SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h

   1 /** @file
   2   Header file for NV data structure definition.
   3
   4 Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.<BR>
   5 SPDX-License-Identifier: BSD-2-Clause-Patent
   6
   7 **/
   8
   9 #ifndef __SECUREBOOT_CONFIG_NV_DATA_H__
  10 #define __SECUREBOOT_CONFIG_NV_DATA_H__
  11
  12 #include <Guid/HiiPlatformSetupFormset.h>
  13 #include <Guid/SecureBootConfigHii.h>
  14
  15 //
  16 // Used by VFR for form or button identification
  17 //
  18 #define SECUREBOOT_CONFIGURATION_VARSTORE_ID  0x0001
  19 #define SECUREBOOT_CONFIGURATION_FORM_ID      0x01
  20 #define FORMID_SECURE_BOOT_OPTION_FORM        0x02
  21 #define FORMID_SECURE_BOOT_PK_OPTION_FORM     0x03
  22 #define FORMID_SECURE_BOOT_KEK_OPTION_FORM    0x04
  23 #define FORMID_SECURE_BOOT_DB_OPTION_FORM     0x05
  24 #define FORMID_SECURE_BOOT_DBX_OPTION_FORM    0x06
  25 #define FORMID_ENROLL_PK_FORM                 0x07
  26 #define SECUREBOOT_ADD_PK_FILE_FORM_ID        0x08
  27 #define FORMID_ENROLL_KEK_FORM                0x09
  28 #define FORMID_DELETE_KEK_FORM                0x0a
  29 #define SECUREBOOT_ENROLL_SIGNATURE_TO_DB     0x0b
  30 #define SECUREBOOT_DELETE_SIGNATURE_FROM_DB   0x0c
  31 #define SECUREBOOT_ENROLL_SIGNATURE_TO_DBX    0x0d
  32 #define FORMID_SECURE_BOOT_DBT_OPTION_FORM    0x14
  33 #define SECUREBOOT_ENROLL_SIGNATURE_TO_DBT    0x15
  34 #define SECUREBOOT_DELETE_SIGNATURE_FROM_DBT  0x16
  35 #define SECUREBOOT_DELETE_SIGNATURE_LIST_FORM 0x17
  36 #define SECUREBOOT_DELETE_SIGNATURE_DATA_FORM 0x18
  37
  38 #define SECURE_BOOT_MODE_CUSTOM               0x01
  39 #define SECURE_BOOT_MODE_STANDARD             0x00
  40
  41 #define KEY_SECURE_BOOT_ENABLE                0x1000
  42 #define KEY_SECURE_BOOT_MODE                  0x1001
  43 #define KEY_VALUE_SAVE_AND_EXIT_DB            0x1002
  44 #define KEY_VALUE_NO_SAVE_AND_EXIT_DB         0x1003
  45 #define KEY_VALUE_SAVE_AND_EXIT_PK            0x1004
  46 #define KEY_VALUE_NO_SAVE_AND_EXIT_PK         0x1005
  47 #define KEY_VALUE_SAVE_AND_EXIT_KEK           0x1008
  48 #define KEY_VALUE_NO_SAVE_AND_EXIT_KEK        0x1009
  49 #define KEY_VALUE_SAVE_AND_EXIT_DBX           0x100a
  50 #define KEY_VALUE_NO_SAVE_AND_EXIT_DBX        0x100b
  51 #define KEY_HIDE_SECURE_BOOT                  0x100c
  52 #define KEY_VALUE_SAVE_AND_EXIT_DBT           0x100d
  53 #define KEY_VALUE_NO_SAVE_AND_EXIT_DBT        0x100e
  54
  55 #define KEY_VALUE_FROM_DBX_TO_LIST_FORM       0x100f
  56
  57 #define KEY_SECURE_BOOT_OPTION                0x1100
  58 #define KEY_SECURE_BOOT_PK_OPTION             0x1101
  59 #define KEY_SECURE_BOOT_KEK_OPTION            0x1102
  60 #define KEY_SECURE_BOOT_DB_OPTION             0x1103
  61 #define KEY_SECURE_BOOT_DBX_OPTION            0x1104
  62 #define KEY_SECURE_BOOT_DELETE_PK             0x1105
  63 #define KEY_ENROLL_PK                         0x1106
  64 #define KEY_ENROLL_KEK                        0x1107
  65 #define KEY_DELETE_KEK                        0x1108
  66 #define KEY_SECURE_BOOT_KEK_GUID              0x110a
  67 #define KEY_SECURE_BOOT_SIGNATURE_GUID_DB     0x110b
