/** @file
  Lock down policy

  Copyright (c) 2021, Intel Corporation. All rights reserved.<BR>
  SPDX-License-Identifier: BSD-2-Clause-Patent
**/
#ifndef _LOCK_DOWN_CONFIG_H_
#define _LOCK_DOWN_CONFIG_H_

#define LOCK_DOWN_CONFIG_REVISION 1
extern EFI_GUID gLockDownConfigGuid;

#pragma pack (push,1)

/**
  The PCH_LOCK_DOWN_CONFIG block describes the expected configuration of the PCH
  for security requirement.
**/
typedef struct {
  CONFIG_BLOCK_HEADER   Header;                   ///< Config Block Header
  /**
    <b>(Test)</b> Enable SMI_LOCK bit to prevent writes to the Global SMI Enable bit. 0: Disable; <b>1: Enable</b>.
  **/
  UINT32  GlobalSmi      :  1;
  /**
    <b>(Test)</b> Enable BIOS Interface Lock Down bit to prevent writes to the Backup Control Register
    Top Swap bit and the General Control and Status Registers Boot BIOS Straps.
    Intel strongly recommends that BIOS sets the BIOS Interface Lock Down bit. Enabling this bit
    will mitigate malicious software attempts to replace the system BIOS with its own code.
    0: Disable; <b>1: Enable</b>.
  **/
  UINT32  BiosInterface  :  1;
  /**
    Enable the BIOS Lock Enable (BLE) feature and set EISS bit (D31:F5:RegDCh[5])
    for the BIOS region protection. When it is enabled, the BIOS Region can only be
    modified from SMM.
    If this EISS bit is set, then WPD must be a '1' and InSMM.STS must be '1' also
    in order to write to BIOS regions of SPI Flash. If this EISS bit is clear,
    then the InSMM.STS is a don't care.
    The BIOS must set the EISS bit while BIOS Guard support is enabled.
    In recovery path, platform can temporary disable EISS for SPI programming in
    PEI phase or early DXE phase.
    When PcdSmmVariableEnable is FALSE, to support BIOS regions update outside of SMM,
    the BiosLock must be set to Disabled by platform.
    0: Disable; <b>1: Enable.</b>
  **/
  UINT32  BiosLock       :  1;
  /**
    <b>(Test)</b> This test option when set will force all GPIO pads to be unlocked
    before BIOS transitions to POSTBOOT_SAI. This option should not be enabled in production
    configuration and used only for debug purpose when free runtime reconfiguration of
    GPIO pads is needed.
    <b>0: Disable</b>; 1: Enable.
  **/
  UINT32  UnlockGpioPads :  1;
  UINT32  RsvdBits0      : 28;             ///< Reserved bits
} PCH_LOCK_DOWN_CONFIG;

#pragma pack (pop)

#endif // _LOCK_DOWN_CONFIG_H_