SecurityPkg: SecureBootConfigDxe: Support AUTH_2 enrollment to DBX

[mirror_edk2.git] / SecurityPkg / VariableAuthenticated / SecureBootConfigDxe / SecureBootConfigNvData.h

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
index 6015dd636dd49d1f738b8f632215432ae3f7a62a..6b69f92b269f49e3c96736ff95be71e5d7cdc0f2 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
@@ -1,13 +1,13 @@
 /** @file\r
   Header file for NV data structure definition.\r
 \r
-Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
-This program and the accompanying materials \r
-are licensed and made available under the terms and conditions of the BSD License \r
-which accompanies this distribution.  The full text of the license may be found at \r
+Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.<BR>\r
+This program and the accompanying materials\r
+are licensed and made available under the terms and conditions of the BSD License\r
+which accompanies this distribution.  The full text of the license may be found at\r
 http://opensource.org/licenses/bsd-license.php\r
 \r
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, \r
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
 \r
 **/\r
@@ -36,11 +36,9 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define SECUREBOOT_DELETE_SIGNATURE_FROM_DB   0x0c\r
 #define SECUREBOOT_ENROLL_SIGNATURE_TO_DBX    0x0d\r
 #define SECUREBOOT_DELETE_SIGNATURE_FROM_DBX  0x0e\r
-#define FORM_FILE_EXPLORER_ID                 0x0f\r
-#define FORM_FILE_EXPLORER_ID_PK              0x10\r
-#define FORM_FILE_EXPLORER_ID_KEK             0x11\r
-#define FORM_FILE_EXPLORER_ID_DB              0x12\r
-#define FORM_FILE_EXPLORER_ID_DBX             0x13\r
+#define FORMID_SECURE_BOOT_DBT_OPTION_FORM    0x14\r
+#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBT    0x15\r
+#define SECUREBOOT_DELETE_SIGNATURE_FROM_DBT  0x16\r
 \r
 #define SECURE_BOOT_MODE_CUSTOM               0x01\r
 #define SECURE_BOOT_MODE_STANDARD             0x00\r
@@ -55,6 +53,9 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define KEY_VALUE_NO_SAVE_AND_EXIT_KEK        0x1009\r
 #define KEY_VALUE_SAVE_AND_EXIT_DBX           0x100a\r
 #define KEY_VALUE_NO_SAVE_AND_EXIT_DBX        0x100b\r
+#define KEY_HIDE_SECURE_BOOT                  0x100c\r
+#define KEY_VALUE_SAVE_AND_EXIT_DBT           0x100d\r
+#define KEY_VALUE_NO_SAVE_AND_EXIT_DBT        0x100e\r
 \r
 #define KEY_SECURE_BOOT_OPTION                0x1100\r
 #define KEY_SECURE_BOOT_PK_OPTION             0x1101\r
@@ -68,12 +69,16 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define KEY_SECURE_BOOT_KEK_GUID              0x110a\r
 #define KEY_SECURE_BOOT_SIGNATURE_GUID_DB     0x110b\r
 #define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX    0x110c\r
+#define KEY_SECURE_BOOT_DBT_OPTION            0x110d\r
+#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBT    0x110e\r
 \r
 #define LABEL_KEK_DELETE                      0x1200\r
 #define LABEL_DB_DELETE                       0x1201\r
 #define LABEL_DBX_DELETE                      0x1202\r
+#define LABEL_DBT_DELETE                      0x1203\r
 #define LABEL_END                             0xffff\r
 \r
+\r
 #define SECURE_BOOT_MAX_ATTEMPTS_NUM          255\r
 \r
 #define CONFIG_OPTION_OFFSET                  0x2000\r
@@ -92,27 +97,37 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 //\r
 // Question ID 0x4000 ~ 0x4FFF is for DBX\r
 //\r
-#define OPTION_DEL_DBX_QUESTION_ID            0x4000 \r
-\r
+#define OPTION_DEL_DBX_QUESTION_ID            0x4000\r
 \r
-#define FILE_OPTION_OFFSET                    0x8000\r
-#define FILE_OPTION_MASK                      0x7FFF\r
+//\r
+// Question ID 0x5000 ~ 0x5FFF is for DBT\r
+//\r
+#define OPTION_DEL_DBT_QUESTION_ID            0x5000\r
 \r
 #define SECURE_BOOT_GUID_SIZE                 36\r
 #define SECURE_BOOT_GUID_STORAGE_SIZE         37\r
 \r
+#define UNKNOWN_FILE_TYPE                     0\r
+#define X509_CERT_FILE_TYPE                   1\r
+#define PE_IMAGE_FILE_TYPE                    2\r
+#define AUTHENTICATION_2_FILE_TYPE            3\r
 \r
 //\r
 // Nv Data structure referenced by IFR\r
 //\r
 typedef struct {\r
-  BOOLEAN SecureBootState; //Secure Boot Disable/Enable;\r
-  BOOLEAN HideSecureBoot;  //Hiden Attempt Secure Boot\r
+  BOOLEAN AttemptSecureBoot;   // Attempt to enable/disable Secure Boot\r
+  BOOLEAN HideSecureBoot;      // Hiden Attempt Secure Boot\r
   CHAR16  SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE];\r
-  BOOLEAN PhysicalPresent; //If a Physical Present User;\r
-  UINT8   SecureBootMode;  //Secure Boot Mode: Standard Or Custom\r
-  BOOLEAN DeletePk; \r
-  BOOLEAN HasPk;           //If Pk is existed it is true;\r
+  BOOLEAN PhysicalPresent;     // If a Physical Present User\r
+  UINT8   SecureBootMode;      // Secure Boot Mode: Standard Or Custom\r
+  BOOLEAN DeletePk;\r
+  BOOLEAN HasPk;               // If Pk is existed it is true\r
+  BOOLEAN AlwaysRevocation;    // If the certificate is always revoked. Revocation time is hidden\r
+  UINT8   CertificateFormat;   // The type of the certificate\r
+  EFI_HII_DATE RevocationDate; // The revocation date of the certificate\r
+  EFI_HII_TIME RevocationTime; // The revocation time of the certificate\r
+  UINT8   FileEnrollType;      // File type of sigunature enroll\r
 } SECUREBOOT_CONFIGURATION;\r
 \r
 #endif\r