  68 #define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX    0x110c
  69 #define KEY_SECURE_BOOT_DBT_OPTION            0x110d
  70 #define KEY_SECURE_BOOT_SIGNATURE_GUID_DBT    0x110e
  71 #define KEY_SECURE_BOOT_DELETE_ALL_LIST       0x110f
  72 #define KEY_SECURE_BOOT_DELETE_ALL_DATA       0x1110
  73 #define KEY_SECURE_BOOT_DELETE_CHECK_DATA     0x1111
  74
  75 #define LABEL_KEK_DELETE                      0x1200
  76 #define LABEL_DB_DELETE                       0x1201
  77 #define LABEL_SIGNATURE_LIST_START            0x1202
  78 #define LABEL_DBT_DELETE                      0x1203
  79 #define LABEL_SIGNATURE_DATA_START            0x1204
  80 #define LABEL_DELETE_ALL_LIST_BUTTON          0x1300
  81 #define LABEL_END                             0xffff
  82
  83 #define SECURE_BOOT_MAX_ATTEMPTS_NUM          255
  84
  85 #define CONFIG_OPTION_OFFSET                  0x2000
  86
  87 #define OPTION_CONFIG_QUESTION_ID             0x2000
  88 #define OPTION_CONFIG_RANGE                   0x1000
  89
  90 //
  91 // Question ID 0x2000 ~ 0x2FFF is for KEK
  92 //
  93 #define OPTION_DEL_KEK_QUESTION_ID            0x2000
  94 //
  95 // Question ID 0x3000 ~ 0x3FFF is for DB
  96 //
  97 #define OPTION_DEL_DB_QUESTION_ID             0x3000
  98 //
  99 // Question ID 0x4000 ~ 0x4FFF is for signature list.
 100 //
 101 #define OPTION_SIGNATURE_LIST_QUESTION_ID     0X4000
 102 //
 103 // Question ID 0x6000 ~ 0x6FFF is for signature data.
 104 //
 105 #define OPTION_SIGNATURE_DATA_QUESTION_ID     0x6000
 106
 107 //
 108 // Question ID 0x5000 ~ 0x5FFF is for DBT
 109 //
 110 #define OPTION_DEL_DBT_QUESTION_ID            0x5000
 111
 112 #define SECURE_BOOT_GUID_SIZE                 36
 113 #define SECURE_BOOT_GUID_STORAGE_SIZE         37
 114
 115 #define UNKNOWN_FILE_TYPE                     0
 116 #define X509_CERT_FILE_TYPE                   1
 117 #define PE_IMAGE_FILE_TYPE                    2
 118 #define AUTHENTICATION_2_FILE_TYPE            3
 119
 120 //
 121 // Nv Data structure referenced by IFR
 122 //
 123 typedef struct {
 124   BOOLEAN AttemptSecureBoot;   // Attempt to enable/disable Secure Boot
 125   BOOLEAN HideSecureBoot;      // Hiden Attempt Secure Boot
 126   CHAR16  SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE];
 127   BOOLEAN PhysicalPresent;     // If a Physical Present User
 128   UINT8   SecureBootMode;      // Secure Boot Mode: Standard Or Custom
 129   BOOLEAN DeletePk;
 130   BOOLEAN HasPk;               // If Pk is existed it is true
 131   BOOLEAN AlwaysRevocation;    // If the certificate is always revoked. Revocation time is hidden
 132   UINT8   CertificateFormat;   // The type of the certificate
 133   EFI_HII_DATE RevocationDate; // The revocation date of the certificate
 134   EFI_HII_TIME RevocationTime; // The revocation time of the certificate
 135   UINT8   FileEnrollType;      // File type of sigunature enroll
 136   UINT32  ListCount;           // The count of signature list.
 137   UINT32  CheckedDataCount;    // The count of checked signature data.
 138 } SECUREBOOT_CONFIGURATION;
 139
 140 #endif