SecurityPkg: SecureBootConfigDxe: Remove SecureBoot UI change for Customized Secure...

  Remove SecureBoot UI support for Customized SecureBoot Mode transition according to Mantis 1263.
The feature has been moved to
  https://github.com/tianocore/edk2-staging/tree/Customized-Secure-Boot
Previous check-in hash is
  SHA-1: 96832eefea1025c130979dec9b7da069f77bcd96

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: El-Haj-Mahmoud Samer <samer.el-haj-mahmoud@hpe.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
index 484da2c0cabdf84f9ec3435afcce788e672b3e89..fefbfbfd06a10037644304d45520b2077f64fe8f 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
@@ -33,14 +33,6 @@ formset
 \r
     subtitle text = STRING_TOKEN(STR_NULL);\r
 \r
-    //\r
-    // Display current secure boot mode(one of SetupMode/AuditMode/UserMode/DeployedMode)\r
-    //\r
-    text\r
-      help   = STRING_TOKEN(STR_CUR_SECURE_BOOT_MODE_HELP),\r
-      text   = STRING_TOKEN(STR_CUR_SECURE_BOOT_MODE_PROMPT),\r
-        text   = STRING_TOKEN(STR_CUR_SECURE_BOOT_MODE_CONTENT);\r
-\r
     text\r
       help   = STRING_TOKEN(STR_SECURE_BOOT_STATE_HELP),\r
       text   = STRING_TOKEN(STR_SECURE_BOOT_STATE_PROMPT),\r
@@ -71,7 +63,7 @@ formset
     endoneof;\r
 \r
     //\r
-    // Display PK include page\r
+    // Display of 'Current Secure Boot Mode'\r
     //\r
     suppressif questionref(SecureBootMode) == SECURE_BOOT_MODE_STANDARD;\r
     grayoutif NOT ideqval SECUREBOOT_CONFIGURATION.PhysicalPresent == 1;\r
@@ -93,33 +85,6 @@ formset
 \r
     subtitle text = STRING_TOKEN(STR_NULL);\r
 \r
-    //\r
-    // Display of SetupMode/UserMode/AuditMode/DeployedMode transition\r
-    //\r
-    oneof name   = TransSecureBootMode,\r
-            questionid = KEY_TRANS_SECURE_BOOT_MODE,\r
-            prompt = STRING_TOKEN(STR_TRANS_SECURE_BOOT_MODE_PROMPT),\r
-            help   = STRING_TOKEN(STR_TRANS_SECURE_BOOT_MODE_HELP),\r
-            flags  = INTERACTIVE | NUMERIC_SIZE_1,\r
-      suppressif ideqval SECUREBOOT_CONFIGURATION.CurSecureBootMode == SECURE_BOOT_MODE_AUDIT_MODE \r
-              OR (ideqval SECUREBOOT_CONFIGURATION.CurSecureBootMode == SECURE_BOOT_MODE_DEPLOYED_MODE AND\r
-                  ideqval SECUREBOOT_CONFIGURATION.PhysicalPresent == 0);\r
-            option text = STRING_TOKEN(STR_USER_MODE),     value = SECURE_BOOT_MODE_USER_MODE,   flags = 0;\r
-      endif\r
-      suppressif ideqval SECUREBOOT_CONFIGURATION.CurSecureBootMode == SECURE_BOOT_MODE_AUDIT_MODE;\r
-            option text = STRING_TOKEN(STR_SETUP_MODE),    value = SECURE_BOOT_MODE_SETUP_MODE,  flags = 0;\r
-      endif\r
-      suppressif ideqval SECUREBOOT_CONFIGURATION.CurSecureBootMode == SECURE_BOOT_MODE_DEPLOYED_MODE;\r
-            option text = STRING_TOKEN(STR_AUDIT_MODE),    value = SECURE_BOOT_MODE_AUDIT_MODE,  flags = 0;\r
-      endif\r
-      suppressif ideqval SECUREBOOT_CONFIGURATION.CurSecureBootMode == SECURE_BOOT_MODE_SETUP_MODE;\r
-            option text = STRING_TOKEN(STR_DEPLOYED_MODE), value = SECURE_BOOT_MODE_DEPLOYED_MODE,  flags = 0;\r
-      endif\r
-\r
-    endoneof;\r
-\r
-    subtitle text = STRING_TOKEN(STR_NULL);\r
