UEFI 2.4 X509 Certificate Hash and RFC3161 Timestamp Verification support for Secure...

Main ChangeLogs includes:
1. Introduce the new GUID and structure definitions for certificate hash and timestamp support;
2. Update Image Verification Library to support DBT signature checking;
3. Update the related SecureBoot Configuration Pages;

Contributed-under: TianoCore Contribution Agreement 1.0

Signed-off-by: Qin Long <qin.long@intel.com>
Reviewed-by: Guo Dong <guo.dong@intel.com>
Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@16380 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdePkg/Include/Guid/ImageAuthentication.h b/MdePkg/Include/Guid/ImageAuthentication.h
index 8b46e7356b757600ff142871c456df5aa3155fcb..427a7d47bbe80ad5c4f4cca0a0757e7f9b003d57 100644 (file)
--- a/MdePkg/Include/Guid/ImageAuthentication.h
+++ b/MdePkg/Include/Guid/ImageAuthentication.h
@@ -1,23 +1,24 @@
 /** @file\r
   Image signature database are defined for the signed image validation.\r
 \r
 /** @file\r
   Image signature database are defined for the signed image validation.\r
 \r

-  Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>\r
-  This program and the accompanying materials                          \r
-  are licensed and made available under the terms and conditions of the BSD License         \r
-  which accompanies this distribution.  The full text of the license may be found at        \r
-  http://opensource.org/licenses/bsd-license.php                                            \r
+  Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>\r
+  This program and the accompanying materials\r
+  are licensed and made available under the terms and conditions of the BSD License\r
+  which accompanies this distribution.  The full text of the license may be found at\r
+  http://opensource.org/licenses/bsd-license.php\r

 \r
 \r

-  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,                     \r
-  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.             \r
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r

 \r
   @par Revision Reference:\r
 \r
   @par Revision Reference:\r

-  GUIDs defined in UEFI 2.3.1 spec.\r
+  GUIDs defined in UEFI 2.4 spec.\r

 **/\r
 \r
 #ifndef __IMAGE_AUTHTICATION_H__\r
 #define __IMAGE_AUTHTICATION_H__\r
 \r
 #include <Guid/GlobalVariable.h>\r
 **/\r
 \r
 #ifndef __IMAGE_AUTHTICATION_H__\r
 #define __IMAGE_AUTHTICATION_H__\r
 \r
 #include <Guid/GlobalVariable.h>\r

+#include <Protocol/Hash.h>\r

 \r
 #define EFI_IMAGE_SECURITY_DATABASE_GUID \\r
   { \\r
 \r
 #define EFI_IMAGE_SECURITY_DATABASE_GUID \\r
   { \\r


@@ -25,15 +26,20 @@
   }\r
 \r
 ///\r
   }\r
 \r
 ///\r

-/// Varialbe name with guid EFI_IMAGE_SECURITY_DATABASE_GUID \r
+/// Varialbe name with guid EFI_IMAGE_SECURITY_DATABASE_GUID\r

 /// for the authorized signature database.\r
 ///\r
 #define EFI_IMAGE_SECURITY_DATABASE       L"db"\r
 ///\r
 /// for the authorized signature database.\r
 ///\r
 #define EFI_IMAGE_SECURITY_DATABASE       L"db"\r
 ///\r

-/// Varialbe name with guid EFI_IMAGE_SECURITY_DATABASE_GUID \r
+/// Varialbe name with guid EFI_IMAGE_SECURITY_DATABASE_GUID\r

 /// for the forbidden signature database.\r
 ///\r
 #define EFI_IMAGE_SECURITY_DATABASE1      L"dbx"\r
 /// for the forbidden signature database.\r
 ///\r
 #define EFI_IMAGE_SECURITY_DATABASE1      L"dbx"\r

+///\r
+/// Variable name with guid EFI_IMAGE_SECURITY_DATABASE_GUID\r
+/// for the timestamp signature database.\r
+///\r
+#define EFI_IMAGE_SECURITY_DATABASE2      L"dbt"\r

 \r
 #define SECURE_BOOT_MODE_ENABLE           1\r
 #define SECURE_BOOT_MODE_DISABLE          0\r
 \r
 #define SECURE_BOOT_MODE_ENABLE           1\r
 #define SECURE_BOOT_MODE_DISABLE          0\r


@@ -45,7 +51,7 @@
 // Signature Database\r
 //***********************************************************************\r
 ///\r
 // Signature Database\r
 //***********************************************************************\r
 ///\r

-/// The format of a signature database. \r
+/// The format of a signature database.\r

 ///\r
 #pragma pack(1)\r
 \r
 ///\r
 #pragma pack(1)\r
 \r


@@ -76,17 +82,50 @@ typedef struct {
   ///\r
   /// Size of each signature.\r
   ///\r
   ///\r
   /// Size of each signature.\r
   ///\r

-  UINT32              SignatureSize; \r
+  UINT32              SignatureSize;\r

   ///\r
   ///\r

-  /// Header before the array of signatures. The format of this header is specified \r
+  /// Header before the array of signatures. The format of this header is specified\r

   /// by the SignatureType.\r
   /// UINT8           SignatureHeader[SignatureHeaderSize];\r
   ///\r
   /// by the SignatureType.\r
   /// UINT8           SignatureHeader[SignatureHeaderSize];\r
   ///\r

-  /// An array of signatures. Each signature is SignatureSize bytes in length. \r
+  /// An array of signatures. Each signature is SignatureSize bytes in length.\r

   /// EFI_SIGNATURE_DATA Signatures[][SignatureSize];\r
   ///\r
 } EFI_SIGNATURE_LIST;\r
 \r
   /// EFI_SIGNATURE_DATA Signatures[][SignatureSize];\r
   ///\r
 } EFI_SIGNATURE_LIST;\r
 \r

+typedef struct {\r
+  ///\r
+  /// The SHA256 hash of an X.509 certificate's To-Be-Signed contents.\r
+  ///\r
+  EFI_SHA256_HASH     ToBeSignedHash;\r
+  ///\r
+  /// The time that the certificate shall be considered to be revoked.\r
+  ///\r
+  EFI_TIME            TimeOfRevocation;\r
+} EFI_CERT_X509_SHA256;\r
+\r
+typedef struct {\r
+  ///\r
+  /// The SHA384 hash of an X.509 certificate's To-Be-Signed contents.\r
+  ///\r
+  EFI_SHA384_HASH     ToBeSignedHash;\r
+  ///\r
+  /// The time that the certificate shall be considered to be revoked.\r
+  ///\r
+  EFI_TIME            TimeOfRevocation;\r
+} EFI_CERT_X509_SHA384;\r
+\r
+typedef struct {\r
+  ///\r
+  /// The SHA512 hash of an X.509 certificate's To-Be-Signed contents.\r
+  ///\r
+  EFI_SHA512_HASH     ToBeSignedHash;\r
+  ///\r
+  /// The time that the certificate shall be considered to be revoked.\r
+  ///\r
+  EFI_TIME            TimeOfRevocation;\r
+} EFI_CERT_X509_SHA512;\r
+\r

 #pragma pack()\r
 \r
 ///\r
 #pragma pack()\r
 \r
 ///\r


@@ -103,7 +142,7 @@ typedef struct {
 /// This identifies a signature containing an RSA-2048 key. The key (only the modulus\r
 /// since the public key exponent is known to be 0x10001) shall be stored in big-endian\r
 /// order.\r
 /// This identifies a signature containing an RSA-2048 key. The key (only the modulus\r
 /// since the public key exponent is known to be 0x10001) shall be stored in big-endian\r
 /// order.\r

-/// The SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size \r
+/// The SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size\r

 /// of SignatureOwner component) + 256 bytes.\r
 ///\r
 #define EFI_CERT_RSA2048_GUID \\r
 /// of SignatureOwner component) + 256 bytes.\r
 ///\r
 #define EFI_CERT_RSA2048_GUID \\r


@@ -112,8 +151,8 @@ typedef struct {
   }\r
 \r
 ///\r
   }\r
 \r
 ///\r

-/// This identifies a signature containing a RSA-2048 signature of a SHA-256 hash.  The \r
-/// SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size of \r
+/// This identifies a signature containing a RSA-2048 signature of a SHA-256 hash.  The\r
+/// SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size of\r

 /// SignatureOwner component) + 256 bytes.\r
 ///\r
 #define EFI_CERT_RSA2048_SHA256_GUID \\r
 /// SignatureOwner component) + 256 bytes.\r
 ///\r
 #define EFI_CERT_RSA2048_SHA256_GUID \\r


@@ -131,8 +170,8 @@ typedef struct {
   }\r
 \r
 ///\r
   }\r
 \r
 ///\r

-/// TThis identifies a signature containing a RSA-2048 signature of a SHA-1 hash.  The \r
-/// SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size of \r
+/// TThis identifies a signature containing a RSA-2048 signature of a SHA-1 hash.  The\r
+/// SignatureHeader size shall always be 0. The SignatureSize shall always be 16 (size of\r

 /// SignatureOwner component) + 256 bytes.\r
 ///\r
 #define EFI_CERT_RSA2048_SHA1_GUID \\r
 /// SignatureOwner component) + 256 bytes.\r
 ///\r
 #define EFI_CERT_RSA2048_SHA1_GUID \\r


@@ -142,11 +181,11 @@ typedef struct {
 \r
 ///\r
 /// This identifies a signature based on an X.509 certificate. If the signature is an X.509\r
 \r
 ///\r
 /// This identifies a signature based on an X.509 certificate. If the signature is an X.509\r

-/// certificate then verification of the signature of an image should validate the public \r
-/// key certificate in the image using certificate path verification, up to this X.509 \r
+/// certificate then verification of the signature of an image should validate the public\r
+/// key certificate in the image using certificate path verification, up to this X.509\r

 /// certificate as a trusted root.  The SignatureHeader size shall always be 0. The\r
 /// certificate as a trusted root.  The SignatureHeader size shall always be 0. The\r

-/// SignatureSize may vary but shall always be 16 (size of the SignatureOwner component) + \r
-/// the size of the certificate itself. \r
+/// SignatureSize may vary but shall always be 16 (size of the SignatureOwner component) +\r
+/// the size of the certificate itself.\r

 /// Note: This means that each certificate will normally be in a separate EFI_SIGNATURE_LIST.\r
 ///\r
 #define EFI_CERT_X509_GUID \\r
 /// Note: This means that each certificate will normally be in a separate EFI_SIGNATURE_LIST.\r
 ///\r
 #define EFI_CERT_X509_GUID \\r


@@ -172,7 +211,7 @@ typedef struct {
 #define EFI_CERT_SHA384_GUID \\r
   { \\r
     0xff3e5307, 0x9fd0, 0x48c9, {0x85, 0xf1, 0x8a, 0xd5, 0x6c, 0x70, 0x1e, 0x1} \\r
 #define EFI_CERT_SHA384_GUID \\r
   { \\r
     0xff3e5307, 0x9fd0, 0x48c9, {0x85, 0xf1, 0x8a, 0xd5, 0x6c, 0x70, 0x1e, 0x1} \\r

-  }  \r
+  }\r

 \r
 ///\r
 /// This identifies a signature containing a SHA-512 hash. The SignatureHeader size shall\r
 \r
 ///\r
 /// This identifies a signature containing a SHA-512 hash. The SignatureHeader size shall\r


@@ -184,6 +223,45 @@ typedef struct {
     0x93e0fae, 0xa6c4, 0x4f50, {0x9f, 0x1b, 0xd4, 0x1e, 0x2b, 0x89, 0xc1, 0x9a} \\r
   }\r
 \r
     0x93e0fae, 0xa6c4, 0x4f50, {0x9f, 0x1b, 0xd4, 0x1e, 0x2b, 0x89, 0xc1, 0x9a} \\r
   }\r
 \r

+///\r
+/// This identifies a signature containing the SHA256 hash of an X.509 certificate's\r
+/// To-Be-Signed contents, and a time of revocation. The SignatureHeader size shall\r
+/// always be 0. The SignatureSize shall always be 16 (size of the SignatureOwner component)\r
+/// + 48 bytes for an EFI_CERT_X509_SHA256 structure. If the TimeOfRevocation is non-zero,\r
+/// the certificate should be considered to be revoked from that time and onwards, and\r
+/// otherwise the certificate shall be considered to always be revoked.\r
+///\r
+#define EFI_CERT_X509_SHA256_GUID \\r
+  { \\r
+    0x3bd2a492, 0x96c0, 0x4079, {0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed } \\r
+  }\r
+\r
+///\r
+/// This identifies a signature containing the SHA384 hash of an X.509 certificate's\r
+/// To-Be-Signed contents, and a time of revocation. The SignatureHeader size shall\r
+/// always be 0. The SignatureSize shall always be 16 (size of the SignatureOwner component)\r
+/// + 64 bytes for an EFI_CERT_X509_SHA384 structure. If the TimeOfRevocation is non-zero,\r
+/// the certificate should be considered to be revoked from that time and onwards, and\r
+/// otherwise the certificate shall be considered to always be revoked.\r
+///\r
+#define EFI_CERT_X509_SHA384_GUID \\r
+  { \\r
+    0x7076876e, 0x80c2, 0x4ee6, {0xaa, 0xd2, 0x28, 0xb3, 0x49, 0xa6, 0x86, 0x5b } \\r
+  }\r
+\r
+///\r
+/// This identifies a signature containing the SHA512 hash of an X.509 certificate's\r
+/// To-Be-Signed contents, and a time of revocation. The SignatureHeader size shall\r
+/// always be 0. The SignatureSize shall always be 16 (size of the SignatureOwner component)\r
+/// + 80 bytes for an EFI_CERT_X509_SHA512 structure. If the TimeOfRevocation is non-zero,\r
+/// the certificate should be considered to be revoked from that time and onwards, and\r
+/// otherwise the certificate shall be considered to always be revoked.\r
+///\r
+#define EFI_CERT_X509_SHA512_GUID \\r
+  { \\r
+    0x446dbf63, 0x2502, 0x4cda, {0xbc, 0xfa, 0x24, 0x65, 0xd2, 0xb0, 0xfe, 0x9d } \\r
+  }\r
+\r

 ///\r
 /// This identifies a signature containing a DER-encoded PKCS #7 version 1.5 [RFC2315]\r
 /// SignedData value.\r
 ///\r
 /// This identifies a signature containing a DER-encoded PKCS #7 version 1.5 [RFC2315]\r
 /// SignedData value.\r


@@ -192,13 +270,13 @@ typedef struct {
   { \\r
     0x4aafd29d, 0x68df, 0x49ee, {0x8a, 0xa9, 0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7} \\r
   }\r
   { \\r
     0x4aafd29d, 0x68df, 0x49ee, {0x8a, 0xa9, 0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7} \\r
   }\r

-  \r
+\r

 //***********************************************************************\r
 // Image Execution Information Table Definition\r
 //***********************************************************************\r
 typedef UINT32 EFI_IMAGE_EXECUTION_ACTION;\r
 \r
 //***********************************************************************\r
 // Image Execution Information Table Definition\r
 //***********************************************************************\r
 typedef UINT32 EFI_IMAGE_EXECUTION_ACTION;\r
 \r

-#define EFI_IMAGE_EXECUTION_AUTHENTICATION      0x00000007 \r
+#define EFI_IMAGE_EXECUTION_AUTHENTICATION      0x00000007\r

 #define EFI_IMAGE_EXECUTION_AUTH_UNTESTED       0x00000000\r
 #define EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED     0x00000001\r
 #define EFI_IMAGE_EXECUTION_AUTH_SIG_PASSED     0x00000002\r
 #define EFI_IMAGE_EXECUTION_AUTH_UNTESTED       0x00000000\r
 #define EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED     0x00000001\r
 #define EFI_IMAGE_EXECUTION_AUTH_SIG_PASSED     0x00000002\r


@@ -208,7 +286,7 @@ typedef UINT32 EFI_IMAGE_EXECUTION_ACTION;
 #define EFI_IMAGE_EXECUTION_INITIALIZED         0x00000008\r
 \r
 //\r
 #define EFI_IMAGE_EXECUTION_INITIALIZED         0x00000008\r
 \r
 //\r

-// EFI_IMAGE_EXECUTION_INFO is added to EFI System Configuration Table \r
+// EFI_IMAGE_EXECUTION_INFO is added to EFI System Configuration Table\r

 // and assigned the GUID EFI_IMAGE_SECURITY_DATABASE_GUID.\r
 //\r
 typedef struct {\r
 // and assigned the GUID EFI_IMAGE_SECURITY_DATABASE_GUID.\r
 //\r
 typedef struct {\r


@@ -221,24 +299,24 @@ typedef struct {
   ///\r
   UINT32                        InfoSize;\r
   ///\r
   ///\r
   UINT32                        InfoSize;\r
   ///\r

-  /// If this image was a UEFI device driver (for option ROM, for example) this is the \r
-  /// null-terminated, user-friendly name for the device. If the image was for an application, \r
-  /// then this is the name of the application. If this cannot be determined, then a simple \r
+  /// If this image was a UEFI device driver (for option ROM, for example) this is the\r
+  /// null-terminated, user-friendly name for the device. If the image was for an application,\r
+  /// then this is the name of the application. If this cannot be determined, then a simple\r

   /// NULL character should be put in this position.\r
   /// CHAR16                    Name[];\r
   ///\r
 \r
   ///\r
   /// NULL character should be put in this position.\r
   /// CHAR16                    Name[];\r
   ///\r
 \r
   ///\r

-  /// For device drivers, this is the device path of the device for which this device driver \r
-  /// was intended. In some cases, the driver itself may be stored as part of the system \r
-  /// firmware, but this field should record the device's path, not the firmware path. For \r
-  /// applications, this is the device path of the application. If this cannot be determined, \r
+  /// For device drivers, this is the device path of the device for which this device driver\r
+  /// was intended. In some cases, the driver itself may be stored as part of the system\r
+  /// firmware, but this field should record the device's path, not the firmware path. For\r
+  /// applications, this is the device path of the application. If this cannot be determined,\r

   /// a simple end-of-path device node should be put in this position.\r
   /// EFI_DEVICE_PATH_PROTOCOL  DevicePath;\r
   ///\r
 \r
   ///\r
   /// a simple end-of-path device node should be put in this position.\r
   /// EFI_DEVICE_PATH_PROTOCOL  DevicePath;\r
   ///\r
 \r
   ///\r

-  /// Zero or more image signatures. If the image contained no signatures, \r
+  /// Zero or more image signatures. If the image contained no signatures,\r

   /// then this field is empty.\r
   ///\r
   EFI_SIGNATURE_LIST            Signature;\r
   /// then this field is empty.\r
   ///\r
   EFI_SIGNATURE_LIST            Signature;\r


@@ -249,16 +327,16 @@ typedef struct {
   ///\r
   /// Number of EFI_IMAGE_EXECUTION_INFO structures.\r
   ///\r
   ///\r
   /// Number of EFI_IMAGE_EXECUTION_INFO structures.\r
   ///\r

-  UINTN                     NumberOfImages; \r
+  UINTN                     NumberOfImages;\r

   ///\r
   /// Number of image instances of EFI_IMAGE_EXECUTION_INFO structures.\r
   ///\r
   ///\r
   /// Number of image instances of EFI_IMAGE_EXECUTION_INFO structures.\r
   ///\r

-  // EFI_IMAGE_EXECUTION_INFO  InformationInfo[] \r
+  // EFI_IMAGE_EXECUTION_INFO  InformationInfo[]\r

 } EFI_IMAGE_EXECUTION_INFO_TABLE;\r
 \r
 extern EFI_GUID gEfiImageSecurityDatabaseGuid;\r
 extern EFI_GUID gEfiCertSha256Guid;\r
 } EFI_IMAGE_EXECUTION_INFO_TABLE;\r
 \r
 extern EFI_GUID gEfiImageSecurityDatabaseGuid;\r
 extern EFI_GUID gEfiCertSha256Guid;\r

-extern EFI_GUID gEfiCertRsa2048Guid;      \r
+extern EFI_GUID gEfiCertRsa2048Guid;\r

 extern EFI_GUID gEfiCertRsa2048Sha256Guid;\r
 extern EFI_GUID gEfiCertSha1Guid;\r
 extern EFI_GUID gEfiCertRsa2048Sha1Guid;\r
 extern EFI_GUID gEfiCertRsa2048Sha256Guid;\r
 extern EFI_GUID gEfiCertSha1Guid;\r
 extern EFI_GUID gEfiCertRsa2048Sha1Guid;\r


@@ -266,6 +344,9 @@ extern EFI_GUID gEfiCertX509Guid;
 extern EFI_GUID gEfiCertSha224Guid;\r
 extern EFI_GUID gEfiCertSha384Guid;\r
 extern EFI_GUID gEfiCertSha512Guid;\r
 extern EFI_GUID gEfiCertSha224Guid;\r
 extern EFI_GUID gEfiCertSha384Guid;\r
 extern EFI_GUID gEfiCertSha512Guid;\r

+extern EFI_GUID gEfiCertX509Sha256Guid;\r
+extern EFI_GUID gEfiCertX509Sha384Guid;\r
+extern EFI_GUID gEfiCertX509Sha512Guid;\r

 extern EFI_GUID gEfiCertPkcs7Guid;\r
 \r
 extern EFI_GUID gEfiCertPkcs7Guid;\r
 \r

-#endif\r
+#endif
\ No newline at end of file

diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec
index f9e0c8f0319a27f6fc9632a34c4071c79fffd664..6dc696e5d9756b9b435e261cb6fb01ae18587bc2 100644 (file)
--- a/MdePkg/MdePkg.dec
+++ b/MdePkg/MdePkg.dec
@@ -201,7 +201,7 @@
   #                  Script Opcodes.  These OpCode will be restored by S3\r
   #                  related modules.\r
   S3BootScriptLib|Include/Library/S3BootScriptLib.h\r
   #                  Script Opcodes.  These OpCode will be restored by S3\r
   #                  related modules.\r
   S3BootScriptLib|Include/Library/S3BootScriptLib.h\r

-  \r
+\r

   ##  @libraryclass  I/O and MMIO Library Services that do I/O and also enable\r
   #                  the I/O operatation to be replayed during an S3 resume.\r
   #                  This library class maps directly on top of the IoLib class.\r
   ##  @libraryclass  I/O and MMIO Library Services that do I/O and also enable\r
   #                  the I/O operatation to be replayed during an S3 resume.\r
   #                  This library class maps directly on top of the IoLib class.\r


@@ -222,7 +222,7 @@
   #                  operatation to be replayed during an S3 resume. This\r
   #                  library class maps directly on top of the Timer class.\r
   S3StallLib|Include/Library/S3StallLib.h\r
   #                  operatation to be replayed during an S3 resume. This\r
   #                  library class maps directly on top of the Timer class.\r
   S3StallLib|Include/Library/S3StallLib.h\r

-  \r
+\r

   ##  @libraryclass  Defines library APIs used by modules to get/set print error level.\r
   DebugPrintErrorLevelLib|Include/Library/DebugPrintErrorLevelLib.h\r
 \r
   ##  @libraryclass  Defines library APIs used by modules to get/set print error level.\r
   DebugPrintErrorLevelLib|Include/Library/DebugPrintErrorLevelLib.h\r
 \r


@@ -238,7 +238,7 @@
   ##  @libraryclass  Provides services to enable/disable periodic SMI handlers.\r
   #\r
   SmmPeriodicSmiLib|Include/Library/SmmPeriodicSmiLib.h\r
   ##  @libraryclass  Provides services to enable/disable periodic SMI handlers.\r
   #\r
   SmmPeriodicSmiLib|Include/Library/SmmPeriodicSmiLib.h\r

-  \r
+\r

 [LibraryClasses.IPF]\r
   ##  @libraryclass  The SAL Library provides a service to make a SAL CALL.\r
   SalLib|Include/Library/SalLib.h\r
 [LibraryClasses.IPF]\r
   ##  @libraryclass  The SAL Library provides a service to make a SAL CALL.\r
   SalLib|Include/Library/SalLib.h\r


@@ -248,7 +248,7 @@
 \r
   ##  @libraryclass  Provides library services to make Extended SAL Calls.\r
   ExtendedSalLib|Include/Library/ExtendedSalLib.h\r
 \r
   ##  @libraryclass  Provides library services to make Extended SAL Calls.\r
   ExtendedSalLib|Include/Library/ExtendedSalLib.h\r

-  \r
+\r

 [Guids]\r
   #\r
   # GUID defined in UEFI2.1/UEFI2.0/EFI1.1\r
 [Guids]\r
   #\r
   # GUID defined in UEFI2.1/UEFI2.0/EFI1.1\r


@@ -523,6 +523,11 @@
   ## Include/Guid/FmpCapsule.h\r
   gEfiFmpCapsuleGuid             =  { 0x6dcbd5ed, 0xe82d, 0x4c44, {0xbd, 0xa1, 0x71, 0x94, 0x19, 0x9a, 0xd9, 0x2a }}\r
 \r
   ## Include/Guid/FmpCapsule.h\r
   gEfiFmpCapsuleGuid             =  { 0x6dcbd5ed, 0xe82d, 0x4c44, {0xbd, 0xa1, 0x71, 0x94, 0x19, 0x9a, 0xd9, 0x2a }}\r
 \r

+  ## Include/Guid/ImageAuthentication.h\r
+  gEfiCertX509Sha256Guid         = { 0x3bd2a492, 0x96c0, 0x4079, {0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed }}\r
+  gEfiCertX509Sha384Guid         = { 0x7076876e, 0x80c2, 0x4ee6, {0xaa, 0xd2, 0x28, 0xb3, 0x49, 0xa6, 0x86, 0x5b }}\r
+  gEfiCertX509Sha512Guid         = { 0x446dbf63, 0x2502, 0x4cda, {0xbc, 0xfa, 0x24, 0x65, 0xd2, 0xb0, 0xfe, 0x9d }}\r
+\r

   ## Include/Protocol/Rng.h\r
   gEfiRngAlgorithmSp80090Hash256Guid = { 0xa7af67cb, 0x603b, 0x4d42, {0xba, 0x21, 0x70, 0xbf, 0xb6, 0x29, 0x3f, 0x96 }}\r
   gEfiRngAlgorithmSp80090Hmac256Guid = { 0xc5149b43, 0xae85, 0x4f53, {0x99, 0x82, 0xb9, 0x43, 0x35, 0xd3, 0xa9, 0xe7 }}\r
   ## Include/Protocol/Rng.h\r
   gEfiRngAlgorithmSp80090Hash256Guid = { 0xa7af67cb, 0x603b, 0x4d42, {0xba, 0x21, 0x70, 0xbf, 0xb6, 0x29, 0x3f, 0x96 }}\r
   gEfiRngAlgorithmSp80090Hmac256Guid = { 0xc5149b43, 0xae85, 0x4f53, {0x99, 0x82, 0xb9, 0x43, 0x35, 0xd3, 0xa9, 0xe7 }}\r


@@ -535,7 +540,7 @@
   gEfiAdapterInfoMediaStateGuid       = { 0xD7C74207, 0xA831, 0x4A26, {0xB1, 0xF5, 0xD1, 0x93, 0x06, 0x5C, 0xE8, 0xB6 }}\r
   gEfiAdapterInfoNetworkBootGuid      = { 0x1FBD2960, 0x4130, 0x41E5, {0x94, 0xAC, 0xD2, 0xCF, 0x03, 0x7F, 0xB3, 0x7C }}\r
   gEfiAdapterInfoSanMacAddressGuid    = { 0x114da5ef, 0x2cf1, 0x4e12, {0x9b, 0xbb, 0xc4, 0x70, 0xb5, 0x52, 0x5, 0xd9 }}\r
   gEfiAdapterInfoMediaStateGuid       = { 0xD7C74207, 0xA831, 0x4A26, {0xB1, 0xF5, 0xD1, 0x93, 0x06, 0x5C, 0xE8, 0xB6 }}\r
   gEfiAdapterInfoNetworkBootGuid      = { 0x1FBD2960, 0x4130, 0x41E5, {0x94, 0xAC, 0xD2, 0xCF, 0x03, 0x7F, 0xB3, 0x7C }}\r
   gEfiAdapterInfoSanMacAddressGuid    = { 0x114da5ef, 0x2cf1, 0x4e12, {0x9b, 0xbb, 0xc4, 0x70, 0xb5, 0x52, 0x5, 0xd9 }}\r

-       \r
+\r

   #\r
   # GUID defined in PI1.0\r
   #\r
   #\r
   # GUID defined in PI1.0\r
   #\r


@@ -611,7 +616,7 @@
   #\r
   ## Include/Guid/EventGroup.h\r
   gEfiEndOfDxeEventGroupGuid        = { 0x2ce967a, 0xdd7e, 0x4ffc, { 0x9e, 0xe7, 0x81, 0xc, 0xf0, 0x47, 0x8, 0x80 }}\r
   #\r
   ## Include/Guid/EventGroup.h\r
   gEfiEndOfDxeEventGroupGuid        = { 0x2ce967a, 0xdd7e, 0x4ffc, { 0x9e, 0xe7, 0x81, 0xc, 0xf0, 0x47, 0x8, 0x80 }}\r

-  \r
+\r

   ## Include/Guid/FirmwareContentsSigned.h\r
   gEfiFirmwareContentsSignedGuid    = { 0xf9d89e8, 0x9259, 0x4f76, { 0xa5, 0xaf, 0xc, 0x89, 0xe3, 0x40, 0x23, 0xdf }}\r
 \r
   ## Include/Guid/FirmwareContentsSigned.h\r
   gEfiFirmwareContentsSignedGuid    = { 0xf9d89e8, 0x9259, 0x4f76, { 0xa5, 0xaf, 0xc, 0x89, 0xe3, 0x40, 0x23, 0xdf }}\r
 \r


@@ -629,7 +634,7 @@
   gEfiIa32X64ErrorTypeBusCheckGuid   = { 0x1CF3F8B3, 0xC5B1, 0x49a2, { 0xAA, 0x59, 0x5E, 0xEF, 0x92, 0xFF, 0xA6, 0x3C }}\r
 \r
   ## Include/Guid/Cper.h\r
   gEfiIa32X64ErrorTypeBusCheckGuid   = { 0x1CF3F8B3, 0xC5B1, 0x49a2, { 0xAA, 0x59, 0x5E, 0xEF, 0x92, 0xFF, 0xA6, 0x3C }}\r
 \r
   ## Include/Guid/Cper.h\r

-  gEfiIa32X64ErrorTypeMsCheckGuid    = { 0x48AB7F57, 0xDC34, 0x4f6c, { 0xA7, 0xD3, 0xB0, 0xB5, 0xB0, 0xA7, 0x43, 0x14 }} \r
+  gEfiIa32X64ErrorTypeMsCheckGuid    = { 0x48AB7F57, 0xDC34, 0x4f6c, { 0xA7, 0xD3, 0xB0, 0xB5, 0xB0, 0xA7, 0x43, 0x14 }}\r

 \r
 [Ppis]\r
   ## Include/Ppi/MasterBootMode.h\r
 \r
 [Ppis]\r
   ## Include/Ppi/MasterBootMode.h\r


@@ -733,7 +738,7 @@
   #\r
   # PPIs defined in PI 1.3.\r
   #\r
   #\r
   # PPIs defined in PI 1.3.\r
   #\r

-  \r
+\r

   ## Include/Ppi/I2cMaster.h\r
   gEfiPeiI2cMasterPpiGuid            = { 0xb3bfab9b, 0x9f9c, 0x4e8b, { 0xad, 0x37, 0x7f, 0x8c, 0x51, 0xfc, 0x62, 0x80 }}\r
 \r
   ## Include/Ppi/I2cMaster.h\r
   gEfiPeiI2cMasterPpiGuid            = { 0xb3bfab9b, 0x9f9c, 0x4e8b, { 0xad, 0x37, 0x7f, 0x8c, 0x51, 0xfc, 0x62, 0x80 }}\r
 \r


@@ -924,16 +929,16 @@
 \r
   ## Include/Protocol/PiPcd.h\r
   gEfiPcdProtocolGuid = { 0x13a3f0f6, 0x264a, 0x3ef0, { 0xf2, 0xe0, 0xde, 0xc5, 0x12, 0x34, 0x2f, 0x34 } }\r
 \r
   ## Include/Protocol/PiPcd.h\r
   gEfiPcdProtocolGuid = { 0x13a3f0f6, 0x264a, 0x3ef0, { 0xf2, 0xe0, 0xde, 0xc5, 0x12, 0x34, 0x2f, 0x34 } }\r

-  \r
+\r

   ## Include/Protocol/FirmwareVolumeBlock.h\r
   gEfiFirmwareVolumeBlock2ProtocolGuid = { 0x8f644fa9, 0xe850, 0x4db1, {0x9c, 0xe2, 0xb, 0x44, 0x69, 0x8e, 0x8d, 0xa4 } }\r
 \r
   ## Include/Protocol/CpuIo2.h\r
   gEfiCpuIo2ProtocolGuid = {0xad61f191, 0xae5f, 0x4c0e, {0xb9, 0xfa, 0xe8, 0x69, 0xd2, 0x88, 0xc6, 0x4f } }\r
   ## Include/Protocol/FirmwareVolumeBlock.h\r
   gEfiFirmwareVolumeBlock2ProtocolGuid = { 0x8f644fa9, 0xe850, 0x4db1, {0x9c, 0xe2, 0xb, 0x44, 0x69, 0x8e, 0x8d, 0xa4 } }\r
 \r
   ## Include/Protocol/CpuIo2.h\r
   gEfiCpuIo2ProtocolGuid = {0xad61f191, 0xae5f, 0x4c0e, {0xb9, 0xfa, 0xe8, 0x69, 0xd2, 0x88, 0xc6, 0x4f } }\r

-  \r
+\r

   ## Include/Protocol/LegacyRegion2.h\r
   gEfiLegacyRegion2ProtocolGuid = {0x70101eaf, 0x85, 0x440c, {0xb3, 0x56, 0x8e, 0xe3, 0x6f, 0xef, 0x24, 0xf0 } }\r
   ## Include/Protocol/LegacyRegion2.h\r
   gEfiLegacyRegion2ProtocolGuid = {0x70101eaf, 0x85, 0x440c, {0xb3, 0x56, 0x8e, 0xe3, 0x6f, 0xef, 0x24, 0xf0 } }\r

-  \r
+\r

   ## Include/Protocol/McaInitPmi.h\r
   gEfiSalMcaInitPmiProtocolGuid = { 0xb60dc6e8, 0x3b6f, 0x11d5, {0xaf, 0x9, 0x0, 0xa0, 0xc9, 0x44, 0xa0, 0x5b } }\r
 \r
   ## Include/Protocol/McaInitPmi.h\r
   gEfiSalMcaInitPmiProtocolGuid = { 0xb60dc6e8, 0x3b6f, 0x11d5, {0xaf, 0x9, 0x0, 0xa0, 0xc9, 0x44, 0xa0, 0x5b } }\r
 \r


@@ -1331,7 +1336,7 @@
 \r
   ## Include/Protocol/IpSec.h\r
   gEfiIpSecProtocolGuid                = { 0xdfb386f7, 0xe100, 0x43ad, {0x9c, 0x9a, 0xed, 0x90, 0xd0, 0x8a, 0x5e, 0x12 }}\r
 \r
   ## Include/Protocol/IpSec.h\r
   gEfiIpSecProtocolGuid                = { 0xdfb386f7, 0xe100, 0x43ad, {0x9c, 0x9a, 0xed, 0x90, 0xd0, 0x8a, 0x5e, 0x12 }}\r

-  \r
+\r

   ## Include/Protocol/IpSec.h\r
   gEfiIpSec2ProtocolGuid               = { 0xa3979e64, 0xace8, 0x4ddc, {0xbc, 0x7, 0x4d, 0x66, 0xb8, 0xfd, 0x9, 0x77 }}\r
 \r
   ## Include/Protocol/IpSec.h\r
   gEfiIpSec2ProtocolGuid               = { 0xa3979e64, 0xace8, 0x4ddc, {0xbc, 0x7, 0x4d, 0x66, 0xb8, 0xfd, 0x9, 0x77 }}\r
 \r


@@ -1361,7 +1366,7 @@
 \r
   ## Include/Protocol/Rng.h\r
   gEfiRngProtocolGuid                  = { 0x3152bca5, 0xeade, 0x433d, {0x86, 0x2e, 0xc0, 0x1c, 0xdc, 0x29, 0x1f, 0x44 }}\r
 \r
   ## Include/Protocol/Rng.h\r
   gEfiRngProtocolGuid                  = { 0x3152bca5, 0xeade, 0x433d, {0x86, 0x2e, 0xc0, 0x1c, 0xdc, 0x29, 0x1f, 0x44 }}\r

-  \r
+\r

   ## Include/Protocol/AdapterInformation.h\r
   gEfiAdapterInformationProtocolGuid    = { 0xE5DD1403, 0xD622, 0xC24E, {0x84, 0x88, 0xC7, 0x1B, 0x17, 0xF5, 0xE8, 0x02 }}\r
 \r
   ## Include/Protocol/AdapterInformation.h\r
   gEfiAdapterInformationProtocolGuid    = { 0xE5DD1403, 0xD622, 0xC24E, {0x84, 0x88, 0xC7, 0x1B, 0x17, 0xF5, 0xE8, 0x02 }}\r
 \r


@@ -1780,4 +1785,4 @@
   gEfiMdePkgTokenSpaceGuid.PcdDefaultTerminalType|0|UINT8|0x00000024\r
 \r
 [UserExtensions.TianoCore."ExtraFiles"]\r
   gEfiMdePkgTokenSpaceGuid.PcdDefaultTerminalType|0|UINT8|0x00000024\r
 \r
 [UserExtensions.TianoCore."ExtraFiles"]\r

