summaryrefslogtreecommitdiff
path: root/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
blob: 34720bb5e29d1e7073dc9529519be7184e6abf0d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
/** @file
  Header file for NV data structure definition.

Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent

**/

#ifndef __SECUREBOOT_CONFIG_NV_DATA_H__
#define __SECUREBOOT_CONFIG_NV_DATA_H__

#include <Guid/HiiPlatformSetupFormset.h>
#include <Guid/SecureBootConfigHii.h>

//
// Used by VFR for form or button identification
//
#define SECUREBOOT_CONFIGURATION_VARSTORE_ID   0x0001
#define SECUREBOOT_CONFIGURATION_FORM_ID       0x01
#define FORMID_SECURE_BOOT_OPTION_FORM         0x02
#define FORMID_SECURE_BOOT_PK_OPTION_FORM      0x03
#define FORMID_SECURE_BOOT_KEK_OPTION_FORM     0x04
#define FORMID_SECURE_BOOT_DB_OPTION_FORM      0x05
#define FORMID_SECURE_BOOT_DBX_OPTION_FORM     0x06
#define FORMID_ENROLL_PK_FORM                  0x07
#define SECUREBOOT_ADD_PK_FILE_FORM_ID         0x08
#define FORMID_ENROLL_KEK_FORM                 0x09
#define FORMID_DELETE_KEK_FORM                 0x0a
#define SECUREBOOT_ENROLL_SIGNATURE_TO_DB      0x0b
#define SECUREBOOT_DELETE_SIGNATURE_FROM_DB    0x0c
#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBX     0x0d
#define FORMID_SECURE_BOOT_DBT_OPTION_FORM     0x14
#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBT     0x15
#define SECUREBOOT_DELETE_SIGNATURE_FROM_DBT   0x16
#define SECUREBOOT_DELETE_SIGNATURE_LIST_FORM  0x17
#define SECUREBOOT_DELETE_SIGNATURE_DATA_FORM  0x18

#define SECURE_BOOT_MODE_CUSTOM    0x01
#define SECURE_BOOT_MODE_STANDARD  0x00

#define KEY_SECURE_BOOT_ENABLE          0x1000
#define KEY_SECURE_BOOT_MODE            0x1001
#define KEY_VALUE_SAVE_AND_EXIT_DB      0x1002
#define KEY_VALUE_NO_SAVE_AND_EXIT_DB   0x1003
#define KEY_VALUE_SAVE_AND_EXIT_PK      0x1004
#define KEY_VALUE_NO_SAVE_AND_EXIT_PK   0x1005
#define KEY_VALUE_SAVE_AND_EXIT_KEK     0x1008
#define KEY_VALUE_NO_SAVE_AND_EXIT_KEK  0x1009
#define KEY_VALUE_SAVE_AND_EXIT_DBX     0x100a
#define KEY_VALUE_NO_SAVE_AND_EXIT_DBX  0x100b
#define KEY_HIDE_SECURE_BOOT            0x100c
#define KEY_VALUE_SAVE_AND_EXIT_DBT     0x100d
#define KEY_VALUE_NO_SAVE_AND_EXIT_DBT  0x100e

#define KEY_VALUE_FROM_DBX_TO_LIST_FORM  0x100f

#define KEY_SECURE_BOOT_RESET_TO_DEFAULT  0x1010

#define KEY_SECURE_BOOT_OPTION              0x1100
#define KEY_SECURE_BOOT_PK_OPTION           0x1101
#define KEY_SECURE_BOOT_KEK_OPTION          0x1102
#define KEY_SECURE_BOOT_DB_OPTION           0x1103
#define KEY_SECURE_BOOT_DBX_OPTION          0x1104
#define KEY_SECURE_BOOT_DELETE_PK           0x1105
#define KEY_ENROLL_PK                       0x1106
#define KEY_ENROLL_KEK                      0x1107
#define KEY_DELETE_KEK                      0x1108
#define KEY_SECURE_BOOT_KEK_GUID            0x110a
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DB   0x110b
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX  0x110c
#define KEY_SECURE_BOOT_DBT_OPTION          0x110d
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBT  0x110e
#define KEY_SECURE_BOOT_DELETE_ALL_LIST     0x110f
#define KEY_SECURE_BOOT_DELETE_ALL_DATA     0x1110
#define KEY_SECURE_BOOT_DELETE_CHECK_DATA   0x1111

#define LABEL_KEK_DELETE              0x1200
#define LABEL_DB_DELETE               0x1201
#define LABEL_SIGNATURE_LIST_START    0x1202
#define LABEL_DBT_DELETE              0x1203
#define LABEL_SIGNATURE_DATA_START    0x1204
#define LABEL_DELETE_ALL_LIST_BUTTON  0x1300
#define LABEL_END                     0xffff

#define SECURE_BOOT_MAX_ATTEMPTS_NUM  255

#define CONFIG_OPTION_OFFSET  0x2000

#define OPTION_CONFIG_QUESTION_ID  0x2000
#define OPTION_CONFIG_RANGE        0x1000

//
// Question ID 0x2000 ~ 0x2FFF is for KEK
//
#define OPTION_DEL_KEK_QUESTION_ID  0x2000
//
// Question ID 0x3000 ~ 0x3FFF is for DB
//
#define OPTION_DEL_DB_QUESTION_ID  0x3000
//
// Question ID 0x4000 ~ 0x4FFF is for signature list.
//
#define OPTION_SIGNATURE_LIST_QUESTION_ID  0X4000
//
// Question ID 0x6000 ~ 0x6FFF is for signature data.
//
#define OPTION_SIGNATURE_DATA_QUESTION_ID  0x6000

//
// Question ID 0x5000 ~ 0x5FFF is for DBT
//
#define OPTION_DEL_DBT_QUESTION_ID  0x5000

#define SECURE_BOOT_GUID_SIZE          36
#define SECURE_BOOT_GUID_STORAGE_SIZE  37

#define UNKNOWN_FILE_TYPE           0
#define X509_CERT_FILE_TYPE         1
#define PE_IMAGE_FILE_TYPE          2
#define AUTHENTICATION_2_FILE_TYPE  3

//
// Nv Data structure referenced by IFR
//
typedef struct {
  BOOLEAN         AttemptSecureBoot; // Attempt to enable/disable Secure Boot
  BOOLEAN         HideSecureBoot;    // Hidden Attempt Secure Boot
  CHAR16          SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE];
  BOOLEAN         PhysicalPresent; // If a Physical Present User
  UINT8           SecureBootMode;  // Secure Boot Mode: Standard Or Custom
  BOOLEAN         DeletePk;
  BOOLEAN         HasPk;             // If Pk is existed it is true
  BOOLEAN         AlwaysRevocation;  // If the certificate is always revoked. Revocation time is hidden
  UINT8           CertificateFormat; // The type of the certificate
  EFI_HII_DATE    RevocationDate;    // The revocation date of the certificate
  EFI_HII_TIME    RevocationTime;    // The revocation time of the certificate
  UINT8           FileEnrollType;    // File type of signature enroll
  UINT32          ListCount;         // The count of signature list.
  UINT32          CheckedDataCount;  // The count of checked signature data.
} SECUREBOOT_CONFIGURATION;

#endif