-\r
     goto FORMID_SECURE_BOOT_PK_OPTION_FORM,\r
          prompt = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION),\r
          help   = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION_HELP),\r

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
index c8f4d977d92a5506d7a4cdd2c556276d9a5087ae..088fa26e0d7eb12230a703f65bd21b3b5f404ba6 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
@@ -49,8 +49,6 @@ HII_VENDOR_DEVICE_PATH          mSecureBootHiiVendorDevicePath = {
 \r
 \r
 BOOLEAN mIsEnterSecureBootForm = FALSE;\r
-BOOLEAN mIsSelectedSecureBootModeForm = FALSE;\r
-BOOLEAN mIsSecureBootModeChanged = FALSE;\r
 \r
 //\r
 // OID ASN.1 Value for Hash Algorithms\r
@@ -2832,256 +2830,6 @@ ON_EXIT:
            );\r
 }\r
 \r
-/**\r
-  Perform secure boot mode transition from User Mode by setting AuditMode \r
-  or DeployedMode variable.\r
-\r
-  @param[in]  NewMode          New secure boot mode.\r
-\r
-  @retval   EFI_SUCCESS        Secure Boot mode transition is successful.\r
-**/\r
-EFI_STATUS\r
-TransitionFromUserMode(\r
-  IN  UINT8 NewMode\r
-  )\r
-{\r
-  UINT8      Data;\r
-  EFI_STATUS Status;\r
-\r
-  if (NewMode == SECURE_BOOT_MODE_AUDIT_MODE) {\r
-    Data = 1;\r
-    Status = gRT->SetVariable(\r
-                    EFI_AUDIT_MODE_NAME,\r
-                    &gEfiGlobalVariableGuid,\r
-                    EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,\r
-                    sizeof(UINT8),\r
-                    &Data\r
-                    );\r
-    return Status;\r
-  } else if (NewMode == SECURE_BOOT_MODE_DEPLOYED_MODE) {\r
-    Data = 1;\r
-    Status = gRT->SetVariable(\r
-                    EFI_DEPLOYED_MODE_NAME,\r
-                    &gEfiGlobalVariableGuid,\r
-                    EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,\r
-                    sizeof(UINT8),\r
-                    &Data\r
-                    );\r
-    return Status;\r
-  }\r
-\r
-  //\r
-  // Other case do nothing here. May Goto enroll PK page.\r
-  //\r
-  return EFI_SUCCESS;\r
-}\r
-\r
-/**\r
-  Perform secure boot mode transition from Setup Mode by setting AuditMode \r
-  variable.\r
-\r
-  @param[in]  NewMode          New secure boot mode.\r
-\r
-  @retval   EFI_SUCCESS        Secure Boot mode transition is successful.\r
-**/\r
-EFI_STATUS\r
-TransitionFromSetupMode(\r
-  IN UINT8 NewMode\r
-  )\r
-{\r
-  UINT8      Data;\r
-  EFI_STATUS Status;\r
-\r
-  Status = EFI_INVALID_PARAMETER;\r
-\r
-  if (NewMode == SECURE_BOOT_MODE_AUDIT_MODE) {\r
-    Data = 1;\r
-    Status = gRT->SetVariable(\r
-                    EFI_AUDIT_MODE_NAME,\r
-                    &gEfiGlobalVariableGuid,\r
-                    EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,\r
-                    sizeof(UINT8),\r
-                    &Data\r
-                    );\r
-    return Status;\r
-  }\r
-\r
-  //\r
-  // Other case do nothing here. May Goto enroll PK page.\r
-  //\r
-  return EFI_SUCCESS;\r
-}\r
-\r
-/**\r
-  Perform secure boot mode transition from Audit Mode. Nothing is done here,\r
-  should goto enroll PK page.\r
-\r
-  @param[in]  NewMode          New secure boot mode.\r
