DB_OPTION_FORM 0x05\r
	30	#define FORMID_SECURE_BOOT_DBX_OPTION_FORM 0x06\r
	31	#define FORMID_ENROLL_PK_FORM 0x07\r
	32	#define SECUREBOOT_ADD_PK_FILE_FORM_ID 0x08\r
	33	#define FORMID_ENROLL_KEK_FORM 0x09\r
	34	#define FORMID_DELETE_KEK_FORM 0x0a\r
	35	#define SECUREBOOT_ENROLL_SIGNATURE_TO_DB 0x0b\r
	36	#define SECUREBOOT_DELETE_SIGNATURE_FROM_DB 0x0c\r
	37	#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBX 0x0d\r
20333c6d QL	38	#define FORMID_SECURE_BOOT_DBT_OPTION_FORM 0x14\r
	39	#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBT 0x15\r
	40	#define SECUREBOOT_DELETE_SIGNATURE_FROM_DBT 0x16\r
85974aef	41	#define SECUREBOOT_DELETE_SIGNATURE_LIST_FORM 0x17\r
85974aef	42	#define SECUREBOOT_DELETE_SIGNATURE_DATA_FORM 0x18\r
ecc722ad	43	\r
	44	#define SECURE_BOOT_MODE_CUSTOM 0x01\r
	45	#define SECURE_BOOT_MODE_STANDARD 0x00\r
	46	\r
	47	#define KEY_SECURE_BOOT_ENABLE 0x1000\r
	48	#define KEY_SECURE_BOOT_MODE 0x1001\r
	49	#define KEY_VALUE_SAVE_AND_EXIT_DB 0x1002\r
	50	#define KEY_VALUE_NO_SAVE_AND_EXIT_DB 0x1003\r
	51	#define KEY_VALUE_SAVE_AND_EXIT_PK 0x1004\r
	52	#define KEY_VALUE_NO_SAVE_AND_EXIT_PK 0x1005\r
	53	#define KEY_VALUE_SAVE_AND_EXIT_KEK 0x1008\r
	54	#define KEY_VALUE_NO_SAVE_AND_EXIT_KEK 0x1009\r
	55	#define KEY_VALUE_SAVE_AND_EXIT_DBX 0x100a\r
	56	#define KEY_VALUE_NO_SAVE_AND_EXIT_DBX 0x100b\r
a2f2c258	57	#define KEY_HIDE_SECURE_BOOT 0x100c\r
20333c6d QL	58	#define KEY_VALUE_SAVE_AND_EXIT_DBT 0x100d\r
20333c6d QL	59	#define KEY_VALUE_NO_SAVE_AND_EXIT_DBT 0x100e\r
ecc722ad	60	\r
85974aef	61	#define KEY_VALUE_FROM_DBX_TO_LIST_FORM 0x100f\r
85974aef	62	\r
ecc722ad	63	#define KEY_SECURE_BOOT_OPTION 0x1100\r
	64	#define KEY_SECURE_BOOT_PK_OPTION 0x1101\r
	65	#define KEY_SECURE_BOOT_KEK_OPTION 0x1102\r
	66	#define KEY_SECURE_BOOT_DB_OPTION 0x1103\r
	67	#define KEY_SECURE_BOOT_DBX_OPTION 0x1104\r
	68	#define KEY_SECURE_BOOT_DELETE_PK 0x1105\r
	69	#define KEY_ENROLL_PK 0x1106\r
	70	#define KEY_ENROLL_KEK 0x1107\r
	71	#define KEY_DELETE_KEK 0x1108\r
	72	#define KEY_SECURE_BOOT_KEK_GUID 0x110a\r
	73	#define KEY_SECURE_BOOT_SIGNATURE_GUID_DB 0x110b\r
	74	#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX 0x110c\r
20333c6d QL	75	#define KEY_SECURE_BOOT_DBT_OPTION 0x110d\r
20333c6d QL	76	#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBT 0x110e\r
85974aef	77	#define KEY_SECURE_BOOT_DELETE_ALL_LIST 0x110f\r
	78	#define KEY_SECURE_BOOT_DELETE_ALL_DATA 0x1110\r
	79	#define KEY_SECURE_BOOT_DELETE_CHECK_DATA 0x1111\r
ecc722ad	80	\r
	81	#define LABEL_KEK_DELETE 0x1200\r
	82	#define LABEL_DB_DELETE 0x1201\r
