SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h

   1 /** @file
   2   Header file for NV data structure definition.
   3
   4 Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.<BR>
   5 SPDX-License-Identifier: BSD-2-Clause-Patent
   6
   7 **/
   8
   9 #ifndef __SECUREBOOT_CONFIG_NV_DATA_H__
  10 #define __SECUREBOOT_CONFIG_NV_DATA_H__
  11
  12 #include <Guid/HiiPlatformSetupFormset.h>
  13 #include <Guid/SecureBootConfigHii.h>
  14
  15 //
  16 // Used by VFR for form or button identification
  17 //
  18 #define SECUREBOOT_CONFIGURATION_VARSTORE_ID   0x0001
  19 #define SECUREBOOT_CONFIGURATION_FORM_ID       0x01
  20 #define FORMID_SECURE_BOOT_OPTION_FORM         0x02
  21 #define FORMID_SECURE_BOOT_PK_OPTION_FORM      0x03
  22 #define FORMID_SECURE_BOOT_KEK_OPTION_FORM     0x04
  23 #define FORMID_SECURE_BOOT_DB_OPTION_FORM      0x05
  24 #define FORMID_SECURE_BOOT_DBX_OPTION_FORM     0x06
  25 #define FORMID_ENROLL_PK_FORM                  0x07
  26 #define SECUREBOOT_ADD_PK_FILE_FORM_ID         0x08
  27 #define FORMID_ENROLL_KEK_FORM                 0x09
  28 #define FORMID_DELETE_KEK_FORM                 0x0a
  29 #define SECUREBOOT_ENROLL_SIGNATURE_TO_DB      0x0b
  30 #define SECUREBOOT_DELETE_SIGNATURE_FROM_DB    0x0c
  31 #define SECUREBOOT_ENROLL_SIGNATURE_TO_DBX     0x0d
  32 #define FORMID_SECURE_BOOT_DBT_OPTION_FORM     0x14
  33 #define SECUREBOOT_ENROLL_SIGNATURE_TO_DBT     0x15
  34 #define SECUREBOOT_DELETE_SIGNATURE_FROM_DBT   0x16
  35 #define SECUREBOOT_DELETE_SIGNATURE_LIST_FORM  0x17
  36 #define SECUREBOOT_DELETE_SIGNATURE_DATA_FORM  0x18
  37
  38 #define SECURE_BOOT_MODE_CUSTOM    0x01
  39 #define SECURE_BOOT_MODE_STANDARD  0x00
  40
  41 #define KEY_SECURE_BOOT_ENABLE          0x1000
  42 #define KEY_SECURE_BOOT_MODE            0x1001
  43 #define KEY_VALUE_SAVE_AND_EXIT_DB      0x1002
  44 #define KEY_VALUE_NO_SAVE_AND_EXIT_DB   0x1003
  45 #define KEY_VALUE_SAVE_AND_EXIT_PK      0x1004
  46 #define KEY_VALUE_NO_SAVE_AND_EXIT_PK   0x1005
  47 #define KEY_VALUE_SAVE_AND_EXIT_KEK     0x1008
  48 #define KEY_VALUE_NO_SAVE_AND_EXIT_KEK  0x1009
  49 #define KEY_VALUE_SAVE_AND_EXIT_DBX     0x100a
  50 #define KEY_VALUE_NO_SAVE_AND_EXIT_DBX  0x100b
  51 #define KEY_HIDE_SECURE_BOOT            0x100c
  52 #define KEY_VALUE_SAVE_AND_EXIT_DBT     0x100d
  53 #define KEY_VALUE_NO_SAVE_AND_EXIT_DBT  0x100e
  54
  55 #define KEY_VALUE_FROM_DBX_TO_LIST_FORM  0x100f
  56
  57 #define KEY_SECURE_BOOT_RESET_TO_DEFAULT  0x1010
  58
  59 #define KEY_SECURE_BOOT_OPTION              0x1100
  60 #define KEY_SECURE_BOOT_PK_OPTION           0x1101
  61 #define KEY_SECURE_BOOT_KEK_OPTION          0x1102
  62 #define KEY_SECURE_BOOT_DB_OPTION           0x1103
  63 #define KEY_SECURE_BOOT_DBX_OPTION          0x1104
  64 #define KEY_SECURE_BOOT_DELETE_PK           0x1105
  65 #define KEY_ENROLL_PK                       0x1106
  66 #define KEY_ENROLL_KEK                      0x1107
  67 #define KEY_DELETE_KEK                      0x1108
  68 #define KEY_SECURE_BOOT_KEK_GUID            0x110a