-\r
-  @retval   EFI_SUCCESS        Secure Boot mode transition is successful.\r
-**/\r
-EFI_STATUS\r
-TransitionFromAuditMode(\r
-  IN UINT8 NewMode\r
-  )\r
-{\r
-  //\r
-  // Other case do nothing here. Should Goto enroll PK page.\r
-  //\r
-  return EFI_SUCCESS;\r
-}\r
-\r
-/**\r
-   Perform secure boot mode transition from Deployed Mode by setting Deployed Mode\r
-   variable to 0.\r
-\r
-  @param[in]  NewMode          New secure boot mode.\r
-\r
-  @retval   EFI_SUCCESS        Secure Boot mode transition is successful.\r
-**/\r
-EFI_STATUS\r
-TransitionFromDeployedMode(\r
-  IN UINT8 NewMode\r
-  )\r
-{\r
-  UINT8      Data;\r
-  EFI_STATUS Status;\r
-\r
-  //\r
-  // Platform specific logic. when physical presence,  Allow to set DeployedMode =:0\r
-  // to switch back to UserMode\r
-  //\r
-  if (NewMode == SECURE_BOOT_MODE_USER_MODE) {\r
-    Data = 0;\r
-    Status = gRT->SetVariable(\r
-                    EFI_DEPLOYED_MODE_NAME,\r
-                    &gEfiGlobalVariableGuid,\r
-                    EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,\r
-                    sizeof(UINT8),\r
-                    &Data\r
-                    );\r
-    DEBUG((EFI_D_INFO, "DeployedMode Status %x\n", Status));\r
-    return Status;\r
-  }\r
-  return EFI_SUCCESS;\r
-}\r
-\r
-/**\r
-   Perform main secure boot mode transition.\r
-\r
-  @param[in]  CurMode          New secure boot mode.\r
-  @param[in]  NewMode          New secure boot mode.\r
-\r
-  @retval   EFI_SUCCESS        Secure Boot mode transition is successful.\r
-**/\r
-EFI_STATUS\r
-SecureBootModeTransition(\r
-  IN  UINT8  CurMode,\r
-  IN  UINT8  NewMode\r
-  )\r
-{\r
-  EFI_STATUS                         Status;\r
-\r
-  //\r
-  // Set platform to be customized mode to ensure platform specific mode switch sucess\r
-  //\r
-  Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);\r
-  if (EFI_ERROR (Status)) {\r
-    return Status;\r
-  }\r
-\r
-  //\r
-  // SecureBootMode transition\r
-  //\r
-  switch (CurMode) {\r
-    case SECURE_BOOT_MODE_USER_MODE:\r
-      Status = TransitionFromUserMode(NewMode);\r
-      break;\r
-\r
-    case SECURE_BOOT_MODE_SETUP_MODE:\r
-      Status = TransitionFromSetupMode(NewMode);\r
-      break;\r
-\r
-    case SECURE_BOOT_MODE_AUDIT_MODE:\r
-      Status = TransitionFromAuditMode(NewMode);\r
-      break;\r
-\r
-    case SECURE_BOOT_MODE_DEPLOYED_MODE:\r
-      Status = TransitionFromDeployedMode(NewMode);\r
-      break;\r
-\r
-    default:\r
-      Status = EFI_INVALID_PARAMETER;\r
-      ASSERT(FALSE);\r
-  }\r
-\r
-  return Status;\r
-}\r
-\r
-/**\r
-   Get current secure boot mode by retrieve data from SetupMode/AuditMode/DeployedMode.\r
-\r
-  @param[out]  SecureBootMode                Current secure boot mode.\r
-\r
-**/\r
-VOID\r
-ExtractSecureBootModeFromVariable(\r
-  OUT UINT8      *SecureBootMode\r
-  )\r
-{\r
-  UINT8     *SetupMode;\r
-  UINT8     *AuditMode;\r
-  UINT8     *DeployedMode;\r
-\r
-  SetupMode        = NULL;\r
-  AuditMode        = NULL;\r
-  DeployedMode     = NULL;\r
-\r
-  //\r
-  // Get AuditMode/DeployedMode from variable\r
-  //\r