85974aef	83	#define LABEL_SIGNATURE_LIST_START 0x1202\r
20333c6d	84	#define LABEL_DBT_DELETE 0x1203\r
85974aef	85	#define LABEL_SIGNATURE_DATA_START 0x1204\r
85974aef	86	#define LABEL_DELETE_ALL_LIST_BUTTON 0x1300\r
ecc722ad	87	#define LABEL_END 0xffff\r
	88	\r
	89	#define SECURE_BOOT_MAX_ATTEMPTS_NUM 255\r
	90	\r
	91	#define CONFIG_OPTION_OFFSET 0x2000\r
	92	\r
	93	#define OPTION_CONFIG_QUESTION_ID 0x2000\r
	94	#define OPTION_CONFIG_RANGE 0x1000\r
	95	\r
	96	//\r
	97	// Question ID 0x2000 ~ 0x2FFF is for KEK\r
	98	//\r
	99	#define OPTION_DEL_KEK_QUESTION_ID 0x2000\r
	100	//\r
	101	// Question ID 0x3000 ~ 0x3FFF is for DB\r
	102	//\r
	103	#define OPTION_DEL_DB_QUESTION_ID 0x3000\r
	104	//\r
85974aef	105	// Question ID 0x4000 ~ 0x4FFF is for signature list.\r
	106	//\r
	107	#define OPTION_SIGNATURE_LIST_QUESTION_ID 0X4000\r
	108	//\r
	109	// Question ID 0x6000 ~ 0x6FFF is for signature data.\r
ecc722ad	110	//\r
85974aef	111	#define OPTION_SIGNATURE_DATA_QUESTION_ID 0x6000\r
20333c6d QL	112	\r
	113	//\r
	114	// Question ID 0x5000 ~ 0x5FFF is for DBT\r
	115	//\r
	116	#define OPTION_DEL_DBT_QUESTION_ID 0x5000\r
ecc722ad	117	\r
ecc722ad	118	#define SECURE_BOOT_GUID_SIZE 36\r
	119	#define SECURE_BOOT_GUID_STORAGE_SIZE 37\r
	120	\r
4de754e1 ZC	121	#define UNKNOWN_FILE_TYPE 0\r
	122	#define X509_CERT_FILE_TYPE 1\r
	123	#define PE_IMAGE_FILE_TYPE 2\r
	124	#define AUTHENTICATION_2_FILE_TYPE 3\r
96832eef	125	\r
beda2356	126	//\r
	127	// Nv Data structure referenced by IFR\r
	128	//\r
	129	typedef struct {\r
20333c6d QL	130	BOOLEAN AttemptSecureBoot; // Attempt to enable/disable Secure Boot\r
20333c6d QL	131	BOOLEAN HideSecureBoot; // Hiden Attempt Secure Boot\r
ecc722ad	132	CHAR16 SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE];\r
20333c6d QL	133	BOOLEAN PhysicalPresent; // If a Physical Present User\r
	134	UINT8 SecureBootMode; // Secure Boot Mode: Standard Or Custom\r
	135	BOOLEAN DeletePk;\r
	136	BOOLEAN HasPk; // If Pk is existed it is true\r
	137	BOOLEAN AlwaysRevocation; // If the certificate is always revoked. Revocation time is hidden\r
	138	UINT8 CertificateFormat; // The type of the certificate\r
	139	EFI_HII_DATE RevocationDate; // The revocation date of the certificate\r
	140	EFI_HII_TIME RevocationTime; // The revocation time of the certificate\r
4de754e1	141	UINT8 FileEnrollType; // File type of sigunature enroll\r
85974aef	142	UINT32 ListCount; // The count of signature list.\r
85974aef	143	UINT32 CheckedDataCount; // The count of checked signature data.\r
beda2356	144	} SECUREBOOT_CONFIGURATION;\r
beda2356	145	\r
2e728930	146	#endif\r