-  MdePkgExtra.uni\r
+  MdePkgExtra.uni
\ No newline at end of file

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
index 0a48ce16287b34ea8deb7cde89cad43a850cccf5..3324dba0af862dfad49d2e8e6cc5d93054363208 100644 (file)
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
@@ -64,11 +64,11 @@ UINT8 mHashOidValue[] = {
   };\r
 \r
 HASH_TABLE mHash[] = {\r
   };\r
 \r
 HASH_TABLE mHash[] = {\r

-  { L"SHA1",   20, &mHashOidValue[0],  5, Sha1GetContextSize,  Sha1Init,   Sha1Update,    Sha1Final  },\r
-  { L"SHA224", 28, &mHashOidValue[5],  9, NULL,                NULL,       NULL,          NULL       },\r
-  { L"SHA256", 32, &mHashOidValue[14], 9, Sha256GetContextSize,Sha256Init, Sha256Update,  Sha256Final},\r
-  { L"SHA384", 48, &mHashOidValue[23], 9, NULL,                NULL,       NULL,          NULL       },\r
-  { L"SHA512", 64, &mHashOidValue[32], 9, NULL,                NULL,       NULL,          NULL       }\r
+  { L"SHA1",   20, &mHashOidValue[0],  5, Sha1GetContextSize,   Sha1Init,   Sha1Update,   Sha1Final  },\r
+  { L"SHA224", 28, &mHashOidValue[5],  9, NULL,                 NULL,       NULL,         NULL       },\r
+  { L"SHA256", 32, &mHashOidValue[14], 9, Sha256GetContextSize, Sha256Init, Sha256Update, Sha256Final},\r
+  { L"SHA384", 48, &mHashOidValue[23], 9, Sha384GetContextSize, Sha384Init, Sha384Update, Sha384Final},\r
+  { L"SHA512", 64, &mHashOidValue[32], 9, Sha512GetContextSize, Sha512Init, Sha512Update, Sha512Final}\r

 };\r
 \r
 /**\r
 };\r
 \r
 /**\r


@@ -99,11 +99,11 @@ SecureBootHook (
 \r
   @param  FileHandle      Pointer to the file handle to read the PE/COFF image.\r
   @param  FileOffset      Offset into the PE/COFF image to begin the read operation.\r
 \r
   @param  FileHandle      Pointer to the file handle to read the PE/COFF image.\r
   @param  FileOffset      Offset into the PE/COFF image to begin the read operation.\r

-  @param  ReadSize        On input, the size in bytes of the requested read operation.  \r
+  @param  ReadSize        On input, the size in bytes of the requested read operation.\r

                           On output, the number of bytes actually read.\r
   @param  Buffer          Output buffer that contains the data read from the PE/COFF image.\r
                           On output, the number of bytes actually read.\r
   @param  Buffer          Output buffer that contains the data read from the PE/COFF image.\r

-  \r
-  @retval EFI_SUCCESS     The specified portion of the PE/COFF image was read and the size \r
+\r
+  @retval EFI_SUCCESS     The specified portion of the PE/COFF image was read and the size\r

 **/\r
 EFI_STATUS\r
 EFIAPI\r
 **/\r
 EFI_STATUS\r
 EFIAPI\r


@@ -117,7 +117,7 @@ DxeImageVerificationLibImageRead (
   UINTN               EndPosition;\r
 \r
   if (FileHandle == NULL || ReadSize == NULL || Buffer == NULL) {\r
   UINTN               EndPosition;\r
 \r
   if (FileHandle == NULL || ReadSize == NULL || Buffer == NULL) {\r

-    return EFI_INVALID_PARAMETER;    \r
+    return EFI_INVALID_PARAMETER;\r

   }\r
 \r
   if (MAX_ADDRESS - FileOffset < *ReadSize) {\r
   }\r
 \r
   if (MAX_ADDRESS - FileOffset < *ReadSize) {\r


@@ -306,7 +306,7 @@ HashPeImage (
   SectionHeader = NULL;\r
   Status        = FALSE;\r
 \r
   SectionHeader = NULL;\r
   Status        = FALSE;\r
 \r

-  if ((HashAlg != HASHALG_SHA1) && (HashAlg != HASHALG_SHA256)) {\r
+  if ((HashAlg >= HASHALG_MAX)) {\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r


@@ -315,13 +315,28 @@ HashPeImage (
   //\r
   ZeroMem (mImageDigest, MAX_DIGEST_SIZE);\r
 \r
   //\r
   ZeroMem (mImageDigest, MAX_DIGEST_SIZE);\r
 \r

-  if (HashAlg == HASHALG_SHA1) {\r
-    mImageDigestSize  = SHA1_DIGEST_SIZE;\r
-    mCertType         = gEfiCertSha1Guid;\r
-  } else if (HashAlg == HASHALG_SHA256) {\r
-    mImageDigestSize  = SHA256_DIGEST_SIZE;\r
-    mCertType         = gEfiCertSha256Guid;\r
-  } else {\r
+  switch (HashAlg) {\r
+  case HASHALG_SHA1:\r
+    mImageDigestSize = SHA1_DIGEST_SIZE;\r
+    mCertType        = gEfiCertSha1Guid;\r
+    break;\r
+\r
+  case HASHALG_SHA256:\r
+    mImageDigestSize = SHA256_DIGEST_SIZE;\r
+    mCertType        = gEfiCertSha256Guid;\r
+    break;\r
+\r
+  case HASHALG_SHA384:\r
+    mImageDigestSize = SHA384_DIGEST_SIZE;\r
+    mCertType        = gEfiCertSha384Guid;\r
+    break;\r
+\r
+  case HASHALG_SHA512:\r
+    mImageDigestSize = SHA512_DIGEST_SIZE;\r
+    mCertType        = gEfiCertSha512Guid;\r
+    break;\r
+\r
+  default:\r

     return FALSE;\r
   }\r
 \r
     return FALSE;\r
   }\r
 \r


@@ -347,8 +362,8 @@ HashPeImage (
   //\r
   if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
     //\r
   //\r
   if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
     //\r

-    // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value \r
-    //       in the PE/COFF Header. If the MachineType is Itanium(IA64) and the \r
+    // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value\r
+    //       in the PE/COFF Header. If the MachineType is Itanium(IA64) and the\r

     //       Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC\r
     //       then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC\r
     //\r
     //       Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC\r
     //       then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC\r
     //\r


@@ -359,7 +374,7 @@ HashPeImage (
     //\r
     Magic =  mNtHeader.Pe32->OptionalHeader.Magic;\r
   }\r
     //\r
     Magic =  mNtHeader.Pe32->OptionalHeader.Magic;\r
   }\r

-  \r
+\r

   //\r
   // 3.  Calculate the distance from the base of the image header to the image checksum address.\r
   // 4.  Hash the image header from its base to beginning of the image checksum.\r
   //\r
   // 3.  Calculate the distance from the base of the image header to the image checksum address.\r
   // 4.  Hash the image header from its base to beginning of the image checksum.\r


@@ -466,7 +481,7 @@ HashPeImage (
       if (!Status) {\r
         goto Done;\r
       }\r
       if (!Status) {\r
         goto Done;\r
       }\r

-    }    \r
+    }\r

   }\r
 \r
   //\r
   }\r
 \r
   //\r


@@ -604,7 +619,7 @@ Done:
 \r
   @param[in]  AuthData            Pointer to the Authenticode Signature retrieved from signed image.\r
   @param[in]  AuthDataSize        Size of the Authenticode Signature in bytes.\r
 \r
   @param[in]  AuthData            Pointer to the Authenticode Signature retrieved from signed image.\r
   @param[in]  AuthDataSize        Size of the Authenticode Signature in bytes.\r

-  \r
+\r

   @retval EFI_UNSUPPORTED             Hash algorithm is not supported.\r
   @retval EFI_SUCCESS                 Hash successfully.\r
 \r
   @retval EFI_UNSUPPORTED             Hash algorithm is not supported.\r
   @retval EFI_SUCCESS                 Hash successfully.\r
 \r


@@ -803,6 +818,124 @@ AddImageExeInfo (
   }\r
 }\r
 \r
   }\r
 }\r
 \r

+/**\r
+  Check whether the hash of an given X.509 certificate is in forbidden database (DBX).\r
+\r
+  @param[in]  Certificate       Pointer to X.509 Certificate that is searched for.\r
+  @param[in]  CertSize          Size of X.509 Certificate.\r
+  @param[in]  SignatureList     Pointer to the Signature List in forbidden database.\r
+  @param[in]  SignatureListSize Size of Signature List.\r
+  @param[out] RevocationTime    Return the time that the certificate was revoked.\r
+\r
+  @return TRUE   The certificate hash is found in the forbidden database.\r
+  @return FALSE  The certificate hash is not found in the forbidden database.\r
+\r
+**/\r
+BOOLEAN\r
+IsCertHashFoundInDatabase (\r
+  IN  UINT8               *Certificate,\r
+  IN  UINTN               CertSize,\r
+  IN  EFI_SIGNATURE_LIST  *SignatureList,\r
+  IN  UINTN               SignatureListSize,\r
+  OUT EFI_TIME            *RevocationTime\r
+  )\r
+{\r
+  BOOLEAN             IsFound;\r
+  EFI_STATUS          Status;\r
+  EFI_SIGNATURE_LIST  *DbxList;\r
+  UINTN               DbxSize;\r
+  EFI_SIGNATURE_DATA  *CertHash;\r
+  UINTN               CertHashCount;\r
+  UINTN               Index;\r
+  UINT32              HashAlg;\r
+  VOID                *HashCtx;\r
+  UINT8               CertDigest[MAX_DIGEST_SIZE];\r
+  UINT8               *DbxCertHash;\r
+  UINTN               SiglistHeaderSize;\r
+\r
+  IsFound  = FALSE;\r
+  DbxList  = SignatureList;\r
+  DbxSize  = SignatureListSize;\r
+  HashCtx  = NULL;\r
+  HashAlg  = HASHALG_MAX;\r
+\r
+  ASSERT (RevocationTime != NULL);\r
+\r
+  while ((DbxSize > 0) && (SignatureListSize >= DbxList->SignatureListSize)) {\r
+    //\r
+    // Determine Hash Algorithm of Certificate in the forbidden database.\r
+    //\r
+    if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha256Guid)) {\r
+      HashAlg = HASHALG_SHA256;\r
+    } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha384Guid)) {\r
+      HashAlg = HASHALG_SHA384;\r
+    } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha512Guid)) {\r
+      HashAlg = HASHALG_SHA512;\r
+    } else {\r
+      DbxSize -= DbxList->SignatureListSize;\r
+      DbxList  = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);\r
+      continue;\r
+    }\r
+\r
+    //\r
+    // Calculate the hash value of current db certificate for comparision.\r
+    //\r
+    if (mHash[HashAlg].GetContextSize == NULL) {\r
+      goto Done;\r
+    }\r
+    ZeroMem (CertDigest, MAX_DIGEST_SIZE);\r
+    HashCtx = AllocatePool (mHash[HashAlg].GetContextSize ());\r
+    if (HashCtx == NULL) {\r
+      goto Done;\r
+    }\r
+    Status = mHash[HashAlg].HashInit (HashCtx);\r
+    if (!Status) {\r
+      goto Done;\r
+    }\r
+    Status = mHash[HashAlg].HashUpdate (HashCtx, Certificate, CertSize);\r
+    if (!Status) {\r
+      goto Done;\r
+    }\r
+    Status = mHash[HashAlg].HashFinal (HashCtx, CertDigest);\r
+    if (!Status) {\r
+      goto Done;\r
+    }\r
+\r
+    SiglistHeaderSize = sizeof (EFI_SIGNATURE_LIST) + DbxList->SignatureHeaderSize;\r
+    CertHash          = (EFI_SIGNATURE_DATA *) ((UINT8 *) DbxList + SiglistHeaderSize);\r
+    CertHashCount     = (DbxList->SignatureListSize - SiglistHeaderSize) / DbxList->SignatureSize;\r
+    for (Index = 0; Index < CertHashCount; Index++) {\r
+      //\r
+      // Iterate each Signature Data Node within this CertList for verify.\r
+      //\r
+      DbxCertHash = CertHash->SignatureData;\r
+      if (CompareMem (DbxCertHash, CertDigest, mHash[HashAlg].DigestLength) == 0) {\r
+        //\r
+        // Hash of Certificate is found in forbidden database.\r
+        //\r
+        IsFound = TRUE;\r
+\r
+        //\r
+        // Return the revocation time.\r
+        //\r
+        CopyMem (RevocationTime, (EFI_TIME *)(DbxCertHash + mHash[HashAlg].DigestLength), sizeof (EFI_TIME));\r
+        goto Done;\r
+      }\r
+      CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertHash + DbxList->SignatureSize);\r
+    }\r
+\r
+    DbxSize -= DbxList->SignatureListSize;\r
+    DbxList  = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);\r
+  }\r
+\r
+Done:\r
+  if (HashCtx != NULL) {\r
+    FreePool (HashCtx);\r
+  }\r
+\r
+  return IsFound;\r
+}\r
+\r

 /**\r
   Check whether signature is in specified database.\r
 \r
 /**\r
   Check whether signature is in specified database.\r
 \r


@@ -831,6 +964,7 @@ IsSignatureFoundInDatabase (
   UINTN               Index;\r
   UINTN               CertCount;\r
   BOOLEAN             IsFound;\r
   UINTN               Index;\r
   UINTN               CertCount;\r
   BOOLEAN             IsFound;\r

+\r

   //\r
   // Read signature database variable.\r
   //\r
   //\r
   // Read signature database variable.\r
   //\r


@@ -890,24 +1024,296 @@ Done:
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Verify PKCS#7 SignedData using certificate found in Variable which formatted\r
-  as EFI_SIGNATURE_LIST. The Variable may be PK, KEK, DB or DBX.\r
+  Check whether the timestamp is valid by comparing the signing time and the revocation time.\r

 \r
 \r

-  @param[in]  AuthData      Pointer to the Authenticode Signature retrieved from signed image.\r
-  @param[in]  AuthDataSize  Size of the Authenticode Signature in bytes.\r
-  @param[in]  VariableName  Name of Variable to search for Certificate.\r
-  @param[in]  VendorGuid    Variable vendor GUID.\r
+  @param SigningTime         A pointer to the signing time.\r
+  @param RevocationTime      A pointer to the revocation time.\r

 \r
 \r

-  @retval TRUE         Image pass verification.\r
-  @retval FALSE        Image fail verification.\r
+  @retval  TRUE              The SigningTime is not later than the RevocationTime.\r
+  @retval  FALSE             The SigningTime is later than the RevocationTime.\r

 \r
 **/\r
 BOOLEAN\r
 \r
 **/\r
 BOOLEAN\r

-IsPkcsSignedDataVerifiedBySignatureList (\r
+IsValidSignatureByTimestamp (\r
+  IN EFI_TIME               *SigningTime,\r
+  IN EFI_TIME               *RevocationTime\r
+  )\r
+{\r
+  if (SigningTime->Year != RevocationTime->Year) {\r
+    return (BOOLEAN) (SigningTime->Year < RevocationTime->Year);\r
+  } else if (SigningTime->Month != RevocationTime->Month) {\r
+    return (BOOLEAN) (SigningTime->Month < RevocationTime->Month);\r
+  } else if (SigningTime->Day != RevocationTime->Day) {\r
+    return (BOOLEAN) (SigningTime->Day < RevocationTime->Day);\r
+  } else if (SigningTime->Hour != RevocationTime->Hour) {\r
+    return (BOOLEAN) (SigningTime->Hour < RevocationTime->Hour);\r
+  } else if (SigningTime->Minute != RevocationTime->Minute) {\r
+    return (BOOLEAN) (SigningTime->Minute < RevocationTime->Minute);\r
+  }\r
+\r
+  return (BOOLEAN) (SigningTime->Second <= RevocationTime->Second);\r
+}\r
+\r
+/**\r
+  Check if the given time value is zero.\r
+\r
+  @param[in]  Time      Pointer of a time value.\r
+\r
+  @retval     TRUE      The Time is Zero.\r
+  @retval     FALSE     The Time is not Zero.\r
+\r
+**/\r
+BOOLEAN\r
+IsTimeZero (\r
+  IN EFI_TIME               *Time\r
+  )\r
+{\r
+  if ((Time->Year == 0) && (Time->Month == 0) &&  (Time->Day == 0) &&\r
+      (Time->Hour == 0) && (Time->Minute == 0) && (Time->Second == 0)) {\r
+    return TRUE;\r
+  }\r
+\r
+  return FALSE;\r
+}\r
+\r
+/**\r
+  Check whether the timestamp signature is valid and the signing time is also earlier than \r
+  the revocation time.\r
+\r
+  @param[in]  AuthData        Pointer to the Authenticode signature retrieved from signed image.\r
+  @param[in]  AuthDataSize    Size of the Authenticode signature in bytes.\r
+  @param[in]  RevocationTime  The time that the certificate was revoked.\r
+\r
+  @retval TRUE      Timestamp signature is valid and signing time is no later than the \r
+                    revocation time.\r
+  @retval FALSE     Timestamp signature is not valid or the signing time is later than the\r
+                    revocation time.\r
+\r
+**/\r
+BOOLEAN\r
+PassTimestampCheck (\r
+  IN UINT8                  *AuthData,\r
+  IN UINTN                  AuthDataSize,\r
+  IN EFI_TIME               *RevocationTime\r
+  )\r
+{\r
+  EFI_STATUS                Status;\r
+  BOOLEAN                   VerifyStatus;\r
+  EFI_SIGNATURE_LIST        *CertList;\r
+  EFI_SIGNATURE_DATA        *Cert;\r
+  UINT8                     *DbtData;\r
+  UINTN                     DbtDataSize;\r
+  UINT8                     *RootCert;\r
+  UINTN                     RootCertSize;\r
+  UINTN                     Index;\r
+  UINTN                     CertCount;\r
+  EFI_TIME                  SigningTime;\r
+\r
+  //\r
+  // Variable Initialization\r
+  //\r
+  VerifyStatus      = FALSE;\r
+  DbtData           = NULL;\r
+  CertList          = NULL;\r
+  Cert              = NULL;\r
+  RootCert          = NULL;\r
+  RootCertSize      = 0;\r
+\r
+  //\r
+  // If RevocationTime is zero, the certificate shall be considered to always be revoked.\r
+  //\r
+  if (IsTimeZero (RevocationTime)) {\r
+    return FALSE;\r
+  }\r
+\r
+  //\r
+  // RevocationTime is non-zero, the certificate should be considered to be revoked from that time and onwards.\r
+  // Using the dbt to get the trusted TSA certificates.\r
+  //\r
+  DbtDataSize = 0;\r
+  Status   = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid, NULL, &DbtDataSize, NULL);\r
+  if (Status == EFI_BUFFER_TOO_SMALL) {\r
+    DbtData = (UINT8 *) AllocateZeroPool (DbtDataSize);\r
+    if (DbtData == NULL) {\r
+      goto Done;\r
+    }\r
+    Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid, NULL, &DbtDataSize, (VOID *) DbtData);\r
+    if (EFI_ERROR (Status)) {\r
+      goto Done;\r
+    }\r
+  }\r
+\r
+  CertList = (EFI_SIGNATURE_LIST *) DbtData;\r
+  while ((DbtDataSize > 0) && (DbtDataSize >= CertList->SignatureListSize)) {\r
+    if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {\r
+      Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
+      CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
+      for (Index = 0; Index < CertCount; Index++) {\r
+        //\r
+        // Iterate each Signature Data Node within this CertList for verify.\r
+        //\r
+        RootCert     = Cert->SignatureData;\r
+        RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID);\r
+        //\r
+        // Get the signing time if the timestamp signature is valid.\r
+        //\r
+        if (ImageTimestampVerify (AuthData, AuthDataSize, RootCert, RootCertSize, &SigningTime)) {\r
+          //\r
+          // The signer signature is valid only when the signing time is earlier than revocation time.\r
+          //\r
+          if (IsValidSignatureByTimestamp (&SigningTime, RevocationTime)) {\r
+            VerifyStatus = TRUE;\r
+            goto Done;\r
+          }\r
+        }\r
+        Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);\r
+      }\r
+    }\r
+    DbtDataSize -= CertList->SignatureListSize;\r
+    CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
+  }\r
+\r
+Done:\r
+  if (DbtData != NULL) {\r
+    FreePool (DbtData);\r
+  }\r
+\r
+  return VerifyStatus;\r
+}\r
+\r
+/**\r
+  Check whether the image signature is forbidden by the forbidden database (dbx).\r
+  The image is forbidden to load if any certificates for signing are revoked before signing time.\r
+\r
+  @param[in]  AuthData      Pointer to the Authenticode signature retrieved from the signed image.\r
+  @param[in]  AuthDataSize  Size of the Authenticode signature in bytes.\r
+\r
+  @retval TRUE              Image is forbidden by dbx.\r
+  @retval FALSE             Image is not forbidden by dbx.\r
+\r
+**/\r
+BOOLEAN\r
+IsForbiddenByDbx (\r
+  IN UINT8                  *AuthData,\r
+  IN UINTN                  AuthDataSize\r
+  )\r
+{\r
+  EFI_STATUS                Status;\r
+  BOOLEAN                   IsForbidden;\r
+  UINT8                     *Data;\r
+  UINTN                     DataSize;\r
+  UINTN                     Index;\r
+  UINT8                     *CertBuffer;\r
+  UINTN                     BufferLength;\r
+  UINT8                     *TrustedCert;\r
+  UINTN                     TrustedCertLength;\r
+  UINT8                     CertNumber;\r
+  UINT8                     *CertPtr;\r
+  UINT8                     *Cert;\r
+  UINTN                     CertSize;\r
+  EFI_TIME                  RevocationTime;\r
+\r
+  //\r
+  // Variable Initialization\r
+  //\r
+  IsForbidden       = FALSE;\r
+  Data              = NULL;\r
+  Cert              = NULL;\r
+  CertBuffer        = NULL;\r
+  BufferLength      = 0;\r
+  TrustedCert       = NULL;\r
+  TrustedCertLength = 0;\r
+\r
+  //\r
+  // The image will not be forbidden if dbx can't be got.\r
+  //\r
+  DataSize = 0;\r
+  Status   = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
+  if (Status == EFI_BUFFER_TOO_SMALL) {\r
+    Data = (UINT8 *) AllocateZeroPool (DataSize);\r
+    if (Data == NULL) {\r
+      return IsForbidden;\r
+    }\r
+\r
+    Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);\r
+  }\r
+  if (EFI_ERROR (Status)) {\r
+    return IsForbidden;\r
+  }\r
+\r
+  //\r
+  // Retrieve the certificate stack from AuthData\r
+  // The output CertStack format will be:\r
+  //       UINT8  CertNumber;\r
+  //       UINT32 Cert1Length;\r
+  //       UINT8  Cert1[];\r
+  //       UINT32 Cert2Length;\r
+  //       UINT8  Cert2[];\r
+  //       ...\r
+  //       UINT32 CertnLength;\r
+  //       UINT8  Certn[];\r
+  //\r
+  Pkcs7GetSigners (AuthData, AuthDataSize, &CertBuffer, &BufferLength, &TrustedCert, &TrustedCertLength);\r
+  if (BufferLength == 0) {\r
+    IsForbidden = TRUE;\r
+    goto Done;\r
+  }\r
+\r
+  //\r
+  // Check if any certificates in AuthData is in the forbidden database.\r
+  //\r
+  CertNumber = (UINT8) (*CertBuffer);\r
+  CertPtr    = CertBuffer + 1;\r
+  for (Index = 0; Index < CertNumber; Index++) {\r
+    CertSize = (UINTN) ReadUnaligned32 ((UINT32 *)CertPtr);\r
+    Cert     = (UINT8 *)CertPtr + sizeof (UINT32);\r
+    if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, Cert, &gEfiCertX509Guid, CertSize)) {\r
+      //\r
+      // Raw certificate in dbx means the image signed by the certificate is forbidden.\r
+      //\r
+      IsForbidden = TRUE;\r
+      goto Done;\r
+    }\r
+\r
+    if (IsCertHashFoundInDatabase (Cert, CertSize, (EFI_SIGNATURE_LIST *)Data, DataSize, &RevocationTime)) {\r
+      //\r
+      // Check the timestamp signature and signing time to determine if the image can be trusted.\r
+      //\r
+      IsForbidden = TRUE;\r
+      if (PassTimestampCheck (AuthData, AuthDataSize, &RevocationTime)) {\r
+        IsForbidden = FALSE;\r
+      }\r
+      goto Done;\r
+    }\r
+\r
+    CertPtr = CertPtr + sizeof (UINT32) + CertSize;\r
+  }\r
+\r
+Done:\r
+  if (Data != NULL) {\r
+    FreePool (Data);\r
+  }\r
+\r
+  Pkcs7FreeSigners (CertBuffer);\r
+  Pkcs7FreeSigners (TrustedCert);\r
+\r
+  return IsForbidden;\r
+}\r
+\r
+/**\r
+  Check whether the image signature can be verified by the trusted certificates in DB database.\r
+\r
+  @param[in]  AuthData      Pointer to the Authenticode signature retrieved from signed image.\r
+  @param[in]  AuthDataSize  Size of the Authenticode signature in bytes.\r
+\r
+  @retval TRUE         Image passed verification using certificate in db.\r
+  @retval FALSE        Image didn't pass verification using certificate in db.\r
+\r
+**/\r
+BOOLEAN\r
+IsAllowedByDb (\r

   IN UINT8              *AuthData,\r
   IN UINT8              *AuthData,\r

-  IN UINTN              AuthDataSize,\r
-  IN CHAR16             *VariableName,\r
-  IN EFI_GUID           *VendorGuid\r
+  IN UINTN              AuthDataSize\r

   )\r
 {\r
   EFI_STATUS                Status;\r
   )\r
 {\r
   EFI_STATUS                Status;\r


@@ -929,14 +1335,14 @@ IsPkcsSignedDataVerifiedBySignatureList (
   VerifyStatus = FALSE;\r
 \r
   DataSize = 0;\r
   VerifyStatus = FALSE;\r
 \r
   DataSize = 0;\r

-  Status   = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, NULL);\r
+  Status   = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r

   if (Status == EFI_BUFFER_TOO_SMALL) {\r
     Data = (UINT8 *) AllocateZeroPool (DataSize);\r
     if (Data == NULL) {\r
       return VerifyStatus;\r
     }\r
 \r
   if (Status == EFI_BUFFER_TOO_SMALL) {\r
     Data = (UINT8 *) AllocateZeroPool (DataSize);\r
     if (Data == NULL) {\r
       return VerifyStatus;\r
     }\r
 \r

-    Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, (VOID *) Data);\r
+    Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);\r

     if (EFI_ERROR (Status)) {\r
       goto Done;\r
     }\r
     if (EFI_ERROR (Status)) {\r
       goto Done;\r
     }\r


@@ -947,14 +1353,15 @@ IsPkcsSignedDataVerifiedBySignatureList (
     CertList = (EFI_SIGNATURE_LIST *) Data;\r
     while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {\r
       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {\r
     CertList = (EFI_SIGNATURE_LIST *) Data;\r
     while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {\r
       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {\r

-        Cert          = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
-        CertCount     = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
+        Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
+        CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
+\r

         for (Index = 0; Index < CertCount; Index++) {\r
           //\r
           // Iterate each Signature Data Node within this CertList for verify.\r
           //\r
         for (Index = 0; Index < CertCount; Index++) {\r
           //\r
           // Iterate each Signature Data Node within this CertList for verify.\r
           //\r

-          RootCert      = Cert->SignatureData;\r
-          RootCertSize  = CertList->SignatureSize - sizeof (EFI_GUID);\r
+          RootCert     = Cert->SignatureData;\r
+          RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID);\r

 \r
           //\r
           // Call AuthenticodeVerify library to Verify Authenticode struct.\r
 \r
           //\r
           // Call AuthenticodeVerify library to Verify Authenticode struct.\r


@@ -968,12 +1375,14 @@ IsPkcsSignedDataVerifiedBySignatureList (
                            mImageDigestSize\r
                            );\r
           if (VerifyStatus) {\r
                            mImageDigestSize\r
                            );\r
           if (VerifyStatus) {\r

-            SecureBootHook (VariableName, VendorGuid, CertList->SignatureSize, Cert);\r
+            SecureBootHook (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid, CertList->SignatureSize, Cert);\r

             goto Done;\r
           }\r
             goto Done;\r
           }\r

+\r

           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);\r
         }\r
       }\r
           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);\r
         }\r
       }\r

+\r

       DataSize -= CertList->SignatureListSize;\r
       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
     }\r
       DataSize -= CertList->SignatureListSize;\r
       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
     }\r


@@ -1108,7 +1517,7 @@ DxeImageVerificationHandler (
   }\r
 \r
   //\r
   }\r
 \r
   //\r

-  // The policy QUERY_USER_ON_SECURITY_VIOLATION and ALLOW_EXECUTE_ON_SECURITY_VIOLATION \r
+  // The policy QUERY_USER_ON_SECURITY_VIOLATION and ALLOW_EXECUTE_ON_SECURITY_VIOLATION\r

   // violates the UEFI spec and has been removed.\r
   //\r
   ASSERT (Policy != QUERY_USER_ON_SECURITY_VIOLATION && Policy != ALLOW_EXECUTE_ON_SECURITY_VIOLATION);\r
   // violates the UEFI spec and has been removed.\r
   //\r
   ASSERT (Policy != QUERY_USER_ON_SECURITY_VIOLATION && Policy != ALLOW_EXECUTE_ON_SECURITY_VIOLATION);\r


@@ -1183,8 +1592,8 @@ DxeImageVerificationHandler (
 \r
   if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
     //\r
 \r
   if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
     //\r

-    // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value \r
-    //       in the PE/COFF Header. If the MachineType is Itanium(IA64) and the \r
+    // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value\r
+    //       in the PE/COFF Header. If the MachineType is Itanium(IA64) and the\r

     //       Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC\r
     //       then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC\r
     //\r
     //       Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC\r
     //       then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC\r
     //\r


@@ -1195,7 +1604,7 @@ DxeImageVerificationHandler (
     //\r
     Magic = mNtHeader.Pe32->OptionalHeader.Magic;\r
   }\r
     //\r
     Magic = mNtHeader.Pe32->OptionalHeader.Magic;\r
   }\r

-  \r
+\r

   if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
     //\r
     // Use PE32 offset.\r
   if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
     //\r
     // Use PE32 offset.\r


@@ -1203,7 +1612,7 @@ DxeImageVerificationHandler (
     NumberOfRvaAndSizes = mNtHeader.Pe32->OptionalHeader.NumberOfRvaAndSizes;\r
     if (NumberOfRvaAndSizes > EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {\r
       SecDataDir = (EFI_IMAGE_DATA_DIRECTORY *) &mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY];\r
     NumberOfRvaAndSizes = mNtHeader.Pe32->OptionalHeader.NumberOfRvaAndSizes;\r
     if (NumberOfRvaAndSizes > EFI_IMAGE_DIRECTORY_ENTRY_SECURITY) {\r
       SecDataDir = (EFI_IMAGE_DATA_DIRECTORY *) &mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY];\r

-    }        \r
+    }\r

   } else {\r
     //\r
     // Use PE32+ offset.\r
   } else {\r
     //\r
     // Use PE32+ offset.\r


@@ -1219,7 +1628,7 @@ DxeImageVerificationHandler (
   //\r
   if (SecDataDir == NULL || SecDataDir->Size == 0) {\r
     //\r
   //\r
   if (SecDataDir == NULL || SecDataDir->Size == 0) {\r
     //\r

-    // This image is not signed. The SHA256 hash value of the image must match a record in the security database "db", \r
+    // This image is not signed. The SHA256 hash value of the image must match a record in the security database "db",\r

     // and not be reflected in the security data base "dbx".\r
     //\r
     if (!HashPeImage (HASHALG_SHA256)) {\r
     // and not be reflected in the security data base "dbx".\r
     //\r
     if (!HashPeImage (HASHALG_SHA256)) {\r


@@ -1247,7 +1656,7 @@ DxeImageVerificationHandler (
   }\r
 \r
   //\r
   }\r
 \r
   //\r

-  // Verify the signature of the image, multiple signatures are allowed as per PE/COFF Section 4.7 \r
+  // Verify the signature of the image, multiple signatures are allowed as per PE/COFF Section 4.7\r

   // "Attribute Certificate Table".\r
   // The first certificate starts at offset (SecDataDir->VirtualAddress) from the start of the file.\r
   //\r
   // "Attribute Certificate Table".\r
   // The first certificate starts at offset (SecDataDir->VirtualAddress) from the start of the file.\r
   //\r


@@ -1259,13 +1668,13 @@ DxeImageVerificationHandler (
         (SecDataDir->VirtualAddress + SecDataDir->Size - OffSet) < WinCertificate->dwLength) {\r
       break;\r
     }\r
         (SecDataDir->VirtualAddress + SecDataDir->Size - OffSet) < WinCertificate->dwLength) {\r
       break;\r
     }\r

-    \r
+\r

     //\r
     // Verify the image's Authenticode signature, only DER-encoded PKCS#7 signed data is supported.\r
     //\r
     if (WinCertificate->wCertificateType == WIN_CERT_TYPE_PKCS_SIGNED_DATA) {\r
       //\r
     //\r
     // Verify the image's Authenticode signature, only DER-encoded PKCS#7 signed data is supported.\r
     //\r
     if (WinCertificate->wCertificateType == WIN_CERT_TYPE_PKCS_SIGNED_DATA) {\r
       //\r

-      // The certificate is formatted as WIN_CERTIFICATE_EFI_PKCS which is described in the \r
+      // The certificate is formatted as WIN_CERTIFICATE_EFI_PKCS which is described in the\r

       // Authenticode specification.\r
       //\r
       PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) WinCertificate;\r
       // Authenticode specification.\r
       //\r
       PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) WinCertificate;\r


@@ -1298,11 +1707,11 @@ DxeImageVerificationHandler (
     if (EFI_ERROR (Status)) {\r
       continue;\r
     }\r
     if (EFI_ERROR (Status)) {\r
       continue;\r
     }\r

-    \r
+\r

     //\r
     // Check the digital signature against the revoked certificate in forbidden database (dbx).\r
     //\r
     //\r
     // Check the digital signature against the revoked certificate in forbidden database (dbx).\r
     //\r

-    if (IsPkcsSignedDataVerifiedBySignatureList (AuthData, AuthDataSize, EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid)) {\r
+    if (IsForbiddenByDbx (AuthData, AuthDataSize)) {\r

       Action = EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED;\r
       VerifyStatus = EFI_ACCESS_DENIED;\r
       break;\r
       Action = EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED;\r
       VerifyStatus = EFI_ACCESS_DENIED;\r
       break;\r


@@ -1312,7 +1721,7 @@ DxeImageVerificationHandler (
     // Check the digital signature against the valid certificate in allowed database (db).\r
     //\r
     if (EFI_ERROR (VerifyStatus)) {\r
     // Check the digital signature against the valid certificate in allowed database (db).\r
     //\r
     if (EFI_ERROR (VerifyStatus)) {\r

-      if (IsPkcsSignedDataVerifiedBySignatureList (AuthData, AuthDataSize, EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid)) {\r
+      if (IsAllowedByDb (AuthData, AuthDataSize)) {\r

         VerifyStatus = EFI_SUCCESS;\r
       }\r
     }\r
         VerifyStatus = EFI_SUCCESS;\r
       }\r
     }\r


@@ -1337,7 +1746,7 @@ DxeImageVerificationHandler (
     //\r
     VerifyStatus = EFI_ACCESS_DENIED;\r
   }\r
     //\r
     VerifyStatus = EFI_ACCESS_DENIED;\r
   }\r

-  \r
+\r

   if (!EFI_ERROR (VerifyStatus)) {\r
     return EFI_SUCCESS;\r
   } else {\r
   if (!EFI_ERROR (VerifyStatus)) {\r
     return EFI_SUCCESS;\r
   } else {\r


@@ -1407,7 +1816,7 @@ OnReadyToBoot (
     return ;\r
   }\r
 \r
     return ;\r
   }\r
 \r

-  ImageExeInfoTable->NumberOfImages = 0;  \r
+  ImageExeInfoTable->NumberOfImages = 0;\r

   gBS->InstallConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID *) ImageExeInfoTable);\r
 \r
 }\r
   gBS->InstallConfigurationTable (&gEfiImageSecurityDatabaseGuid, (VOID *) ImageExeInfoTable);\r
 \r
 }\r


@@ -1434,10 +1843,10 @@ DxeImageVerificationLibConstructor (
   //\r
   EfiCreateEventReadyToBootEx (\r
     TPL_CALLBACK,\r
   //\r
   EfiCreateEventReadyToBootEx (\r
     TPL_CALLBACK,\r

-    OnReadyToBoot, \r
-    NULL, \r
+    OnReadyToBoot,\r
+    NULL,\r

     &Event\r
     &Event\r

-    ); \r
+    );\r

 \r
   return RegisterSecurity2Handler (\r
           DxeImageVerificationHandler,\r
 \r
   return RegisterSecurity2Handler (\r
           DxeImageVerificationHandler,\r