-  GetVariable2 (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&SetupMode, NULL);\r
-  GetVariable2 (EFI_AUDIT_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&AuditMode, NULL);\r
-  GetVariable2 (EFI_DEPLOYED_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&DeployedMode, NULL);\r
-  if (SetupMode != NULL && AuditMode != NULL && DeployedMode != NULL) {\r
-    if (*SetupMode == 0 && *AuditMode == 0 && *DeployedMode == 0) {\r
-      //\r
-      // User Mode\r
-      //\r
-      *SecureBootMode = SECURE_BOOT_MODE_USER_MODE;\r
-    } else if (*SetupMode == 1 && *AuditMode == 0 && *DeployedMode == 0) {\r
-      //\r
-      // Setup Mode\r
-      //\r
-      *SecureBootMode = SECURE_BOOT_MODE_SETUP_MODE;\r
-    } else if (*SetupMode == 1 && *AuditMode == 1 && *DeployedMode == 0) {\r
-      //\r
-      // Audit Mode\r
-      //\r
-      *SecureBootMode = SECURE_BOOT_MODE_AUDIT_MODE;\r
-    } else if (*SetupMode == 0 && *AuditMode == 0 && *DeployedMode == 1) {\r
-      //\r
-      // Deployed Mode\r
-      //\r
-      *SecureBootMode = SECURE_BOOT_MODE_DEPLOYED_MODE;\r
-    } else {\r
-      ASSERT(FALSE);\r
-    }\r
-  }else {\r
-    ASSERT(FALSE);\r
-  }\r
-\r
-  if (SetupMode != NULL) {\r
-    FreePool (SetupMode);\r
-  }\r
-  if (DeployedMode != NULL) {\r
-    FreePool (DeployedMode);\r
-  }\r
-  if (AuditMode != NULL) {\r
-    FreePool (AuditMode);\r
-  }\r
-}\r
-\r
 /**\r
 \r
   Update SecureBoot strings based on new Secure Boot Mode State. String includes STR_SECURE_BOOT_STATE_CONTENT\r
@@ -3098,7 +2846,6 @@ UpdateSecureBootString(
   IN SECUREBOOT_CONFIG_PRIVATE_DATA  *Private\r
   )\r
 {\r
-  UINT8       CurSecureBootMode;\r
   UINT8       *SecureBoot;\r
 \r
   SecureBoot = NULL;\r
@@ -3116,20 +2863,6 @@ UpdateSecureBootString(
   } else {\r
     HiiSetString (Private->HiiHandle, STRING_TOKEN (STR_SECURE_BOOT_STATE_CONTENT), L"Disabled", NULL);\r
   }\r
-  //\r
-  // Get current secure boot mode.\r
-  //\r
-  ExtractSecureBootModeFromVariable(&CurSecureBootMode);\r
-  \r
-  if (CurSecureBootMode == SECURE_BOOT_MODE_USER_MODE) {\r
-    HiiSetString (Private->HiiHandle, STRING_TOKEN (STR_CUR_SECURE_BOOT_MODE_CONTENT), L"UserMode", NULL);\r
-  } else if (CurSecureBootMode == SECURE_BOOT_MODE_SETUP_MODE) {\r
-    HiiSetString (Private->HiiHandle, STRING_TOKEN (STR_CUR_SECURE_BOOT_MODE_CONTENT), L"SetupMode", NULL);\r
-  } else if (CurSecureBootMode == SECURE_BOOT_MODE_AUDIT_MODE) {\r
-    HiiSetString (Private->HiiHandle, STRING_TOKEN (STR_CUR_SECURE_BOOT_MODE_CONTENT), L"AuditMode", NULL);\r
-  } else if (CurSecureBootMode == SECURE_BOOT_MODE_DEPLOYED_MODE) {\r
-    HiiSetString (Private->HiiHandle, STRING_TOKEN (STR_CUR_SECURE_BOOT_MODE_CONTENT), L"DeployedMode", NULL);\r
-  }\r
 \r
   FreePool(SecureBoot);\r
 \r
@@ -3148,10 +2881,12 @@ SecureBootExtractConfigFromVariable (
   )\r
 {\r
   UINT8     *SecureBootEnable;\r
+  UINT8     *SetupMode;\r
   UINT8     *SecureBootMode;\r
   EFI_TIME  CurrTime;\r
 \r
   SecureBootEnable = NULL;\r
+  SetupMode        = NULL;\r
   SecureBootMode   = NULL;\r
 \r
   //\r
@@ -3177,25 +2912,11 @@ SecureBootExtractConfigFromVariable (
     ConfigData->PhysicalPresent = FALSE;\r