  69 #define KEY_SECURE_BOOT_SIGNATURE_GUID_DB   0x110b
  70 #define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX  0x110c
  71 #define KEY_SECURE_BOOT_DBT_OPTION          0x110d
  72 #define KEY_SECURE_BOOT_SIGNATURE_GUID_DBT  0x110e
  73 #define KEY_SECURE_BOOT_DELETE_ALL_LIST     0x110f
  74 #define KEY_SECURE_BOOT_DELETE_ALL_DATA     0x1110
  75 #define KEY_SECURE_BOOT_DELETE_CHECK_DATA   0x1111
  76
  77 #define LABEL_KEK_DELETE              0x1200
  78 #define LABEL_DB_DELETE               0x1201
  79 #define LABEL_SIGNATURE_LIST_START    0x1202
  80 #define LABEL_DBT_DELETE              0x1203
  81 #define LABEL_SIGNATURE_DATA_START    0x1204
  82 #define LABEL_DELETE_ALL_LIST_BUTTON  0x1300
  83 #define LABEL_END                     0xffff
  84
  85 #define SECURE_BOOT_MAX_ATTEMPTS_NUM  255
  86
  87 #define CONFIG_OPTION_OFFSET  0x2000
  88
  89 #define OPTION_CONFIG_QUESTION_ID  0x2000
  90 #define OPTION_CONFIG_RANGE        0x1000
  91
  92 //
  93 // Question ID 0x2000 ~ 0x2FFF is for KEK
  94 //
  95 #define OPTION_DEL_KEK_QUESTION_ID  0x2000
  96 //
  97 // Question ID 0x3000 ~ 0x3FFF is for DB
  98 //
  99 #define OPTION_DEL_DB_QUESTION_ID  0x3000
 100 //
 101 // Question ID 0x4000 ~ 0x4FFF is for signature list.
 102 //
 103 #define OPTION_SIGNATURE_LIST_QUESTION_ID  0X4000
 104 //
 105 // Question ID 0x6000 ~ 0x6FFF is for signature data.
 106 //
 107 #define OPTION_SIGNATURE_DATA_QUESTION_ID  0x6000
 108
 109 //
 110 // Question ID 0x5000 ~ 0x5FFF is for DBT
 111 //
 112 #define OPTION_DEL_DBT_QUESTION_ID  0x5000
 113
 114 #define SECURE_BOOT_GUID_SIZE          36
 115 #define SECURE_BOOT_GUID_STORAGE_SIZE  37
 116
 117 #define UNKNOWN_FILE_TYPE           0
 118 #define X509_CERT_FILE_TYPE         1
 119 #define PE_IMAGE_FILE_TYPE          2
 120 #define AUTHENTICATION_2_FILE_TYPE  3
 121
 122 //
 123 // Nv Data structure referenced by IFR
 124 //
 125 typedef struct {
 126   BOOLEAN         AttemptSecureBoot; // Attempt to enable/disable Secure Boot
 127   BOOLEAN         HideSecureBoot;    // Hidden Attempt Secure Boot
 128   CHAR16          SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE];
 129   BOOLEAN         PhysicalPresent; // If a Physical Present User
 130   UINT8           SecureBootMode;  // Secure Boot Mode: Standard Or Custom
 131   BOOLEAN         DeletePk;
 132   BOOLEAN         HasPk;             // If Pk is existed it is true
 133   BOOLEAN         AlwaysRevocation;  // If the certificate is always revoked. Revocation time is hidden
 134   UINT8           CertificateFormat; // The type of the certificate
 135   EFI_HII_DATE    RevocationDate;    // The revocation date of the certificate
 136   EFI_HII_TIME    RevocationTime;    // The revocation time of the certificate
 137   UINT8           FileEnrollType;    // File type of signature enroll
 138   UINT32          ListCount;         // The count of signature list.
 139   UINT32          CheckedDataCount;  // The count of checked signature data.
 140 } SECUREBOOT_CONFIGURATION;
 141
 142 #endif