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.h b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.h
index 9aef601cee46115cf439b379ce35b761436fe658..b09ef8afd3e1b0d66ad383a949abbc8a0a4e18a0 100644 (file)
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.h
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.h
@@ -2,13 +2,13 @@
   The internal header file includes the common header files, defines\r
   internal structure and functions used by ImageVerificationLib.\r
 \r
   The internal header file includes the common header files, defines\r
   internal structure and functions used by ImageVerificationLib.\r
 \r

-Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>\r
-This program and the accompanying materials \r
-are licensed and made available under the terms and conditions of the BSD License \r
-which accompanies this distribution.  The full text of the license may be found at \r
+Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>\r
+This program and the accompanying materials\r
+are licensed and made available under the terms and conditions of the BSD License\r
+which accompanies this distribution.  The full text of the license may be found at\r

 http://opensource.org/licenses/bsd-license.php\r
 \r
 http://opensource.org/licenses/bsd-license.php\r
 \r

-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, \r
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r

 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
 \r
 **/\r
 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
 \r
 **/\r


@@ -76,9 +76,9 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define HASHALG_MAX                            0x00000005\r
 \r
 //\r
 #define HASHALG_MAX                            0x00000005\r
 \r
 //\r

-// Set max digest size as SHA256 Output (32 bytes) by far\r
+// Set max digest size as SHA512 Output (64 bytes) by far\r

 //\r
 //\r

-#define MAX_DIGEST_SIZE    SHA256_DIGEST_SIZE      \r
+#define MAX_DIGEST_SIZE    SHA512_DIGEST_SIZE\r

 //\r
 //\r
 // PKCS7 Certificate definition\r
 //\r
 //\r
 // PKCS7 Certificate definition\r


@@ -204,4 +204,4 @@ typedef struct {
   HASH_FINAL               HashFinal;\r
 } HASH_TABLE;\r
 \r
   HASH_FINAL               HashFinal;\r
 } HASH_TABLE;\r
 \r

-#endif\r
+#endif
\ No newline at end of file

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
index ab580aaf57fdb357a2c64832ab6df724d3824843..3430b6ea9dacd878443684c55d1dfbfb6a2b8028 100644 (file)
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
@@ -25,7 +25,7 @@
   FILE_GUID                      = 0CA970E1-43FA-4402-BC0A-81AF336BFFD6\r
   MODULE_TYPE                    = DXE_DRIVER\r
   VERSION_STRING                 = 1.0\r
   FILE_GUID                      = 0CA970E1-43FA-4402-BC0A-81AF336BFFD6\r
   MODULE_TYPE                    = DXE_DRIVER\r
   VERSION_STRING                 = 1.0\r

-  LIBRARY_CLASS                  = NULL|DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SAL_DRIVER DXE_SMM_DRIVER UEFI_APPLICATION UEFI_DRIVER \r
+  LIBRARY_CLASS                  = NULL|DXE_DRIVER DXE_RUNTIME_DRIVER DXE_SAL_DRIVER DXE_SMM_DRIVER UEFI_APPLICATION UEFI_DRIVER\r

   CONSTRUCTOR                    = DxeImageVerificationLibConstructor\r
 \r
 #\r
   CONSTRUCTOR                    = DxeImageVerificationLibConstructor\r
 \r
 #\r


@@ -67,6 +67,7 @@
 [Guids]\r
   ## SOMETIMES_CONSUMES   ## Variable:L"DB"\r
   ## SOMETIMES_CONSUMES   ## Variable:L"DBX"\r
 [Guids]\r
   ## SOMETIMES_CONSUMES   ## Variable:L"DB"\r
   ## SOMETIMES_CONSUMES   ## Variable:L"DBX"\r

+  ## SOMETIMES_CONSUMES   ## Variable:L"DBT"\r

   ## PRODUCES             ## SystemTable\r
   ## CONSUMES             ## SystemTable\r
   gEfiImageSecurityDatabaseGuid\r
   ## PRODUCES             ## SystemTable\r
   ## CONSUMES             ## SystemTable\r
   gEfiImageSecurityDatabaseGuid\r


@@ -74,16 +75,26 @@
   ## SOMETIMES_CONSUMES   ## GUID       # Unique ID for the type of the signature.\r
   ## SOMETIMES_PRODUCES   ## GUID       # Unique ID for the type of the signature.\r
   gEfiCertSha1Guid\r
   ## SOMETIMES_CONSUMES   ## GUID       # Unique ID for the type of the signature.\r
   ## SOMETIMES_PRODUCES   ## GUID       # Unique ID for the type of the signature.\r
   gEfiCertSha1Guid\r

-  \r
+\r

   ## SOMETIMES_CONSUMES   ## GUID       # Unique ID for the type of the signature.\r
   ## SOMETIMES_PRODUCES   ## GUID       # Unique ID for the type of the signature.\r
   gEfiCertSha256Guid\r
 \r
   ## SOMETIMES_CONSUMES   ## GUID       # Unique ID for the type of the signature.\r
   ## SOMETIMES_PRODUCES   ## GUID       # Unique ID for the type of the signature.\r
   gEfiCertSha256Guid\r
 \r

+  ## SOMETIMES_CONSUMES   ## GUID       # Unique ID for the type of the signature.\r
+  ## SOMETIMES_PRODUCES   ## GUID       # Unique ID for the type of the signature.\r
+  gEfiCertSha384Guid\r
+\r
+  ## SOMETIMES_CONSUMES   ## GUID       # Unique ID for the type of the signature.\r
+  ## SOMETIMES_PRODUCES   ## GUID       # Unique ID for the type of the signature.\r
+  gEfiCertSha512Guid\r
+\r

   gEfiCertX509Guid                      ## SOMETIMES_CONSUMES    ## GUID     # Unique ID for the type of the signature.\r
   gEfiCertX509Guid                      ## SOMETIMES_CONSUMES    ## GUID     # Unique ID for the type of the signature.\r

+  gEfiCertX509Sha256Guid                ## SOMETIMES_CONSUMES    ## GUID     # Unique ID for the type of the signature.\r
+  gEfiCertX509Sha384Guid                ## SOMETIMES_CONSUMES    ## GUID     # Unique ID for the type of the signature.\r
+  gEfiCertX509Sha512Guid                ## SOMETIMES_CONSUMES    ## GUID     # Unique ID for the type of the signature.\r

   gEfiCertPkcs7Guid                     ## SOMETIMES_CONSUMES    ## GUID     # Unique ID for the type of the certificate.\r
   gEfiCertPkcs7Guid                     ## SOMETIMES_CONSUMES    ## GUID     # Unique ID for the type of the certificate.\r

-  \r
+\r

 [Pcd]\r
   gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy          ## SOMETIMES_CONSUMES\r
   gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy     ## SOMETIMES_CONSUMES\r
   gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy         ## SOMETIMES_CONSUMES\r
 [Pcd]\r
   gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy          ## SOMETIMES_CONSUMES\r
   gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy     ## SOMETIMES_CONSUMES\r
   gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy         ## SOMETIMES_CONSUMES\r

-  
\ No newline at end of file

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
index 566c5e29a7866cc4248f01fc56df13fed3e08816..3f0698e606eb8a81b4962b8d960b4c2313910a7b 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
@@ -9,7 +9,7 @@
   Variable attribute should also be checked to avoid authentication bypass.\r
      The whole SMM authentication variable design relies on the integrity of flash part and SMM.\r
   which is assumed to be protected by platform.  All variable code and metadata in flash/SMM Memory\r
   Variable attribute should also be checked to avoid authentication bypass.\r
      The whole SMM authentication variable design relies on the integrity of flash part and SMM.\r
   which is assumed to be protected by platform.  All variable code and metadata in flash/SMM Memory\r

-  may not be modified without authorization. If platform fails to protect these resources, \r
+  may not be modified without authorization. If platform fails to protect these resources,\r

   the authentication service provided in this driver will be broken, and the behavior is undefined.\r
 \r
   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do\r
   the authentication service provided in this driver will be broken, and the behavior is undefined.\r
 \r
   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do\r


@@ -77,7 +77,10 @@ EFI_SIGNATURE_ITEM mSupportSigItem[] = {
   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},\r
   {EFI_CERT_SHA224_GUID,          0,               28           },\r
   {EFI_CERT_SHA384_GUID,          0,               48           },\r
   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},\r
   {EFI_CERT_SHA224_GUID,          0,               28           },\r
   {EFI_CERT_SHA384_GUID,          0,               48           },\r

-  {EFI_CERT_SHA512_GUID,          0,               64           }\r
+  {EFI_CERT_SHA512_GUID,          0,               64           },\r
+  {EFI_CERT_X509_SHA256_GUID,     0,               48           },\r
+  {EFI_CERT_X509_SHA384_GUID,     0,               64           },\r
+  {EFI_CERT_X509_SHA512_GUID,     0,               80           }\r

 };\r
 \r
 /**\r
 };\r
 \r
 /**\r


@@ -88,7 +91,7 @@ EFI_SIGNATURE_ITEM mSupportSigItem[] = {
 \r
   @retval TRUE      This variable is protected, only a physical present user could set this variable.\r
   @retval FALSE     This variable is not protected.\r
 \r
   @retval TRUE      This variable is protected, only a physical present user could set this variable.\r
   @retval FALSE     This variable is not protected.\r

-  \r
+\r

 **/\r
 BOOLEAN\r
 NeedPhysicallyPresent(\r
 **/\r
 BOOLEAN\r
 NeedPhysicallyPresent(\r


@@ -100,7 +103,7 @@ NeedPhysicallyPresent(
     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {\r
     return TRUE;\r
   }\r
     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {\r
     return TRUE;\r
   }\r

-  \r
+\r

   return FALSE;\r
 }\r
 \r
   return FALSE;\r
 }\r
 \r


@@ -122,7 +125,7 @@ InCustomMode (
   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {\r
     return TRUE;\r
   }\r
   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {\r
     return TRUE;\r
   }\r

-  \r
+\r

   return FALSE;\r
 }\r
 \r
   return FALSE;\r
 }\r
 \r


@@ -256,7 +259,7 @@ AutenticatedVariableServiceInitialize (
     Data      = GetVariableDataPtr (Variable.CurrPtr);\r
     ASSERT ((DataSize != 0) && (Data != NULL));\r
     //\r
     Data      = GetVariableDataPtr (Variable.CurrPtr);\r
     ASSERT ((DataSize != 0) && (Data != NULL));\r
     //\r

-    // "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before) \r
+    // "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)\r

     //  Therefore, there is no memory overflow in underlying CopyMem.\r
     //\r
     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);\r
     //  Therefore, there is no memory overflow in underlying CopyMem.\r
     //\r
     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);\r


@@ -269,7 +272,7 @@ AutenticatedVariableServiceInitialize (
   } else {\r
     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));\r
   }\r
   } else {\r
     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));\r
   }\r

-  \r
+\r

   //\r
   // Create "SetupMode" variable with BS+RT attribute set.\r
   //\r
   //\r
   // Create "SetupMode" variable with BS+RT attribute set.\r
   //\r


@@ -293,7 +296,7 @@ AutenticatedVariableServiceInitialize (
   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r
   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r

-  \r
+\r

   //\r
   // Create "SignatureSupport" variable with BS+RT attribute set.\r
   //\r
   //\r
   // Create "SignatureSupport" variable with BS+RT attribute set.\r
   //\r


@@ -390,12 +393,12 @@ AutenticatedVariableServiceInitialize (
   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r
   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r

-  \r
+\r

   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));\r
 \r
   //\r
   // Check "certdb" variable's existence.\r
   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));\r
 \r
   //\r
   // Check "certdb" variable's existence.\r

-  // If it doesn't exist, then create a new one with \r
+  // If it doesn't exist, then create a new one with\r

   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.\r
   //\r
   Status = FindVariable (\r
   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.\r
   //\r
   Status = FindVariable (\r


@@ -423,7 +426,7 @@ AutenticatedVariableServiceInitialize (
     if (EFI_ERROR (Status)) {\r
       return Status;\r
     }\r
     if (EFI_ERROR (Status)) {\r
       return Status;\r
     }\r

-  }  \r
+  }\r

 \r
   //\r
   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.\r
 \r
   //\r
   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.\r


@@ -480,7 +483,7 @@ AutenticatedVariableServiceInitialize (
   Add public key in store and return its index.\r
 \r
   @param[in]  PubKey                  Input pointer to Public Key data\r
   Add public key in store and return its index.\r
 \r
   @param[in]  PubKey                  Input pointer to Public Key data\r

-  @param[in]  VariableDataEntry       The variable data entry \r
+  @param[in]  VariableDataEntry       The variable data entry\r

 \r
   @return                             Index of new added item\r
 \r
 \r
   @return                             Index of new added item\r
 \r


@@ -543,7 +546,7 @@ AddPubKeyInStore (
         //\r
         return 0;\r
       }\r
         //\r
         return 0;\r
       }\r

-      \r
+\r

       Status = Reclaim (\r
                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,\r
                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,\r
       Status = Reclaim (\r
                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,\r
                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,\r


@@ -573,7 +576,7 @@ AddPubKeyInStore (
       Data      = GetVariableDataPtr (Variable.CurrPtr);\r
       ASSERT ((DataSize != 0) && (Data != NULL));\r
       //\r
       Data      = GetVariableDataPtr (Variable.CurrPtr);\r
       ASSERT ((DataSize != 0) && (Data != NULL));\r
       //\r

-      // "AuthVarKeyDatabase" is an internal used variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before) \r
+      // "AuthVarKeyDatabase" is an internal used variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)\r

       //  Therefore, there is no memory overflow in underlying CopyMem.\r
       //\r
       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);\r
       //  Therefore, there is no memory overflow in underlying CopyMem.\r
       //\r
       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);\r


@@ -581,7 +584,7 @@ AddPubKeyInStore (
 \r
       if (mPubKeyNumber == mMaxKeyNumber) {\r
         return 0;\r
 \r
       if (mPubKeyNumber == mMaxKeyNumber) {\r
         return 0;\r

-      }     \r
+      }\r

     }\r
 \r
     //\r
     }\r
 \r
     //\r


@@ -656,7 +659,7 @@ VerifyCounterBasedPayload (
   UINT8                           Digest[SHA256_DIGEST_SIZE];\r
   VOID                            *Rsa;\r
   UINTN                           PayloadSize;\r
   UINT8                           Digest[SHA256_DIGEST_SIZE];\r
   VOID                            *Rsa;\r
   UINTN                           PayloadSize;\r

-  \r
+\r

   PayloadSize = DataSize - AUTHINFO_SIZE;\r
   Rsa         = NULL;\r
   CertData    = NULL;\r
   PayloadSize = DataSize - AUTHINFO_SIZE;\r
   Rsa         = NULL;\r
   CertData    = NULL;\r


@@ -885,7 +888,7 @@ UpdatePlatformMode (
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx variable.\r
+  Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx/dbt variable.\r

 \r
   @param[in]  VariableName                Name of Variable to be check.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r
 \r
   @param[in]  VariableName                Name of Variable to be check.\r
   @param[in]  VendorGuid                  Variable vendor GUID.\r


@@ -894,7 +897,7 @@ UpdatePlatformMode (
 \r
   @return EFI_INVALID_PARAMETER           Invalid signature list format.\r
   @return EFI_SUCCESS                     Passed signature list format check successfully.\r
 \r
   @return EFI_INVALID_PARAMETER           Invalid signature list format.\r
   @return EFI_SUCCESS                     Passed signature list format check successfully.\r

-  \r
+\r

 **/\r
 EFI_STATUS\r
 CheckSignatureListFormat(\r
 **/\r
 EFI_STATUS\r
 CheckSignatureListFormat(\r


@@ -921,9 +924,10 @@ CheckSignatureListFormat(
 \r
   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){\r
     IsPk = TRUE;\r
 \r
   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){\r
     IsPk = TRUE;\r

-  } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0) ||\r
-             (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) && \r
-              (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0 || StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))){\r
+  } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) ||\r
+             (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&\r
+             ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||\r
+              (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0)))) {\r

     IsPk = FALSE;\r
   } else {\r
     return EFI_SUCCESS;\r
     IsPk = FALSE;\r
   } else {\r
     return EFI_SUCCESS;\r


@@ -942,10 +946,10 @@ CheckSignatureListFormat(
     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {\r
       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {\r
         //\r
     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {\r
       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {\r
         //\r

-        // The value of SignatureSize should always be 16 (size of SignatureOwner \r
+        // The value of SignatureSize should always be 16 (size of SignatureOwner\r

         // component) add the data length according to signature type.\r
         //\r
         // component) add the data length according to signature type.\r
         //\r

-        if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) && \r
+        if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&\r

           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {\r
           return EFI_INVALID_PARAMETER;\r
         }\r
           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {\r
           return EFI_INVALID_PARAMETER;\r
         }\r


@@ -986,7 +990,7 @@ CheckSignatureListFormat(
       return EFI_INVALID_PARAMETER;\r
     }\r
     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;\r
       return EFI_INVALID_PARAMETER;\r
     }\r
     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;\r

-    \r
+\r

     SigDataSize -= SigList->SignatureListSize;\r
     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);\r
   }\r
     SigDataSize -= SigList->SignatureListSize;\r
     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);\r
   }\r


@@ -1007,7 +1011,7 @@ CheckSignatureListFormat(
 \r
   @return EFI_SUCCESS           Variable is updated successfully.\r
   @return Others                Failed to update variable.\r
 \r
   @return EFI_SUCCESS           Variable is updated successfully.\r
   @return Others                Failed to update variable.\r

-  \r
+\r

 **/\r
 EFI_STATUS\r
 VendorKeyIsModified (\r
 **/\r
 EFI_STATUS\r
 VendorKeyIsModified (\r


@@ -1021,7 +1025,7 @@ VendorKeyIsModified (
     return EFI_SUCCESS;\r
   }\r
   mVendorKeyState = VENDOR_KEYS_MODIFIED;\r
     return EFI_SUCCESS;\r
   }\r
   mVendorKeyState = VENDOR_KEYS_MODIFIED;\r

-  \r
+\r

   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);\r
   Status = UpdateVariable (\r
              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,\r
   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);\r
   Status = UpdateVariable (\r
              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,\r


@@ -1093,10 +1097,10 @@ ProcessVarWithPk (
   UINT8                       *Payload;\r
   UINTN                       PayloadSize;\r
 \r
   UINT8                       *Payload;\r
   UINTN                       PayloadSize;\r
 \r

-  if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 || \r
+  if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||\r

       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {\r
     //\r
       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {\r
     //\r

-    // PK, KEK and db/dbx should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based\r
+    // PK, KEK and db/dbx/dbt should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based\r

     // authenticated variable.\r
     //\r
     return EFI_INVALID_PARAMETER;\r
     // authenticated variable.\r
     //\r
     return EFI_INVALID_PARAMETER;\r


@@ -1221,7 +1225,7 @@ ProcessVarWithKek (
   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||\r
       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {\r
     //\r
   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||\r
       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {\r
     //\r

-    // DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based\r
+    // DB, DBX and DBT should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based\r

     // authenticated variable.\r
     //\r
     return EFI_INVALID_PARAMETER;\r
     // authenticated variable.\r
     //\r
     return EFI_INVALID_PARAMETER;\r


@@ -1253,7 +1257,7 @@ ProcessVarWithKek (
     if (EFI_ERROR (Status)) {\r
       return Status;\r
     }\r
     if (EFI_ERROR (Status)) {\r
       return Status;\r
     }\r

-    \r
+\r

     Status = UpdateVariable (\r
                VariableName,\r
                VendorGuid,\r
     Status = UpdateVariable (\r
                VariableName,\r
                VendorGuid,\r


@@ -1338,23 +1342,23 @@ ProcessVariable (
     //\r
     return EFI_SECURITY_VIOLATION;\r
   }\r
     //\r
     return EFI_SECURITY_VIOLATION;\r
   }\r

-  \r
+\r

   //\r
   // A time-based authenticated variable and a count-based authenticated variable\r
   // can't be updated by each other.\r
   //\r
   // A time-based authenticated variable and a count-based authenticated variable\r
   // can't be updated by each other.\r

-  // \r
-  if (Variable->CurrPtr != NULL) {    \r
+  //\r
+  if (Variable->CurrPtr != NULL) {\r

     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&\r
         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {\r
     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&\r
         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {\r

-      return EFI_SECURITY_VIOLATION;      \r
+      return EFI_SECURITY_VIOLATION;\r

     }\r
     }\r

-    \r
-    if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) && \r
+\r
+    if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&\r

         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {\r
         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {\r

-      return EFI_SECURITY_VIOLATION;      \r
+      return EFI_SECURITY_VIOLATION;\r

     }\r
   }\r
     }\r
   }\r

-    \r
+\r

   //\r
   // Process Time-based Authenticated variable.\r
   //\r
   //\r
   // Process Time-based Authenticated variable.\r
   //\r


@@ -1392,7 +1396,7 @@ ProcessVariable (
       KeyIndex   = Variable->CurrPtr->PubKeyIndex;\r
       IsFirstTime = FALSE;\r
     }\r
       KeyIndex   = Variable->CurrPtr->PubKeyIndex;\r
       IsFirstTime = FALSE;\r
     }\r

-  } else if ((Variable->CurrPtr != NULL) && \r
+  } else if ((Variable->CurrPtr != NULL) &&\r

              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)\r
             ) {\r
     //\r
              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)\r
             ) {\r
     //\r


@@ -1423,7 +1427,7 @@ ProcessVariable (
   if (!IsFirstTime) {\r
     //\r
     // 2 cases need to check here\r
   if (!IsFirstTime) {\r
     //\r
     // 2 cases need to check here\r

-    //   1. Internal PubKey variable. PubKeyIndex is always 0 \r
+    //   1. Internal PubKey variable. PubKeyIndex is always 0\r

     //   2. Other counter-based AuthVariable. Check input PubKey.\r
     //\r
     if (KeyIndex == 0 || CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {\r
     //   2. Other counter-based AuthVariable. Check input PubKey.\r
     //\r
     if (KeyIndex == 0 || CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {\r


@@ -1478,7 +1482,7 @@ ProcessVariable (
 \r
   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.\r
   @param[in]       DataSize          Size of Data buffer.\r
 \r
   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.\r
   @param[in]       DataSize          Size of Data buffer.\r

-  @param[in]       FreeBufSize       Size of free data buffer \r
+  @param[in]       FreeBufSize       Size of free data buffer\r

   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.\r
   @param[in]       NewDataSize       Size of NewData buffer.\r
   @param[out]      MergedBufSize     Size of the merged buffer\r
   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.\r
   @param[in]       NewDataSize       Size of NewData buffer.\r
   @param[out]      MergedBufSize     Size of the merged buffer\r


@@ -1714,7 +1718,7 @@ FindCertsFromDb (
       //\r
       // Check whether VariableName matches.\r
       //\r
       //\r
       // Check whether VariableName matches.\r
       //\r

-      if ((NameSize == StrLen (VariableName)) && \r
+      if ((NameSize == StrLen (VariableName)) &&\r

           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {\r
         Offset = Offset + NameSize * sizeof (CHAR16);\r
 \r
           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {\r
         Offset = Offset + NameSize * sizeof (CHAR16);\r
 \r


@@ -1723,7 +1727,7 @@ FindCertsFromDb (
         }\r
 \r
         if (CertDataSize != NULL) {\r
         }\r
 \r
         if (CertDataSize != NULL) {\r

-          *CertDataSize = CertSize;        \r
+          *CertDataSize = CertSize;\r

         }\r
 \r
         if (CertNodeOffset != NULL) {\r
         }\r
 \r
         if (CertNodeOffset != NULL) {\r


@@ -1744,7 +1748,7 @@ FindCertsFromDb (
     }\r
   }\r
 \r
     }\r
   }\r
 \r

-  return EFI_NOT_FOUND;  \r
+  return EFI_NOT_FOUND;\r

 }\r
 \r
 /**\r
 }\r
 \r
 /**\r


@@ -1778,7 +1782,7 @@ GetCertsFromDb (
   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r

-  \r
+\r

   //\r
   // Get variable "certdb".\r
   //\r
   //\r
   // Get variable "certdb".\r
   //\r


@@ -1788,7 +1792,7 @@ GetCertsFromDb (
              &CertDbVariable,\r
              &mVariableModuleGlobal->VariableGlobal,\r
              FALSE\r
              &CertDbVariable,\r
              &mVariableModuleGlobal->VariableGlobal,\r
              FALSE\r

-             );      \r
+             );\r

   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r
   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r


@@ -1851,7 +1855,7 @@ DeleteCertsFromDb (
   if ((VariableName == NULL) || (VendorGuid == NULL)) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
   if ((VariableName == NULL) || (VendorGuid == NULL)) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r

-  \r
+\r

   //\r
   // Get variable "certdb".\r
   //\r
   //\r
   // Get variable "certdb".\r
   //\r


@@ -1861,7 +1865,7 @@ DeleteCertsFromDb (
              &CertDbVariable,\r
              &mVariableModuleGlobal->VariableGlobal,\r
              FALSE\r
              &CertDbVariable,\r
              &mVariableModuleGlobal->VariableGlobal,\r
              FALSE\r

-             );      \r
+             );\r

   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r
   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r


@@ -1929,8 +1933,8 @@ DeleteCertsFromDb (
 \r
   //\r
   // Set "certdb".\r
 \r
   //\r
   // Set "certdb".\r

-  // \r
-  VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;  \r
+  //\r
+  VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r

   Status   = UpdateVariable (\r
                EFI_CERT_DB_NAME,\r
                &gEfiCertDbGuid,\r
   Status   = UpdateVariable (\r
                EFI_CERT_DB_NAME,\r
                &gEfiCertDbGuid,\r


@@ -1984,7 +1988,7 @@ InsertCertsToDb (
   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r

-  \r
+\r

   //\r
   // Get variable "certdb".\r
   //\r
   //\r
   // Get variable "certdb".\r
   //\r


@@ -1994,7 +1998,7 @@ InsertCertsToDb (
              &CertDbVariable,\r
              &mVariableModuleGlobal->VariableGlobal,\r
              FALSE\r
              &CertDbVariable,\r
              &mVariableModuleGlobal->VariableGlobal,\r
              FALSE\r

-             );      \r
+             );\r

   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r
   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r


@@ -2030,7 +2034,7 @@ InsertCertsToDb (
   // Construct new data content of variable "certdb".\r
   //\r
   NameSize      = (UINT32) StrLen (VariableName);\r
   // Construct new data content of variable "certdb".\r
   //\r
   NameSize      = (UINT32) StrLen (VariableName);\r

-  CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16); \r
+  CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);\r

   NewCertDbSize = (UINT32) DataSize + CertNodeSize;\r
   if (NewCertDbSize > mMaxCertDbSize) {\r
     return EFI_OUT_OF_RESOURCES;\r
   NewCertDbSize = (UINT32) DataSize + CertNodeSize;\r
   if (NewCertDbSize > mMaxCertDbSize) {\r
     return EFI_OUT_OF_RESOURCES;\r


@@ -2053,7 +2057,7 @@ InsertCertsToDb (
   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));\r
   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));\r
   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));\r
   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));\r
   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));\r
   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));\r

-  \r
+\r

   CopyMem (\r
     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),\r
     VariableName,\r
   CopyMem (\r
     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),\r
     VariableName,\r


@@ -2065,11 +2069,11 @@ InsertCertsToDb (
     CertData,\r
     CertDataSize\r
     );\r
     CertData,\r
     CertDataSize\r
     );\r

-  \r
+\r

   //\r
   // Set "certdb".\r
   //\r
   // Set "certdb".\r

-  // \r
-  VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;  \r
+  //\r
+  VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r

   Status   = UpdateVariable (\r
                EFI_CERT_DB_NAME,\r
                &gEfiCertDbGuid,\r
   Status   = UpdateVariable (\r
                EFI_CERT_DB_NAME,\r
                &gEfiCertDbGuid,\r


@@ -2349,7 +2353,7 @@ VerifyTimeBasedPayload (
   } else if (AuthVarType == AuthVarTypePriv) {\r
 \r
     //\r
   } else if (AuthVarType == AuthVarTypePriv) {\r
 \r
     //\r

-    // Process common authenticated variable except PK/KEK/DB/DBX.\r
+    // Process common authenticated variable except PK/KEK/DB/DBX/DBT.\r

     // Get signer's certificates from SignedData.\r
     //\r
     VerifyStatus = Pkcs7GetSigners (\r
     // Get signer's certificates from SignedData.\r
     //\r
     VerifyStatus = Pkcs7GetSigners (\r


@@ -2376,7 +2380,7 @@ VerifyTimeBasedPayload (
       if (EFI_ERROR (Status)) {\r
         goto Exit;\r
       }\r
       if (EFI_ERROR (Status)) {\r
         goto Exit;\r
       }\r

-    \r
+\r

       if ((CertStackSize != CertsSizeinDb) ||\r
           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {\r
         goto Exit;\r
       if ((CertStackSize != CertsSizeinDb) ||\r
           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {\r
         goto Exit;\r


@@ -2419,7 +2423,7 @@ VerifyTimeBasedPayload (
     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
     RootCert      = Cert->SignatureData;\r
     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);\r
     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
     RootCert      = Cert->SignatureData;\r
     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);\r

-    \r
+\r

     // Verify Pkcs7 SignedData via Pkcs7Verify library.\r
     //\r
     VerifyStatus = Pkcs7Verify (\r
     // Verify Pkcs7 SignedData via Pkcs7Verify library.\r
     //\r
     VerifyStatus = Pkcs7Verify (\r


@@ -2469,4 +2473,3 @@ Exit:
            &CertData->TimeStamp\r
            );\r
 }\r
            &CertData->TimeStamp\r
            );\r
 }\r

-\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c
index cb0f2baf9d3ff8f79f193406b6cb13d7a2691826..432531f6dfc94087cec5d53f3e69da97250346a1 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c
@@ -592,14 +592,14 @@ GetEndPointer (
 \r
   Check the PubKeyIndex is a valid key or not.\r
 \r
 \r
   Check the PubKeyIndex is a valid key or not.\r
 \r

-  This function will iterate the NV storage to see if this PubKeyIndex is still referenced \r
+  This function will iterate the NV storage to see if this PubKeyIndex is still referenced\r

   by any valid count-based auth variabe.\r
   by any valid count-based auth variabe.\r

-  \r
+\r

   @param[in]  PubKeyIndex     Index of the public key in public key store.\r
 \r
   @retval     TRUE            The PubKeyIndex is still in use.\r
   @retval     FALSE           The PubKeyIndex is not referenced by any count-based auth variabe.\r
   @param[in]  PubKeyIndex     Index of the public key in public key store.\r
 \r
   @retval     TRUE            The PubKeyIndex is still in use.\r
   @retval     FALSE           The PubKeyIndex is not referenced by any count-based auth variabe.\r

-  \r
+\r

 **/\r
 BOOLEAN\r
 IsValidPubKeyIndex (\r
 **/\r
 BOOLEAN\r
 IsValidPubKeyIndex (\r


@@ -617,20 +617,20 @@ IsValidPubKeyIndex (
   VariableStoreEnd = GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase);\r
 \r
   while (IsValidVariableHeader (Variable, VariableStoreEnd)) {\r
   VariableStoreEnd = GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase);\r
 \r
   while (IsValidVariableHeader (Variable, VariableStoreEnd)) {\r

-    if ((Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) && \r
+    if ((Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) &&\r

         Variable->PubKeyIndex == PubKeyIndex) {\r
       return TRUE;\r
     }\r
     Variable = GetNextVariablePtr (Variable);\r
   }\r
         Variable->PubKeyIndex == PubKeyIndex) {\r
       return TRUE;\r
     }\r
     Variable = GetNextVariablePtr (Variable);\r
   }\r

-  \r
+\r

   return FALSE;\r
 }\r
 \r
 /**\r
 \r
   Get the number of valid public key in PubKeyStore.\r
   return FALSE;\r
 }\r
 \r
 /**\r
 \r
   Get the number of valid public key in PubKeyStore.\r

-  \r
+\r

   @param[in]  PubKeyNumber     Number of the public key in public key store.\r
 \r
   @return     Number of valid public key in PubKeyStore.\r
   @param[in]  PubKeyNumber     Number of the public key in public key store.\r
 \r
   @return     Number of valid public key in PubKeyStore.\r


@@ -645,13 +645,13 @@ GetValidPubKeyNumber (
   UINT32       Counter;\r
 \r
   Counter = 0;\r
   UINT32       Counter;\r
 \r
   Counter = 0;\r

-  \r
+\r

   for (PubKeyIndex = 1; PubKeyIndex <= PubKeyNumber; PubKeyIndex++) {\r
     if (IsValidPubKeyIndex (PubKeyIndex)) {\r
       Counter++;\r
     }\r
   }\r
   for (PubKeyIndex = 1; PubKeyIndex <= PubKeyNumber; PubKeyIndex++) {\r
     if (IsValidPubKeyIndex (PubKeyIndex)) {\r
       Counter++;\r
     }\r
   }\r

-  \r
+\r

   return Counter;\r
 }\r
 \r
   return Counter;\r
 }\r
 \r


@@ -659,7 +659,7 @@ GetValidPubKeyNumber (
 \r
   Filter the useless key in public key store.\r
 \r
 \r
   Filter the useless key in public key store.\r
 \r

-  This function will find out all valid public keys in public key database, save them in new allocated \r
+  This function will find out all valid public keys in public key database, save them in new allocated\r

   buffer NewPubKeyStore, and give the new PubKeyIndex. The caller is responsible for freeing buffer\r
   NewPubKeyIndex and NewPubKeyStore with FreePool().\r
 \r
   buffer NewPubKeyStore, and give the new PubKeyIndex. The caller is responsible for freeing buffer\r
   NewPubKeyIndex and NewPubKeyStore with FreePool().\r
 \r


@@ -668,10 +668,10 @@ GetValidPubKeyNumber (
   @param[out]  NewPubKeyIndex       Point to an array of new PubKeyIndex corresponds to NewPubKeyStore.\r
   @param[out]  NewPubKeyStore       Saved all valid public keys in PubKeyStore.\r
   @param[out]  NewPubKeySize        Buffer size of the NewPubKeyStore.\r
   @param[out]  NewPubKeyIndex       Point to an array of new PubKeyIndex corresponds to NewPubKeyStore.\r
   @param[out]  NewPubKeyStore       Saved all valid public keys in PubKeyStore.\r
   @param[out]  NewPubKeySize        Buffer size of the NewPubKeyStore.\r

-  \r
+\r

   @retval  EFI_SUCCESS              Trim operation is complete successfully.\r
   @retval  EFI_OUT_OF_RESOURCES     No enough memory resources, or no useless key in PubKeyStore.\r
   @retval  EFI_SUCCESS              Trim operation is complete successfully.\r
   @retval  EFI_OUT_OF_RESOURCES     No enough memory resources, or no useless key in PubKeyStore.\r

-  \r
+\r

 **/\r
 EFI_STATUS\r
 PubKeyStoreFilter (\r
 **/\r
 EFI_STATUS\r
 PubKeyStoreFilter (\r


@@ -685,7 +685,7 @@ PubKeyStoreFilter (
   UINT32        PubKeyIndex;\r
   UINT32        CopiedKey;\r
   UINT32        NewPubKeyNumber;\r
   UINT32        PubKeyIndex;\r
   UINT32        CopiedKey;\r
   UINT32        NewPubKeyNumber;\r

-  \r
+\r

   NewPubKeyNumber = GetValidPubKeyNumber (PubKeyNumber);\r
   if (NewPubKeyNumber == PubKeyNumber) {\r
     return EFI_OUT_OF_RESOURCES;\r
   NewPubKeyNumber = GetValidPubKeyNumber (PubKeyNumber);\r
   if (NewPubKeyNumber == PubKeyNumber) {\r
     return EFI_OUT_OF_RESOURCES;\r


@@ -739,7 +739,7 @@ PubKeyStoreFilter (
   @param[in]      NewVariable             Pointer to new variable.\r
   @param[in]      NewVariableSize         New variable size.\r
   @param[in]      ReclaimPubKeyStore      Reclaim for public key database or not.\r
   @param[in]      NewVariable             Pointer to new variable.\r
   @param[in]      NewVariableSize         New variable size.\r
   @param[in]      ReclaimPubKeyStore      Reclaim for public key database or not.\r

-  \r
+\r

   @return EFI_SUCCESS                  Reclaim operation has finished successfully.\r
   @return EFI_OUT_OF_RESOURCES         No enough memory resources or variable space.\r
   @return EFI_DEVICE_ERROR             The public key database doesn't exist.\r
   @return EFI_SUCCESS                  Reclaim operation has finished successfully.\r
   @return EFI_OUT_OF_RESOURCES         No enough memory resources or variable space.\r
   @return EFI_DEVICE_ERROR             The public key database doesn't exist.\r


@@ -873,7 +873,7 @@ Reclaim (
     while (IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))) {\r
       NextVariable = GetNextVariablePtr (Variable);\r
       if (Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) {\r
     while (IsValidVariableHeader (Variable, GetEndPointer (VariableStoreHeader))) {\r
       NextVariable = GetNextVariablePtr (Variable);\r
       if (Variable->State == VAR_ADDED || Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) {\r

-        if ((StrCmp (GetVariableNamePtr (Variable), AUTHVAR_KEYDB_NAME) == 0) && \r
+        if ((StrCmp (GetVariableNamePtr (Variable), AUTHVAR_KEYDB_NAME) == 0) &&\r

             (CompareGuid (&Variable->VendorGuid, &gEfiAuthenticatedVariableGuid))) {\r
           //\r
           // Skip the public key database, it will be reinstalled later.\r
             (CompareGuid (&Variable->VendorGuid, &gEfiAuthenticatedVariableGuid))) {\r
           //\r
           // Skip the public key database, it will be reinstalled later.\r