   }\r
 \r
-  //\r
-  // Get the SecureBootMode from CustomMode variable.\r
-  //\r
-  GetVariable2 (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, (VOID**)&SecureBootMode, NULL);\r
-  if (SecureBootMode == NULL) {\r
-    ConfigData->SecureBootMode = STANDARD_SECURE_BOOT_MODE;\r
-  } else {\r
-    ConfigData->SecureBootMode = *(SecureBootMode);\r
-  }\r
-\r
-  //\r
-  // Extact current Secure Boot Mode\r
-  //\r
-  ExtractSecureBootModeFromVariable(&ConfigData->CurSecureBootMode);\r
-\r
   //\r
   // If there is no PK then the Delete Pk button will be gray.\r
   //\r
-  if (ConfigData->CurSecureBootMode == SECURE_BOOT_MODE_SETUP_MODE || ConfigData->CurSecureBootMode == SECURE_BOOT_MODE_AUDIT_MODE) {\r
+  GetVariable2 (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&SetupMode, NULL);\r
+  if (SetupMode == NULL || (*SetupMode) == SETUP_MODE) {\r
     ConfigData->HasPk = FALSE;\r
   } else  {\r
     ConfigData->HasPk = TRUE;\r
@@ -3212,7 +2933,7 @@ SecureBootExtractConfigFromVariable (
   //\r
   // Fix Pk, SecureBootEnable inconsistence\r
   //\r
-  if (ConfigData->CurSecureBootMode == SECURE_BOOT_MODE_USER_MODE || ConfigData->CurSecureBootMode == SECURE_BOOT_MODE_DEPLOYED_MODE) {\r
+  if ((*SetupMode) == USER_MODE) {\r
     ConfigData->HideSecureBoot = FALSE;\r
     if ((SecureBootEnable != NULL) && (*SecureBootEnable == SECURE_BOOT_ENABLE)) {\r
       ConfigData->AttemptSecureBoot = TRUE;\r
@@ -3221,10 +2942,22 @@ SecureBootExtractConfigFromVariable (
     ConfigData->HideSecureBoot = TRUE;\r
   }\r
 \r
+  //\r
+  // Get the SecureBootMode from CustomMode variable.\r
+  //\r
+  GetVariable2 (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, (VOID**)&SecureBootMode, NULL);\r
+  if (SecureBootMode == NULL) {\r
+    ConfigData->SecureBootMode = STANDARD_SECURE_BOOT_MODE;\r
+  } else {\r
+    ConfigData->SecureBootMode = *(SecureBootMode);\r
+  }\r
+\r
   if (SecureBootEnable != NULL) {\r
     FreePool (SecureBootEnable);\r
   }\r
-\r
+  if (SetupMode != NULL) {\r
+    FreePool (SetupMode);\r
+  }\r
   if (SecureBootMode != NULL) {\r
     FreePool (SecureBootMode);\r
   }\r
@@ -3458,18 +3191,20 @@ SecureBootCallback (
   UINT8                           *SecureBootEnable;\r
   UINT8                           *Pk;\r
   UINT8                           *SecureBootMode;\r
+  UINT8                           *SetupMode;\r
   CHAR16                          PromptString[100];\r
-  UINT8                           CurSecureBootMode;\r
   EFI_DEVICE_PATH_PROTOCOL        *File;\r
 \r
   Status           = EFI_SUCCESS;\r
   SecureBootEnable = NULL;\r
   SecureBootMode   = NULL;\r
+  SetupMode        = NULL;\r
   File             = NULL;\r
 \r
   if ((This == NULL) || (Value == NULL) || (ActionRequest == NULL)) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
+\r
   Private = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);\r
 \r
   gSecureBootPrivateData = Private;\r
@@ -3493,13 +3228,6 @@ SecureBootCallback (
       Status = UpdateSecureBootString(Private);\r
       SecureBootExtractConfigFromVariable (IfrNvData);\r
       mIsEnterSecureBootForm = TRUE;\r
-    } else if (QuestionId == KEY_TRANS_SECURE_BOOT_MODE){\r
