SecureBootConfigNvData.h 5.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140
  1. /** @file
  2. Header file for NV data structure definition.
  3. Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.<BR>
  4. SPDX-License-Identifier: BSD-2-Clause-Patent
  5. **/
  6. #ifndef __SECUREBOOT_CONFIG_NV_DATA_H__
  7. #define __SECUREBOOT_CONFIG_NV_DATA_H__
  8. #include <Guid/HiiPlatformSetupFormset.h>
  9. #include <Guid/SecureBootConfigHii.h>
  10. //
  11. // Used by VFR for form or button identification
  12. //
  13. #define SECUREBOOT_CONFIGURATION_VARSTORE_ID 0x0001
  14. #define SECUREBOOT_CONFIGURATION_FORM_ID 0x01
  15. #define FORMID_SECURE_BOOT_OPTION_FORM 0x02
  16. #define FORMID_SECURE_BOOT_PK_OPTION_FORM 0x03
  17. #define FORMID_SECURE_BOOT_KEK_OPTION_FORM 0x04
  18. #define FORMID_SECURE_BOOT_DB_OPTION_FORM 0x05
  19. #define FORMID_SECURE_BOOT_DBX_OPTION_FORM 0x06
  20. #define FORMID_ENROLL_PK_FORM 0x07
  21. #define SECUREBOOT_ADD_PK_FILE_FORM_ID 0x08
  22. #define FORMID_ENROLL_KEK_FORM 0x09
  23. #define FORMID_DELETE_KEK_FORM 0x0a
  24. #define SECUREBOOT_ENROLL_SIGNATURE_TO_DB 0x0b
  25. #define SECUREBOOT_DELETE_SIGNATURE_FROM_DB 0x0c
  26. #define SECUREBOOT_ENROLL_SIGNATURE_TO_DBX 0x0d
  27. #define FORMID_SECURE_BOOT_DBT_OPTION_FORM 0x14
  28. #define SECUREBOOT_ENROLL_SIGNATURE_TO_DBT 0x15
  29. #define SECUREBOOT_DELETE_SIGNATURE_FROM_DBT 0x16
  30. #define SECUREBOOT_DELETE_SIGNATURE_LIST_FORM 0x17
  31. #define SECUREBOOT_DELETE_SIGNATURE_DATA_FORM 0x18
  32. #define SECURE_BOOT_MODE_CUSTOM 0x01
  33. #define SECURE_BOOT_MODE_STANDARD 0x00
  34. #define KEY_SECURE_BOOT_ENABLE 0x1000
  35. #define KEY_SECURE_BOOT_MODE 0x1001
  36. #define KEY_VALUE_SAVE_AND_EXIT_DB 0x1002
  37. #define KEY_VALUE_NO_SAVE_AND_EXIT_DB 0x1003
  38. #define KEY_VALUE_SAVE_AND_EXIT_PK 0x1004
  39. #define KEY_VALUE_NO_SAVE_AND_EXIT_PK 0x1005
  40. #define KEY_VALUE_SAVE_AND_EXIT_KEK 0x1008
  41. #define KEY_VALUE_NO_SAVE_AND_EXIT_KEK 0x1009
  42. #define KEY_VALUE_SAVE_AND_EXIT_DBX 0x100a
  43. #define KEY_VALUE_NO_SAVE_AND_EXIT_DBX 0x100b
  44. #define KEY_HIDE_SECURE_BOOT 0x100c
  45. #define KEY_VALUE_SAVE_AND_EXIT_DBT 0x100d
  46. #define KEY_VALUE_NO_SAVE_AND_EXIT_DBT 0x100e
  47. #define KEY_VALUE_FROM_DBX_TO_LIST_FORM 0x100f
  48. #define KEY_SECURE_BOOT_OPTION 0x1100
  49. #define KEY_SECURE_BOOT_PK_OPTION 0x1101
  50. #define KEY_SECURE_BOOT_KEK_OPTION 0x1102
  51. #define KEY_SECURE_BOOT_DB_OPTION 0x1103
  52. #define KEY_SECURE_BOOT_DBX_OPTION 0x1104
  53. #define KEY_SECURE_BOOT_DELETE_PK 0x1105
  54. #define KEY_ENROLL_PK 0x1106
  55. #define KEY_ENROLL_KEK 0x1107
  56. #define KEY_DELETE_KEK 0x1108
  57. #define KEY_SECURE_BOOT_KEK_GUID 0x110a