@@ -882,7 +882,7 @@ Reclaim (
           Variable = NextVariable;\r
           continue;\r
         }\r
           Variable = NextVariable;\r
           continue;\r
         }\r

-        \r
+\r

         VariableSize = (UINTN) NextVariable - (UINTN) Variable;\r
         CopyMem (CurrPtr, (UINT8 *) Variable, VariableSize);\r
         ((VARIABLE_HEADER*) CurrPtr)->PubKeyIndex = NewPubKeyIndex[Variable->PubKeyIndex];\r
         VariableSize = (UINTN) NextVariable - (UINTN) Variable;\r
         CopyMem (CurrPtr, (UINT8 *) Variable, VariableSize);\r
         ((VARIABLE_HEADER*) CurrPtr)->PubKeyIndex = NewPubKeyIndex[Variable->PubKeyIndex];\r


@@ -909,7 +909,7 @@ Reclaim (
     Variable->DataSize = NewPubKeySize;\r
     StrCpy (GetVariableNamePtr (Variable), GetVariableNamePtr (PubKeyHeader));\r
     CopyMem (GetVariableDataPtr (Variable), NewPubKeyStore, NewPubKeySize);\r
     Variable->DataSize = NewPubKeySize;\r
     StrCpy (GetVariableNamePtr (Variable), GetVariableNamePtr (PubKeyHeader));\r
     CopyMem (GetVariableDataPtr (Variable), NewPubKeyStore, NewPubKeySize);\r

-    CurrPtr = (UINT8*) GetNextVariablePtr (Variable); \r
+    CurrPtr = (UINT8*) GetNextVariablePtr (Variable);\r

     CommonVariableTotalSize += (UINTN) CurrPtr - (UINTN) Variable;\r
   } else {\r
     //\r
     CommonVariableTotalSize += (UINTN) CurrPtr - (UINTN) Variable;\r
   } else {\r
     //\r


@@ -1524,7 +1524,7 @@ VariableGetBestLanguage (
 \r
   @param[in] Attributes         Variable attributes for Variable entries.\r
   @param ...                    The variable argument list with type VARIABLE_ENTRY_CONSISTENCY *.\r
 \r
   @param[in] Attributes         Variable attributes for Variable entries.\r
   @param ...                    The variable argument list with type VARIABLE_ENTRY_CONSISTENCY *.\r

-                                A NULL terminates the list. The VariableSize of \r
+                                A NULL terminates the list. The VariableSize of\r

                                 VARIABLE_ENTRY_CONSISTENCY is the variable data size as input.\r
                                 It will be changed to variable total size as output.\r
 \r
                                 VARIABLE_ENTRY_CONSISTENCY is the variable data size as input.\r
                                 It will be changed to variable total size as output.\r
 \r


@@ -1803,7 +1803,7 @@ AutoUpdateLangVariable (
         VariableEntry[0].VariableSize = ISO_639_2_ENTRY_SIZE + 1;\r
         VariableEntry[0].Guid = &gEfiGlobalVariableGuid;\r
         VariableEntry[0].Name = EFI_LANG_VARIABLE_NAME;\r
         VariableEntry[0].VariableSize = ISO_639_2_ENTRY_SIZE + 1;\r
         VariableEntry[0].Guid = &gEfiGlobalVariableGuid;\r
         VariableEntry[0].Name = EFI_LANG_VARIABLE_NAME;\r

-        \r
+\r

         VariableEntry[1].VariableSize = AsciiStrSize (BestPlatformLang);\r
         VariableEntry[1].Guid = &gEfiGlobalVariableGuid;\r
         VariableEntry[1].Name = EFI_PLATFORM_LANG_VARIABLE_NAME;\r
         VariableEntry[1].VariableSize = AsciiStrSize (BestPlatformLang);\r
         VariableEntry[1].Guid = &gEfiGlobalVariableGuid;\r
         VariableEntry[1].Name = EFI_PLATFORM_LANG_VARIABLE_NAME;\r


@@ -2009,7 +2009,7 @@ UpdateVariable (
         Status = EFI_INVALID_PARAMETER;\r
         goto Done;\r
       }\r
         Status = EFI_INVALID_PARAMETER;\r
         goto Done;\r
       }\r

-      \r
+\r

       //\r
       // Only variable that have RT attributes can be updated/deleted in Runtime.\r
       //\r
       //\r
       // Only variable that have RT attributes can be updated/deleted in Runtime.\r
       //\r


@@ -2103,20 +2103,21 @@ UpdateVariable (
         CopyMem (BufferForMerge, (UINT8 *) ((UINTN) Variable->CurrPtr + DataOffset), Variable->CurrPtr->DataSize);\r
 \r
         //\r
         CopyMem (BufferForMerge, (UINT8 *) ((UINTN) Variable->CurrPtr + DataOffset), Variable->CurrPtr->DataSize);\r
 \r
         //\r

-        // Set Max Common Variable Data Size as default MaxDataSize \r
+        // Set Max Common Variable Data Size as default MaxDataSize\r

         //\r
         MaxDataSize = PcdGet32 (PcdMaxVariableSize) - DataOffset;\r
 \r
         if ((CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&\r
         //\r
         MaxDataSize = PcdGet32 (PcdMaxVariableSize) - DataOffset;\r
 \r
         if ((CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&\r

-            ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))) ||\r
-            (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0))) {\r
+            ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||\r
+             (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0))) ||\r
+             (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0))) {\r

           //\r
           // For variables with formatted as EFI_SIGNATURE_LIST, the driver shall not perform an append of\r
           // EFI_SIGNATURE_DATA values that are already part of the existing variable value.\r
           //\r
           Status = AppendSignatureList (\r
                      BufferForMerge,\r
           //\r
           // For variables with formatted as EFI_SIGNATURE_LIST, the driver shall not perform an append of\r
           // EFI_SIGNATURE_DATA values that are already part of the existing variable value.\r
           //\r
           Status = AppendSignatureList (\r
                      BufferForMerge,\r

-                     Variable->CurrPtr->DataSize, \r
+                     Variable->CurrPtr->DataSize,\r

                      MaxDataSize - Variable->CurrPtr->DataSize,\r
                      Data,\r
                      DataSize,\r
                      MaxDataSize - Variable->CurrPtr->DataSize,\r
                      Data,\r
                      DataSize,\r


@@ -2530,8 +2531,8 @@ Done:
 /**\r
   Check if a Unicode character is a hexadecimal character.\r
 \r
 /**\r
   Check if a Unicode character is a hexadecimal character.\r
 \r

-  This function checks if a Unicode character is a \r
-  hexadecimal character.  The valid hexadecimal character is \r
+  This function checks if a Unicode character is a\r
+  hexadecimal character.  The valid hexadecimal character is\r

   L'0' to L'9', L'a' to L'f', or L'A' to L'F'.\r
 \r
 \r
   L'0' to L'9', L'a' to L'f', or L'A' to L'F'.\r
 \r
 \r


@@ -2701,7 +2702,7 @@ VariableLockRequestToLock (
 \r
   @retval TRUE      This variable is read-only variable.\r
   @retval FALSE     This variable is NOT read-only variable.\r
 \r
   @retval TRUE      This variable is read-only variable.\r
   @retval FALSE     This variable is NOT read-only variable.\r

-  \r
+\r

 **/\r
 BOOLEAN\r
 IsReadOnlyVariable (\r
 **/\r
 BOOLEAN\r
 IsReadOnlyVariable (\r


@@ -2722,7 +2723,7 @@ IsReadOnlyVariable (
       return TRUE;\r
     }\r
   }\r
       return TRUE;\r
     }\r
   }\r

-  \r
+\r

   return FALSE;\r
 }\r
 \r
   return FALSE;\r
 }\r
 \r


@@ -3077,8 +3078,8 @@ VariableServiceSetVariable (
 \r
   if ((UINTN)(~0) - PayloadSize < StrSize(VariableName)){\r
     //\r
 \r
   if ((UINTN)(~0) - PayloadSize < StrSize(VariableName)){\r
     //\r

-    // Prevent whole variable size overflow \r
-    // \r
+    // Prevent whole variable size overflow\r
+    //\r

     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r


@@ -3184,8 +3185,9 @@ VariableServiceSetVariable (
     Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, TRUE);\r
   } else if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) {\r
     Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, FALSE);\r
     Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, TRUE);\r
   } else if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) {\r
     Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, FALSE);\r

-  } else if (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) && \r
-          ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))) {\r
+  } else if (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&\r
+          ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))\r
+           || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2)) == 0) {\r

     Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, FALSE);\r
     if (EFI_ERROR (Status)) {\r
       Status = ProcessVarWithKek (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes);\r
     Status = ProcessVarWithPk (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes, FALSE);\r
     if (EFI_ERROR (Status)) {\r
       Status = ProcessVarWithKek (VariableName, VendorGuid, Data, DataSize, &Variable, Attributes);\r


@@ -3937,4 +3939,3 @@ GetFvbInfoByAddress (
 \r
   return Status;\r
 }\r
 \r
   return Status;\r
 }\r

-\r

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
index aab321e402802d86f9a58b205cf8f040388fc684..3c994317f74b3bde670b9da2fa88696f88a95c76 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
@@ -1,13 +1,13 @@
 /** @file\r
   VFR file used by the SecureBoot configuration component.\r
 \r
 /** @file\r
   VFR file used by the SecureBoot configuration component.\r
 \r

-Copyright (c) 2011 - 2013, Intel Corporation. All rights reserved.<BR>\r
-This program and the accompanying materials \r
-are licensed and made available under the terms and conditions of the BSD License \r
-which accompanies this distribution.  The full text of the license may be found at \r
+Copyright (c) 2011 - 2014, Intel Corporation. All rights reserved.<BR>\r
+This program and the accompanying materials\r
+are licensed and made available under the terms and conditions of the BSD License\r
+which accompanies this distribution.  The full text of the license may be found at\r

 http://opensource.org/licenses/bsd-license.php\r
 \r
 http://opensource.org/licenses/bsd-license.php\r
 \r

-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, \r
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r

 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
 \r
 **/\r
 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
 \r
 **/\r


@@ -24,7 +24,7 @@ formset
     varid = SECUREBOOT_CONFIGURATION_VARSTORE_ID,\r
     name  = SECUREBOOT_CONFIGURATION,\r
     guid  = SECUREBOOT_CONFIG_FORM_SET_GUID;\r
     varid = SECUREBOOT_CONFIGURATION_VARSTORE_ID,\r
     name  = SECUREBOOT_CONFIGURATION,\r
     guid  = SECUREBOOT_CONFIG_FORM_SET_GUID;\r

-  \r
+\r

   //\r
   // ##1 Form "Secure Boot Configuration"\r
   //\r
   //\r
   // ##1 Form "Secure Boot Configuration"\r
   //\r


@@ -37,7 +37,7 @@ formset
       help   = STRING_TOKEN(STR_SECURE_BOOT_STATE_HELP),\r
       text   = STRING_TOKEN(STR_SECURE_BOOT_STATE_PROMPT),\r
         text   = STRING_TOKEN(STR_SECURE_BOOT_STATE_CONTENT);\r
       help   = STRING_TOKEN(STR_SECURE_BOOT_STATE_HELP),\r
       text   = STRING_TOKEN(STR_SECURE_BOOT_STATE_PROMPT),\r
         text   = STRING_TOKEN(STR_SECURE_BOOT_STATE_CONTENT);\r

-        \r
+\r

     //\r
     // Define of Check Box: Attempt Secure Boot\r
     //\r
     //\r
     // Define of Check Box: Attempt Secure Boot\r
     //\r


@@ -48,8 +48,8 @@ formset
               help     = STRING_TOKEN(STR_NULL),\r
               flags    = INTERACTIVE,\r
       endcheckbox;\r
               help     = STRING_TOKEN(STR_NULL),\r
               flags    = INTERACTIVE,\r
       endcheckbox;\r

-    endif;  \r
-    \r
+    endif;\r
+\r

     //\r
     // Display of Check Box: Attempt Secure Boot\r
     //\r
     //\r
     // Display of Check Box: Attempt Secure Boot\r
     //\r


@@ -61,7 +61,7 @@ formset
           flags  = INTERACTIVE | RESET_REQUIRED,\r
     endcheckbox;\r
     endif;\r
           flags  = INTERACTIVE | RESET_REQUIRED,\r
     endcheckbox;\r
     endif;\r

-    \r
+\r

     //\r
     // Display of Oneof: 'Secure Boot Mode'\r
     //\r
     //\r
     // Display of Oneof: 'Secure Boot Mode'\r
     //\r


@@ -75,14 +75,14 @@ formset
       endoneof;\r
     endif;\r
       oneof name = SecureBootMode,\r
       endoneof;\r
     endif;\r
       oneof name = SecureBootMode,\r

-            questionid = KEY_SECURE_BOOT_MODE,      \r
+            questionid = KEY_SECURE_BOOT_MODE,\r

             prompt = STRING_TOKEN(STR_SECURE_BOOT_MODE_PROMPT),\r
             help   = STRING_TOKEN(STR_SECURE_BOOT_MODE_HELP),\r
             flags  = INTERACTIVE | NUMERIC_SIZE_1,\r
             option text = STRING_TOKEN(STR_STANDARD_MODE),    value = SECURE_BOOT_MODE_STANDARD, flags = DEFAULT;\r
             option text = STRING_TOKEN(STR_CUSTOM_MODE),      value = SECURE_BOOT_MODE_CUSTOM,   flags = 0;\r
       endoneof;\r
             prompt = STRING_TOKEN(STR_SECURE_BOOT_MODE_PROMPT),\r
             help   = STRING_TOKEN(STR_SECURE_BOOT_MODE_HELP),\r
             flags  = INTERACTIVE | NUMERIC_SIZE_1,\r
             option text = STRING_TOKEN(STR_STANDARD_MODE),    value = SECURE_BOOT_MODE_STANDARD, flags = DEFAULT;\r
             option text = STRING_TOKEN(STR_CUSTOM_MODE),      value = SECURE_BOOT_MODE_CUSTOM,   flags = 0;\r
       endoneof;\r

-    \r
+\r

     //\r
     //\r
     // Display of 'Current Secure Boot Mode'\r
     //\r
     //\r
     // Display of 'Current Secure Boot Mode'\r


@@ -97,55 +97,63 @@ formset
       endif;\r
     endif;\r
   endform;\r
       endif;\r
     endif;\r
   endform;\r

-  \r
+\r

   //\r
   // ##2 Form: 'Custom Secure Boot Options'\r
   //\r
   form formid = FORMID_SECURE_BOOT_OPTION_FORM,\r
     title  = STRING_TOKEN(STR_SECURE_BOOT_OPTION_TITLE);\r
   //\r
   // ##2 Form: 'Custom Secure Boot Options'\r
   //\r
   form formid = FORMID_SECURE_BOOT_OPTION_FORM,\r
     title  = STRING_TOKEN(STR_SECURE_BOOT_OPTION_TITLE);\r

-    \r
+\r

     subtitle text = STRING_TOKEN(STR_NULL);\r
     subtitle text = STRING_TOKEN(STR_NULL);\r

-    \r
+\r

     goto FORMID_SECURE_BOOT_PK_OPTION_FORM,\r
          prompt = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION),\r
          help   = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION_HELP),\r
          flags  = INTERACTIVE,\r
          key    = KEY_SECURE_BOOT_PK_OPTION;\r
     goto FORMID_SECURE_BOOT_PK_OPTION_FORM,\r
          prompt = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION),\r
          help   = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION_HELP),\r
          flags  = INTERACTIVE,\r
          key    = KEY_SECURE_BOOT_PK_OPTION;\r

-        \r
+\r

     subtitle text = STRING_TOKEN(STR_NULL);\r
     subtitle text = STRING_TOKEN(STR_NULL);\r

-    \r
+\r

     goto FORMID_SECURE_BOOT_KEK_OPTION_FORM,\r
          prompt = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION),\r
          help   = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION_HELP),\r
          flags  = INTERACTIVE,\r
          key    = KEY_SECURE_BOOT_KEK_OPTION;\r
     goto FORMID_SECURE_BOOT_KEK_OPTION_FORM,\r
          prompt = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION),\r
          help   = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION_HELP),\r
          flags  = INTERACTIVE,\r
          key    = KEY_SECURE_BOOT_KEK_OPTION;\r

-        \r
+\r

     subtitle text = STRING_TOKEN(STR_NULL);\r
     subtitle text = STRING_TOKEN(STR_NULL);\r

-    \r
+\r

     goto FORMID_SECURE_BOOT_DB_OPTION_FORM,\r
          prompt = STRING_TOKEN(STR_SECURE_BOOT_DB_OPTION),\r
          help   = STRING_TOKEN(STR_SECURE_BOOT_DB_OPTION_HELP),\r
          flags  = INTERACTIVE,\r
          key    = KEY_SECURE_BOOT_DB_OPTION;\r
     goto FORMID_SECURE_BOOT_DB_OPTION_FORM,\r
          prompt = STRING_TOKEN(STR_SECURE_BOOT_DB_OPTION),\r
          help   = STRING_TOKEN(STR_SECURE_BOOT_DB_OPTION_HELP),\r
          flags  = INTERACTIVE,\r
          key    = KEY_SECURE_BOOT_DB_OPTION;\r

-    \r
+\r

     subtitle text = STRING_TOKEN(STR_NULL);\r
     subtitle text = STRING_TOKEN(STR_NULL);\r

-    \r
+\r

     goto FORMID_SECURE_BOOT_DBX_OPTION_FORM,\r
          prompt = STRING_TOKEN(STR_SECURE_BOOT_DBX_OPTION),\r
          help   = STRING_TOKEN(STR_SECURE_BOOT_DBX_OPTION_HELP),\r
          flags  = INTERACTIVE,\r
          key    = KEY_SECURE_BOOT_DBX_OPTION;\r
 \r
     goto FORMID_SECURE_BOOT_DBX_OPTION_FORM,\r
          prompt = STRING_TOKEN(STR_SECURE_BOOT_DBX_OPTION),\r
          help   = STRING_TOKEN(STR_SECURE_BOOT_DBX_OPTION_HELP),\r
          flags  = INTERACTIVE,\r
          key    = KEY_SECURE_BOOT_DBX_OPTION;\r
 \r

+    subtitle text = STRING_TOKEN(STR_NULL);\r
+\r
+    goto FORMID_SECURE_BOOT_DBT_OPTION_FORM,\r
+         prompt = STRING_TOKEN(STR_SECURE_BOOT_DBT_OPTION),\r
+         help   = STRING_TOKEN(STR_SECURE_BOOT_DBT_OPTION_HELP),\r
+         flags  = INTERACTIVE,\r
+         key    = KEY_SECURE_BOOT_DBT_OPTION;\r
+\r

   endform;\r
   endform;\r

-  \r
+\r

   //\r
   // ##3 Form: 'PK Options'\r
   //\r
   form formid = FORMID_SECURE_BOOT_PK_OPTION_FORM,\r
     title  = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION);\r
   //\r
   // ##3 Form: 'PK Options'\r
   //\r
   form formid = FORMID_SECURE_BOOT_PK_OPTION_FORM,\r
     title  = STRING_TOKEN(STR_SECURE_BOOT_PK_OPTION);\r

-    \r
+\r

     subtitle text = STRING_TOKEN(STR_NULL);\r
     subtitle text = STRING_TOKEN(STR_NULL);\r

-    \r
+\r

     //\r
     // Define of Check Box: 'Delete PK'\r
     //\r
     //\r
     // Define of Check Box: 'Delete PK'\r
     //\r


@@ -155,7 +163,7 @@ formset
                help     = STRING_TOKEN(STR_NULL),\r
       endcheckbox;\r
     endif;\r
                help     = STRING_TOKEN(STR_NULL),\r
       endcheckbox;\r
     endif;\r

-    \r
+\r

     grayoutif ideqval SECUREBOOT_CONFIGURATION.HasPk == 1;\r
     goto FORMID_ENROLL_PK_FORM,\r
          prompt = STRING_TOKEN(STR_ENROLL_PK),\r
     grayoutif ideqval SECUREBOOT_CONFIGURATION.HasPk == 1;\r
     goto FORMID_ENROLL_PK_FORM,\r
          prompt = STRING_TOKEN(STR_ENROLL_PK),\r


@@ -163,28 +171,28 @@ formset
          flags  = INTERACTIVE,\r
          key    = KEY_ENROLL_PK;\r
     endif;\r
          flags  = INTERACTIVE,\r
          key    = KEY_ENROLL_PK;\r
     endif;\r

-    \r
+\r

     subtitle text = STRING_TOKEN(STR_NULL);\r
     subtitle text = STRING_TOKEN(STR_NULL);\r

-   \r
+\r

     //\r
     //\r

-    // Display of Check Box: 'Delete Pk' \r
+    // Display of Check Box: 'Delete Pk'\r

     //\r
     grayoutif ideqval SECUREBOOT_CONFIGURATION.HideSecureBoot == 1;\r
     checkbox varid = SECUREBOOT_CONFIGURATION.DeletePk,\r
           questionid = KEY_SECURE_BOOT_DELETE_PK,\r
     //\r
     grayoutif ideqval SECUREBOOT_CONFIGURATION.HideSecureBoot == 1;\r
     checkbox varid = SECUREBOOT_CONFIGURATION.DeletePk,\r
           questionid = KEY_SECURE_BOOT_DELETE_PK,\r

-          prompt = STRING_TOKEN(STR_DELETE_PK),          \r
+          prompt = STRING_TOKEN(STR_DELETE_PK),\r

           help   = STRING_TOKEN(STR_DELETE_PK_HELP),\r
           flags  = INTERACTIVE | RESET_REQUIRED,\r
     endcheckbox;\r
     endif;\r
   endform;\r
           help   = STRING_TOKEN(STR_DELETE_PK_HELP),\r
           flags  = INTERACTIVE | RESET_REQUIRED,\r
     endcheckbox;\r
     endif;\r
   endform;\r

-  \r
+\r

   //\r
   // ##4 Form: 'Enroll PK'\r
   //\r
   form formid = FORMID_ENROLL_PK_FORM,\r
     title  = STRING_TOKEN(STR_ENROLL_PK);\r
   //\r
   // ##4 Form: 'Enroll PK'\r
   //\r
   form formid = FORMID_ENROLL_PK_FORM,\r
     title  = STRING_TOKEN(STR_ENROLL_PK);\r

-    \r
+\r

     subtitle text = STRING_TOKEN(STR_NULL);\r
 \r
     goto FORM_FILE_EXPLORER_ID_PK,\r
     subtitle text = STRING_TOKEN(STR_NULL);\r
 \r
     goto FORM_FILE_EXPLORER_ID_PK,\r


@@ -193,7 +201,7 @@ formset
          flags = INTERACTIVE,\r
          key = SECUREBOOT_ADD_PK_FILE_FORM_ID;\r
   endform;\r
          flags = INTERACTIVE,\r
          key = SECUREBOOT_ADD_PK_FILE_FORM_ID;\r
   endform;\r

-  \r
+\r

   //\r
   // ##5 Form: 'KEK Options'\r
   //\r
   //\r
   // ##5 Form: 'KEK Options'\r
   //\r


@@ -201,29 +209,29 @@ formset
     title  = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION);\r
 \r
     //\r
     title  = STRING_TOKEN(STR_SECURE_BOOT_KEK_OPTION);\r
 \r
     //\r

-    // Display of 'Enroll KEK' \r
+    // Display of 'Enroll KEK'\r

     //\r
     goto FORMID_ENROLL_KEK_FORM,\r
          prompt = STRING_TOKEN(STR_ENROLL_KEK),\r
          help   = STRING_TOKEN(STR_ENROLL_KEK_HELP),\r
          flags  = INTERACTIVE;\r
     //\r
     goto FORMID_ENROLL_KEK_FORM,\r
          prompt = STRING_TOKEN(STR_ENROLL_KEK),\r
          help   = STRING_TOKEN(STR_ENROLL_KEK_HELP),\r
          flags  = INTERACTIVE;\r

-    \r
-    subtitle text = STRING_TOKEN(STR_NULL);     \r
-   \r
+\r
+    subtitle text = STRING_TOKEN(STR_NULL);\r
+\r

     //\r
     //\r

-    // Display of 'Delete KEK' \r
+    // Display of 'Delete KEK'\r

     //\r
     goto FORMID_DELETE_KEK_FORM,\r
          prompt = STRING_TOKEN(STR_DELETE_KEK),\r
          help   = STRING_TOKEN(STR_DELETE_KEK_HELP),\r
          flags  = INTERACTIVE,\r
          key    = KEY_DELETE_KEK;\r
     //\r
     goto FORMID_DELETE_KEK_FORM,\r
          prompt = STRING_TOKEN(STR_DELETE_KEK),\r
          help   = STRING_TOKEN(STR_DELETE_KEK_HELP),\r
          flags  = INTERACTIVE,\r
          key    = KEY_DELETE_KEK;\r

-  \r
-    subtitle text = STRING_TOKEN(STR_NULL);    \r
+\r
+    subtitle text = STRING_TOKEN(STR_NULL);\r

   endform;\r
 \r
   //\r
   endform;\r
 \r
   //\r

-  // ##6 Form: 'Enroll KEK' \r
+  // ##6 Form: 'Enroll KEK'\r

   //\r
   form formid = FORMID_ENROLL_KEK_FORM,\r
     title = STRING_TOKEN(STR_ENROLL_KEK_TITLE);\r
   //\r
   form formid = FORMID_ENROLL_KEK_FORM,\r
     title = STRING_TOKEN(STR_ENROLL_KEK_TITLE);\r


@@ -258,7 +266,7 @@ formset
       help   = STRING_TOKEN(STR_SAVE_AND_EXIT),\r
       flags  = INTERACTIVE,\r
       key    = KEY_VALUE_SAVE_AND_EXIT_KEK;\r
       help   = STRING_TOKEN(STR_SAVE_AND_EXIT),\r
       flags  = INTERACTIVE,\r
       key    = KEY_VALUE_SAVE_AND_EXIT_KEK;\r

- \r
+\r

     goto FORMID_SECURE_BOOT_OPTION_FORM,\r
       prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r
       help   = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r
     goto FORMID_SECURE_BOOT_OPTION_FORM,\r
       prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r
       help   = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r


@@ -269,15 +277,15 @@ formset
 \r
   //\r
   // ##7 Form: 'Delete KEK'\r
 \r
   //\r
   // ##7 Form: 'Delete KEK'\r

-  //  \r
+  //\r

   form formid = FORMID_DELETE_KEK_FORM,\r
     title  = STRING_TOKEN(STR_DELETE_KEK_TITLE);\r
 \r
     label LABEL_KEK_DELETE;\r
     label LABEL_END;\r
   form formid = FORMID_DELETE_KEK_FORM,\r
     title  = STRING_TOKEN(STR_DELETE_KEK_TITLE);\r
 \r
     label LABEL_KEK_DELETE;\r
     label LABEL_END;\r

-         \r
+\r

     subtitle text = STRING_TOKEN(STR_NULL);\r
     subtitle text = STRING_TOKEN(STR_NULL);\r

-    \r
+\r

   endform;\r
 \r
   //\r
   endform;\r
 \r
   //\r


@@ -300,7 +308,7 @@ formset
     help   = STRING_TOKEN (STR_SECURE_BOOT_DELETE_SIGNATURE),\r
     flags  = INTERACTIVE,\r
     key    = SECUREBOOT_DELETE_SIGNATURE_FROM_DB;\r
     help   = STRING_TOKEN (STR_SECURE_BOOT_DELETE_SIGNATURE),\r
     flags  = INTERACTIVE,\r
     key    = SECUREBOOT_DELETE_SIGNATURE_FROM_DB;\r

-    \r
+\r

   endform;\r
 \r
   //\r
   endform;\r
 \r
   //\r


@@ -326,6 +334,29 @@ formset
 \r
   endform;\r
 \r
 \r
   endform;\r
 \r

+  //\r
+  // ##9 Form: 'DBT Options'\r
+  //\r
+  form formid = FORMID_SECURE_BOOT_DBT_OPTION_FORM,\r
+    title = STRING_TOKEN(STR_SECURE_BOOT_DBT_OPTION);\r
+\r
+    subtitle text = STRING_TOKEN(STR_NULL);\r
+\r
+    goto SECUREBOOT_ENROLL_SIGNATURE_TO_DBT,\r
+    prompt = STRING_TOKEN (STR_SECURE_BOOT_ENROLL_SIGNATURE),\r
+    help   = STRING_TOKEN (STR_SECURE_BOOT_ENROLL_SIGNATURE),\r
+    flags  = 0;\r
+\r
+    subtitle text = STRING_TOKEN(STR_NULL);\r
+\r
+    goto SECUREBOOT_DELETE_SIGNATURE_FROM_DBT,\r
+    prompt = STRING_TOKEN (STR_SECURE_BOOT_DELETE_SIGNATURE),\r
+    help   = STRING_TOKEN (STR_SECURE_BOOT_DELETE_SIGNATURE),\r
+    flags  = INTERACTIVE,\r
+    key    = SECUREBOOT_DELETE_SIGNATURE_FROM_DBT;\r
+\r
+  endform;\r
+\r

   //\r
   // Form: 'Delete Signature' for DB Options.\r
   //\r
   //\r
   // Form: 'Delete Signature' for DB Options.\r
   //\r


@@ -335,7 +366,7 @@ formset
     label LABEL_DB_DELETE;\r
     label LABEL_END;\r
     subtitle text = STRING_TOKEN(STR_NULL);\r
     label LABEL_DB_DELETE;\r
     label LABEL_END;\r
     subtitle text = STRING_TOKEN(STR_NULL);\r

-    \r
+\r

   endform;\r
 \r
   //\r
   endform;\r
 \r
   //\r


@@ -347,7 +378,19 @@ formset
     label LABEL_DBX_DELETE;\r
     label LABEL_END;\r
     subtitle text = STRING_TOKEN(STR_NULL);\r
     label LABEL_DBX_DELETE;\r
     label LABEL_END;\r
     subtitle text = STRING_TOKEN(STR_NULL);\r

-    \r
+\r
+  endform;\r
+\r
+  //\r
+  // Form: 'Delete Signature' for DBT Options.\r
+  //\r
+  form formid = SECUREBOOT_DELETE_SIGNATURE_FROM_DBT,\r
+    title  = STRING_TOKEN(STR_SECURE_BOOT_DELETE_SIGNATURE);\r
+\r
+    label LABEL_DBT_DELETE;\r
+    label LABEL_END;\r
+    subtitle text = STRING_TOKEN(STR_NULL);\r
+\r

   endform;\r
 \r
   //\r
   endform;\r
 \r
   //\r


@@ -386,7 +429,7 @@ formset
          help   = STRING_TOKEN(STR_SAVE_AND_EXIT),\r
          flags  = INTERACTIVE,\r
          key    = KEY_VALUE_SAVE_AND_EXIT_DB;\r
          help   = STRING_TOKEN(STR_SAVE_AND_EXIT),\r
          flags  = INTERACTIVE,\r
          key    = KEY_VALUE_SAVE_AND_EXIT_DB;\r

- \r
+\r

     goto FORMID_SECURE_BOOT_OPTION_FORM,\r
          prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r
          help   = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r
     goto FORMID_SECURE_BOOT_OPTION_FORM,\r
          prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r
          help   = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r


@@ -409,7 +452,6 @@ formset
          flags = INTERACTIVE,\r
          key = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;\r
 \r
          flags = INTERACTIVE,\r
          key = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;\r
 \r

-    subtitle text = STRING_TOKEN(STR_NULL);\r

     label SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;\r
     label LABEL_END;\r
     subtitle text = STRING_TOKEN(STR_NULL);\r
     label SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;\r
     label LABEL_END;\r
     subtitle text = STRING_TOKEN(STR_NULL);\r


@@ -423,6 +465,38 @@ formset
             maxsize = SECURE_BOOT_GUID_SIZE,\r
     endstring;\r
 \r
             maxsize = SECURE_BOOT_GUID_SIZE,\r
     endstring;\r
 \r

+    oneof name = SignatureFormatInDbx,\r
+          varid       = SECUREBOOT_CONFIGURATION.CertificateFormat,\r
+          prompt      = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_PROMPT),\r
+          help        = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_HELP),\r
+          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA256), value = 0x2, flags = DEFAULT;\r
+          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA384), value = 0x3, flags = 0;\r
+          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_SHA512), value = 0x4, flags = 0;\r
+          option text = STRING_TOKEN(STR_DBX_CERTIFICATE_FORMAT_RAW), value = 0x5, flags = 0;\r
+    endoneof;\r
+\r
+    suppressif ideqval SECUREBOOT_CONFIGURATION.CertificateFormat == 5;\r
+        checkbox varid  = SECUREBOOT_CONFIGURATION.AlwaysRevocation,\r
+               prompt = STRING_TOKEN(STR_ALWAYS_CERTIFICATE_REVOCATION_PROMPT),\r
+               help   = STRING_TOKEN(STR_ALWAYS_CERTIFICATE_REVOCATION_HELP),\r
+               flags  = INTERACTIVE,\r
+        endcheckbox;\r
+\r
+        suppressif ideqval SECUREBOOT_CONFIGURATION.AlwaysRevocation == 1;\r
+            date  varid  = SECUREBOOT_CONFIGURATION.RevocationDate,\r
+                  prompt = STRING_TOKEN(STR_CERTIFICATE_REVOCATION_DATE_PROMPT),\r
+                  help   = STRING_TOKEN(STR_CERTIFICATE_REVOCATION_DATE_HELP),\r
+                  flags  = STORAGE_NORMAL,\r
+            enddate;\r
+\r
+            time varid   = SECUREBOOT_CONFIGURATION.RevocationTime,\r
+                 prompt  = STRING_TOKEN(STR_CERTIFICATE_REVOCATION_TIME_PROMPT),\r
+                 help    = STRING_TOKEN(STR_CERTIFICATE_REVOCATION_TIME_HELP),\r
+                 flags   = STORAGE_NORMAL,\r
+            endtime;\r
+        endif;\r
+    endif;\r
+\r

     subtitle text = STRING_TOKEN(STR_NULL);\r
     subtitle text = STRING_TOKEN(STR_NULL);\r
 \r
     subtitle text = STRING_TOKEN(STR_NULL);\r
     subtitle text = STRING_TOKEN(STR_NULL);\r
 \r


@@ -431,7 +505,7 @@ formset
          help   = STRING_TOKEN(STR_SAVE_AND_EXIT),\r
          flags  = INTERACTIVE,\r
          key    = KEY_VALUE_SAVE_AND_EXIT_DBX;\r
          help   = STRING_TOKEN(STR_SAVE_AND_EXIT),\r
          flags  = INTERACTIVE,\r
          key    = KEY_VALUE_SAVE_AND_EXIT_DBX;\r

- \r
+\r

     goto FORMID_SECURE_BOOT_OPTION_FORM,\r
          prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r
          help   = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r
     goto FORMID_SECURE_BOOT_OPTION_FORM,\r
          prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r
          help   = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r


@@ -440,6 +514,51 @@ formset
 \r
   endform;\r
 \r
 \r
   endform;\r
 \r

+  //\r
+  // Form: 'Enroll Signature' for DBT options.\r
+  //\r
+  form formid = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT,\r
+    title = STRING_TOKEN(STR_SECURE_BOOT_ENROLL_SIGNATURE);\r
+\r
+    subtitle text = STRING_TOKEN(STR_NULL);\r
+\r
+    goto FORM_FILE_EXPLORER_ID_DBT,\r
+         prompt = STRING_TOKEN(STR_SECURE_BOOT_ADD_SIGNATURE_FILE),\r
+         help = STRING_TOKEN(STR_SECURE_BOOT_ADD_SIGNATURE_FILE),\r
+         flags = INTERACTIVE,\r
+         key = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;\r
+\r
+    subtitle text = STRING_TOKEN(STR_NULL);\r
+    label SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;\r
+    label LABEL_END;\r
+    subtitle text = STRING_TOKEN(STR_NULL);\r
+\r
+    string  varid   = SECUREBOOT_CONFIGURATION.SignatureGuid,\r
+            prompt  = STRING_TOKEN(STR_SECURE_BOOT_SIGNATURE_GUID),\r
+            help    = STRING_TOKEN(STR_SECURE_BOOT_SIGNATURE_GUID_HELP),\r
+            flags   = INTERACTIVE,\r
+            key     = KEY_SECURE_BOOT_SIGNATURE_GUID_DBT,\r
+            minsize = SECURE_BOOT_GUID_SIZE,\r
+            maxsize = SECURE_BOOT_GUID_SIZE,\r
+    endstring;\r
+\r
+    subtitle text = STRING_TOKEN(STR_NULL);\r
+    subtitle text = STRING_TOKEN(STR_NULL);\r
+\r
+    goto FORMID_SECURE_BOOT_OPTION_FORM,\r
+         prompt = STRING_TOKEN(STR_SAVE_AND_EXIT),\r
+         help   = STRING_TOKEN(STR_SAVE_AND_EXIT),\r
+         flags  = INTERACTIVE,\r
+         key    = KEY_VALUE_SAVE_AND_EXIT_DBT;\r
+\r
+    goto FORMID_SECURE_BOOT_OPTION_FORM,\r
+         prompt = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r
+         help   = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r
+         flags  = INTERACTIVE,\r
+         key    = KEY_VALUE_NO_SAVE_AND_EXIT_DBT;\r
+\r
+  endform;\r
+\r

   //\r
   // File Explorer for PK\r
   //\r
   //\r
   // File Explorer for PK\r
   //\r