-      //\r
-      // Secure Boot Policy variable changes after transition. Re-sync CurSecureBootMode\r
-      //\r
-      ExtractSecureBootModeFromVariable(&IfrNvData->CurSecureBootMode);\r
-      mIsSelectedSecureBootModeForm = TRUE;\r
-      mIsSecureBootModeChanged = FALSE;\r
     }\r
     goto EXIT;\r
   }\r
@@ -3511,12 +3239,7 @@ SecureBootCallback (
         Value->u8 = SECURE_BOOT_MODE_STANDARD;\r
         Status = EFI_SUCCESS;\r
       }\r
-    } else if (QuestionId == KEY_TRANS_SECURE_BOOT_MODE) {\r
-      if (mIsSelectedSecureBootModeForm) {\r
-        Value->u8 = IfrNvData->CurSecureBootMode;\r
-        Status = EFI_SUCCESS;\r
-      }\r
-    }\r
+    } \r
     goto EXIT;\r
   }\r
 \r
@@ -3770,57 +3493,6 @@ SecureBootCallback (
           );\r
       }\r
       break;\r
-    case KEY_TRANS_SECURE_BOOT_MODE:\r
-      //\r
-      // Pop up to alert user want to change secure boot mode \r
-      //\r
-      if ((IfrNvData->CurSecureBootMode == SECURE_BOOT_MODE_USER_MODE && \r
-           (Value->u8 == SECURE_BOOT_MODE_AUDIT_MODE || Value->u8 == SECURE_BOOT_MODE_DEPLOYED_MODE))\r
-        ||(IfrNvData->CurSecureBootMode == SECURE_BOOT_MODE_SETUP_MODE && \r
-           Value->u8 == SECURE_BOOT_MODE_AUDIT_MODE)\r
-        ||(IfrNvData->CurSecureBootMode == SECURE_BOOT_MODE_DEPLOYED_MODE && \r
-          Value->u8 == SECURE_BOOT_MODE_USER_MODE && IfrNvData->PhysicalPresent == 1)){\r
-        CreatePopUp (\r
-          EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,\r
-          &Key,\r
-          L"Are you sure you want to switch secure boot mode?",\r
-          L"Press 'Y' to switch secure boot mode, 'N' to discard change and return",\r
-          NULL\r
-          );\r
-        if (Key.UnicodeChar != 'y' && Key.UnicodeChar != 'Y') {\r
-          //\r
-          // If not 'Y'/''y' restore to defualt secure boot mode\r
-          //\r
-          Value->u8 = IfrNvData->CurSecureBootMode;\r
-          goto EXIT;\r
-        }\r
-      } else if ((IfrNvData->CurSecureBootMode == SECURE_BOOT_MODE_SETUP_MODE && Value->u8 == SECURE_BOOT_MODE_USER_MODE)\r
-               ||(IfrNvData->CurSecureBootMode == SECURE_BOOT_MODE_USER_MODE && Value->u8 == SECURE_BOOT_MODE_SETUP_MODE)\r
-               ||(IfrNvData->CurSecureBootMode == SECURE_BOOT_MODE_AUDIT_MODE && Value->u8 == SECURE_BOOT_MODE_DEPLOYED_MODE)\r
-               ||(IfrNvData->CurSecureBootMode == SECURE_BOOT_MODE_DEPLOYED_MODE && Value->u8 == SECURE_BOOT_MODE_SETUP_MODE)) {\r
-        CreatePopUp (\r
-          EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,\r
-          &Key,\r
-          L"Secure boot mode transition requires PK change",\r
-          L"Please go to link below to update PK",\r
-          NULL\r
-          );\r
-      } else {\r
-        Status = EFI_INVALID_PARAMETER;\r
-        goto EXIT;\r
-      }\r
-\r
-      Status = SecureBootModeTransition(IfrNvData->CurSecureBootMode, Value->u8);\r
-      //\r
-      // Secure Boot Policy variable may change after transition. Re-sync CurSecureBootMode\r
-      //\r
-      ExtractSecureBootModeFromVariable(&CurSecureBootMode);\r
