SecurityPkg: SecureBootConfigDxe: Support AUTH_2 enrollment to DBX
[mirror_edk2.git] / SecurityPkg / VariableAuthenticated / SecureBootConfigDxe / SecureBootConfigNvData.h
CommitLineData
beda2356 1/** @file\r
2 Header file for NV data structure definition.\r
3\r
4de754e1 4Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.<BR>\r
20333c6d
QL
5This program and the accompanying materials\r
6are licensed and made available under the terms and conditions of the BSD License\r
7which accompanies this distribution. The full text of the license may be found at\r
beda2356 8http://opensource.org/licenses/bsd-license.php\r
9\r
20333c6d 10THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
beda2356 11WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
12\r
13**/\r
14\r
15#ifndef __SECUREBOOT_CONFIG_NV_DATA_H__\r
16#define __SECUREBOOT_CONFIG_NV_DATA_H__\r
17\r
18#include <Guid/HiiPlatformSetupFormset.h>\r
19#include <Guid/SecureBootConfigHii.h>\r
20\r
ecc722ad 21//\r
22// Used by VFR for form or button identification\r
23//\r
beda2356 24#define SECUREBOOT_CONFIGURATION_VARSTORE_ID 0x0001\r
ecc722ad 25#define SECUREBOOT_CONFIGURATION_FORM_ID 0x01\r
26#define FORMID_SECURE_BOOT_OPTION_FORM 0x02\r
27#define FORMID_SECURE_BOOT_PK_OPTION_FORM 0x03\r
28#define FORMID_SECURE_BOOT_KEK_OPTION_FORM 0x04\r
29#define FORMID_SECURE_BOOT_DB_OPTION_FORM 0x05\r
30#define FORMID_SECURE_BOOT_DBX_OPTION_FORM 0x06\r
31#define FORMID_ENROLL_PK_FORM 0x07\r
32#define SECUREBOOT_ADD_PK_FILE_FORM_ID 0x08\r
33#define FORMID_ENROLL_KEK_FORM 0x09\r
34#define FORMID_DELETE_KEK_FORM 0x0a\r
35#define SECUREBOOT_ENROLL_SIGNATURE_TO_DB 0x0b\r
36#define SECUREBOOT_DELETE_SIGNATURE_FROM_DB 0x0c\r
37#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBX 0x0d\r
38#define SECUREBOOT_DELETE_SIGNATURE_FROM_DBX 0x0e\r
20333c6d
QL
39#define FORMID_SECURE_BOOT_DBT_OPTION_FORM 0x14\r
40#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBT 0x15\r
41#define SECUREBOOT_DELETE_SIGNATURE_FROM_DBT 0x16\r
ecc722ad 42\r
43#define SECURE_BOOT_MODE_CUSTOM 0x01\r
44#define SECURE_BOOT_MODE_STANDARD 0x00\r
45\r
46#define KEY_SECURE_BOOT_ENABLE 0x1000\r
47#define KEY_SECURE_BOOT_MODE 0x1001\r
48#define KEY_VALUE_SAVE_AND_EXIT_DB 0x1002\r
49#define KEY_VALUE_NO_SAVE_AND_EXIT_DB 0x1003\r
50#define KEY_VALUE_SAVE_AND_EXIT_PK 0x1004\r
51#define KEY_VALUE_NO_SAVE_AND_EXIT_PK 0x1005\r
52#define KEY_VALUE_SAVE_AND_EXIT_KEK 0x1008\r
53#define KEY_VALUE_NO_SAVE_AND_EXIT_KEK 0x1009\r
54#define KEY_VALUE_SAVE_AND_EXIT_DBX 0x100a\r
55#define KEY_VALUE_NO_SAVE_AND_EXIT_DBX 0x100b\r
a2f2c258 56#define KEY_HIDE_SECURE_BOOT 0x100c\r
20333c6d
QL
57#define KEY_VALUE_SAVE_AND_EXIT_DBT 0x100d\r
58#define KEY_VALUE_NO_SAVE_AND_EXIT_DBT 0x100e\r
ecc722ad 59\r
60#define KEY_SECURE_BOOT_OPTION 0x1100\r