@@ -449,7 +568,7 @@ formset
        label FORM_FILE_EXPLORER_ID;\r
        label LABEL_END;\r
   endform;\r
        label FORM_FILE_EXPLORER_ID;\r
        label LABEL_END;\r
   endform;\r

-  \r
+\r

   //\r
   // File Explorer for KEK\r
   //\r
   //\r
   // File Explorer for KEK\r
   //\r


@@ -480,6 +599,15 @@ formset
        label LABEL_END;\r
   endform;\r
 \r
        label LABEL_END;\r
   endform;\r
 \r

+  //\r
+  // File Explorer for DBT\r
+  //\r
+  form formid = FORM_FILE_EXPLORER_ID_DBT,\r
+       title = STRING_TOKEN(STR_FILE_EXPLORER_TITLE);\r
+\r
+       label FORM_FILE_EXPLORER_ID;\r
+       label LABEL_END;\r
+  endform;\r

 \r
   //\r
   // Enroll Pk from File Commit Form\r
 \r
   //\r
   // Enroll Pk from File Commit Form\r


@@ -489,21 +617,23 @@ formset
 \r
     label SECUREBOOT_ADD_PK_FILE_FORM_ID;\r
     label LABEL_END;\r
 \r
     label SECUREBOOT_ADD_PK_FILE_FORM_ID;\r
     label LABEL_END;\r

-    \r
+\r

     subtitle text = STRING_TOKEN(STR_NULL);\r
 \r
      text\r
        help   = STRING_TOKEN(STR_SAVE_AND_EXIT),\r
        text   = STRING_TOKEN(STR_SAVE_AND_EXIT),\r
     subtitle text = STRING_TOKEN(STR_NULL);\r
 \r
      text\r
        help   = STRING_TOKEN(STR_SAVE_AND_EXIT),\r
        text   = STRING_TOKEN(STR_SAVE_AND_EXIT),\r

+       text   = STRING_TOKEN(STR_NULL),\r

        flags  = INTERACTIVE,\r
        key    = KEY_VALUE_SAVE_AND_EXIT_PK;\r
 \r
      text\r
        help   = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r
        text   = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r
        flags  = INTERACTIVE,\r
        key    = KEY_VALUE_SAVE_AND_EXIT_PK;\r
 \r
      text\r
        help   = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r
        text   = STRING_TOKEN(STR_NO_SAVE_AND_EXIT),\r

+       text   = STRING_TOKEN(STR_NULL),\r

        flags  = INTERACTIVE,\r
        key    = KEY_VALUE_NO_SAVE_AND_EXIT_PK;\r
 \r
   endform;\r
 \r
        flags  = INTERACTIVE,\r
        key    = KEY_VALUE_NO_SAVE_AND_EXIT_PK;\r
 \r
   endform;\r
 \r

-endformset;\r
+endformset;
\ No newline at end of file

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
index e6d21f5e69cfdb2540d1ba82c1792879a58604d5..ef400c47b9dc07154faea6d54c207bfee9172284 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
@@ -62,40 +62,40 @@
   ## SOMETIMES_CONSUMES      ## Variable:L"CustomMode"\r
   ## SOMETIMES_PRODUCES      ## Variable:L"CustomMode"\r
   gEfiCustomModeEnableGuid\r
   ## SOMETIMES_CONSUMES      ## Variable:L"CustomMode"\r
   ## SOMETIMES_PRODUCES      ## Variable:L"CustomMode"\r
   gEfiCustomModeEnableGuid\r

-    \r
+\r

   ## SOMETIMES_CONSUMES      ## Variable:L"SecureBootEnable"\r
   ## SOMETIMES_PRODUCES      ## Variable:L"SecureBootEnable"\r
   gEfiSecureBootEnableDisableGuid\r
   ## SOMETIMES_CONSUMES      ## Variable:L"SecureBootEnable"\r
   ## SOMETIMES_PRODUCES      ## Variable:L"SecureBootEnable"\r
   gEfiSecureBootEnableDisableGuid\r

-  \r
+\r

   ## SOMETIMES_CONSUMES      ## GUID            # Unique ID for the type of the signature.\r
   ## SOMETIMES_PRODUCES      ## GUID            # Unique ID for the type of the signature.\r
   gEfiCertRsa2048Guid\r
   ## SOMETIMES_CONSUMES      ## GUID            # Unique ID for the type of the signature.\r
   ## SOMETIMES_PRODUCES      ## GUID            # Unique ID for the type of the signature.\r
   gEfiCertRsa2048Guid\r

-  \r
+\r

   ## SOMETIMES_CONSUMES      ## GUID            # Unique ID for the type of the signature.\r
   ## SOMETIMES_CONSUMES      ## GUID            # Unique ID for the type of the signature.\r

-  ## SOMETIMES_PRODUCES      ## GUID            # Unique ID for the type of the signature.                               \r
+  ## SOMETIMES_PRODUCES      ## GUID            # Unique ID for the type of the signature.\r

   gEfiCertX509Guid\r
   gEfiCertX509Guid\r

-  \r
+\r

   ## SOMETIMES_CONSUMES      ## GUID            # Unique ID for the type of the signature.\r
   ## SOMETIMES_CONSUMES      ## GUID            # Unique ID for the type of the signature.\r

-  ## SOMETIMES_PRODUCES      ## GUID            # Unique ID for the type of the signature.   \r
+  ## SOMETIMES_PRODUCES      ## GUID            # Unique ID for the type of the signature.\r

   gEfiCertSha1Guid\r
   gEfiCertSha1Guid\r

-  \r
+\r

   ## SOMETIMES_CONSUMES      ## GUID            # Unique ID for the type of the signature.\r
   ## SOMETIMES_CONSUMES      ## GUID            # Unique ID for the type of the signature.\r

-  ## SOMETIMES_PRODUCES      ## GUID            # Unique ID for the type of the signature.   \r
+  ## SOMETIMES_PRODUCES      ## GUID            # Unique ID for the type of the signature.\r

   gEfiCertSha256Guid\r
   gEfiCertSha256Guid\r

-  \r
+\r

   ## SOMETIMES_CONSUMES      ## Variable:L"db"\r
   ## SOMETIMES_PRODUCES      ## Variable:L"db"\r
   ## SOMETIMES_CONSUMES      ## Variable:L"dbx"\r
   ## SOMETIMES_PRODUCES      ## Variable:L"dbx"\r
   gEfiImageSecurityDatabaseGuid\r
   ## SOMETIMES_CONSUMES      ## Variable:L"db"\r
   ## SOMETIMES_PRODUCES      ## Variable:L"db"\r
   ## SOMETIMES_CONSUMES      ## Variable:L"dbx"\r
   ## SOMETIMES_PRODUCES      ## Variable:L"dbx"\r
   gEfiImageSecurityDatabaseGuid\r

-    \r
+\r

   ## SOMETIMES_CONSUMES      ## Variable:L"SetupMode"\r
   ## SOMETIMES_PRODUCES      ## Variable:L"PK"\r
   ## SOMETIMES_CONSUMES      ## Variable:L"KEK"\r
   ## SOMETIMES_PRODUCES      ## Variable:L"KEK"\r
   ## SOMETIMES_CONSUMES      ## Variable:L"SecureBoot"\r
   gEfiGlobalVariableGuid\r
   ## SOMETIMES_CONSUMES      ## Variable:L"SetupMode"\r
   ## SOMETIMES_PRODUCES      ## Variable:L"PK"\r
   ## SOMETIMES_CONSUMES      ## Variable:L"KEK"\r
   ## SOMETIMES_PRODUCES      ## Variable:L"KEK"\r
   ## SOMETIMES_CONSUMES      ## Variable:L"SecureBoot"\r
   gEfiGlobalVariableGuid\r

-  \r
+\r

   gEfiIfrTianoGuid                              ## PRODUCES            ## GUID       # HII opcode\r
   ## PRODUCES                ## HII\r
   ## CONSUMES                ## HII\r
   gEfiIfrTianoGuid                              ## PRODUCES            ## GUID       # HII opcode\r
   ## PRODUCES                ## HII\r
   ## CONSUMES                ## HII\r


@@ -105,6 +105,10 @@
   gEfiFileSystemVolumeLabelInfoIdGuid           ## SOMETIMES_CONSUMES  ## GUID  # Indicate the information type\r
   gEfiFileInfoGuid                              ## SOMETIMES_CONSUMES  ## GUID  # Indicate the information type\r
 \r
   gEfiFileSystemVolumeLabelInfoIdGuid           ## SOMETIMES_CONSUMES  ## GUID  # Indicate the information type\r
   gEfiFileInfoGuid                              ## SOMETIMES_CONSUMES  ## GUID  # Indicate the information type\r
 \r

+  gEfiCertX509Sha256Guid                        ## SOMETIMES_PRODUCES  ## GUID  # Unique ID for the type of the certificate.\r
+  gEfiCertX509Sha384Guid                        ## SOMETIMES_PRODUCES  ## GUID  # Unique ID for the type of the certificate.\r
+  gEfiCertX509Sha512Guid                        ## SOMETIMES_PRODUCES  ## GUID  # Unique ID for the type of the certificate.\r
+\r

 [Protocols]\r
   gEfiHiiConfigAccessProtocolGuid               ## PRODUCES\r
   gEfiDevicePathProtocolGuid                    ## PRODUCES\r
 [Protocols]\r
   gEfiHiiConfigAccessProtocolGuid               ## PRODUCES\r
   gEfiDevicePathProtocolGuid                    ## PRODUCES\r


@@ -119,4 +123,3 @@
 \r
 [UserExtensions.TianoCore."ExtraFiles"]\r
   SecureBootConfigDxeExtra.uni\r
 \r
 [UserExtensions.TianoCore."ExtraFiles"]\r
   SecureBootConfigDxeExtra.uni\r

-  
\ No newline at end of file

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigFileExplorer.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigFileExplorer.c
index 310b1ecd4e89f7934d89fcc5acd17a5b67a8a0b0..b731865ed774058945756582b86f856708d4e791 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigFileExplorer.c
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigFileExplorer.c
@@ -65,7 +65,7 @@ StrDuplicate (
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Helper function called as part of the code needed to allocate \r
+  Helper function called as part of the code needed to allocate\r

   the proper sized buffer for various EFI interfaces.\r
 \r
   @param[in, out]   Status          Current status\r
   the proper sized buffer for various EFI interfaces.\r
 \r
   @param[in, out]   Status          Current status\r


@@ -122,7 +122,7 @@ GrowBuffer (
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Append file name to existing file name, and allocate a new buffer \r
+  Append file name to existing file name, and allocate a new buffer\r

   to hold the appended result.\r
 \r
   @param[in]  Str1  The existing file name\r
   to hold the appended result.\r
 \r
   @param[in]  Str1  The existing file name\r


@@ -149,7 +149,7 @@ AppendFileName (
   Str   = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16));\r
   ASSERT (Str != NULL);\r
 \r
   Str   = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16));\r
   ASSERT (Str != NULL);\r
 \r

-  TmpStr = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16)); \r
+  TmpStr = AllocateZeroPool (Size1 + Size2 + sizeof (CHAR16));\r

   ASSERT (TmpStr != NULL);\r
 \r
   StrCat (Str, Str1);\r
   ASSERT (TmpStr != NULL);\r
 \r
   StrCat (Str, Str1);\r


@@ -170,7 +170,7 @@ AppendFileName (
       //\r
 \r
       //\r
       //\r
 \r
       //\r

-      // Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings \r
+      // Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings\r

       // that overlap.\r
       //\r
       StrCpy (TmpStr, Ptr + 3);\r
       // that overlap.\r
       //\r
       StrCpy (TmpStr, Ptr + 3);\r


@@ -182,7 +182,7 @@ AppendFileName (
       //\r
 \r
       //\r
       //\r
 \r
       //\r

-      // Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings \r
+      // Use TmpStr as a backup, as StrCpy in BaseLib does not handle copy of two strings\r

       // that overlap.\r
       //\r
       StrCpy (TmpStr, Ptr + 2);\r
       // that overlap.\r
       //\r
       StrCpy (TmpStr, Ptr + 2);\r


@@ -196,7 +196,7 @@ AppendFileName (
   }\r
 \r
   FreePool (TmpStr);\r
   }\r
 \r
   FreePool (TmpStr);\r

-  \r
+\r

   return Str;\r
 }\r
 \r
   return Str;\r
 }\r
 \r


@@ -354,7 +354,7 @@ DestroyMenuEntry (
   Free resources allocated in Allocate Rountine.\r
 \r
   @param[in, out]  MenuOption        Menu to be freed\r
   Free resources allocated in Allocate Rountine.\r
 \r
   @param[in, out]  MenuOption        Menu to be freed\r

-  \r
+\r

 **/\r
 VOID\r
 FreeMenu (\r
 **/\r
 VOID\r
 FreeMenu (\r


@@ -459,7 +459,7 @@ FileSystemVolumeLabelInfo (
   This function opens a file with the open mode according to the file path. The\r
   Attributes is valid only for EFI_FILE_MODE_CREATE.\r
 \r
   This function opens a file with the open mode according to the file path. The\r
   Attributes is valid only for EFI_FILE_MODE_CREATE.\r
 \r

-  @param[in, out]  FilePath        On input, the device path to the file.  \r
+  @param[in, out]  FilePath        On input, the device path to the file.\r

                                    On output, the remaining device path.\r
   @param[out]      FileHandle      Pointer to the file handle.\r
   @param[in]       OpenMode        The mode to open the file with.\r
                                    On output, the remaining device path.\r
   @param[out]      FileHandle      Pointer to the file handle.\r
   @param[in]       OpenMode        The mode to open the file with.\r


@@ -495,7 +495,7 @@ OpenFileByDevicePath(
   EFI_SIMPLE_FILE_SYSTEM_PROTOCOL *EfiSimpleFileSystemProtocol;\r
   EFI_FILE_PROTOCOL               *Handle1;\r
   EFI_FILE_PROTOCOL               *Handle2;\r
   EFI_SIMPLE_FILE_SYSTEM_PROTOCOL *EfiSimpleFileSystemProtocol;\r
   EFI_FILE_PROTOCOL               *Handle1;\r
   EFI_FILE_PROTOCOL               *Handle2;\r

-  EFI_HANDLE                      DeviceHandle; \r
+  EFI_HANDLE                      DeviceHandle;\r

 \r
   if ((FilePath == NULL || FileHandle == NULL)) {\r
     return EFI_INVALID_PARAMETER;\r
 \r
   if ((FilePath == NULL || FileHandle == NULL)) {\r
     return EFI_INVALID_PARAMETER;\r


@@ -816,7 +816,7 @@ FindFileSystem (
   if (NoSimpleFsHandles != 0) {\r
     FreePool (SimpleFsHandle);\r
   }\r
   if (NoSimpleFsHandles != 0) {\r
     FreePool (SimpleFsHandle);\r
   }\r

-  \r
+\r

   //\r
   // Remember how many file system options are here\r
   //\r
   //\r
   // Remember how many file system options are here\r
   //\r


@@ -826,7 +826,7 @@ FindFileSystem (
 \r
 \r
 /**\r
 \r
 \r
 /**\r

-  Find files under the current directory. All files and sub-directories \r
+  Find files under the current directory. All files and sub-directories\r

   in current directory will be stored in DirectoryMenu for future use.\r
 \r
   @param[in] MenuEntry     The Menu Entry.\r
   in current directory will be stored in DirectoryMenu for future use.\r
 \r
   @param[in] MenuEntry     The Menu Entry.\r


@@ -892,7 +892,7 @@ FindFiles (
   if (DirInfo == NULL) {\r
     return EFI_OUT_OF_RESOURCES;\r
   }\r
   if (DirInfo == NULL) {\r
     return EFI_OUT_OF_RESOURCES;\r
   }\r

-  \r
+\r

   //\r
   // Get all files in current directory\r
   // Pass 1 to get Directories\r
   //\r
   // Get all files in current directory\r
   // Pass 1 to get Directories\r


@@ -934,7 +934,7 @@ FindFiles (
                                     NewFileContext->FileName\r
                                     );\r
       NewMenuEntry->HelpString = NULL;\r
                                     NewFileContext->FileName\r
                                     );\r
       NewMenuEntry->HelpString = NULL;\r

-      \r
+\r

       NewFileContext->IsDir = (BOOLEAN) ((DirInfo->Attribute & EFI_FILE_DIRECTORY) == EFI_FILE_DIRECTORY);\r
       if (NewFileContext->IsDir) {\r
         BufferSize = StrLen (DirInfo->FileName) * 2 + 6;\r
       NewFileContext->IsDir = (BOOLEAN) ((DirInfo->Attribute & EFI_FILE_DIRECTORY) == EFI_FILE_DIRECTORY);\r
       if (NewFileContext->IsDir) {\r
         BufferSize = StrLen (DirInfo->FileName) * 2 + 6;\r


@@ -977,7 +977,7 @@ RefreshUpdateData (
 {\r
   //\r
   // Free current updated date\r
 {\r
   //\r
   // Free current updated date\r

-  //  \r
+  //\r

   if (mStartOpCodeHandle != NULL) {\r
     HiiFreeOpCodeHandle (mStartOpCodeHandle);\r
   }\r
   if (mStartOpCodeHandle != NULL) {\r
     HiiFreeOpCodeHandle (mStartOpCodeHandle);\r
   }\r


@@ -1032,6 +1032,9 @@ UpdateFileExplorePage (
   } else if (FeCurrentState == FileExplorerStateEnrollSignatureFileToDbx) {\r
     FormId     = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;\r
     FileFormId = FORM_FILE_EXPLORER_ID_DBX;\r
   } else if (FeCurrentState == FileExplorerStateEnrollSignatureFileToDbx) {\r
     FormId     = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;\r
     FileFormId = FORM_FILE_EXPLORER_ID_DBX;\r

+  } else if (FeCurrentState == FileExplorerStateEnrollSignatureFileToDbt) {\r
+    FormId     = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;\r
+    FileFormId = FORM_FILE_EXPLORER_ID_DBT;\r

   } else {\r
     return;\r
   }\r
   } else {\r
     return;\r
   }\r


@@ -1118,7 +1121,7 @@ UpdateFileExplorer (
     //\r
     FreeMenu (&FsOptionMenu);\r
     FindFileSystem ();\r
     //\r
     FreeMenu (&FsOptionMenu);\r
     FindFileSystem ();\r

-    \r
+\r

     CreateMenuStringToken (PrivateData->HiiHandle, &FsOptionMenu);\r
     UpdateFileExplorePage (PrivateData->HiiHandle, &FsOptionMenu, PrivateData->FeCurrentState);\r
 \r
     CreateMenuStringToken (PrivateData->HiiHandle, &FsOptionMenu);\r
     UpdateFileExplorePage (PrivateData->HiiHandle, &FsOptionMenu, PrivateData->FeCurrentState);\r
 \r


@@ -1156,13 +1159,15 @@ UpdateFileExplorer (
         FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DB;\r
       } else if (PrivateData->FeCurrentState == FileExplorerStateEnrollSignatureFileToDbx) {\r
         FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;\r
         FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DB;\r
       } else if (PrivateData->FeCurrentState == FileExplorerStateEnrollSignatureFileToDbx) {\r
         FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;\r

+      } else if (PrivateData->FeCurrentState == FileExplorerStateEnrollSignatureFileToDbt) {\r
+        FormId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;\r

       } else {\r
         return FALSE;\r
       }\r
 \r
       PrivateData->MenuEntry = NewMenuEntry;\r
       PrivateData->FileContext->FileName = NewFileContext->FileName;\r
       } else {\r
         return FALSE;\r
       }\r
 \r
       PrivateData->MenuEntry = NewMenuEntry;\r
       PrivateData->FileContext->FileName = NewFileContext->FileName;\r

-      \r
+\r

       TmpDevicePath = NewFileContext->DevicePath;\r
       OpenFileByDevicePath (\r
         &TmpDevicePath,\r
       TmpDevicePath = NewFileContext->DevicePath;\r
       OpenFileByDevicePath (\r
         &TmpDevicePath,\r


@@ -1200,7 +1205,7 @@ OnExit:
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Clean up the dynamic opcode at label and form specified by both LabelId. \r
+  Clean up the dynamic opcode at label and form specified by both LabelId.\r

 \r
   @param[in] LabelId         It is both the Form ID and Label ID for opcode deletion.\r
   @param[in] PrivateData     Module private data.\r
 \r
   @param[in] LabelId         It is both the Form ID and Label ID for opcode deletion.\r
   @param[in] PrivateData     Module private data.\r


@@ -1226,4 +1231,3 @@ CleanUpPage (
     mEndOpCodeHandle    // LABEL_END\r
     );\r
 }\r
     mEndOpCodeHandle    // LABEL_END\r
     );\r
 }\r

-\r

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
index c6356143bc66721ed7c5fd1ef1b687d4a799194a..517d9d9904c48e09f44551a23fd89e862808c916 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
@@ -17,7 +17,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 CHAR16              mSecureBootStorageName[] = L"SECUREBOOT_CONFIGURATION";\r
 \r
 SECUREBOOT_CONFIG_PRIVATE_DATA         mSecureBootConfigPrivateDateTemplate = {\r
 CHAR16              mSecureBootStorageName[] = L"SECUREBOOT_CONFIGURATION";\r
 \r
 SECUREBOOT_CONFIG_PRIVATE_DATA         mSecureBootConfigPrivateDateTemplate = {\r

-  SECUREBOOT_CONFIG_PRIVATE_DATA_SIGNATURE,  \r
+  SECUREBOOT_CONFIG_PRIVATE_DATA_SIGNATURE,\r

   {\r
     SecureBootExtractConfig,\r
     SecureBootRouteConfig,\r
   {\r
     SecureBootExtractConfig,\r
     SecureBootRouteConfig,\r


@@ -63,16 +63,16 @@ UINT8 mHashOidValue[] = {
   };\r
 \r
 HASH_TABLE mHash[] = {\r
   };\r
 \r
 HASH_TABLE mHash[] = {\r

-  { L"SHA1",   20, &mHashOidValue[8],  5, Sha1GetContextSize,  Sha1Init,   Sha1Update,    Sha1Final  },\r
-  { L"SHA224", 28, &mHashOidValue[13], 9, NULL,                NULL,       NULL,          NULL       },\r
-  { L"SHA256", 32, &mHashOidValue[22], 9, Sha256GetContextSize,Sha256Init, Sha256Update,  Sha256Final},\r
-  { L"SHA384", 48, &mHashOidValue[31], 9, NULL,                NULL,       NULL,          NULL       },\r
-  { L"SHA512", 64, &mHashOidValue[40], 9, NULL,                NULL,       NULL,          NULL       }\r
+  { L"SHA1",   20, &mHashOidValue[8],  5, Sha1GetContextSize,   Sha1Init,   Sha1Update,   Sha1Final  },\r
+  { L"SHA224", 28, &mHashOidValue[13], 9, NULL,                 NULL,       NULL,         NULL       },\r
+  { L"SHA256", 32, &mHashOidValue[22], 9, Sha256GetContextSize, Sha256Init, Sha256Update, Sha256Final},\r
+  { L"SHA384", 48, &mHashOidValue[31], 9, Sha384GetContextSize, Sha384Init, Sha384Update, Sha384Final},\r
+  { L"SHA512", 64, &mHashOidValue[40], 9, Sha512GetContextSize, Sha512Init, Sha512Update, Sha512Final}\r

 };\r
 \r
 //\r
 };\r
 \r
 //\r

-// Variable Definitions \r
-//                                          \r
+// Variable Definitions\r
+//\r

 UINT32            mPeCoffHeaderOffset = 0;\r
 WIN_CERTIFICATE   *mCertificate = NULL;\r
 IMAGE_TYPE        mImageType;\r
 UINT32            mPeCoffHeaderOffset = 0;\r
 WIN_CERTIFICATE   *mCertificate = NULL;\r
 IMAGE_TYPE        mImageType;\r


@@ -109,7 +109,7 @@ IsDerEncodeCertificate (
   IN CONST CHAR16         *FileSuffix\r
 )\r
 {\r
   IN CONST CHAR16         *FileSuffix\r
 )\r
 {\r

-  UINTN     Index; \r
+  UINTN     Index;\r

   for (Index = 0; mDerEncodedSuffix[Index] != NULL; Index++) {\r
     if (StrCmp (FileSuffix, mDerEncodedSuffix[Index]) == 0) {\r
       return TRUE;\r
   for (Index = 0; mDerEncodedSuffix[Index] != NULL; Index++) {\r
     if (StrCmp (FileSuffix, mDerEncodedSuffix[Index]) == 0) {\r
       return TRUE;\r


@@ -147,14 +147,14 @@ SaveSecureBootVariable (
 /**\r
   Create a time based data payload by concatenating the EFI_VARIABLE_AUTHENTICATION_2\r
   descriptor with the input data. NO authentication is required in this function.\r
 /**\r
   Create a time based data payload by concatenating the EFI_VARIABLE_AUTHENTICATION_2\r
   descriptor with the input data. NO authentication is required in this function.\r

-  \r
+\r

   @param[in, out]   DataSize       On input, the size of Data buffer in bytes.\r
                                    On output, the size of data returned in Data\r
                                    buffer in bytes.\r
   @param[in, out]   DataSize       On input, the size of Data buffer in bytes.\r
                                    On output, the size of data returned in Data\r
                                    buffer in bytes.\r

-  @param[in, out]   Data           On input, Pointer to data buffer to be wrapped or \r
+  @param[in, out]   Data           On input, Pointer to data buffer to be wrapped or\r

                                    pointer to NULL to wrap an empty payload.\r
                                    On output, Pointer to the new payload date buffer allocated from pool,\r
                                    pointer to NULL to wrap an empty payload.\r
                                    On output, Pointer to the new payload date buffer allocated from pool,\r

-                                   it's caller's responsibility to free the memory when finish using it. \r
+                                   it's caller's responsibility to free the memory when finish using it.\r

 \r
   @retval EFI_SUCCESS              Create time based payload successfully.\r
   @retval EFI_OUT_OF_RESOURCES     There are not enough memory resourses to create time based payload.\r
 \r
   @retval EFI_SUCCESS              Create time based payload successfully.\r
   @retval EFI_OUT_OF_RESOURCES     There are not enough memory resourses to create time based payload.\r


@@ -175,20 +175,20 @@ CreateTimeBasedPayload (
   EFI_VARIABLE_AUTHENTICATION_2    *DescriptorData;\r
   UINTN                            DescriptorSize;\r
   EFI_TIME                         Time;\r
   EFI_VARIABLE_AUTHENTICATION_2    *DescriptorData;\r
   UINTN                            DescriptorSize;\r
   EFI_TIME                         Time;\r

-  \r
+\r

   if (Data == NULL || DataSize == NULL) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
   if (Data == NULL || DataSize == NULL) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r

-  \r
+\r

   //\r
   //\r

-  // In Setup mode or Custom mode, the variable does not need to be signed but the \r
+  // In Setup mode or Custom mode, the variable does not need to be signed but the\r

   // parameters to the SetVariable() call still need to be prepared as authenticated\r
   // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor without certificate\r
   // data in it.\r
   //\r
   Payload     = *Data;\r
   PayloadSize = *DataSize;\r
   // parameters to the SetVariable() call still need to be prepared as authenticated\r
   // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor without certificate\r
   // data in it.\r
   //\r
   Payload     = *Data;\r
   PayloadSize = *DataSize;\r

-  \r
+\r

   DescriptorSize    = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);\r
   NewData = (UINT8*) AllocateZeroPool (DescriptorSize + PayloadSize);\r
   if (NewData == NULL) {\r
   DescriptorSize    = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);\r
   NewData = (UINT8*) AllocateZeroPool (DescriptorSize + PayloadSize);\r
   if (NewData == NULL) {\r


@@ -213,16 +213,16 @@ CreateTimeBasedPayload (
   Time.Daylight   = 0;\r
   Time.Pad2       = 0;\r
   CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));\r
   Time.Daylight   = 0;\r
   Time.Pad2       = 0;\r
   CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));\r

- \r
+\r

   DescriptorData->AuthInfo.Hdr.dwLength         = OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);\r
   DescriptorData->AuthInfo.Hdr.wRevision        = 0x0200;\r
   DescriptorData->AuthInfo.Hdr.wCertificateType = WIN_CERT_TYPE_EFI_GUID;\r
   CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);\r
   DescriptorData->AuthInfo.Hdr.dwLength         = OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);\r
   DescriptorData->AuthInfo.Hdr.wRevision        = 0x0200;\r
   DescriptorData->AuthInfo.Hdr.wCertificateType = WIN_CERT_TYPE_EFI_GUID;\r
   CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);\r

-  \r
+\r

   if (Payload != NULL) {\r
     FreePool(Payload);\r
   }\r
   if (Payload != NULL) {\r
     FreePool(Payload);\r
   }\r

-  \r
+\r

   *DataSize = DescriptorSize + PayloadSize;\r
   *Data     = NewData;\r
   return EFI_SUCCESS;\r
   *DataSize = DescriptorSize + PayloadSize;\r
   *Data     = NewData;\r
   return EFI_SUCCESS;\r


@@ -287,17 +287,17 @@ DeleteVariable (
 \r
   @param[in]   SecureBootMode        New secure boot mode: STANDARD_SECURE_BOOT_MODE or\r
                                      CUSTOM_SECURE_BOOT_MODE.\r
 \r
   @param[in]   SecureBootMode        New secure boot mode: STANDARD_SECURE_BOOT_MODE or\r
                                      CUSTOM_SECURE_BOOT_MODE.\r

-  \r
+\r

   @return EFI_SUCCESS                The platform has switched to the special mode successfully.\r
   @return other                      Fail to operate the secure boot mode.\r
   @return EFI_SUCCESS                The platform has switched to the special mode successfully.\r
   @return other                      Fail to operate the secure boot mode.\r

-  \r
+\r

 **/\r
 EFI_STATUS\r
 SetSecureBootMode (\r
   IN     UINT8         SecureBootMode\r
   )\r
 {\r
 **/\r
 EFI_STATUS\r
 SetSecureBootMode (\r
   IN     UINT8         SecureBootMode\r
   )\r
 {\r

-  return gRT->SetVariable (                          \r
+  return gRT->SetVariable (\r

                 EFI_CUSTOM_MODE_NAME,\r
                 &gEfiCustomModeEnableGuid,\r
                 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
                 EFI_CUSTOM_MODE_NAME,\r
                 &gEfiCustomModeEnableGuid,\r
                 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r


@@ -311,26 +311,26 @@ SetSecureBootMode (
 \r
   @param[in]   X509File              FileHandle of X509 Certificate storing file.\r
   @param[out]  PkCert                Point to the data buffer to store the signature list.\r
 \r
   @param[in]   X509File              FileHandle of X509 Certificate storing file.\r
   @param[out]  PkCert                Point to the data buffer to store the signature list.\r

-  \r
+\r

   @return EFI_UNSUPPORTED            Unsupported Key Length.\r
   @return EFI_OUT_OF_RESOURCES       There are not enough memory resourses to form the signature list.\r
   @return EFI_UNSUPPORTED            Unsupported Key Length.\r
   @return EFI_OUT_OF_RESOURCES       There are not enough memory resourses to form the signature list.\r

-  \r
+\r

 **/\r
 EFI_STATUS\r
 CreatePkX509SignatureList (\r
 **/\r
 EFI_STATUS\r
 CreatePkX509SignatureList (\r

-  IN    EFI_FILE_HANDLE             X509File, \r
-  OUT   EFI_SIGNATURE_LIST          **PkCert \r
+  IN    EFI_FILE_HANDLE             X509File,\r
+  OUT   EFI_SIGNATURE_LIST          **PkCert\r

   )\r
 {\r
   )\r
 {\r

-  EFI_STATUS              Status;  \r
+  EFI_STATUS              Status;\r

   UINT8                   *X509Data;\r
   UINTN                   X509DataSize;\r
   EFI_SIGNATURE_DATA      *PkCertData;\r
 \r
   X509Data = NULL;\r
   PkCertData = NULL;\r
   UINT8                   *X509Data;\r
   UINTN                   X509DataSize;\r
   EFI_SIGNATURE_DATA      *PkCertData;\r
 \r
   X509Data = NULL;\r
   PkCertData = NULL;\r

-  X509DataSize = 0;  \r
-  \r
+  X509DataSize = 0;\r
+\r

   Status = ReadFileContent (X509File, (VOID**) &X509Data, &X509DataSize, 0);\r
   if (EFI_ERROR (Status)) {\r
     goto ON_EXIT;\r
   Status = ReadFileContent (X509File, (VOID**) &X509Data, &X509DataSize, 0);\r
   if (EFI_ERROR (Status)) {\r
     goto ON_EXIT;\r


@@ -350,32 +350,32 @@ CreatePkX509SignatureList (
     goto ON_EXIT;\r
   }\r
 \r
     goto ON_EXIT;\r
   }\r
 \r

-  (*PkCert)->SignatureListSize   = (UINT32) (sizeof(EFI_SIGNATURE_LIST) \r
+  (*PkCert)->SignatureListSize   = (UINT32) (sizeof(EFI_SIGNATURE_LIST)\r

                                     + sizeof(EFI_SIGNATURE_DATA) - 1\r
                                     + X509DataSize);\r
   (*PkCert)->SignatureSize       = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);\r
   (*PkCert)->SignatureHeaderSize = 0;\r
   CopyGuid (&(*PkCert)->SignatureType, &gEfiCertX509Guid);\r
                                     + sizeof(EFI_SIGNATURE_DATA) - 1\r
                                     + X509DataSize);\r
   (*PkCert)->SignatureSize       = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);\r
   (*PkCert)->SignatureHeaderSize = 0;\r
   CopyGuid (&(*PkCert)->SignatureType, &gEfiCertX509Guid);\r

-  PkCertData                     = (EFI_SIGNATURE_DATA*) ((UINTN)(*PkCert) \r
+  PkCertData                     = (EFI_SIGNATURE_DATA*) ((UINTN)(*PkCert)\r

                                                           + sizeof(EFI_SIGNATURE_LIST)\r
                                                           + (*PkCert)->SignatureHeaderSize);\r
                                                           + sizeof(EFI_SIGNATURE_LIST)\r
                                                           + (*PkCert)->SignatureHeaderSize);\r

-  CopyGuid (&PkCertData->SignatureOwner, &gEfiGlobalVariableGuid);   \r
+  CopyGuid (&PkCertData->SignatureOwner, &gEfiGlobalVariableGuid);\r

   //\r
   // Fill the PK database with PKpub data from X509 certificate file.\r
   //\r
   // Fill the PK database with PKpub data from X509 certificate file.\r

-  //  \r
+  //\r

   CopyMem (&(PkCertData->SignatureData[0]), X509Data, X509DataSize);\r
   CopyMem (&(PkCertData->SignatureData[0]), X509Data, X509DataSize);\r

-  \r
+\r

 ON_EXIT:\r
 ON_EXIT:\r

-  \r
+\r

   if (X509Data != NULL) {\r
     FreePool (X509Data);\r
   }\r
   if (X509Data != NULL) {\r
     FreePool (X509Data);\r
   }\r

-  \r
+\r

   if (EFI_ERROR(Status) && *PkCert != NULL) {\r
     FreePool (*PkCert);\r
     *PkCert = NULL;\r
   }\r
   if (EFI_ERROR(Status) && *PkCert != NULL) {\r
     FreePool (*PkCert);\r
     *PkCert = NULL;\r
   }\r

-  \r
+\r

   return Status;\r
 }\r
 \r
   return Status;\r
 }\r
 \r


@@ -389,12 +389,12 @@ ON_EXIT:
   @retval   EFI_SUCCESS            New PK enrolled successfully.\r
   @retval   EFI_INVALID_PARAMETER  The parameter is invalid.\r
   @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.\r
   @retval   EFI_SUCCESS            New PK enrolled successfully.\r
   @retval   EFI_INVALID_PARAMETER  The parameter is invalid.\r
   @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.\r

-  \r
+\r

 **/\r
 EFI_STATUS\r
 EnrollPlatformKey (\r
    IN  SECUREBOOT_CONFIG_PRIVATE_DATA*   Private\r
 **/\r
 EFI_STATUS\r
 EnrollPlatformKey (\r
    IN  SECUREBOOT_CONFIG_PRIVATE_DATA*   Private\r

-  )                       \r
+  )\r

 {\r
   EFI_STATUS                      Status;\r
   UINT32                          Attr;\r
 {\r
   EFI_STATUS                      Status;\r
   UINT32                          Attr;\r


@@ -402,7 +402,7 @@ EnrollPlatformKey (
   EFI_SIGNATURE_LIST              *PkCert;\r
   UINT16*                         FilePostFix;\r
   UINTN                           NameLength;\r
   EFI_SIGNATURE_LIST              *PkCert;\r
   UINT16*                         FilePostFix;\r
   UINTN                           NameLength;\r

-  \r
+\r

   if (Private->FileContext->FileName == NULL) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
   if (Private->FileContext->FileName == NULL) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r


@@ -433,18 +433,18 @@ EnrollPlatformKey (
   // Prase the selected PK file and generature PK certificate list.\r
   //\r
   Status = CreatePkX509SignatureList (\r
   // Prase the selected PK file and generature PK certificate list.\r
   //\r
   Status = CreatePkX509SignatureList (\r

-            Private->FileContext->FHandle, \r
-            &PkCert \r
+            Private->FileContext->FHandle,\r
+            &PkCert\r