-      if (IfrNvData->CurSecureBootMode != CurSecureBootMode) {\r
-        IfrNvData->CurSecureBootMode = CurSecureBootMode;\r
-        mIsSecureBootModeChanged = TRUE;\r
-      }\r
-      break;\r
-\r
     default:\r
       if ((QuestionId >= OPTION_DEL_KEK_QUESTION_ID) &&\r
                  (QuestionId < (OPTION_DEL_KEK_QUESTION_ID + OPTION_CONFIG_RANGE))) {\r
@@ -3889,13 +3561,6 @@ SecureBootCallback (
     case KEY_SECURE_BOOT_MODE:\r
       mIsEnterSecureBootForm = FALSE;\r
       break;\r
-    case KEY_TRANS_SECURE_BOOT_MODE:\r
-      mIsSelectedSecureBootModeForm = FALSE;\r
-      if (mIsSecureBootModeChanged) {\r
-        *ActionRequest = EFI_BROWSER_ACTION_REQUEST_RESET;\r
-      }\r
-      mIsSecureBootModeChanged = FALSE;\r
-      break;\r
     case KEY_SECURE_BOOT_KEK_GUID:\r
     case KEY_SECURE_BOOT_SIGNATURE_GUID_DB:\r
     case KEY_SECURE_BOOT_SIGNATURE_GUID_DBX:\r
@@ -3914,7 +3579,8 @@ SecureBootCallback (
       break;\r
 \r
     case KEY_SECURE_BOOT_DELETE_PK:\r
-      if (IfrNvData->CurSecureBootMode == SECURE_BOOT_MODE_USER_MODE || IfrNvData->CurSecureBootMode == SECURE_BOOT_MODE_DEPLOYED_MODE) {\r
+      GetVariable2 (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&SetupMode, NULL);\r
+      if (SetupMode == NULL || (*SetupMode) == SETUP_MODE) {\r
         IfrNvData->DeletePk = TRUE;\r
         IfrNvData->HasPk    = FALSE;\r
         *ActionRequest = EFI_BROWSER_ACTION_REQUEST_SUBMIT;\r
@@ -3923,6 +3589,9 @@ SecureBootCallback (
         IfrNvData->HasPk    = TRUE;\r
         *ActionRequest = EFI_BROWSER_ACTION_REQUEST_FORM_APPLY;\r
       }\r
+      if (SetupMode != NULL) {\r
+        FreePool (SetupMode);\r
+      }\r
       break;\r
     default:\r
       break;\r

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
index cf8dc885dedbe05586915c9bf38e85bba3a89bcd..df4d72ec160638258011c30c1da8f19a71953d7f 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
@@ -56,7 +56,6 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define KEY_HIDE_SECURE_BOOT                  0x100c\r
 #define KEY_VALUE_SAVE_AND_EXIT_DBT           0x100d\r
 #define KEY_VALUE_NO_SAVE_AND_EXIT_DBT        0x100e\r
-#define KEY_TRANS_SECURE_BOOT_MODE            0x100f\r
 \r
 #define KEY_SECURE_BOOT_OPTION                0x1100\r
 #define KEY_SECURE_BOOT_PK_OPTION             0x1101\r
@@ -108,10 +107,6 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define SECURE_BOOT_GUID_SIZE                 36\r
 #define SECURE_BOOT_GUID_STORAGE_SIZE         37\r
 \r
-#define SECURE_BOOT_MODE_USER_MODE            0\r
-#define SECURE_BOOT_MODE_SETUP_MODE           1\r
-#define SECURE_BOOT_MODE_AUDIT_MODE           2\r
-#define SECURE_BOOT_MODE_DEPLOYED_MODE        3\r
 \r
 //\r
 // Nv Data structure referenced by IFR\r
@@ -122,8 +117,6 @@ typedef struct {
   CHAR16  SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE];\r
   BOOLEAN PhysicalPresent;     // If a Physical Present User\r
   UINT8   SecureBootMode;      // Secure Boot Mode: Standard Or Custom\r
-  UINT8   CurSecureBootMode;   // Current SecureBoot Mode SetupMode/UserMode/AuditMode/DeployedMode\r
-  UINT8   TransSecureBootMode; // Trans Next SecureBoot Mode\r
