SecureBootConfigNvData.h

Go to the documentation of this file.

 
#ifndef __SECUREBOOT_CONFIG_NV_DATA_H__
#define __SECUREBOOT_CONFIG_NV_DATA_H__
 
#include <Guid/HiiPlatformSetupFormset.h>
#include <Guid/SecureBootConfigHii.h>
 
//
// Used by VFR for form or button identification
//
#define SECUREBOOT_CONFIGURATION_VARSTORE_ID   0x0001
#define SECUREBOOT_CONFIGURATION_FORM_ID       0x01
#define FORMID_SECURE_BOOT_OPTION_FORM         0x02
#define FORMID_SECURE_BOOT_PK_OPTION_FORM      0x03
#define FORMID_SECURE_BOOT_KEK_OPTION_FORM     0x04
#define FORMID_SECURE_BOOT_DB_OPTION_FORM      0x05
#define FORMID_SECURE_BOOT_DBX_OPTION_FORM     0x06
#define FORMID_ENROLL_PK_FORM                  0x07
#define SECUREBOOT_ADD_PK_FILE_FORM_ID         0x08
#define FORMID_ENROLL_KEK_FORM                 0x09
#define FORMID_DELETE_KEK_FORM                 0x0a
#define SECUREBOOT_ENROLL_SIGNATURE_TO_DB      0x0b
#define SECUREBOOT_DELETE_SIGNATURE_FROM_DB    0x0c
#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBX     0x0d
#define FORMID_SECURE_BOOT_DBT_OPTION_FORM     0x14
#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBT     0x15
#define SECUREBOOT_DELETE_SIGNATURE_FROM_DBT   0x16
#define SECUREBOOT_DELETE_SIGNATURE_LIST_FORM  0x17
#define SECUREBOOT_DELETE_SIGNATURE_DATA_FORM  0x18
 
#define SECURE_BOOT_MODE_CUSTOM    0x01
#define SECURE_BOOT_MODE_STANDARD  0x00
 
#define KEY_SECURE_BOOT_ENABLE          0x1000
#define KEY_SECURE_BOOT_MODE            0x1001
#define KEY_VALUE_SAVE_AND_EXIT_DB      0x1002
#define KEY_VALUE_NO_SAVE_AND_EXIT_DB   0x1003
#define KEY_VALUE_SAVE_AND_EXIT_PK      0x1004
#define KEY_VALUE_NO_SAVE_AND_EXIT_PK   0x1005
#define KEY_VALUE_SAVE_AND_EXIT_KEK     0x1008
#define KEY_VALUE_NO_SAVE_AND_EXIT_KEK  0x1009
#define KEY_VALUE_SAVE_AND_EXIT_DBX     0x100a
#define KEY_VALUE_NO_SAVE_AND_EXIT_DBX  0x100b
#define KEY_HIDE_SECURE_BOOT            0x100c
#define KEY_VALUE_SAVE_AND_EXIT_DBT     0x100d
#define KEY_VALUE_NO_SAVE_AND_EXIT_DBT  0x100e
 
#define KEY_VALUE_FROM_DBX_TO_LIST_FORM  0x100f
 
#define KEY_SECURE_BOOT_RESET_TO_DEFAULT  0x1010
 
#define KEY_SECURE_BOOT_OPTION              0x1100
#define KEY_SECURE_BOOT_PK_OPTION           0x1101
#define KEY_SECURE_BOOT_KEK_OPTION          0x1102
#define KEY_SECURE_BOOT_DB_OPTION           0x1103
#define KEY_SECURE_BOOT_DBX_OPTION          0x1104
#define KEY_SECURE_BOOT_DELETE_PK           0x1105
#define KEY_ENROLL_PK                       0x1106
#define KEY_ENROLL_KEK                      0x1107
#define KEY_DELETE_KEK                      0x1108
#define KEY_SECURE_BOOT_KEK_GUID            0x110a
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DB   0x110b
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX  0x110c
#define KEY_SECURE_BOOT_DBT_OPTION          0x110d
#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBT  0x110e
#define KEY_SECURE_BOOT_DELETE_ALL_LIST     0x110f
#define KEY_SECURE_BOOT_DELETE_ALL_DATA     0x1110
#define KEY_SECURE_BOOT_DELETE_CHECK_DATA   0x1111
 
#define LABEL_KEK_DELETE              0x1200
#define LABEL_DB_DELETE               0x1201
#define LABEL_SIGNATURE_LIST_START    0x1202
#define LABEL_DBT_DELETE              0x1203
#define LABEL_SIGNATURE_DATA_START    0x1204
#define LABEL_DELETE_ALL_LIST_BUTTON  0x1300
#define LABEL_END                     0xffff
 
#define SECURE_BOOT_MAX_ATTEMPTS_NUM  255
 
#define CONFIG_OPTION_OFFSET  0x2000
 
#define OPTION_CONFIG_QUESTION_ID  0x2000
#define OPTION_CONFIG_RANGE        0x1000
 
//
// Question ID 0x2000 ~ 0x2FFF is for KEK
//
#define OPTION_DEL_KEK_QUESTION_ID  0x2000
//
// Question ID 0x3000 ~ 0x3FFF is for DB
//
#define OPTION_DEL_DB_QUESTION_ID  0x3000
//
// Question ID 0x4000 ~ 0x4FFF is for signature list.
//
#define OPTION_SIGNATURE_LIST_QUESTION_ID  0X4000
//
// Question ID 0x6000 ~ 0x6FFF is for signature data.
//
#define OPTION_SIGNATURE_DATA_QUESTION_ID  0x6000
 
//
// Question ID 0x5000 ~ 0x5FFF is for DBT
//
#define OPTION_DEL_DBT_QUESTION_ID  0x5000
 
#define SECURE_BOOT_GUID_SIZE          36
#define SECURE_BOOT_GUID_STORAGE_SIZE  37
 
#define UNKNOWN_FILE_TYPE           0
#define X509_CERT_FILE_TYPE         1
#define PE_IMAGE_FILE_TYPE          2
#define AUTHENTICATION_2_FILE_TYPE  3
 
//
// Nv Data structure referenced by IFR
//
typedef struct {
  BOOLEAN         AttemptSecureBoot; // Attempt to enable/disable Secure Boot
  BOOLEAN         HideSecureBoot;    // Hidden Attempt Secure Boot
  CHAR16          SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE];
  BOOLEAN         PhysicalPresent; // If a Physical Present User
  UINT8           SecureBootMode;  // Secure Boot Mode: Standard Or Custom
  BOOLEAN         DeletePk;
  BOOLEAN         HasPk;             // If Pk is existed it is true
  BOOLEAN         AlwaysRevocation;  // If the certificate is always revoked. Revocation time is hidden
  UINT8           CertificateFormat; // The type of the certificate
  EFI_HII_DATE    RevocationDate;    // The revocation date of the certificate
  EFI_HII_TIME    RevocationTime;    // The revocation time of the certificate
  UINT8           FileEnrollType;    // File type of signature enroll
  UINT32          ListCount;         // The count of signature list.
  UINT32          CheckedDataCount;  // The count of checked signature data.
} SECUREBOOT_CONFIGURATION;
 
#endif