             );\r
   if (EFI_ERROR (Status)) {\r
     goto ON_EXIT;\r
   }\r
   ASSERT (PkCert != NULL);\r
             );\r
   if (EFI_ERROR (Status)) {\r
     goto ON_EXIT;\r
   }\r
   ASSERT (PkCert != NULL);\r

-                         \r
+\r

   //\r
   // Set Platform Key variable.\r
   //\r
   // Set Platform Key variable.\r

-  // \r
-  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS \r
+  //\r
+  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS\r

           | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
   DataSize = PkCert->SignatureListSize;\r
   Status = CreateTimeBasedPayload (&DataSize, (UINT8**) &PkCert);\r
           | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
   DataSize = PkCert->SignatureListSize;\r
   Status = CreateTimeBasedPayload (&DataSize, (UINT8**) &PkCert);\r


@@ -452,12 +452,12 @@ EnrollPlatformKey (
     DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
     goto ON_EXIT;\r
   }\r
     DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
     goto ON_EXIT;\r
   }\r

-  \r
+\r

   Status = gRT->SetVariable(\r
   Status = gRT->SetVariable(\r

-                  EFI_PLATFORM_KEY_NAME, \r
-                  &gEfiGlobalVariableGuid, \r
-                  Attr, \r
-                  DataSize, \r
+                  EFI_PLATFORM_KEY_NAME,\r
+                  &gEfiGlobalVariableGuid,\r
+                  Attr,\r
+                  DataSize,\r

                   PkCert\r
                   );\r
   if (EFI_ERROR (Status)) {\r
                   PkCert\r
                   );\r
   if (EFI_ERROR (Status)) {\r


@@ -466,13 +466,13 @@ EnrollPlatformKey (
     }\r
     goto ON_EXIT;\r
   }\r
     }\r
     goto ON_EXIT;\r
   }\r

-  \r
+\r

 ON_EXIT:\r
 \r
   if (PkCert != NULL) {\r
     FreePool(PkCert);\r
   }\r
 ON_EXIT:\r
 \r
   if (PkCert != NULL) {\r
     FreePool(PkCert);\r
   }\r

-  \r
+\r

   if (Private->FileContext->FHandle != NULL) {\r
     CloseFile (Private->FileContext->FHandle);\r
     Private->FileContext->FHandle = NULL;\r
   if (Private->FileContext->FHandle != NULL) {\r
     CloseFile (Private->FileContext->FHandle);\r
     Private->FileContext->FHandle = NULL;\r


@@ -486,7 +486,7 @@ ON_EXIT:
 \r
   @retval EFI_SUCCESS    Delete PK successfully.\r
   @retval Others         Could not allow to delete PK.\r
 \r
   @retval EFI_SUCCESS    Delete PK successfully.\r
   @retval Others         Could not allow to delete PK.\r

-  \r
+\r

 **/\r
 EFI_STATUS\r
 DeletePlatformKey (\r
 **/\r
 EFI_STATUS\r
 DeletePlatformKey (\r


@@ -532,7 +532,7 @@ EnrollRsa2048ToKek (
   CPL_KEY_INFO                    *KeyInfo;\r
   EFI_SIGNATURE_DATA              *KEKSigData;\r
   UINTN                           KekSigListSize;\r
   CPL_KEY_INFO                    *KeyInfo;\r
   EFI_SIGNATURE_DATA              *KEKSigData;\r
   UINTN                           KekSigListSize;\r

-  UINT8                           *KeyBuffer;  \r
+  UINT8                           *KeyBuffer;\r

   UINTN                           KeyLenInBytes;\r
 \r
   Attr        = 0;\r
   UINTN                           KeyLenInBytes;\r
 \r
   Attr        = 0;\r


@@ -544,11 +544,11 @@ EnrollRsa2048ToKek (
   KEKSigData  = NULL;\r
   KekSigList  = NULL;\r
   KekSigListSize = 0;\r
   KEKSigData  = NULL;\r
   KekSigList  = NULL;\r
   KekSigListSize = 0;\r

-  \r
+\r

   //\r
   // Form the KeKpub certificate list into EFI_SIGNATURE_LIST type.\r
   // First, We have to parse out public key data from the pbk key file.\r
   //\r
   // Form the KeKpub certificate list into EFI_SIGNATURE_LIST type.\r
   // First, We have to parse out public key data from the pbk key file.\r

-  //                \r
+  //\r

   Status = ReadFileContent (\r
              Private->FileContext->FHandle,\r
              (VOID**) &KeyBlob,\r
   Status = ReadFileContent (\r
              Private->FileContext->FHandle,\r
              (VOID**) &KeyBlob,\r


@@ -565,10 +565,10 @@ EnrollRsa2048ToKek (
     Status = EFI_UNSUPPORTED;\r
     goto ON_EXIT;\r
   }\r
     Status = EFI_UNSUPPORTED;\r
     goto ON_EXIT;\r
   }\r

-  \r
+\r

   //\r
   // Convert the Public key to fix octet string format represented in RSA PKCS#1.\r
   //\r
   // Convert the Public key to fix octet string format represented in RSA PKCS#1.\r

-  // \r
+  //\r

   KeyLenInBytes = KeyInfo->KeyLengthInBits / 8;\r
   KeyBuffer = AllocateZeroPool (KeyLenInBytes);\r
   if (KeyBuffer == NULL) {\r
   KeyLenInBytes = KeyInfo->KeyLengthInBits / 8;\r
   KeyBuffer = AllocateZeroPool (KeyLenInBytes);\r
   if (KeyBuffer == NULL) {\r


@@ -576,13 +576,13 @@ EnrollRsa2048ToKek (
     goto ON_EXIT;\r
   }\r
   Int2OctStr (\r
     goto ON_EXIT;\r
   }\r
   Int2OctStr (\r

-    (UINTN*) (KeyBlob + sizeof (CPL_KEY_INFO)), \r
-    KeyLenInBytes / sizeof (UINTN), \r
-    KeyBuffer, \r
+    (UINTN*) (KeyBlob + sizeof (CPL_KEY_INFO)),\r
+    KeyLenInBytes / sizeof (UINTN),\r
+    KeyBuffer,\r

     KeyLenInBytes\r
     );\r
   CopyMem(KeyBlob + sizeof(CPL_KEY_INFO), KeyBuffer, KeyLenInBytes);\r
     KeyLenInBytes\r
     );\r
   CopyMem(KeyBlob + sizeof(CPL_KEY_INFO), KeyBuffer, KeyLenInBytes);\r

-  \r
+\r

   //\r
   // Form an new EFI_SIGNATURE_LIST.\r
   //\r
   //\r
   // Form an new EFI_SIGNATURE_LIST.\r
   //\r


@@ -602,7 +602,7 @@ EnrollRsa2048ToKek (
   KekSigList->SignatureHeaderSize = 0;\r
   KekSigList->SignatureSize = sizeof(EFI_SIGNATURE_DATA) - 1 + WIN_CERT_UEFI_RSA2048_SIZE;\r
   CopyGuid (&KekSigList->SignatureType, &gEfiCertRsa2048Guid);\r
   KekSigList->SignatureHeaderSize = 0;\r
   KekSigList->SignatureSize = sizeof(EFI_SIGNATURE_DATA) - 1 + WIN_CERT_UEFI_RSA2048_SIZE;\r
   CopyGuid (&KekSigList->SignatureType, &gEfiCertRsa2048Guid);\r

-  \r
+\r

   KEKSigData = (EFI_SIGNATURE_DATA*)((UINT8*)KekSigList + sizeof(EFI_SIGNATURE_LIST));\r
   CopyGuid (&KEKSigData->SignatureOwner, Private->SignatureGUID);\r
   CopyMem (\r
   KEKSigData = (EFI_SIGNATURE_DATA*)((UINT8*)KekSigList + sizeof(EFI_SIGNATURE_LIST));\r
   CopyGuid (&KEKSigData->SignatureOwner, Private->SignatureGUID);\r
   CopyMem (\r


@@ -610,13 +610,13 @@ EnrollRsa2048ToKek (
     KeyBlob + sizeof(CPL_KEY_INFO),\r
     WIN_CERT_UEFI_RSA2048_SIZE\r
     );\r
     KeyBlob + sizeof(CPL_KEY_INFO),\r
     WIN_CERT_UEFI_RSA2048_SIZE\r
     );\r

-  \r
+\r

   //\r
   //\r

-  // Check if KEK entry has been already existed. \r
-  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the \r
+  // Check if KEK entry has been already existed.\r
+  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the\r

   // new KEK to original variable.\r
   // new KEK to original variable.\r

-  //            \r
-  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS \r
+  //\r
+  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS\r

          | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
   Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8**) &KekSigList);\r
   if (EFI_ERROR (Status)) {\r
          | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
   Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8**) &KekSigList);\r
   if (EFI_ERROR (Status)) {\r


@@ -625,10 +625,10 @@ EnrollRsa2048ToKek (
   }\r
 \r
   Status = gRT->GetVariable(\r
   }\r
 \r
   Status = gRT->GetVariable(\r

-                  EFI_KEY_EXCHANGE_KEY_NAME, \r
-                  &gEfiGlobalVariableGuid, \r
-                  NULL, \r
-                  &DataSize, \r
+                  EFI_KEY_EXCHANGE_KEY_NAME,\r
+                  &gEfiGlobalVariableGuid,\r
+                  NULL,\r
+                  &DataSize,\r

                   NULL\r
                   );\r
   if (Status == EFI_BUFFER_TOO_SMALL) {\r
                   NULL\r
                   );\r
   if (Status == EFI_BUFFER_TOO_SMALL) {\r


@@ -636,21 +636,21 @@ EnrollRsa2048ToKek (
   } else if (Status != EFI_NOT_FOUND) {\r
     goto ON_EXIT;\r
   }\r
   } else if (Status != EFI_NOT_FOUND) {\r
     goto ON_EXIT;\r
   }\r

-  \r
+\r

   //\r
   // Done. Now we have formed the correct KEKpub database item, just set it into variable storage,\r
   //\r
   // Done. Now we have formed the correct KEKpub database item, just set it into variable storage,\r

-  //             \r
+  //\r

   Status = gRT->SetVariable(\r
   Status = gRT->SetVariable(\r

-                  EFI_KEY_EXCHANGE_KEY_NAME, \r
-                  &gEfiGlobalVariableGuid, \r
-                  Attr, \r
-                  KekSigListSize, \r
+                  EFI_KEY_EXCHANGE_KEY_NAME,\r
+                  &gEfiGlobalVariableGuid,\r
+                  Attr,\r
+                  KekSigListSize,\r

                   KekSigList\r
                   );\r
   if (EFI_ERROR (Status)) {\r
     goto ON_EXIT;\r
   }\r
                   KekSigList\r
                   );\r
   if (EFI_ERROR (Status)) {\r
     goto ON_EXIT;\r
   }\r

-  \r
+\r

 ON_EXIT:\r
 \r
   CloseFile (Private->FileContext->FHandle);\r
 ON_EXIT:\r
 \r
   CloseFile (Private->FileContext->FHandle);\r


@@ -671,7 +671,7 @@ ON_EXIT:
   if (KekSigList != NULL) {\r
     FreePool (KekSigList);\r
   }\r
   if (KekSigList != NULL) {\r
     FreePool (KekSigList);\r
   }\r

-  \r
+\r

   return Status;\r
 }\r
 \r
   return Status;\r
 }\r
 \r


@@ -689,7 +689,7 @@ ON_EXIT:
 EFI_STATUS\r
 EnrollX509ToKek (\r
   IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private\r
 EFI_STATUS\r
 EnrollX509ToKek (\r
   IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private\r

-  ) \r
+  )\r

 {\r
   EFI_STATUS                        Status;\r
   UINTN                             X509DataSize;\r
 {\r
   EFI_STATUS                        Status;\r
   UINTN                             X509DataSize;\r


@@ -727,7 +727,7 @@ EnrollX509ToKek (
 \r
   //\r
   // Fill Certificate Database parameters.\r
 \r
   //\r
   // Fill Certificate Database parameters.\r

-  // \r
+  //\r

   KekSigList->SignatureListSize   = (UINT32) KekSigListSize;\r
   KekSigList->SignatureHeaderSize = 0;\r
   KekSigList->SignatureSize = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);\r
   KekSigList->SignatureListSize   = (UINT32) KekSigListSize;\r
   KekSigList->SignatureHeaderSize = 0;\r
   KekSigList->SignatureSize = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);\r


@@ -738,35 +738,35 @@ EnrollX509ToKek (
   CopyMem (KEKSigData->SignatureData, X509Data, X509DataSize);\r
 \r
   //\r
   CopyMem (KEKSigData->SignatureData, X509Data, X509DataSize);\r
 \r
   //\r

-  // Check if KEK been already existed. \r
-  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the \r
+  // Check if KEK been already existed.\r
+  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the\r

   // new kek to original variable\r
   // new kek to original variable\r

-  //    \r
-  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS \r
+  //\r
+  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS\r

           | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
   Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8**) &KekSigList);\r
   if (EFI_ERROR (Status)) {\r
     DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
     goto ON_EXIT;\r
   }\r
           | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
   Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8**) &KekSigList);\r
   if (EFI_ERROR (Status)) {\r
     DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
     goto ON_EXIT;\r
   }\r

-  \r
+\r

   Status = gRT->GetVariable(\r
   Status = gRT->GetVariable(\r

-                  EFI_KEY_EXCHANGE_KEY_NAME, \r
-                  &gEfiGlobalVariableGuid, \r
-                  NULL, \r
-                  &DataSize, \r
+                  EFI_KEY_EXCHANGE_KEY_NAME,\r
+                  &gEfiGlobalVariableGuid,\r
+                  NULL,\r
+                  &DataSize,\r

                   NULL\r
                   );\r
   if (Status == EFI_BUFFER_TOO_SMALL) {\r
     Attr |= EFI_VARIABLE_APPEND_WRITE;\r
   } else if (Status != EFI_NOT_FOUND) {\r
     goto ON_EXIT;\r
                   NULL\r
                   );\r
   if (Status == EFI_BUFFER_TOO_SMALL) {\r
     Attr |= EFI_VARIABLE_APPEND_WRITE;\r
   } else if (Status != EFI_NOT_FOUND) {\r
     goto ON_EXIT;\r

-  }  \r
+  }\r

 \r
   Status = gRT->SetVariable(\r
 \r
   Status = gRT->SetVariable(\r

-                  EFI_KEY_EXCHANGE_KEY_NAME, \r
-                  &gEfiGlobalVariableGuid, \r
-                  Attr, \r
+                  EFI_KEY_EXCHANGE_KEY_NAME,\r
+                  &gEfiGlobalVariableGuid,\r
+                  Attr,\r

                   KekSigListSize,\r
                   KekSigList\r
                   );\r
                   KekSigListSize,\r
                   KekSigList\r
                   );\r


@@ -775,7 +775,728 @@ EnrollX509ToKek (
   }\r
 \r
 ON_EXIT:\r
   }\r
 \r
 ON_EXIT:\r

-\r
+\r
+  CloseFile (Private->FileContext->FHandle);\r
+  Private->FileContext->FileName = NULL;\r
+  Private->FileContext->FHandle = NULL;\r
+\r
+  if (Private->SignatureGUID != NULL) {\r
+    FreePool (Private->SignatureGUID);\r
+    Private->SignatureGUID = NULL;\r
+  }\r
+\r
+  if (KekSigList != NULL) {\r
+    FreePool (KekSigList);\r
+  }\r
+\r
+  return Status;\r
+}\r
+\r
+/**\r
+  Enroll new KEK into the System without PK's authentication.\r
+  The SignatureOwner GUID will be Private->SignatureGUID.\r
+\r
+  @param[in] PrivateData     The module's private data.\r
+\r
+  @retval   EFI_SUCCESS            New KEK enrolled successful.\r
+  @retval   EFI_INVALID_PARAMETER  The parameter is invalid.\r
+  @retval   others                 Fail to enroll KEK data.\r
+\r
+**/\r
+EFI_STATUS\r
+EnrollKeyExchangeKey (\r
+  IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private\r
+  )\r
+{\r
+  UINT16*     FilePostFix;\r
+  EFI_STATUS  Status;\r
+  UINTN       NameLength;\r
+\r
+  if ((Private->FileContext->FileName == NULL) || (Private->SignatureGUID == NULL)) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
+  Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);\r
+  if (EFI_ERROR (Status)) {\r
+    return Status;\r
+  }\r
+\r
+  //\r
+  // Parse the file's postfix. Supports DER-encoded X509 certificate,\r
+  // and .pbk as RSA public key file.\r
+  //\r
+  NameLength = StrLen (Private->FileContext->FileName);\r
+  if (NameLength <= 4) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+  FilePostFix = Private->FileContext->FileName + NameLength - 4;\r
+  if (IsDerEncodeCertificate(FilePostFix)) {\r
+    return EnrollX509ToKek (Private);\r
+  } else if (CompareMem (FilePostFix, L".pbk",4) == 0) {\r
+    return EnrollRsa2048ToKek (Private);\r
+  } else {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+}\r
+\r
+/**\r
+  Enroll a new X509 certificate into Signature Database (DB or DBX or DBT) without\r
+  KEK's authentication.\r
+\r
+  @param[in] PrivateData     The module's private data.\r
+  @param[in] VariableName    Variable name of signature database, must be\r
+                             EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.\r
+\r
+  @retval   EFI_SUCCESS            New X509 is enrolled successfully.\r
+  @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.\r
+\r
+**/\r
+EFI_STATUS\r
+EnrollX509toSigDB (\r
+  IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,\r
+  IN CHAR16                         *VariableName\r
+  )\r
+{\r
+  EFI_STATUS                        Status;\r
+  UINTN                             X509DataSize;\r
+  VOID                              *X509Data;\r
+  EFI_SIGNATURE_LIST                *SigDBCert;\r
+  EFI_SIGNATURE_DATA                *SigDBCertData;\r
+  VOID                              *Data;\r
+  UINTN                             DataSize;\r
+  UINTN                             SigDBSize;\r
+  UINT32                            Attr;\r
+\r
+  X509DataSize  = 0;\r
+  SigDBSize     = 0;\r
+  DataSize      = 0;\r
+  X509Data      = NULL;\r
+  SigDBCert     = NULL;\r
+  SigDBCertData = NULL;\r
+  Data          = NULL;\r
+\r
+  Status = ReadFileContent (\r
+             Private->FileContext->FHandle,\r
+             &X509Data,\r
+             &X509DataSize,\r
+             0\r
+             );\r
+  if (EFI_ERROR (Status)) {\r
+    goto ON_EXIT;\r
+  }\r
+  ASSERT (X509Data != NULL);\r
+\r
+  SigDBSize = sizeof(EFI_SIGNATURE_LIST) + sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize;\r
+\r
+  Data = AllocateZeroPool (SigDBSize);\r
+  if (Data == NULL) {\r
+    Status = EFI_OUT_OF_RESOURCES;\r
+    goto ON_EXIT;\r
+  }\r
+\r
+  //\r
+  // Fill Certificate Database parameters.\r
+  //\r
+  SigDBCert = (EFI_SIGNATURE_LIST*) Data;\r
+  SigDBCert->SignatureListSize   = (UINT32) SigDBSize;\r
+  SigDBCert->SignatureHeaderSize = 0;\r
+  SigDBCert->SignatureSize = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);\r
+  CopyGuid (&SigDBCert->SignatureType, &gEfiCertX509Guid);\r
+\r
+  SigDBCertData = (EFI_SIGNATURE_DATA*) ((UINT8* ) SigDBCert + sizeof (EFI_SIGNATURE_LIST));\r
+  CopyGuid (&SigDBCertData->SignatureOwner, Private->SignatureGUID);\r
+  CopyMem ((UINT8* ) (SigDBCertData->SignatureData), X509Data, X509DataSize);\r
+\r
+  //\r
+  // Check if signature database entry has been already existed.\r
+  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the\r
+  // new signature data to original variable\r
+  //\r
+  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS\r
+          | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
+  Status = CreateTimeBasedPayload (&SigDBSize, (UINT8**) &Data);\r
+  if (EFI_ERROR (Status)) {\r
+    DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
+    goto ON_EXIT;\r
+  }\r
+\r
+  Status = gRT->GetVariable(\r
+                  VariableName,\r
+                  &gEfiImageSecurityDatabaseGuid,\r
+                  NULL,\r
+                  &DataSize,\r
+                  NULL\r
+                  );\r
+  if (Status == EFI_BUFFER_TOO_SMALL) {\r
+    Attr |= EFI_VARIABLE_APPEND_WRITE;\r
+  } else if (Status != EFI_NOT_FOUND) {\r
+    goto ON_EXIT;\r
+  }\r
+\r
+  Status = gRT->SetVariable(\r
+                  VariableName,\r
+                  &gEfiImageSecurityDatabaseGuid,\r
+                  Attr,\r
+                  SigDBSize,\r
+                  Data\r
+                  );\r
+  if (EFI_ERROR (Status)) {\r
+    goto ON_EXIT;\r
+  }\r
+\r
+ON_EXIT:\r
+\r
+  CloseFile (Private->FileContext->FHandle);\r
+  Private->FileContext->FileName = NULL;\r
+  Private->FileContext->FHandle = NULL;\r
+\r
+  if (Private->SignatureGUID != NULL) {\r
+    FreePool (Private->SignatureGUID);\r
+    Private->SignatureGUID = NULL;\r
+  }\r
+\r
+  if (Data != NULL) {\r
+    FreePool (Data);\r
+  }\r
+\r
+  if (X509Data != NULL) {\r
+    FreePool (X509Data);\r
+  }\r
+\r
+  return Status;\r
+}\r
+\r
+/**\r
+  Check whether signature is in specified database.\r
+\r
+  @param[in]  VariableName        Name of database variable that is searched in.\r
+  @param[in]  Signature           Pointer to signature that is searched for.\r
+  @param[in]  SignatureSize       Size of Signature.\r
+\r
+  @return TRUE                    Found the signature in the variable database.\r
+  @return FALSE                   Not found the signature in the variable database.\r
+\r
+**/\r
+BOOLEAN\r
+IsSignatureFoundInDatabase (\r
+  IN CHAR16             *VariableName,\r
+  IN UINT8              *Signature,\r
+  IN UINTN              SignatureSize\r
+  )\r
+{\r
+  EFI_STATUS          Status;\r
+  EFI_SIGNATURE_LIST  *CertList;\r
+  EFI_SIGNATURE_DATA  *Cert;\r
+  UINTN               DataSize;\r
+  UINT8               *Data;\r
+  UINTN               Index;\r
+  UINTN               CertCount;\r
+  BOOLEAN             IsFound;\r
+\r
+  //\r
+  // Read signature database variable.\r
+  //\r
+  IsFound   = FALSE;\r
+  Data      = NULL;\r
+  DataSize  = 0;\r
+  Status    = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
+  if (Status != EFI_BUFFER_TOO_SMALL) {\r
+    return FALSE;\r
+  }\r
+\r
+  Data = (UINT8 *) AllocateZeroPool (DataSize);\r
+  if (Data == NULL) {\r
+    return FALSE;\r
+  }\r
+\r
+  Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);\r
+  if (EFI_ERROR (Status)) {\r
+    goto Done;\r
+  }\r
+\r
+  //\r
+  // Enumerate all signature data in SigDB to check if executable's signature exists.\r
+  //\r
+  CertList = (EFI_SIGNATURE_LIST *) Data;\r
+  while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {\r
+    CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
+    Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);\r
+    if ((CertList->SignatureSize == sizeof(EFI_SIGNATURE_DATA) - 1 + SignatureSize) && (CompareGuid(&CertList->SignatureType, &gEfiCertX509Guid))) {\r
+      for (Index = 0; Index < CertCount; Index++) {\r
+        if (CompareMem (Cert->SignatureData, Signature, SignatureSize) == 0) {\r
+          //\r
+          // Find the signature in database.\r
+          //\r
+          IsFound = TRUE;\r
+          break;\r
+        }\r
+        Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);\r
+      }\r
+\r
+      if (IsFound) {\r
+        break;\r
+      }\r
+    }\r
+\r
+    DataSize -= CertList->SignatureListSize;\r
+    CertList  = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
+  }\r
+\r
+Done:\r
+  if (Data != NULL) {\r
+    FreePool (Data);\r
+  }\r
+\r
+  return IsFound;\r
+}\r
+\r
+/**\r
+  Calculate the hash of a certificate data with the specified hash algorithm.\r
+\r
+  @param[in]    CertData  The certificate data to be hashed.\r
+  @param[in]    CertSize  The certificate size in bytes.\r
+  @param[in]    HashAlg   The specified hash algorithm.\r
+  @param[out]   CertHash  The output digest of the certificate\r
+\r
+  @retval TRUE            Successfully got the hash of the CertData.\r
+  @retval FALSE           Failed to get the hash of CertData.\r
+\r
+**/\r
+BOOLEAN\r
+CalculateCertHash (\r
+  IN  UINT8                 *CertData,\r
+  IN  UINTN                 CertSize,\r
+  IN  UINT32                HashAlg,\r
+  OUT UINT8                 *CertHash\r
+  )\r
+{\r
+  BOOLEAN                   Status;\r
+  VOID                      *HashCtx;\r
+  UINTN                     CtxSize;\r
+\r
+  HashCtx = NULL;\r
+  Status  = FALSE;\r
+\r
+  if (HashAlg >= HASHALG_MAX) {\r
+    return FALSE;\r
+  }\r
+\r
+  //\r
+  // 1. Initialize context of hash.\r
+  //\r
+  CtxSize = mHash[HashAlg].GetContextSize ();\r
+  HashCtx = AllocatePool (CtxSize);\r
+  ASSERT (HashCtx != NULL);\r
+\r
+  //\r
+  // 2. Initialize a hash context.\r
+  //\r
+  Status = mHash[HashAlg].HashInit (HashCtx);\r
+  if (!Status) {\r
+    goto Done;\r
+  }\r
+\r
+  //\r
+  // 3. Calculate the hash.\r
+  //\r
+  Status  = mHash[HashAlg].HashUpdate (HashCtx, CertData, CertSize);\r
+  if (!Status) {\r
+    goto Done;\r
+  }\r
+\r
+  //\r
+  // 4. Get the hash result.\r
+  //\r
+  ZeroMem (CertHash, mHash[HashAlg].DigestLength);\r
+  Status  = mHash[HashAlg].HashFinal (HashCtx, CertHash);\r
+\r
+Done:\r
+  if (HashCtx != NULL) {\r
+    FreePool (HashCtx);\r
+  }\r
+\r
+  return Status;\r
+}\r
+\r
+/**\r
+  Check whether the hash of an X.509 certificate is in forbidden database (DBX).\r
+\r
+  @param[in]  Certificate       Pointer to X.509 Certificate that is searched for.\r
+  @param[in]  CertSize          Size of X.509 Certificate.\r
+\r
+  @return TRUE               Found the certificate hash in the forbidden database.\r
+  @return FALSE              Certificate hash is Not found in the forbidden database.\r
+\r
+**/\r
+BOOLEAN\r
+IsCertHashFoundInDbx (\r
+  IN  UINT8               *Certificate,\r
+  IN  UINTN               CertSize\r
+  )\r
+{\r
+  BOOLEAN                 IsFound;\r
+  EFI_STATUS              Status;\r
+  EFI_SIGNATURE_LIST      *DbxList;\r
+  EFI_SIGNATURE_DATA      *CertHash;\r
+  UINTN                   CertHashCount;\r
+  UINTN                   Index;\r
+  UINT32                  HashAlg;\r
+  UINT8                   CertDigest[MAX_DIGEST_SIZE];\r
+  UINT8                   *DbxCertHash;\r
+  UINTN                   SiglistHeaderSize;\r
+  UINT8                   *Data;\r
+  UINTN                   DataSize;\r
+\r
+  IsFound  = FALSE;\r
+  HashAlg  = HASHALG_MAX;\r
+  Data     = NULL;\r
+\r
+  //\r
+  // Read signature database variable.\r
+  //\r
+  DataSize  = 0;\r
+  Status    = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
+  if (Status != EFI_BUFFER_TOO_SMALL) {\r
+    return FALSE;\r
+  }\r
+\r
+  Data = (UINT8 *) AllocateZeroPool (DataSize);\r
+  if (Data == NULL) {\r
+    return FALSE;\r
+  }\r
+\r
+  Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);\r
+  if (EFI_ERROR (Status)) {\r
+    goto Done;\r
+  }\r
+\r
+  //\r
+  // Check whether the certificate hash exists in the forbidden database.\r
+  //\r
+  DbxList = (EFI_SIGNATURE_LIST *) Data;\r
+  while ((DataSize > 0) && (DataSize >= DbxList->SignatureListSize)) {\r
+    //\r
+    // Determine Hash Algorithm of Certificate in the forbidden database.\r
+    //\r
+    if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha256Guid)) {\r
+      HashAlg = HASHALG_SHA256;\r
+    } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha384Guid)) {\r
+      HashAlg = HASHALG_SHA384;\r
+    } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha512Guid)) {\r
+      HashAlg = HASHALG_SHA512;\r
+    } else {\r
+      DataSize -= DbxList->SignatureListSize;\r
+      DbxList   = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);\r
+      continue;\r
+    }\r
+\r
+    //\r
+    // Calculate the hash value of current db certificate for comparision.\r
+    //\r
+    if (!CalculateCertHash (Certificate, CertSize, HashAlg, CertDigest)) {\r
+      goto Done;\r
+    }\r
+\r
+    SiglistHeaderSize = sizeof (EFI_SIGNATURE_LIST) + DbxList->SignatureHeaderSize;\r
+    CertHash          = (EFI_SIGNATURE_DATA *) ((UINT8 *) DbxList + SiglistHeaderSize);\r
+    CertHashCount     = (DbxList->SignatureListSize - SiglistHeaderSize) / DbxList->SignatureSize;\r
+    for (Index = 0; Index < CertHashCount; Index++) {\r
+      //\r
+      // Iterate each Signature Data Node within this CertList for verify.\r
+      //\r
+      DbxCertHash = CertHash->SignatureData;\r
+      if (CompareMem (DbxCertHash, CertDigest, mHash[HashAlg].DigestLength) == 0) {\r
+        //\r
+        // Hash of Certificate is found in forbidden database.\r
+        //\r
+        IsFound = TRUE;\r
+        goto Done;\r
+      }\r
+      CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertHash + DbxList->SignatureSize);\r
+    }\r
+\r
+    DataSize -= DbxList->SignatureListSize;\r
+    DbxList   = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);\r
+  }\r
+\r
+Done:\r
+  if (Data != NULL) {\r
+    FreePool (Data);\r
+  }\r
+\r
+  return IsFound;\r
+}\r
+\r
+/**\r
+  Check whether the signature list exists in given variable data.\r
+\r
+  It searches the signature list for the ceritificate hash by CertType.\r
+  If the signature list is found, get the offset of Database for the\r
+  next hash of a certificate.\r
+\r
+  @param[in]  Database      Variable data to save signature list.\r
+  @param[in]  DatabaseSize  Variable size.\r
+  @param[in]  SignatureType The type of the signature.\r
+  @param[out] Offset        The offset to save a new hash of certificate.\r
+\r
+  @return TRUE       The signature list is found in the forbidden database.\r
+  @return FALSE      The signature list is not found in the forbidden database.\r
+**/\r
+BOOLEAN\r
+GetSignaturelistOffset (\r
+  IN  EFI_SIGNATURE_LIST  *Database,\r
+  IN  UINTN               DatabaseSize,\r
+  IN  EFI_GUID            *SignatureType,\r
+  OUT UINTN               *Offset\r
+  )\r
+{\r
+  EFI_SIGNATURE_LIST      *SigList;\r
+  UINTN                   SiglistSize;\r
+\r
+  if ((Database == NULL) || (DatabaseSize == 0)) {\r
+    *Offset = 0;\r
+    return FALSE;\r
+  }\r
+\r
+  SigList     = Database;\r
+  SiglistSize = DatabaseSize;\r
+  while ((SiglistSize > 0) && (SiglistSize >= SigList->SignatureListSize)) {\r
+    if (CompareGuid (&SigList->SignatureType, SignatureType)) {\r
+      *Offset = DatabaseSize - SiglistSize;\r
+      return TRUE;\r
+    }\r
+    SiglistSize -= SigList->SignatureListSize;\r
+    SigList      = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);\r
+  }\r
+  *Offset = 0;\r
+  return FALSE;\r
+}\r
+\r
+/**\r
+  Enroll a new X509 certificate hash into Signature Database (dbx) without\r
+  KEK's authentication.\r
+\r
+  @param[in] PrivateData      The module's private data.\r
+  @param[in] HashAlg          The hash algorithm to enroll the certificate.\r
+  @param[in] RevocationDate   The revocation date of the certificate.\r
+  @param[in] RevocationTime   The revocation time of the certificate.\r
+  @param[in] AlwaysRevocation Indicate whether the certificate is always revoked.\r
+\r
+  @retval   EFI_SUCCESS            New X509 is enrolled successfully.\r
+  @retval   EFI_INVALID_PARAMETER  The parameter is invalid.\r
+  @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.\r
+\r
+**/\r
+EFI_STATUS\r
+EnrollX509HashtoSigDB (\r
+  IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,\r
+  IN UINT32                         HashAlg,\r
+  IN EFI_HII_DATE                   *RevocationDate,\r
+  IN EFI_HII_TIME                   *RevocationTime,\r
+  IN BOOLEAN                        AlwaysRevocation\r
+  )\r
+{\r
+  EFI_STATUS          Status;\r
+  UINTN               X509DataSize;\r
+  VOID                *X509Data;\r
+  EFI_SIGNATURE_LIST  *SignatureList;\r
+  UINTN               SignatureListSize;\r
+  UINT8               *Data;\r
+  UINT8               *NewData;\r
+  UINTN               DataSize;\r
+  UINTN               DbSize;\r
+  UINT32              Attr;\r
+  EFI_SIGNATURE_DATA  *SignatureData;\r
+  UINTN               SignatureSize;\r
+  EFI_GUID            SignatureType;\r
+  UINTN               Offset;\r
+  UINT8               CertHash[MAX_DIGEST_SIZE];\r
+  UINT16*             FilePostFix;\r
+  UINTN               NameLength;\r
+  EFI_TIME            *Time;\r
+\r
+  X509DataSize  = 0;\r
+  DbSize        = 0;\r
+  X509Data      = NULL;\r
+  SignatureData = NULL;\r
+  SignatureList = NULL;\r
+  Data          = NULL;\r
+  NewData       = NULL;\r
+\r
+  if ((Private->FileContext->FileName == NULL) || (Private->FileContext->FHandle == NULL) || (Private->SignatureGUID == NULL)) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
+  Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);\r
+  if (EFI_ERROR (Status)) {\r
+    return Status;\r
+  }\r
+\r
+  //\r
+  // Parse the file's postfix.\r
+  //\r
+  NameLength = StrLen (Private->FileContext->FileName);\r
+  if (NameLength <= 4) {\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+  FilePostFix = Private->FileContext->FileName + NameLength - 4;\r
+  if (!IsDerEncodeCertificate(FilePostFix)) {\r
+    //\r
+    // Only supports DER-encoded X509 certificate.\r
+    //\r
+    return EFI_INVALID_PARAMETER;\r
+  }\r
+\r
+  //\r
+  // Get the certificate from file and calculate its hash.\r
+  //\r
+  Status = ReadFileContent (\r
+             Private->FileContext->FHandle,\r
+             &X509Data,\r
+             &X509DataSize,\r
+             0\r
+             );\r
+  if (EFI_ERROR (Status)) {\r
+    goto ON_EXIT;\r
+  }\r
+  ASSERT (X509Data != NULL);\r
+\r
+  if (!CalculateCertHash (X509Data, X509DataSize, HashAlg, CertHash)) {\r
+    goto ON_EXIT;\r
+  }\r
+\r
+  //\r
+  // Get the variable for enrollment.\r
+  //\r
+  DataSize = 0;\r
+  Status   = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);\r
+  if (Status == EFI_BUFFER_TOO_SMALL) {\r
+    Data = (UINT8 *) AllocateZeroPool (DataSize);\r
+    if (Data == NULL) {\r
+      return EFI_OUT_OF_RESOURCES;\r
+    }\r
+\r
+    Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);\r
+    if (EFI_ERROR (Status)) {\r
+      goto ON_EXIT;\r
+    }\r
+  }\r
+\r
+  //\r
+  // Allocate memory for Signature and fill the Signature\r
+  //\r
+  SignatureSize = sizeof(EFI_SIGNATURE_DATA) - 1 + sizeof (EFI_TIME) + mHash[HashAlg].DigestLength;\r
+  SignatureData = (EFI_SIGNATURE_DATA *) AllocateZeroPool (SignatureSize);\r
+  if (SignatureData == NULL) {\r
+    return EFI_OUT_OF_RESOURCES;\r
+  }\r
+  CopyGuid (&SignatureData->SignatureOwner, Private->SignatureGUID);\r
+  CopyMem (SignatureData->SignatureData, CertHash, mHash[HashAlg].DigestLength);\r
+\r
+  //\r
+  // Fill the time.\r
+  //\r
+  if (!AlwaysRevocation) {\r
+    Time = (EFI_TIME *)(&SignatureData->SignatureData + mHash[HashAlg].DigestLength);\r
+    Time->Year   = RevocationDate->Year;\r
+    Time->Month  = RevocationDate->Month;\r
+    Time->Day    = RevocationDate->Day;\r
+    Time->Hour   = RevocationTime->Hour;\r
+    Time->Minute = RevocationTime->Minute;\r
+    Time->Second = RevocationTime->Second;\r
+  }\r
+\r
+  //\r
+  // Determine the GUID for certificate hash.\r
+  //\r
+  switch (HashAlg) {\r
+  case HASHALG_SHA256:\r
+    SignatureType = gEfiCertX509Sha256Guid;\r
+    break;\r
+  case HASHALG_SHA384:\r
+    SignatureType = gEfiCertX509Sha384Guid;\r
+    break;\r
+  case HASHALG_SHA512:\r
+    SignatureType = gEfiCertX509Sha512Guid;\r
+    break;\r
+  default:\r
+    return FALSE;\r
+  }\r
+\r
+  //\r
+  // Add signature into the new variable data buffer\r
+  //\r
+  if (GetSignaturelistOffset((EFI_SIGNATURE_LIST *)Data, DataSize, &SignatureType, &Offset)) {\r
+    //\r
+    // Add the signature to the found signaturelist.\r
+    //\r
+    DbSize  = DataSize + SignatureSize;\r
+    NewData = AllocateZeroPool (DbSize);\r
+    if (NewData == NULL) {\r
+      Status = EFI_OUT_OF_RESOURCES;\r
+      goto ON_EXIT;\r
+    }\r
+\r
+    SignatureList     = (EFI_SIGNATURE_LIST *)(Data + Offset);\r
+    SignatureListSize = (UINTN) ReadUnaligned32 ((UINT32 *)&SignatureList->SignatureListSize);\r
+    CopyMem (NewData, Data, Offset + SignatureListSize);\r
+\r
+    SignatureList = (EFI_SIGNATURE_LIST *)(NewData + Offset);\r
+    WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureListSize, (UINT32)(SignatureListSize + SignatureSize));\r
+\r
+    Offset += SignatureListSize;\r
+    CopyMem (NewData + Offset, SignatureData, SignatureSize);\r
+    CopyMem (NewData + Offset + SignatureSize, Data + Offset, DataSize - Offset);\r
+\r
+    FreePool (Data);\r
+    Data     = NewData;\r
+    DataSize = DbSize;\r
+  } else {\r
+    //\r
+    // Create a new signaturelist, and add the signature into the signaturelist.\r
+    //\r
+    DbSize  = DataSize + sizeof(EFI_SIGNATURE_LIST) + SignatureSize;\r
+    NewData = AllocateZeroPool (DbSize);\r
+    if (NewData == NULL) {\r
+      Status = EFI_OUT_OF_RESOURCES;\r
+      goto ON_EXIT;\r
+    }\r
+    //\r
+    // Fill Certificate Database parameters.\r
+    //\r
+    SignatureList     = (EFI_SIGNATURE_LIST*) (NewData + DataSize);\r
+    SignatureListSize = sizeof(EFI_SIGNATURE_LIST) + SignatureSize;\r
+    WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureListSize, (UINT32) SignatureListSize);\r
+    WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureSize, (UINT32) SignatureSize);\r
+    CopyGuid (&SignatureList->SignatureType, &SignatureType);\r
+    CopyMem ((UINT8* ) SignatureList + sizeof (EFI_SIGNATURE_LIST), SignatureData, SignatureSize);\r
+    if ((DataSize != 0) && (Data != NULL)) {\r
+      CopyMem (NewData, Data, DataSize);\r
+      FreePool (Data);\r
+    }\r
+    Data     = NewData;\r
+    DataSize = DbSize;\r
+  }\r
+\r
+  Status = CreateTimeBasedPayload (&DataSize, (UINT8**) &Data);\r
+  if (EFI_ERROR (Status)) {\r
+    goto ON_EXIT;\r
+  }\r
+\r
+  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS\r
+          | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
+  Status = gRT->SetVariable(\r
+                  EFI_IMAGE_SECURITY_DATABASE1,\r
+                  &gEfiImageSecurityDatabaseGuid,\r
+                  Attr,\r
+                  DataSize,\r
+                  Data\r
+                  );\r
+  if (EFI_ERROR (Status)) {\r
+    goto ON_EXIT;\r
+  }\r
+\r
+ON_EXIT:\r

