SecurityPkg/SecureBootConfigImpl.c: Secure Boot DBX UI Enhancement

Use 2-level format to display signature list and signature data.
Support batch delete operation to delete signature list or signature data.
Display more useful information for each signature data.

Contributed-under: TianoCore Contribution Agreement 1.0
Cc: Zhang Chao B <chao.b.zhang@intel.com>
Cc: Long Qin <qin.long@intel.com>
Signed-off-by: Chen A Chen <chen.a.chen@intel.com>
Reviewed-by: Long Qin <qin.long@intel.com>
Reviewed-by: Zhang Chao B <chao.b.zhang@intel.com>

1 files changed, 18 insertions, 5 deletions

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
index 6b69f92b26..d112867e58 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
@@ -35,10 +35,11 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define SECUREBOOT_ENROLL_SIGNATURE_TO_DB     0x0b

 #define SECUREBOOT_DELETE_SIGNATURE_FROM_DB   0x0c

 #define SECUREBOOT_ENROLL_SIGNATURE_TO_DBX    0x0d

-#define SECUREBOOT_DELETE_SIGNATURE_FROM_DBX  0x0e

 #define FORMID_SECURE_BOOT_DBT_OPTION_FORM    0x14

 #define SECUREBOOT_ENROLL_SIGNATURE_TO_DBT    0x15

 #define SECUREBOOT_DELETE_SIGNATURE_FROM_DBT  0x16

+#define SECUREBOOT_DELETE_SIGNATURE_LIST_FORM 0x17

+#define SECUREBOOT_DELETE_SIGNATURE_DATA_FORM 0x18

 

 #define SECURE_BOOT_MODE_CUSTOM               0x01

 #define SECURE_BOOT_MODE_STANDARD             0x00

@@ -57,6 +58,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define KEY_VALUE_SAVE_AND_EXIT_DBT           0x100d

 #define KEY_VALUE_NO_SAVE_AND_EXIT_DBT        0x100e

 

+#define KEY_VALUE_FROM_DBX_TO_LIST_FORM       0x100f

+

 #define KEY_SECURE_BOOT_OPTION                0x1100

 #define KEY_SECURE_BOOT_PK_OPTION             0x1101

 #define KEY_SECURE_BOOT_KEK_OPTION            0x1102

@@ -71,14 +74,18 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX    0x110c

 #define KEY_SECURE_BOOT_DBT_OPTION            0x110d

 #define KEY_SECURE_BOOT_SIGNATURE_GUID_DBT    0x110e

+#define KEY_SECURE_BOOT_DELETE_ALL_LIST       0x110f

+#define KEY_SECURE_BOOT_DELETE_ALL_DATA       0x1110

+#define KEY_SECURE_BOOT_DELETE_CHECK_DATA     0x1111

 

 #define LABEL_KEK_DELETE                      0x1200

 #define LABEL_DB_DELETE                       0x1201

-#define LABEL_DBX_DELETE                      0x1202

+#define LABEL_SIGNATURE_LIST_START            0x1202

 #define LABEL_DBT_DELETE                      0x1203

+#define LABEL_SIGNATURE_DATA_START            0x1204

+#define LABEL_DELETE_ALL_LIST_BUTTON          0x1300

 #define LABEL_END                             0xffff

 

-

 #define SECURE_BOOT_MAX_ATTEMPTS_NUM          255

 

 #define CONFIG_OPTION_OFFSET                  0x2000

@@ -95,9 +102,13 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 //

 #define OPTION_DEL_DB_QUESTION_ID             0x3000

 //

-// Question ID 0x4000 ~ 0x4FFF is for DBX

+// Question ID 0x4000 ~ 0x4FFF is for signature list.

+//

+#define OPTION_SIGNATURE_LIST_QUESTION_ID     0X4000

+//

+// Question ID 0x6000 ~ 0x6FFF is for signature data.

 //

-#define OPTION_DEL_DBX_QUESTION_ID            0x4000

+#define OPTION_SIGNATURE_DATA_QUESTION_ID     0x6000

 

 //

 // Question ID 0x5000 ~ 0x5FFF is for DBT

@@ -128,6 +139,8 @@ typedef struct {
   EFI_HII_DATE RevocationDate; // The revocation date of the certificate

   EFI_HII_TIME RevocationTime; // The revocation time of the certificate

   UINT8   FileEnrollType;      // File type of sigunature enroll

+  UINT32  ListCount;           // The count of signature list.

+  UINT32  CheckedDataCount;    // The count of checked signature data.

 } SECUREBOOT_CONFIGURATION;

 

 #endif