61#define KEY_SECURE_BOOT_PK_OPTION 0x1101\r
62#define KEY_SECURE_BOOT_KEK_OPTION 0x1102\r
63#define KEY_SECURE_BOOT_DB_OPTION 0x1103\r
64#define KEY_SECURE_BOOT_DBX_OPTION 0x1104\r
65#define KEY_SECURE_BOOT_DELETE_PK 0x1105\r
66#define KEY_ENROLL_PK 0x1106\r
67#define KEY_ENROLL_KEK 0x1107\r
68#define KEY_DELETE_KEK 0x1108\r
69#define KEY_SECURE_BOOT_KEK_GUID 0x110a\r
70#define KEY_SECURE_BOOT_SIGNATURE_GUID_DB 0x110b\r
71#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX 0x110c\r
20333c6d
QL
72#define KEY_SECURE_BOOT_DBT_OPTION 0x110d\r
73#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBT 0x110e\r
ecc722ad 74\r
75#define LABEL_KEK_DELETE 0x1200\r
76#define LABEL_DB_DELETE 0x1201\r
77#define LABEL_DBX_DELETE 0x1202\r
20333c6d 78#define LABEL_DBT_DELETE 0x1203\r
ecc722ad 79#define LABEL_END 0xffff\r
80\r
96832eef 81\r
ecc722ad 82#define SECURE_BOOT_MAX_ATTEMPTS_NUM 255\r
83\r
84#define CONFIG_OPTION_OFFSET 0x2000\r
85\r
86#define OPTION_CONFIG_QUESTION_ID 0x2000\r
87#define OPTION_CONFIG_RANGE 0x1000\r
88\r
89//\r
90// Question ID 0x2000 ~ 0x2FFF is for KEK\r
91//\r
92#define OPTION_DEL_KEK_QUESTION_ID 0x2000\r
93//\r
94// Question ID 0x3000 ~ 0x3FFF is for DB\r
95//\r
96#define OPTION_DEL_DB_QUESTION_ID 0x3000\r
97//\r
98// Question ID 0x4000 ~ 0x4FFF is for DBX\r
99//\r
20333c6d
QL
100#define OPTION_DEL_DBX_QUESTION_ID 0x4000\r
101\r
102//\r
103// Question ID 0x5000 ~ 0x5FFF is for DBT\r
104//\r
105#define OPTION_DEL_DBT_QUESTION_ID 0x5000\r
ecc722ad 106\r
ecc722ad 107#define SECURE_BOOT_GUID_SIZE 36\r
108#define SECURE_BOOT_GUID_STORAGE_SIZE 37\r
109\r
4de754e1
ZC
110#define UNKNOWN_FILE_TYPE 0\r
111#define X509_CERT_FILE_TYPE 1\r
112#define PE_IMAGE_FILE_TYPE 2\r
113#define AUTHENTICATION_2_FILE_TYPE 3\r
96832eef 114\r
beda2356 115//\r
116// Nv Data structure referenced by IFR\r
117//\r
118typedef struct {\r
20333c6d
QL
119 BOOLEAN AttemptSecureBoot; // Attempt to enable/disable Secure Boot\r
120 BOOLEAN HideSecureBoot; // Hiden Attempt Secure Boot\r
ecc722ad 121 CHAR16 SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE];\r
20333c6d
QL
122 BOOLEAN PhysicalPresent; // If a Physical Present User\r
123 UINT8 SecureBootMode; // Secure Boot Mode: Standard Or Custom\r
124 BOOLEAN DeletePk;\r
125 BOOLEAN HasPk; // If Pk is existed it is true\r
126 BOOLEAN AlwaysRevocation; // If the certificate is always revoked. Revocation time is hidden\r
127 UINT8 CertificateFormat; // The type of the certificate\r
128 EFI_HII_DATE RevocationDate; // The revocation date of the certificate\r
129 EFI_HII_TIME RevocationTime; // The revocation time of the certificate\r
4de754e1 130 UINT8 FileEnrollType; // File type of sigunature enroll\r
beda2356 131} SECUREBOOT_CONFIGURATION;\r
132\r
2e728930 133#endif\r