   CloseFile (Private->FileContext->FHandle);\r
   Private->FileContext->FileName = NULL;\r
   Private->FileContext->FHandle = NULL;\r
   CloseFile (Private->FileContext->FHandle);\r
   Private->FileContext->FileName = NULL;\r
   Private->FileContext->FHandle = NULL;\r


@@ -785,96 +1506,47 @@ ON_EXIT:
     Private->SignatureGUID = NULL;\r
   }\r
 \r
     Private->SignatureGUID = NULL;\r
   }\r
 \r

-  if (KekSigList != NULL) {\r
-    FreePool (KekSigList);\r
+  if (Data != NULL) {\r
+    FreePool (Data);\r

   }\r
 \r
   }\r
 \r

-  return Status;\r
-}\r
-\r
-/**\r
-  Enroll new KEK into the System without PK's authentication.\r
-  The SignatureOwner GUID will be Private->SignatureGUID.\r
-  \r
-  @param[in] PrivateData     The module's private data.\r
-  \r
-  @retval   EFI_SUCCESS            New KEK enrolled successful.\r
-  @retval   EFI_INVALID_PARAMETER  The parameter is invalid.\r
-  @retval   others                 Fail to enroll KEK data.\r
-  \r
-**/\r
-EFI_STATUS\r
-EnrollKeyExchangeKey (\r
-  IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private\r
-  ) \r
-{\r
-  UINT16*     FilePostFix;\r
-  EFI_STATUS  Status;\r
-  UINTN       NameLength;\r
-  \r
-  if ((Private->FileContext->FileName == NULL) || (Private->SignatureGUID == NULL)) {\r
-    return EFI_INVALID_PARAMETER;\r
+  if (SignatureData != NULL) {\r
+    FreePool (SignatureData);\r

   }\r
 \r
   }\r
 \r

-  Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);\r
-  if (EFI_ERROR (Status)) {\r
-    return Status;\r
+  if (X509Data != NULL) {\r
+    FreePool (X509Data);\r

   }\r
 \r
   }\r
 \r

-  //\r
-  // Parse the file's postfix. Supports DER-encoded X509 certificate, \r
-  // and .pbk as RSA public key file.\r
-  //\r
-  NameLength = StrLen (Private->FileContext->FileName);\r
-  if (NameLength <= 4) {\r
-    return EFI_INVALID_PARAMETER;\r
-  }\r
-  FilePostFix = Private->FileContext->FileName + NameLength - 4;\r
-  if (IsDerEncodeCertificate(FilePostFix)) {\r
-    return EnrollX509ToKek (Private);\r
-  } else if (CompareMem (FilePostFix, L".pbk",4) == 0) {\r
-    return EnrollRsa2048ToKek (Private);\r
-  } else {\r
-    return EFI_INVALID_PARAMETER;\r
-  }\r
+  return Status;\r

 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Enroll a new X509 certificate into Signature Database (DB or DBX) without\r
-  KEK's authentication.\r
+  Check whether a certificate from a file exists in dbx.\r

 \r
   @param[in] PrivateData     The module's private data.\r
 \r
   @param[in] PrivateData     The module's private data.\r

-  @param[in] VariableName    Variable name of signature database, must be \r
-                             EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.\r
-  \r
-  @retval   EFI_SUCCESS            New X509 is enrolled successfully.\r
-  @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.\r
+  @param[in] VariableName    Variable name of signature database, must be\r
+                             EFI_IMAGE_SECURITY_DATABASE1.\r

 \r
 \r

+  @retval   TRUE             The X509 certificate is found in dbx successfully.\r
+  @retval   FALSE            The X509 certificate is not found in dbx.\r

 **/\r
 **/\r

-EFI_STATUS\r
-EnrollX509toSigDB (\r
+BOOLEAN\r
+IsX509CertInDbx (\r

   IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,\r
   IN CHAR16                         *VariableName\r
   IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,\r
   IN CHAR16                         *VariableName\r

-  ) \r
+  )\r

 {\r
 {\r

-  EFI_STATUS                        Status;\r
-  UINTN                             X509DataSize;\r
-  VOID                              *X509Data;\r
-  EFI_SIGNATURE_LIST                *SigDBCert;\r
-  EFI_SIGNATURE_DATA                *SigDBCertData;\r
-  VOID                              *Data;\r
-  UINTN                             DataSize;\r
-  UINTN                             SigDBSize;\r
-  UINT32                            Attr;\r
+  EFI_STATUS          Status;\r
+  UINTN               X509DataSize;\r
+  VOID                *X509Data;\r
+  BOOLEAN             IsFound;\r

 \r
 \r

+  //\r
+  //  Read the certificate from file\r
+  //\r

   X509DataSize  = 0;\r
   X509DataSize  = 0;\r

-  SigDBSize     = 0;\r
-  DataSize      = 0;\r

   X509Data      = NULL;\r
   X509Data      = NULL;\r

-  SigDBCert     = NULL;\r
-  SigDBCertData = NULL;\r
-  Data          = NULL;\r
-\r

   Status = ReadFileContent (\r
              Private->FileContext->FHandle,\r
              &X509Data,\r
   Status = ReadFileContent (\r
              Private->FileContext->FHandle,\r
              &X509Data,\r


@@ -882,88 +1554,32 @@ EnrollX509toSigDB (
              0\r
              );\r
   if (EFI_ERROR (Status)) {\r
              0\r
              );\r
   if (EFI_ERROR (Status)) {\r

-    goto ON_EXIT;\r
-  }\r
-  ASSERT (X509Data != NULL);\r
-\r
-  SigDBSize = sizeof(EFI_SIGNATURE_LIST) + sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize;\r
-\r
-  Data = AllocateZeroPool (SigDBSize);\r
-  if (Data == NULL) {\r
-    Status = EFI_OUT_OF_RESOURCES;\r
-    goto ON_EXIT;\r
+    return FALSE;\r

   }\r
 \r
   //\r
   }\r
 \r
   //\r

-  // Fill Certificate Database parameters.\r
-  // \r
-  SigDBCert = (EFI_SIGNATURE_LIST*) Data;\r
-  SigDBCert->SignatureListSize   = (UINT32) SigDBSize;\r
-  SigDBCert->SignatureHeaderSize = 0;\r
-  SigDBCert->SignatureSize = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);\r
-  CopyGuid (&SigDBCert->SignatureType, &gEfiCertX509Guid);\r
-\r
-  SigDBCertData = (EFI_SIGNATURE_DATA*) ((UINT8* ) SigDBCert + sizeof (EFI_SIGNATURE_LIST));\r
-  CopyGuid (&SigDBCertData->SignatureOwner, Private->SignatureGUID);\r
-  CopyMem ((UINT8* ) (SigDBCertData->SignatureData), X509Data, X509DataSize);\r
-\r
+  // Check the raw certificate.\r

   //\r
   //\r

-  // Check if signature database entry has been already existed. \r
-  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the \r
-  // new signature data to original variable\r
-  //    \r
-  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS \r
-          | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
-  Status = CreateTimeBasedPayload (&SigDBSize, (UINT8**) &Data);\r
-  if (EFI_ERROR (Status)) {\r
-    DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
+  IsFound = FALSE;\r
+  if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, X509Data, X509DataSize)) {\r
+    IsFound = TRUE;\r

     goto ON_EXIT;\r
   }\r
 \r
     goto ON_EXIT;\r
   }\r
 \r

-  Status = gRT->GetVariable(\r
-                  VariableName, \r
-                  &gEfiImageSecurityDatabaseGuid, \r
-                  NULL, \r
-                  &DataSize, \r
-                  NULL\r
-                  );\r
-  if (Status == EFI_BUFFER_TOO_SMALL) {\r
-    Attr |= EFI_VARIABLE_APPEND_WRITE;\r
-  } else if (Status != EFI_NOT_FOUND) {\r
-    goto ON_EXIT;\r
-  }  \r
-\r
-  Status = gRT->SetVariable(\r
-                  VariableName, \r
-                  &gEfiImageSecurityDatabaseGuid, \r
-                  Attr, \r
-                  SigDBSize,\r
-                  Data\r
-                  );\r
-  if (EFI_ERROR (Status)) {\r
+  //\r
+  // Check the hash of certificate.\r
+  //\r
+  if (IsCertHashFoundInDbx (X509Data, X509DataSize)) {\r
+    IsFound = TRUE;\r

     goto ON_EXIT;\r
   }\r
 \r
 ON_EXIT:\r
     goto ON_EXIT;\r
   }\r
 \r
 ON_EXIT:\r

-\r
-  CloseFile (Private->FileContext->FHandle);\r
-  Private->FileContext->FileName = NULL;\r
-  Private->FileContext->FHandle = NULL;\r
-\r
-  if (Private->SignatureGUID != NULL) {\r
-    FreePool (Private->SignatureGUID);\r
-    Private->SignatureGUID = NULL;\r
-  }\r
-\r
-  if (Data != NULL) {\r
-    FreePool (Data);\r
-  }\r
-\r

   if (X509Data != NULL) {\r
     FreePool (X509Data);\r
   }\r
 \r
   if (X509Data != NULL) {\r
     FreePool (X509Data);\r
   }\r
 \r

-  return Status;\r
+  return IsFound;\r

 }\r
 \r
 /**\r
 }\r
 \r
 /**\r


@@ -976,8 +1592,8 @@ ON_EXIT:
 **/\r
 EFI_STATUS\r
 LoadPeImage (\r
 **/\r
 EFI_STATUS\r
 LoadPeImage (\r

-  VOID \r
-  )   \r
+  VOID\r
+  )\r

 {\r
   EFI_IMAGE_DOS_HEADER                  *DosHdr;\r
   EFI_IMAGE_NT_HEADERS32                *NtHeader32;\r
 {\r
   EFI_IMAGE_DOS_HEADER                  *DosHdr;\r
   EFI_IMAGE_NT_HEADERS32                *NtHeader32;\r


@@ -992,7 +1608,7 @@ LoadPeImage (
   if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE)\r
   {\r
     //\r
   if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE)\r
   {\r
     //\r

-    // DOS image header is present, \r
+    // DOS image header is present,\r

     // So read the PE header after the DOS image header\r
     //\r
     mPeCoffHeaderOffset = DosHdr->e_lfanew;\r
     // So read the PE header after the DOS image header\r
     //\r
     mPeCoffHeaderOffset = DosHdr->e_lfanew;\r


@@ -1017,7 +1633,7 @@ LoadPeImage (
   // Check the architecture field of PE header and get the Certificate Data Directory data\r
   // Note the size of FileHeader field is constant for both IA32 and X64 arch\r
   //\r
   // Check the architecture field of PE header and get the Certificate Data Directory data\r
   // Note the size of FileHeader field is constant for both IA32 and X64 arch\r
   //\r

-  if ((NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_IA32) \r
+  if ((NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_IA32)\r

       || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_EBC)) {\r
     //\r
     // IA-32 Architecture\r
       || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_EBC)) {\r
     //\r
     // IA-32 Architecture\r


@@ -1045,12 +1661,12 @@ LoadPeImage (
   PE/COFF Specification 8.0 Appendix A\r
 \r
   @param[in]    HashAlg   Hash algorithm type.\r
   PE/COFF Specification 8.0 Appendix A\r
 \r
   @param[in]    HashAlg   Hash algorithm type.\r

- \r
+\r

   @retval TRUE            Successfully hash image.\r
   @retval FALSE           Fail in hash image.\r
 \r
 **/\r
   @retval TRUE            Successfully hash image.\r
   @retval FALSE           Fail in hash image.\r
 \r
 **/\r

-BOOLEAN \r
+BOOLEAN\r

 HashPeImage (\r
   IN  UINT32                HashAlg\r
   )\r
 HashPeImage (\r
   IN  UINT32                HashAlg\r
   )\r


@@ -1074,7 +1690,7 @@ HashPeImage (
   if ((HashAlg != HASHALG_SHA1) && (HashAlg != HASHALG_SHA256)) {\r
     return FALSE;\r
   }\r
   if ((HashAlg != HASHALG_SHA1) && (HashAlg != HASHALG_SHA256)) {\r
     return FALSE;\r
   }\r

-  \r
+\r

   //\r
   // Initialize context of hash.\r
   //\r
   //\r
   // Initialize context of hash.\r
   //\r


@@ -1082,14 +1698,14 @@ HashPeImage (
 \r
   if (HashAlg == HASHALG_SHA1) {\r
     mImageDigestSize  = SHA1_DIGEST_SIZE;\r
 \r
   if (HashAlg == HASHALG_SHA1) {\r
     mImageDigestSize  = SHA1_DIGEST_SIZE;\r

-    mCertType         = gEfiCertSha1Guid;    \r
+    mCertType         = gEfiCertSha1Guid;\r

   } else if (HashAlg == HASHALG_SHA256) {\r
     mImageDigestSize  = SHA256_DIGEST_SIZE;\r
     mCertType         = gEfiCertSha256Guid;\r
   }\r
 \r
   CtxSize   = mHash[HashAlg].GetContextSize();\r
   } else if (HashAlg == HASHALG_SHA256) {\r
     mImageDigestSize  = SHA256_DIGEST_SIZE;\r
     mCertType         = gEfiCertSha256Guid;\r
   }\r
 \r
   CtxSize   = mHash[HashAlg].GetContextSize();\r

-  \r
+\r

   HashCtx = AllocatePool (CtxSize);\r
   ASSERT (HashCtx != NULL);\r
 \r
   HashCtx = AllocatePool (CtxSize);\r
   ASSERT (HashCtx != NULL);\r
 \r


@@ -1106,8 +1722,8 @@ HashPeImage (
   //\r
   if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
     //\r
   //\r
   if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
     //\r

-    // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value \r
-    //       in the PE/COFF Header. If the MachineType is Itanium(IA64) and the \r
+    // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value\r
+    //       in the PE/COFF Header. If the MachineType is Itanium(IA64) and the\r

     //       Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC\r
     //       then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC\r
     //\r
     //       Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC\r
     //       then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC\r
     //\r


@@ -1118,7 +1734,7 @@ HashPeImage (
     //\r
     Magic = mNtHeader.Pe32->OptionalHeader.Magic;\r
   }\r
     //\r
     Magic = mNtHeader.Pe32->OptionalHeader.Magic;\r
   }\r

-  \r
+\r

   //\r
   // 3.  Calculate the distance from the base of the image header to the image checksum address.\r
   // 4.  Hash the image header from its base to beginning of the image checksum.\r
   //\r
   // 3.  Calculate the distance from the base of the image header to the image checksum address.\r
   // 4.  Hash the image header from its base to beginning of the image checksum.\r


@@ -1154,7 +1770,7 @@ HashPeImage (
   } else {\r
     //\r
     // Use PE32+ offset.\r
   } else {\r
     //\r
     // Use PE32+ offset.\r

-    //    \r
+    //\r

     HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);\r
     HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - HashBase);\r
   }\r
     HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);\r
     HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - HashBase);\r
   }\r


@@ -1277,7 +1893,7 @@ HashPeImage (
       HashSize = (UINTN)(\r
                  mImageSize -\r
                  mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY].Size -\r
       HashSize = (UINTN)(\r
                  mImageSize -\r
                  mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY].Size -\r

-                 SumOfBytesHashed);      \r
+                 SumOfBytesHashed);\r

     }\r
 \r
     Status  = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r
     }\r
 \r
     Status  = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);\r


@@ -1299,15 +1915,15 @@ Done:
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Recognize the Hash algorithm in PE/COFF Authenticode and caculate hash of \r
-  Pe/Coff image based on the authenticated image hashing in PE/COFF Specification \r
+  Recognize the Hash algorithm in PE/COFF Authenticode and caculate hash of\r
+  Pe/Coff image based on the authenticated image hashing in PE/COFF Specification\r

   8.0 Appendix A\r
 \r
   @retval EFI_UNSUPPORTED             Hash algorithm is not supported.\r
   @retval EFI_SUCCESS                 Hash successfully.\r
 \r
 **/\r
   8.0 Appendix A\r
 \r
   @retval EFI_UNSUPPORTED             Hash algorithm is not supported.\r
   @retval EFI_SUCCESS                 Hash successfully.\r
 \r
 **/\r

-EFI_STATUS \r
+EFI_STATUS\r

 HashPeImageByType (\r
   VOID\r
   )\r
 HashPeImageByType (\r
   VOID\r
   )\r


@@ -1317,10 +1933,10 @@ HashPeImageByType (
 \r
   PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) (mImageBase + mSecDataDir->Offset);\r
 \r
 \r
   PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) (mImageBase + mSecDataDir->Offset);\r
 \r

-  for (Index = 0; Index < HASHALG_MAX; Index++) {  \r
+  for (Index = 0; Index < HASHALG_MAX; Index++) {\r

     //\r
     // Check the Hash algorithm in PE/COFF Authenticode.\r
     //\r
     // Check the Hash algorithm in PE/COFF Authenticode.\r

-    //    According to PKCS#7 Definition: \r
+    //    According to PKCS#7 Definition:\r

     //        SignedData ::= SEQUENCE {\r
     //            version Version,\r
     //            digestAlgorithms DigestAlgorithmIdentifiers,\r
     //        SignedData ::= SEQUENCE {\r
     //            version Version,\r
     //            digestAlgorithms DigestAlgorithmIdentifiers,\r


@@ -1337,7 +1953,7 @@ HashPeImageByType (
       continue;\r
     }\r
 \r
       continue;\r
     }\r
 \r

-    //    \r
+    //\r

     if (CompareMem (PkcsCertData->CertData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {\r
       break;\r
     }\r
     if (CompareMem (PkcsCertData->CertData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {\r
       break;\r
     }\r


@@ -1358,11 +1974,12 @@ HashPeImageByType (
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Enroll a new executable's signature into Signature Database. \r
+  Enroll a new executable's signature into Signature Database.\r

 \r
   @param[in] PrivateData     The module's private data.\r
 \r
   @param[in] PrivateData     The module's private data.\r

-  @param[in] VariableName    Variable name of signature database, must be \r
-                             EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.\r
+  @param[in] VariableName    Variable name of signature database, must be\r
+                             EFI_IMAGE_SECURITY_DATABASE, EFI_IMAGE_SECURITY_DATABASE1\r
+                             or EFI_IMAGE_SECURITY_DATABASE2.\r

 \r
   @retval   EFI_SUCCESS            New signature is enrolled successfully.\r
   @retval   EFI_INVALID_PARAMETER  The parameter is invalid.\r
 \r
   @retval   EFI_SUCCESS            New signature is enrolled successfully.\r
   @retval   EFI_INVALID_PARAMETER  The parameter is invalid.\r


@@ -1388,6 +2005,10 @@ EnrollImageSignatureToSigDB (
   Data = NULL;\r
   GuidCertData = NULL;\r
 \r
   Data = NULL;\r
   GuidCertData = NULL;\r
 \r

+  if (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0) {\r
+    return EFI_UNSUPPORTED;\r
+  }\r
+\r

   //\r
   // Form the SigDB certificate list.\r
   // Format the data item into EFI_SIGNATURE_LIST type.\r
   //\r
   // Form the SigDB certificate list.\r
   // Format the data item into EFI_SIGNATURE_LIST type.\r


@@ -1402,13 +2023,13 @@ EnrollImageSignatureToSigDB (
   //\r
   Status = ReadFileContent(\r
              Private->FileContext->FHandle,\r
   //\r
   Status = ReadFileContent(\r
              Private->FileContext->FHandle,\r

-             (VOID **) &mImageBase, \r
-             &mImageSize, \r
+             (VOID **) &mImageBase,\r
+             &mImageSize,\r

              0\r
              );\r
   if (EFI_ERROR (Status)) {\r
     goto ON_EXIT;\r
              0\r
              );\r
   if (EFI_ERROR (Status)) {\r
     goto ON_EXIT;\r

-  }  \r
+  }\r

   ASSERT (mImageBase != NULL);\r
 \r
   Status = LoadPeImage ();\r
   ASSERT (mImageBase != NULL);\r
 \r
   Status = LoadPeImage ();\r


@@ -1422,7 +2043,7 @@ EnrollImageSignatureToSigDB (
       goto ON_EXIT;\r
     }\r
   } else {\r
       goto ON_EXIT;\r
     }\r
   } else {\r

-  \r
+\r

     //\r
     // Read the certificate data\r
     //\r
     //\r
     // Read the certificate data\r
     //\r


@@ -1439,7 +2060,7 @@ EnrollImageSignatureToSigDB (
         Status = EFI_ABORTED;\r
         goto ON_EXIT;;\r
       }\r
         Status = EFI_ABORTED;\r
         goto ON_EXIT;;\r
       }\r

-    \r
+\r

     } else if (mCertificate->wCertificateType == WIN_CERT_TYPE_PKCS_SIGNED_DATA) {\r
 \r
       Status = HashPeImageByType ();\r
     } else if (mCertificate->wCertificateType == WIN_CERT_TYPE_PKCS_SIGNED_DATA) {\r
 \r
       Status = HashPeImageByType ();\r


@@ -1455,7 +2076,7 @@ EnrollImageSignatureToSigDB (
   //\r
   // Create a new SigDB entry.\r
   //\r
   //\r
   // Create a new SigDB entry.\r
   //\r

-  SigDBSize = sizeof(EFI_SIGNATURE_LIST) \r
+  SigDBSize = sizeof(EFI_SIGNATURE_LIST)\r

               + sizeof(EFI_SIGNATURE_DATA) - 1\r
               + (UINT32) mImageDigestSize;\r
 \r
               + sizeof(EFI_SIGNATURE_DATA) - 1\r
               + (UINT32) mImageDigestSize;\r
 \r


@@ -1464,10 +2085,10 @@ EnrollImageSignatureToSigDB (
     Status = EFI_OUT_OF_RESOURCES;\r
     goto ON_EXIT;\r
   }\r
     Status = EFI_OUT_OF_RESOURCES;\r
     goto ON_EXIT;\r
   }\r

-  \r
+\r

   //\r
   // Adjust the Certificate Database parameters.\r
   //\r
   // Adjust the Certificate Database parameters.\r

-  // \r
+  //\r

   SigDBCert = (EFI_SIGNATURE_LIST*) Data;\r
   SigDBCert->SignatureListSize   = (UINT32) SigDBSize;\r
   SigDBCert->SignatureHeaderSize = 0;\r
   SigDBCert = (EFI_SIGNATURE_LIST*) Data;\r
   SigDBCert->SignatureListSize   = (UINT32) SigDBSize;\r
   SigDBCert->SignatureHeaderSize = 0;\r


@@ -1478,41 +2099,41 @@ EnrollImageSignatureToSigDB (
   CopyGuid (&SigDBCertData->SignatureOwner, Private->SignatureGUID);\r
   CopyMem (SigDBCertData->SignatureData, mImageDigest, mImageDigestSize);\r
 \r
   CopyGuid (&SigDBCertData->SignatureOwner, Private->SignatureGUID);\r
   CopyMem (SigDBCertData->SignatureData, mImageDigest, mImageDigestSize);\r
 \r

-  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS \r
+  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS\r

           | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
   Status = CreateTimeBasedPayload (&SigDBSize, (UINT8**) &Data);\r
   if (EFI_ERROR (Status)) {\r
     DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
     goto ON_EXIT;\r
   }\r
           | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
   Status = CreateTimeBasedPayload (&SigDBSize, (UINT8**) &Data);\r
   if (EFI_ERROR (Status)) {\r
     DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));\r
     goto ON_EXIT;\r
   }\r

-  \r
+\r

   //\r
   //\r

-  // Check if SigDB variable has been already existed. \r
-  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the \r
+  // Check if SigDB variable has been already existed.\r
+  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the\r

   // new signature data to original variable\r
   // new signature data to original variable\r

-  //    \r
+  //\r

   DataSize = 0;\r
   Status = gRT->GetVariable(\r
   DataSize = 0;\r
   Status = gRT->GetVariable(\r

-                  VariableName, \r
-                  &gEfiImageSecurityDatabaseGuid, \r
-                  NULL, \r
-                  &DataSize, \r
+                  VariableName,\r
+                  &gEfiImageSecurityDatabaseGuid,\r
+                  NULL,\r
+                  &DataSize,\r

                   NULL\r
                   );\r
   if (Status == EFI_BUFFER_TOO_SMALL) {\r
     Attr |= EFI_VARIABLE_APPEND_WRITE;\r
   } else if (Status != EFI_NOT_FOUND) {\r
     goto ON_EXIT;\r
                   NULL\r
                   );\r
   if (Status == EFI_BUFFER_TOO_SMALL) {\r
     Attr |= EFI_VARIABLE_APPEND_WRITE;\r
   } else if (Status != EFI_NOT_FOUND) {\r
     goto ON_EXIT;\r

-  }  \r
+  }\r

 \r
   //\r
   // Enroll the variable.\r
   //\r
   Status = gRT->SetVariable(\r
 \r
   //\r
   // Enroll the variable.\r
   //\r
   Status = gRT->SetVariable(\r

-                  VariableName, \r
-                  &gEfiImageSecurityDatabaseGuid, \r
-                  Attr, \r
-                  SigDBSize, \r
+                  VariableName,\r
+                  &gEfiImageSecurityDatabaseGuid,\r
+                  Attr,\r
+                  SigDBSize,\r

                   Data\r
                   );\r
   if (EFI_ERROR (Status)) {\r
                   Data\r
                   );\r
   if (EFI_ERROR (Status)) {\r


@@ -1543,23 +2164,23 @@ ON_EXIT:
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Enroll signature into DB/DBX without KEK's authentication.\r
+  Enroll signature into DB/DBX/DBT without KEK's authentication.\r

   The SignatureOwner GUID will be Private->SignatureGUID.\r
   The SignatureOwner GUID will be Private->SignatureGUID.\r

-  \r
+\r

   @param[in] PrivateData     The module's private data.\r
   @param[in] PrivateData     The module's private data.\r

-  @param[in] VariableName    Variable name of signature database, must be \r
+  @param[in] VariableName    Variable name of signature database, must be\r

                              EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.\r
                              EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.\r

-  \r
+\r

   @retval   EFI_SUCCESS            New signature enrolled successfully.\r
   @retval   EFI_INVALID_PARAMETER  The parameter is invalid.\r
   @retval   others                 Fail to enroll signature data.\r
   @retval   EFI_SUCCESS            New signature enrolled successfully.\r
   @retval   EFI_INVALID_PARAMETER  The parameter is invalid.\r
   @retval   others                 Fail to enroll signature data.\r

-  \r
+\r

 **/\r
 EFI_STATUS\r
 EnrollSignatureDatabase (\r
   IN SECUREBOOT_CONFIG_PRIVATE_DATA     *Private,\r
   IN CHAR16                             *VariableName\r
 **/\r
 EFI_STATUS\r
 EnrollSignatureDatabase (\r
   IN SECUREBOOT_CONFIG_PRIVATE_DATA     *Private,\r
   IN CHAR16                             *VariableName\r

-  ) \r
+  )\r

 {\r
   UINT16*      FilePostFix;\r
   EFI_STATUS   Status;\r
 {\r
   UINT16*      FilePostFix;\r
   EFI_STATUS   Status;\r


@@ -1569,20 +2190,20 @@ EnrollSignatureDatabase (
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r

-  Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);\r
+  Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);\r

   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r
   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r

-  \r
+\r

   //\r
   //\r

-  // Parse the file's postfix. \r
+  // Parse the file's postfix.\r

   //\r
   NameLength = StrLen (Private->FileContext->FileName);\r
   if (NameLength <= 4) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
   FilePostFix = Private->FileContext->FileName + NameLength - 4;\r
   //\r
   NameLength = StrLen (Private->FileContext->FileName);\r
   if (NameLength <= 4) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
   FilePostFix = Private->FileContext->FileName + NameLength - 4;\r

-  if (IsDerEncodeCertificate(FilePostFix)) {\r
+  if (IsDerEncodeCertificate (FilePostFix)) {\r

     //\r
     // Supports DER-encoded X509 certificate.\r
     //\r
     //\r
     // Supports DER-encoded X509 certificate.\r
     //\r


@@ -1593,7 +2214,7 @@ EnrollSignatureDatabase (
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  List all signatures in specified signature database (e.g. KEK/DB/DBX)\r
+  List all signatures in specified signature database (e.g. KEK/DB/DBX/DBT)\r

   by GUID in the page for user to select and delete as needed.\r
 \r
   @param[in]    PrivateData         Module's private data.\r
   by GUID in the page for user to select and delete as needed.\r
 \r
   @param[in]    PrivateData         Module's private data.\r


@@ -1605,7 +2226,7 @@ EnrollSignatureDatabase (
 \r
   @retval   EFI_SUCCESS             Success to update the signature list page\r
   @retval   EFI_OUT_OF_RESOURCES    Unable to allocate required resources.\r
 \r
   @retval   EFI_SUCCESS             Success to update the signature list page\r
   @retval   EFI_OUT_OF_RESOURCES    Unable to allocate required resources.\r

-  \r
+\r

 **/\r
 EFI_STATUS\r
 UpdateDeletePage (\r
 **/\r
 EFI_STATUS\r
 UpdateDeletePage (\r


@@ -1624,7 +2245,7 @@ UpdateDeletePage (
   VOID                        *StartOpCodeHandle;\r
   VOID                        *EndOpCodeHandle;\r
   EFI_IFR_GUID_LABEL          *StartLabel;\r
   VOID                        *StartOpCodeHandle;\r
   VOID                        *EndOpCodeHandle;\r
   EFI_IFR_GUID_LABEL          *StartLabel;\r

-  EFI_IFR_GUID_LABEL          *EndLabel;  \r
+  EFI_IFR_GUID_LABEL          *EndLabel;\r

   UINTN                       DataSize;\r
   UINT8                       *Data;\r
   EFI_SIGNATURE_LIST          *CertList;\r
   UINTN                       DataSize;\r
   UINT8                       *Data;\r
   EFI_SIGNATURE_LIST          *CertList;\r


@@ -1640,20 +2261,20 @@ UpdateDeletePage (
   GuidStr  = NULL;\r
   StartOpCodeHandle = NULL;\r
   EndOpCodeHandle   = NULL;\r
   GuidStr  = NULL;\r
   StartOpCodeHandle = NULL;\r
   EndOpCodeHandle   = NULL;\r

-  \r
+\r

   //\r
   // Initialize the container for dynamic opcodes.\r
   //\r
   StartOpCodeHandle = HiiAllocateOpCodeHandle ();\r
   if (StartOpCodeHandle == NULL) {\r
     Status = EFI_OUT_OF_RESOURCES;\r
   //\r
   // Initialize the container for dynamic opcodes.\r
   //\r
   StartOpCodeHandle = HiiAllocateOpCodeHandle ();\r
   if (StartOpCodeHandle == NULL) {\r
     Status = EFI_OUT_OF_RESOURCES;\r

-    goto ON_EXIT; \r
+    goto ON_EXIT;\r

   }\r
 \r
   EndOpCodeHandle = HiiAllocateOpCodeHandle ();\r
   if (EndOpCodeHandle == NULL) {\r
     Status = EFI_OUT_OF_RESOURCES;\r
   }\r
 \r
   EndOpCodeHandle = HiiAllocateOpCodeHandle ();\r
   if (EndOpCodeHandle == NULL) {\r
     Status = EFI_OUT_OF_RESOURCES;\r

-    goto ON_EXIT; \r
+    goto ON_EXIT;\r

   }\r
 \r
   //\r
   }\r
 \r
   //\r


@@ -1681,7 +2302,7 @@ UpdateDeletePage (
   // Read Variable.\r
   //\r
   DataSize = 0;\r
   // Read Variable.\r
   //\r
   DataSize = 0;\r

-  Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, Data);  \r
+  Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, Data);\r

   if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {\r
     goto ON_EXIT;\r
   }\r
   if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {\r
     goto ON_EXIT;\r
   }\r


@@ -1720,6 +2341,12 @@ UpdateDeletePage (
       Help = STRING_TOKEN (STR_CERT_TYPE_SHA1_GUID);\r
     } else if (CompareGuid (&CertList->SignatureType, &gEfiCertSha256Guid)) {\r
       Help = STRING_TOKEN (STR_CERT_TYPE_SHA256_GUID);\r
       Help = STRING_TOKEN (STR_CERT_TYPE_SHA1_GUID);\r
     } else if (CompareGuid (&CertList->SignatureType, &gEfiCertSha256Guid)) {\r
       Help = STRING_TOKEN (STR_CERT_TYPE_SHA256_GUID);\r

+    } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha256Guid)) {\r
+      Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA256_GUID);\r
+    } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha384Guid)) {\r
+      Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA384_GUID);\r
+    } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha512Guid)) {\r
+      Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA512_GUID);\r

     } else {\r
       //\r
       // The signature type is not supported in current implementation.\r
     } else {\r
       //\r
       // The signature type is not supported in current implementation.\r


@@ -1731,26 +2358,26 @@ UpdateDeletePage (
 \r
     CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
     for (Index = 0; Index < CertCount; Index++) {\r
 \r
     CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;\r
     for (Index = 0; Index < CertCount; Index++) {\r

-      Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList \r
-                                              + sizeof (EFI_SIGNATURE_LIST) \r
-                                              + CertList->SignatureHeaderSize \r
+      Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList\r
+                                              + sizeof (EFI_SIGNATURE_LIST)\r
+                                              + CertList->SignatureHeaderSize\r

                                               + Index * CertList->SignatureSize);\r
       //\r
                                               + Index * CertList->SignatureSize);\r
       //\r