  58. #define KEY_SECURE_BOOT_SIGNATURE_GUID_DB 0x110b
  59. #define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX 0x110c
  60. #define KEY_SECURE_BOOT_DBT_OPTION 0x110d
  61. #define KEY_SECURE_BOOT_SIGNATURE_GUID_DBT 0x110e
  62. #define KEY_SECURE_BOOT_DELETE_ALL_LIST 0x110f
  63. #define KEY_SECURE_BOOT_DELETE_ALL_DATA 0x1110
  64. #define KEY_SECURE_BOOT_DELETE_CHECK_DATA 0x1111
  65. #define LABEL_KEK_DELETE 0x1200
  66. #define LABEL_DB_DELETE 0x1201
  67. #define LABEL_SIGNATURE_LIST_START 0x1202
  68. #define LABEL_DBT_DELETE 0x1203
  69. #define LABEL_SIGNATURE_DATA_START 0x1204
  70. #define LABEL_DELETE_ALL_LIST_BUTTON 0x1300
  71. #define LABEL_END 0xffff
  72. #define SECURE_BOOT_MAX_ATTEMPTS_NUM 255
  73. #define CONFIG_OPTION_OFFSET 0x2000
  74. #define OPTION_CONFIG_QUESTION_ID 0x2000
  75. #define OPTION_CONFIG_RANGE 0x1000
  76. //
  77. // Question ID 0x2000 ~ 0x2FFF is for KEK
  78. //
  79. #define OPTION_DEL_KEK_QUESTION_ID 0x2000
  80. //
  81. // Question ID 0x3000 ~ 0x3FFF is for DB
  82. //
  83. #define OPTION_DEL_DB_QUESTION_ID 0x3000
  84. //
  85. // Question ID 0x4000 ~ 0x4FFF is for signature list.
  86. //
  87. #define OPTION_SIGNATURE_LIST_QUESTION_ID 0X4000
  88. //
  89. // Question ID 0x6000 ~ 0x6FFF is for signature data.
  90. //
  91. #define OPTION_SIGNATURE_DATA_QUESTION_ID 0x6000
  92. //
  93. // Question ID 0x5000 ~ 0x5FFF is for DBT
  94. //
  95. #define OPTION_DEL_DBT_QUESTION_ID 0x5000
  96. #define SECURE_BOOT_GUID_SIZE 36
  97. #define SECURE_BOOT_GUID_STORAGE_SIZE 37
  98. #define UNKNOWN_FILE_TYPE 0
  99. #define X509_CERT_FILE_TYPE 1
  100. #define PE_IMAGE_FILE_TYPE 2
  101. #define AUTHENTICATION_2_FILE_TYPE 3
  102. //
  103. // Nv Data structure referenced by IFR
  104. //
  105. typedef struct {
  106. BOOLEAN AttemptSecureBoot; // Attempt to enable/disable Secure Boot
  107. BOOLEAN HideSecureBoot; // Hidden Attempt Secure Boot
  108. CHAR16 SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE];
  109. BOOLEAN PhysicalPresent; // If a Physical Present User
  110. UINT8 SecureBootMode; // Secure Boot Mode: Standard Or Custom
  111. BOOLEAN DeletePk;
  112. BOOLEAN HasPk; // If Pk is existed it is true
  113. BOOLEAN AlwaysRevocation; // If the certificate is always revoked. Revocation time is hidden
  114. UINT8 CertificateFormat; // The type of the certificate
  115. EFI_HII_DATE RevocationDate; // The revocation date of the certificate
  116. EFI_HII_TIME RevocationTime; // The revocation time of the certificate
  117. UINT8 FileEnrollType; // File type of signature enroll
  118. UINT32 ListCount; // The count of signature list.
  119. UINT32 CheckedDataCount; // The count of checked signature data.
  120. } SECUREBOOT_CONFIGURATION;
  121. #endif