   BOOLEAN DeletePk;\r
   BOOLEAN HasPk;               // If Pk is existed it is true\r
   BOOLEAN AlwaysRevocation;    // If the certificate is always revoked. Revocation time is hidden\r

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
index eedd8b52ddc9bcc0415272a9338a052ce4ad2887..af6d83b5f81008221bacb2937c83e78e1d879f75 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
@@ -26,10 +26,6 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #string STR_SECURE_BOOT_PROMPT             #language en-US "Attempt Secure Boot"\r
 #string STR_SECURE_BOOT_HELP               #language en-US "Enable/Disable the Secure Boot feature after platform reset"\r
 \r
-#string STR_CUR_SECURE_BOOT_MODE_PROMPT    #language en-US "Current Secure Boot Mode"\r
-#string STR_CUR_SECURE_BOOT_MODE_HELP      #language en-US "Current Secure Boot Mode: SetupMode/AuditMode/UserMode/DeployedMode."\r
-#string STR_CUR_SECURE_BOOT_MODE_CONTENT   #language en-US " "\r
-\r
 #string STR_SECURE_BOOT_ENROLL_SIGNATURE   #language en-US "Enroll Signature"\r
 #string STR_SECURE_BOOT_DELETE_SIGNATURE   #language en-US "Delete Signature"\r
 \r
@@ -60,11 +56,11 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 \r
 #string STR_FILE_EXPLORER_TITLE            #language en-US  "File Explorer"\r
 \r
-#string STR_SECURE_BOOT_MODE_PROMPT        #language en-US "Customize Secure Boot"\r
-#string STR_SECURE_BOOT_MODE_HELP          #language en-US "Customize Secure Boot: Standard/Customized. Secure Boot Policy variables can be configured without authentication in customized option"\r
+#string STR_SECURE_BOOT_MODE_PROMPT        #language en-US "Secure Boot Mode"\r
+#string STR_SECURE_BOOT_MODE_HELP          #language en-US "Secure Boot Mode: Custom Mode or Standard Mode"\r
 \r
-#string STR_STANDARD_MODE                  #language en-US "Standard"\r
-#string STR_CUSTOM_MODE                    #language en-US "Customized"\r
+#string STR_STANDARD_MODE                  #language en-US "Standard Mode"\r
+#string STR_CUSTOM_MODE                    #language en-US "Custom Mode"\r
 \r
 #string STR_SECURE_BOOT_OPTION             #language en-US "Custom Secure Boot Options"\r
 #string STR_SECURE_BOOT_OPTION_HELP        #language en-US "Enter into Custom Secure Boot Options Form"\r
@@ -111,11 +107,3 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #string STR_CERT_TYPE_X509_SHA256_GUID            #language en-US "X509_SHA256_GUID"\r
 #string STR_CERT_TYPE_X509_SHA384_GUID            #language en-US "X509_SHA384_GUID"\r
 #string STR_CERT_TYPE_X509_SHA512_GUID            #language en-US "X509_SHA512_GUID"\r
-\r
-#string STR_TRANS_SECURE_BOOT_MODE_PROMPT         #language en-US "Secure Boot Mode Transition"\r
-#string STR_TRANS_SECURE_BOOT_MODE_HELP           #language en-US "Secure Boot Mode Transition: SetupMode/UserMode/AuditMode/DeployedMode"\r
-\r
-#string STR_USER_MODE                   #language en-US "User Mode"\r
-#string STR_SETUP_MODE                  #language en-US "Setup Mode"\r
-#string STR_AUDIT_MODE                  #language en-US "Audit Mode"\r
-#string STR_DEPLOYED_MODE               #language en-US "Deployed Mode"
\ No newline at end of file