-      // Display GUID and help \r
+      // Display GUID and help\r

       //\r
       GuidToString (&Cert->SignatureOwner, GuidStr, 100);\r
       GuidID  = HiiSetString (PrivateData->HiiHandle, 0, GuidStr, NULL);\r
       HiiCreateCheckBoxOpCode (\r
         StartOpCodeHandle,\r
         (EFI_QUESTION_ID) (QuestionIdBase + GuidIndex++),\r
       //\r
       GuidToString (&Cert->SignatureOwner, GuidStr, 100);\r
       GuidID  = HiiSetString (PrivateData->HiiHandle, 0, GuidStr, NULL);\r
       HiiCreateCheckBoxOpCode (\r
         StartOpCodeHandle,\r
         (EFI_QUESTION_ID) (QuestionIdBase + GuidIndex++),\r

-        0, \r
-        0, \r
-        GuidID, \r
+        0,\r
+        0,\r
+        GuidID,\r

         Help,\r
         EFI_IFR_FLAG_CALLBACK,\r
         0,\r
         NULL\r
         Help,\r
         EFI_IFR_FLAG_CALLBACK,\r
         0,\r
         NULL\r

-        );       \r
+        );\r

     }\r
 \r
     ItemDataSize -= CertList->SignatureListSize;\r
     }\r
 \r
     ItemDataSize -= CertList->SignatureListSize;\r


@@ -1773,7 +2400,7 @@ ON_EXIT:
   if (EndOpCodeHandle != NULL) {\r
     HiiFreeOpCodeHandle (EndOpCodeHandle);\r
   }\r
   if (EndOpCodeHandle != NULL) {\r
     HiiFreeOpCodeHandle (EndOpCodeHandle);\r
   }\r

-  \r
+\r

   if (Data != NULL) {\r
     FreePool (Data);\r
   }\r
   if (Data != NULL) {\r
     FreePool (Data);\r
   }\r


@@ -1786,14 +2413,14 @@ ON_EXIT:
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Delete a KEK entry from KEK database. \r
+  Delete a KEK entry from KEK database.\r

 \r
   @param[in]    PrivateData         Module's private data.\r
   @param[in]    QuestionId          Question id of the KEK item to delete.\r
 \r
   @retval   EFI_SUCCESS            Delete kek item successfully.\r
   @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.\r
 \r
   @param[in]    PrivateData         Module's private data.\r
   @param[in]    QuestionId          Question id of the KEK item to delete.\r
 \r
   @retval   EFI_SUCCESS            Delete kek item successfully.\r
   @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.\r

-  \r
+\r

 **/\r
 EFI_STATUS\r
 DeleteKeyExchangeKey (\r
 **/\r
 EFI_STATUS\r
 DeleteKeyExchangeKey (\r


@@ -1821,18 +2448,18 @@ DeleteKeyExchangeKey (
   OldData         = NULL;\r
   CertList        = NULL;\r
   Cert            = NULL;\r
   OldData         = NULL;\r
   CertList        = NULL;\r
   Cert            = NULL;\r

-  Attr            = 0;   \r
+  Attr            = 0;\r

   DeleteKekIndex  = QuestionId - OPTION_DEL_KEK_QUESTION_ID;\r
 \r
   Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);\r
   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r
   DeleteKekIndex  = QuestionId - OPTION_DEL_KEK_QUESTION_ID;\r
 \r
   Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);\r
   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r

-  \r
+\r

   //\r
   // Get original KEK variable.\r
   //\r
   // Get original KEK variable.\r

-  //                           \r
-  DataSize = 0;  \r
+  //\r
+  DataSize = 0;\r

   Status = gRT->GetVariable (EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid, NULL, &DataSize, NULL);\r
   if (EFI_ERROR(Status) && Status != EFI_BUFFER_TOO_SMALL) {\r
     goto ON_EXIT;\r
   Status = gRT->GetVariable (EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid, NULL, &DataSize, NULL);\r
   if (EFI_ERROR(Status) && Status != EFI_BUFFER_TOO_SMALL) {\r
     goto ON_EXIT;\r


@@ -1840,7 +2467,7 @@ DeleteKeyExchangeKey (
 \r
   OldData = (UINT8*)AllocateZeroPool(DataSize);\r
   if (OldData == NULL) {\r
 \r
   OldData = (UINT8*)AllocateZeroPool(DataSize);\r
   if (OldData == NULL) {\r

-    Status = EFI_OUT_OF_RESOURCES;  \r
+    Status = EFI_OUT_OF_RESOURCES;\r

     goto ON_EXIT;\r
   }\r
 \r
     goto ON_EXIT;\r
   }\r
 \r


@@ -1850,7 +2477,7 @@ DeleteKeyExchangeKey (
   }\r
 \r
   //\r
   }\r
 \r
   //\r

-  // Allocate space for new variable.  \r
+  // Allocate space for new variable.\r

   //\r
   Data = (UINT8*) AllocateZeroPool (DataSize);\r
   if (Data == NULL) {\r
   //\r
   Data = (UINT8*) AllocateZeroPool (DataSize);\r
   if (Data == NULL) {\r


@@ -1880,7 +2507,7 @@ DeleteKeyExchangeKey (
           // Find it! Skip it!\r
           //\r
           NewCertList->SignatureListSize -= CertList->SignatureSize;\r
           // Find it! Skip it!\r
           //\r
           NewCertList->SignatureListSize -= CertList->SignatureSize;\r

-          IsKEKItemFound = TRUE;          \r
+          IsKEKItemFound = TRUE;\r

         } else {\r
           //\r
           // This item doesn't match. Copy it to the Data buffer.\r
         } else {\r
           //\r
           // This item doesn't match. Copy it to the Data buffer.\r


@@ -1898,7 +2525,7 @@ DeleteKeyExchangeKey (
       CopyMem (Data + Offset, CertList, CertList->SignatureListSize);\r
       Offset += CertList->SignatureListSize;\r
     }\r
       CopyMem (Data + Offset, CertList, CertList->SignatureListSize);\r
       Offset += CertList->SignatureListSize;\r
     }\r

-      \r
+\r

     KekDataSize -= CertList->SignatureListSize;\r
     CertList = (EFI_SIGNATURE_LIST*) ((UINT8*) CertList + CertList->SignatureListSize);\r
   }\r
     KekDataSize -= CertList->SignatureListSize;\r
     CertList = (EFI_SIGNATURE_LIST*) ((UINT8*) CertList + CertList->SignatureListSize);\r
   }\r


@@ -1924,7 +2551,7 @@ DeleteKeyExchangeKey (
     if (CertCount != 0) {\r
       CopyMem (OldData + Offset, CertList, CertList->SignatureListSize);\r
       Offset += CertList->SignatureListSize;\r
     if (CertCount != 0) {\r
       CopyMem (OldData + Offset, CertList, CertList->SignatureListSize);\r
       Offset += CertList->SignatureListSize;\r

-    }    \r
+    }\r

     KekDataSize -= CertList->SignatureListSize;\r
     CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
   }\r
     KekDataSize -= CertList->SignatureListSize;\r
     CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
   }\r


@@ -1939,17 +2566,17 @@ DeleteKeyExchangeKey (
   }\r
 \r
   Status = gRT->SetVariable(\r
   }\r
 \r
   Status = gRT->SetVariable(\r

-                  EFI_KEY_EXCHANGE_KEY_NAME, \r
-                  &gEfiGlobalVariableGuid, \r
-                  Attr, \r
-                  DataSize, \r
+                  EFI_KEY_EXCHANGE_KEY_NAME,\r
+                  &gEfiGlobalVariableGuid,\r
+                  Attr,\r
+                  DataSize,\r

                   OldData\r
                   );\r
   if (EFI_ERROR (Status)) {\r
     DEBUG ((DEBUG_ERROR, "Failed to set variable, Status = %r\n", Status));\r
     goto ON_EXIT;\r
   }\r
                   OldData\r
                   );\r
   if (EFI_ERROR (Status)) {\r
     DEBUG ((DEBUG_ERROR, "Failed to set variable, Status = %r\n", Status));\r
     goto ON_EXIT;\r
   }\r

- \r
+\r

 ON_EXIT:\r
   if (Data != NULL) {\r
     FreePool(Data);\r
 ON_EXIT:\r
   if (Data != NULL) {\r
     FreePool(Data);\r


@@ -1960,7 +2587,7 @@ ON_EXIT:
   }\r
 \r
   return UpdateDeletePage (\r
   }\r
 \r
   return UpdateDeletePage (\r

-           PrivateData, \r
+           PrivateData,\r

            EFI_KEY_EXCHANGE_KEY_NAME,\r
            &gEfiGlobalVariableGuid,\r
            LABEL_KEK_DELETE,\r
            EFI_KEY_EXCHANGE_KEY_NAME,\r
            &gEfiGlobalVariableGuid,\r
            LABEL_KEK_DELETE,\r


@@ -1979,7 +2606,7 @@ ON_EXIT:
   @param[in]    FormId              Form ID of current page.\r
   @param[in]    QuestionIdBase      Base question id of the signature list.\r
   @param[in]    DeleteIndex         Signature index to delete.\r
   @param[in]    FormId              Form ID of current page.\r
   @param[in]    QuestionIdBase      Base question id of the signature list.\r
   @param[in]    DeleteIndex         Signature index to delete.\r

-  \r
+\r

   @retval   EFI_SUCCESS             Delete siganture successfully.\r
   @retval   EFI_NOT_FOUND           Can't find the signature item,\r
   @retval   EFI_OUT_OF_RESOURCES    Could not allocate needed resources.\r
   @retval   EFI_SUCCESS             Delete siganture successfully.\r
   @retval   EFI_NOT_FOUND           Can't find the signature item,\r
   @retval   EFI_OUT_OF_RESOURCES    Could not allocate needed resources.\r


@@ -2014,7 +2641,7 @@ DeleteSignature (
   OldData         = NULL;\r
   CertList        = NULL;\r
   Cert            = NULL;\r
   OldData         = NULL;\r
   CertList        = NULL;\r
   Cert            = NULL;\r

-  Attr            = 0; \r
+  Attr            = 0;\r

 \r
   Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);\r
   if (EFI_ERROR (Status)) {\r
 \r
   Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);\r
   if (EFI_ERROR (Status)) {\r


@@ -2023,7 +2650,7 @@ DeleteSignature (
 \r
   //\r
   // Get original signature list data.\r
 \r
   //\r
   // Get original signature list data.\r

-  //                           \r
+  //\r

   DataSize = 0;\r
   Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, NULL);\r
   if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {\r
   DataSize = 0;\r
   Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, NULL);\r
   if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {\r


@@ -2032,17 +2659,17 @@ DeleteSignature (
 \r
   OldData = (UINT8 *) AllocateZeroPool (DataSize);\r
   if (OldData == NULL) {\r
 \r
   OldData = (UINT8 *) AllocateZeroPool (DataSize);\r
   if (OldData == NULL) {\r

-    Status = EFI_OUT_OF_RESOURCES;  \r
+    Status = EFI_OUT_OF_RESOURCES;\r

     goto ON_EXIT;\r
   }\r
 \r
   Status = gRT->GetVariable (VariableName, VendorGuid, &Attr, &DataSize, OldData);\r
   if (EFI_ERROR(Status)) {\r
     goto ON_EXIT;\r
     goto ON_EXIT;\r
   }\r
 \r
   Status = gRT->GetVariable (VariableName, VendorGuid, &Attr, &DataSize, OldData);\r
   if (EFI_ERROR(Status)) {\r
     goto ON_EXIT;\r

-  } \r
+  }\r

 \r
   //\r
 \r
   //\r

-  // Allocate space for new variable.  \r
+  // Allocate space for new variable.\r

   //\r
   Data = (UINT8*) AllocateZeroPool (DataSize);\r
   if (Data == NULL) {\r
   //\r
   Data = (UINT8*) AllocateZeroPool (DataSize);\r
   if (Data == NULL) {\r


@@ -2062,7 +2689,10 @@ DeleteSignature (
     if (CompareGuid (&CertList->SignatureType, &gEfiCertRsa2048Guid) ||\r
         CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid) ||\r
         CompareGuid (&CertList->SignatureType, &gEfiCertSha1Guid) ||\r
     if (CompareGuid (&CertList->SignatureType, &gEfiCertRsa2048Guid) ||\r
         CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid) ||\r
         CompareGuid (&CertList->SignatureType, &gEfiCertSha1Guid) ||\r

-        CompareGuid (&CertList->SignatureType, &gEfiCertSha256Guid)\r
+        CompareGuid (&CertList->SignatureType, &gEfiCertSha256Guid) ||\r
+        CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha256Guid) ||\r
+        CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha384Guid) ||\r
+        CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha512Guid)\r

         ) {\r
       //\r
       // Copy EFI_SIGNATURE_LIST header then calculate the signature count in this list.\r
         ) {\r
       //\r
       // Copy EFI_SIGNATURE_LIST header then calculate the signature count in this list.\r


@@ -2078,7 +2708,7 @@ DeleteSignature (
           // Find it! Skip it!\r
           //\r
           NewCertList->SignatureListSize -= CertList->SignatureSize;\r
           // Find it! Skip it!\r
           //\r
           NewCertList->SignatureListSize -= CertList->SignatureSize;\r

-          IsItemFound = TRUE;          \r
+          IsItemFound = TRUE;\r

         } else {\r
           //\r
           // This item doesn't match. Copy it to the Data buffer.\r
         } else {\r
           //\r
           // This item doesn't match. Copy it to the Data buffer.\r


@@ -2096,7 +2726,7 @@ DeleteSignature (
       CopyMem (Data + Offset, (UINT8*)(CertList), CertList->SignatureListSize);\r
       Offset += CertList->SignatureListSize;\r
     }\r
       CopyMem (Data + Offset, (UINT8*)(CertList), CertList->SignatureListSize);\r
       Offset += CertList->SignatureListSize;\r
     }\r

-      \r
+\r

     ItemDataSize -= CertList->SignatureListSize;\r
     CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
   }\r
     ItemDataSize -= CertList->SignatureListSize;\r
     CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
   }\r


@@ -2122,7 +2752,7 @@ DeleteSignature (
     if (CertCount != 0) {\r
       CopyMem (OldData + Offset, (UINT8*)(CertList), CertList->SignatureListSize);\r
       Offset += CertList->SignatureListSize;\r
     if (CertCount != 0) {\r
       CopyMem (OldData + Offset, (UINT8*)(CertList), CertList->SignatureListSize);\r
       Offset += CertList->SignatureListSize;\r

-    }    \r
+    }\r

     ItemDataSize -= CertList->SignatureListSize;\r
     CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
   }\r
     ItemDataSize -= CertList->SignatureListSize;\r
     CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);\r
   }\r


@@ -2137,17 +2767,17 @@ DeleteSignature (
   }\r
 \r
   Status = gRT->SetVariable(\r
   }\r
 \r
   Status = gRT->SetVariable(\r

-                  VariableName, \r
-                  VendorGuid, \r
-                  Attr, \r
-                  DataSize, \r
+                  VariableName,\r
+                  VendorGuid,\r
+                  Attr,\r
+                  DataSize,\r

                   OldData\r
                   );\r
   if (EFI_ERROR (Status)) {\r
     DEBUG ((DEBUG_ERROR, "Failed to set variable, Status = %r\n", Status));\r
     goto ON_EXIT;\r
   }\r
                   OldData\r
                   );\r
   if (EFI_ERROR (Status)) {\r
     DEBUG ((DEBUG_ERROR, "Failed to set variable, Status = %r\n", Status));\r
     goto ON_EXIT;\r
   }\r

- \r
+\r

 ON_EXIT:\r
   if (Data != NULL) {\r
     FreePool(Data);\r
 ON_EXIT:\r
   if (Data != NULL) {\r
     FreePool(Data);\r


@@ -2158,7 +2788,7 @@ ON_EXIT:
   }\r
 \r
   return UpdateDeletePage (\r
   }\r
 \r
   return UpdateDeletePage (\r

-           PrivateData, \r
+           PrivateData,\r

            VariableName,\r
            VendorGuid,\r
            LabelNumber,\r
            VariableName,\r
            VendorGuid,\r
            LabelNumber,\r


@@ -2169,23 +2799,37 @@ ON_EXIT:
 \r
 /**\r
   This function extracts configuration from variable.\r
 \r
 /**\r
   This function extracts configuration from variable.\r

-  \r
+\r

   @param[in, out]  ConfigData   Point to SecureBoot configuration private data.\r
 \r
 **/\r
 VOID\r
 SecureBootExtractConfigFromVariable (\r
   IN OUT SECUREBOOT_CONFIGURATION    *ConfigData\r
   @param[in, out]  ConfigData   Point to SecureBoot configuration private data.\r
 \r
 **/\r
 VOID\r
 SecureBootExtractConfigFromVariable (\r
   IN OUT SECUREBOOT_CONFIGURATION    *ConfigData\r

-  ) \r
+  )\r

 {\r
 {\r

-  UINT8   *SecureBootEnable;\r
-  UINT8   *SetupMode;\r
-  UINT8   *SecureBootMode;\r
+  UINT8     *SecureBootEnable;\r
+  UINT8     *SetupMode;\r
+  UINT8     *SecureBootMode;\r
+  EFI_TIME  CurrTime;\r

 \r
   SecureBootEnable = NULL;\r
   SetupMode        = NULL;\r
   SecureBootMode   = NULL;\r
 \r
   SecureBootEnable = NULL;\r
   SetupMode        = NULL;\r
   SecureBootMode   = NULL;\r

-  \r
+\r
+  //\r
+  // Initilize the Date and Time using system time.\r
+  //\r
+  ConfigData->CertificateFormat = HASHALG_RAW;\r
+  ConfigData->AlwaysRevocation = TRUE;\r
+  gRT->GetTime (&CurrTime, NULL);\r
+  ConfigData->RevocationDate.Year   = CurrTime.Year;\r
+  ConfigData->RevocationDate.Month  = CurrTime.Month;\r
+  ConfigData->RevocationDate.Day    = CurrTime.Day;\r
+  ConfigData->RevocationTime.Hour   = CurrTime.Hour;\r
+  ConfigData->RevocationTime.Minute = CurrTime.Minute;\r
+  ConfigData->RevocationTime.Second = 0;\r
+\r

   //\r
   // If the SecureBootEnable Variable doesn't exist, hide the SecureBoot Enable/Disable\r
   // Checkbox.\r
   //\r
   // If the SecureBootEnable Variable doesn't exist, hide the SecureBoot Enable/Disable\r
   // Checkbox.\r


@@ -2200,7 +2844,7 @@ SecureBootExtractConfigFromVariable (
       ConfigData->AttemptSecureBoot = TRUE;\r
     }\r
   }\r
       ConfigData->AttemptSecureBoot = TRUE;\r
     }\r
   }\r

-  \r
+\r

   //\r
   // If it is Physical Presence User, set the PhysicalPresent to true.\r
   //\r
   //\r
   // If it is Physical Presence User, set the PhysicalPresent to true.\r
   //\r


@@ -2209,7 +2853,7 @@ SecureBootExtractConfigFromVariable (
   } else {\r
     ConfigData->PhysicalPresent = FALSE;\r
   }\r
   } else {\r
     ConfigData->PhysicalPresent = FALSE;\r
   }\r

-  \r
+\r

   //\r
   // If there is no PK then the Delete Pk button will be gray.\r
   //\r
   //\r
   // If there is no PK then the Delete Pk button will be gray.\r
   //\r


@@ -2289,17 +2933,17 @@ SecureBootExtractConfig (
   if (Progress == NULL || Results == NULL) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
   if (Progress == NULL || Results == NULL) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r

-  \r
+\r

   AllocatedRequest = FALSE;\r
   ConfigRequestHdr = NULL;\r
   ConfigRequest    = NULL;\r
   Size             = 0;\r
   SecureBoot       = NULL;\r
   AllocatedRequest = FALSE;\r
   ConfigRequestHdr = NULL;\r
   ConfigRequest    = NULL;\r
   Size             = 0;\r
   SecureBoot       = NULL;\r

-  \r
+\r

   ZeroMem (&Configuration, sizeof (Configuration));\r
   PrivateData      = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);\r
   *Progress        = Request;\r
   ZeroMem (&Configuration, sizeof (Configuration));\r
   PrivateData      = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);\r
   *Progress        = Request;\r

-  \r
+\r

   if ((Request != NULL) && !HiiIsConfigHdrMatch (Request, &gSecureBootConfigFormSetGuid, mSecureBootStorageName)) {\r
     return EFI_NOT_FOUND;\r
   }\r
   if ((Request != NULL) && !HiiIsConfigHdrMatch (Request, &gSecureBootConfigFormSetGuid, mSecureBootStorageName)) {\r
     return EFI_NOT_FOUND;\r
   }\r


@@ -2321,7 +2965,7 @@ SecureBootExtractConfig (
   if (SecureBoot != NULL) {\r
     FreePool (SecureBoot);\r
   }\r
   if (SecureBoot != NULL) {\r
     FreePool (SecureBoot);\r
   }\r

-  \r
+\r

   BufferSize = sizeof (SECUREBOOT_CONFIGURATION);\r
   ConfigRequest = Request;\r
   if ((Request == NULL) || (StrStr (Request, L"OFFSET") == NULL)) {\r
   BufferSize = sizeof (SECUREBOOT_CONFIGURATION);\r
   ConfigRequest = Request;\r
   if ((Request == NULL) || (StrStr (Request, L"OFFSET") == NULL)) {\r


@@ -2399,7 +3043,7 @@ SecureBootRouteConfig (
   SECUREBOOT_CONFIGURATION   IfrNvData;\r
   UINTN                      BufferSize;\r
   EFI_STATUS                 Status;\r
   SECUREBOOT_CONFIGURATION   IfrNvData;\r
   UINTN                      BufferSize;\r
   EFI_STATUS                 Status;\r

-  \r
+\r

   if (Configuration == NULL || Progress == NULL) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
   if (Configuration == NULL || Progress == NULL) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r


@@ -2480,7 +3124,7 @@ SecureBootCallback (
   )\r
 {\r
   EFI_INPUT_KEY                   Key;\r
   )\r
 {\r
   EFI_INPUT_KEY                   Key;\r

-  EFI_STATUS                      Status;  \r
+  EFI_STATUS                      Status;\r

   SECUREBOOT_CONFIG_PRIVATE_DATA  *Private;\r
   UINTN                           BufferSize;\r
   SECUREBOOT_CONFIGURATION        *IfrNvData;\r
   SECUREBOOT_CONFIG_PRIVATE_DATA  *Private;\r
   UINTN                           BufferSize;\r
   SECUREBOOT_CONFIGURATION        *IfrNvData;\r


@@ -2505,7 +3149,7 @@ SecureBootCallback (
 \r
     return EFI_SUCCESS;\r
   }\r
 \r
     return EFI_SUCCESS;\r
   }\r

-  \r
+\r

   if (Action == EFI_BROWSER_ACTION_RETRIEVE) {\r
     Status = EFI_UNSUPPORTED;\r
     if (QuestionId == KEY_SECURE_BOOT_MODE) {\r
   if (Action == EFI_BROWSER_ACTION_RETRIEVE) {\r
     Status = EFI_UNSUPPORTED;\r
     if (QuestionId == KEY_SECURE_BOOT_MODE) {\r


@@ -2516,14 +3160,14 @@ SecureBootCallback (
     }\r
     return Status;\r
   }\r
     }\r
     return Status;\r
   }\r

-  \r
+\r

   if ((Action != EFI_BROWSER_ACTION_CHANGED) &&\r
       (Action != EFI_BROWSER_ACTION_CHANGING) &&\r
       (Action != EFI_BROWSER_ACTION_FORM_CLOSE) &&\r
       (Action != EFI_BROWSER_ACTION_DEFAULT_STANDARD)) {\r
     return EFI_UNSUPPORTED;\r
   }\r
   if ((Action != EFI_BROWSER_ACTION_CHANGED) &&\r
       (Action != EFI_BROWSER_ACTION_CHANGING) &&\r
       (Action != EFI_BROWSER_ACTION_FORM_CLOSE) &&\r
       (Action != EFI_BROWSER_ACTION_DEFAULT_STANDARD)) {\r
     return EFI_UNSUPPORTED;\r
   }\r

-  \r
+\r

   Private = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);\r
 \r
   //\r
   Private = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);\r
 \r
   //\r


@@ -2538,7 +3182,7 @@ SecureBootCallback (
   Status = EFI_SUCCESS;\r
 \r
   HiiGetBrowserData (&gSecureBootConfigFormSetGuid, mSecureBootStorageName, BufferSize, (UINT8 *) IfrNvData);\r
   Status = EFI_SUCCESS;\r
 \r
   HiiGetBrowserData (&gSecureBootConfigFormSetGuid, mSecureBootStorageName, BufferSize, (UINT8 *) IfrNvData);\r

-  \r
+\r

   if (Action == EFI_BROWSER_ACTION_CHANGING) {\r
 \r
     switch (QuestionId) {\r
   if (Action == EFI_BROWSER_ACTION_CHANGING) {\r
 \r
     switch (QuestionId) {\r


@@ -2573,6 +3217,7 @@ SecureBootCallback (
     case KEY_SECURE_BOOT_KEK_OPTION:\r
     case KEY_SECURE_BOOT_DB_OPTION:\r
     case KEY_SECURE_BOOT_DBX_OPTION:\r
     case KEY_SECURE_BOOT_KEK_OPTION:\r
     case KEY_SECURE_BOOT_DB_OPTION:\r
     case KEY_SECURE_BOOT_DBX_OPTION:\r

+    case KEY_SECURE_BOOT_DBT_OPTION:\r

       //\r
       // Clear Signature GUID.\r
       //\r
       //\r
       // Clear Signature GUID.\r
       //\r


@@ -2588,6 +3233,8 @@ SecureBootCallback (
         LabelId = SECUREBOOT_ENROLL_SIGNATURE_TO_DB;\r
       } else if (QuestionId == KEY_SECURE_BOOT_DBX_OPTION) {\r
         LabelId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;\r
         LabelId = SECUREBOOT_ENROLL_SIGNATURE_TO_DB;\r
       } else if (QuestionId == KEY_SECURE_BOOT_DBX_OPTION) {\r
         LabelId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;\r

+      } else if (QuestionId == KEY_SECURE_BOOT_DBT_OPTION) {\r
+        LabelId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;\r

       } else {\r
         LabelId = FORMID_ENROLL_KEK_FORM;\r
       }\r
       } else {\r
         LabelId = FORMID_ENROLL_KEK_FORM;\r
       }\r


@@ -2595,21 +3242,25 @@ SecureBootCallback (
       //\r
       // Refresh selected file.\r
       //\r
       //\r
       // Refresh selected file.\r
       //\r

-      CleanUpPage (LabelId, Private);    \r
+      CleanUpPage (LabelId, Private);\r

       break;\r
       break;\r

-  \r
+\r

     case SECUREBOOT_ADD_PK_FILE_FORM_ID:\r
     case FORMID_ENROLL_KEK_FORM:\r
     case SECUREBOOT_ENROLL_SIGNATURE_TO_DB:\r
     case SECUREBOOT_ENROLL_SIGNATURE_TO_DBX:\r
     case SECUREBOOT_ADD_PK_FILE_FORM_ID:\r
     case FORMID_ENROLL_KEK_FORM:\r
     case SECUREBOOT_ENROLL_SIGNATURE_TO_DB:\r
     case SECUREBOOT_ENROLL_SIGNATURE_TO_DBX:\r

+    case SECUREBOOT_ENROLL_SIGNATURE_TO_DBT:\r

       if (QuestionId == SECUREBOOT_ADD_PK_FILE_FORM_ID) {\r
         Private->FeCurrentState = FileExplorerStateEnrollPkFile;\r
       } else if (QuestionId == FORMID_ENROLL_KEK_FORM) {\r
         Private->FeCurrentState = FileExplorerStateEnrollKekFile;\r
       } else if (QuestionId == SECUREBOOT_ENROLL_SIGNATURE_TO_DB) {\r
         Private->FeCurrentState = FileExplorerStateEnrollSignatureFileToDb;\r
       if (QuestionId == SECUREBOOT_ADD_PK_FILE_FORM_ID) {\r
         Private->FeCurrentState = FileExplorerStateEnrollPkFile;\r
       } else if (QuestionId == FORMID_ENROLL_KEK_FORM) {\r
         Private->FeCurrentState = FileExplorerStateEnrollKekFile;\r
       } else if (QuestionId == SECUREBOOT_ENROLL_SIGNATURE_TO_DB) {\r
         Private->FeCurrentState = FileExplorerStateEnrollSignatureFileToDb;\r

-      } else {\r
+      } else if (QuestionId == SECUREBOOT_ENROLL_SIGNATURE_TO_DBX) {\r

         Private->FeCurrentState = FileExplorerStateEnrollSignatureFileToDbx;\r
         Private->FeCurrentState = FileExplorerStateEnrollSignatureFileToDbx;\r

+        IfrNvData->CertificateFormat = HASHALG_SHA256;\r
+      } else {\r
+        Private->FeCurrentState = FileExplorerStateEnrollSignatureFileToDbt;\r

       }\r
 \r
       Private->FeDisplayContext = FileExplorerDisplayUnknown;\r
       }\r
 \r
       Private->FeDisplayContext = FileExplorerDisplayUnknown;\r


@@ -2617,7 +3268,7 @@ SecureBootCallback (
       UpdateFileExplorer (Private, 0);\r
       break;\r
 \r
       UpdateFileExplorer (Private, 0);\r
       break;\r
 \r

-    case KEY_SECURE_BOOT_DELETE_PK: \r
+    case KEY_SECURE_BOOT_DELETE_PK:\r

       if (Value->u8) {\r
         CreatePopUp (\r
           EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,\r
       if (Value->u8) {\r
         CreatePopUp (\r
           EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,\r


@@ -2642,16 +3293,16 @@ SecureBootCallback (
 \r
     case KEY_DELETE_KEK:\r
       UpdateDeletePage (\r
 \r
     case KEY_DELETE_KEK:\r
       UpdateDeletePage (\r

-        Private, \r
+        Private,\r

         EFI_KEY_EXCHANGE_KEY_NAME,\r
         &gEfiGlobalVariableGuid,\r
         LABEL_KEK_DELETE,\r
         FORMID_DELETE_KEK_FORM,\r
         EFI_KEY_EXCHANGE_KEY_NAME,\r
         &gEfiGlobalVariableGuid,\r
         LABEL_KEK_DELETE,\r
         FORMID_DELETE_KEK_FORM,\r

-        OPTION_DEL_KEK_QUESTION_ID          \r
+        OPTION_DEL_KEK_QUESTION_ID\r

         );\r
       break;\r
 \r
         );\r
       break;\r
 \r

-    case SECUREBOOT_DELETE_SIGNATURE_FROM_DB:        \r
+    case SECUREBOOT_DELETE_SIGNATURE_FROM_DB:\r

       UpdateDeletePage (\r
         Private,\r
         EFI_IMAGE_SECURITY_DATABASE,\r
       UpdateDeletePage (\r
         Private,\r
         EFI_IMAGE_SECURITY_DATABASE,\r


@@ -2674,6 +3325,18 @@ SecureBootCallback (
 \r
       break;\r
 \r
 \r
       break;\r
 \r

+    case SECUREBOOT_DELETE_SIGNATURE_FROM_DBT:\r
+      UpdateDeletePage (\r
+        Private,\r
+        EFI_IMAGE_SECURITY_DATABASE2,\r
+        &gEfiImageSecurityDatabaseGuid,\r
+        LABEL_DBT_DELETE,\r
+        SECUREBOOT_DELETE_SIGNATURE_FROM_DBT,\r
+        OPTION_DEL_DBT_QUESTION_ID\r
+        );\r
+\r
+      break;\r
+\r

     case KEY_VALUE_SAVE_AND_EXIT_KEK:\r
       Status = EnrollKeyExchangeKey (Private);\r
       if (EFI_ERROR (Status)) {\r
     case KEY_VALUE_SAVE_AND_EXIT_KEK:\r
       Status = EnrollKeyExchangeKey (Private);\r
       if (EFI_ERROR (Status)) {\r


@@ -2701,7 +3364,27 @@ SecureBootCallback (
       break;\r
 \r
     case KEY_VALUE_SAVE_AND_EXIT_DBX:\r
       break;\r
 \r
     case KEY_VALUE_SAVE_AND_EXIT_DBX:\r

-      Status = EnrollSignatureDatabase (Private, EFI_IMAGE_SECURITY_DATABASE1);\r
+      if (IsX509CertInDbx (Private, EFI_IMAGE_SECURITY_DATABASE1)) {\r
+        CreatePopUp (\r
+          EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,\r
+          &Key,\r
+          L"Enrollment failed! Same certificate had already been in the dbx!",\r
+          NULL\r
+          );\r
+          break;\r
+      }\r
+\r
+      if ((IfrNvData != NULL) && (IfrNvData->CertificateFormat < HASHALG_MAX)) {\r
+        Status = EnrollX509HashtoSigDB (\r
+                   Private,\r
+                   IfrNvData->CertificateFormat,\r
+                   &IfrNvData->RevocationDate,\r
+                   &IfrNvData->RevocationTime,\r
+                   IfrNvData->AlwaysRevocation\r
+                   );\r
+      } else {\r
+        Status = EnrollSignatureDatabase (Private, EFI_IMAGE_SECURITY_DATABASE1);\r
+      }\r

       if (EFI_ERROR (Status)) {\r
         CreatePopUp (\r
           EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,\r
       if (EFI_ERROR (Status)) {\r
         CreatePopUp (\r
           EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,\r


@@ -2713,6 +3396,19 @@ SecureBootCallback (
       }\r
       break;\r
 \r
       }\r
       break;\r
 \r

+    case KEY_VALUE_SAVE_AND_EXIT_DBT:\r
+      Status = EnrollSignatureDatabase (Private, EFI_IMAGE_SECURITY_DATABASE2);\r
+      if (EFI_ERROR (Status)) {\r
+        CreatePopUp (\r
+          EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,\r
+          &Key,\r
+          L"ERROR: Unsupported file type!",\r
+          L"Only supports DER-encoded X509 certificate.",\r
+          NULL\r
+          );\r
+      }\r
+      break;\r
+\r

     default:\r
       if (QuestionId >= FILE_OPTION_GOTO_OFFSET) {\r
         UpdateFileExplorer (Private, QuestionId);\r
     default:\r
       if (QuestionId >= FILE_OPTION_GOTO_OFFSET) {\r
         UpdateFileExplorer (Private, QuestionId);\r


@@ -2725,7 +3421,7 @@ SecureBootCallback (
           Private,\r
           EFI_IMAGE_SECURITY_DATABASE,\r
           &gEfiImageSecurityDatabaseGuid,\r
           Private,\r
           EFI_IMAGE_SECURITY_DATABASE,\r
           &gEfiImageSecurityDatabaseGuid,\r

-          LABEL_DB_DELETE,   \r
+          LABEL_DB_DELETE,\r

           SECUREBOOT_DELETE_SIGNATURE_FROM_DB,\r
           OPTION_DEL_DB_QUESTION_ID,\r
           QuestionId - OPTION_DEL_DB_QUESTION_ID\r
           SECUREBOOT_DELETE_SIGNATURE_FROM_DB,\r
           OPTION_DEL_DB_QUESTION_ID,\r
           QuestionId - OPTION_DEL_DB_QUESTION_ID\r


@@ -2736,11 +3432,22 @@ SecureBootCallback (
           Private,\r
           EFI_IMAGE_SECURITY_DATABASE1,\r
           &gEfiImageSecurityDatabaseGuid,\r
           Private,\r
           EFI_IMAGE_SECURITY_DATABASE1,\r
           &gEfiImageSecurityDatabaseGuid,\r

-          LABEL_DBX_DELETE,   \r
+          LABEL_DBX_DELETE,\r

           SECUREBOOT_DELETE_SIGNATURE_FROM_DBX,\r
           OPTION_DEL_DBX_QUESTION_ID,\r
           QuestionId - OPTION_DEL_DBX_QUESTION_ID\r
           );\r
           SECUREBOOT_DELETE_SIGNATURE_FROM_DBX,\r
           OPTION_DEL_DBX_QUESTION_ID,\r
           QuestionId - OPTION_DEL_DBX_QUESTION_ID\r
           );\r

+      } else if ((QuestionId >= OPTION_DEL_DBT_QUESTION_ID) &&\r
+                 (QuestionId < (OPTION_DEL_DBT_QUESTION_ID + OPTION_CONFIG_RANGE))) {\r
+        DeleteSignature (\r
+          Private,\r
+          EFI_IMAGE_SECURITY_DATABASE2,\r
+          &gEfiImageSecurityDatabaseGuid,\r
+          LABEL_DBT_DELETE,\r
+          SECUREBOOT_DELETE_SIGNATURE_FROM_DBT,\r
+          OPTION_DEL_DBT_QUESTION_ID,\r
+          QuestionId - OPTION_DEL_DBT_QUESTION_ID\r
+          );\r

       }\r
       break;\r
     }\r
       }\r
       break;\r
     }\r


@@ -2748,7 +3455,7 @@ SecureBootCallback (
     switch (QuestionId) {\r
     case KEY_SECURE_BOOT_ENABLE:\r
       *ActionRequest = EFI_BROWSER_ACTION_REQUEST_FORM_APPLY;\r
     switch (QuestionId) {\r
     case KEY_SECURE_BOOT_ENABLE:\r
       *ActionRequest = EFI_BROWSER_ACTION_REQUEST_FORM_APPLY;\r

-      break;  \r
+      break;\r

     case KEY_VALUE_SAVE_AND_EXIT_PK:\r
       Status = EnrollPlatformKey (Private);\r
       if (EFI_ERROR (Status)) {\r
     case KEY_VALUE_SAVE_AND_EXIT_PK:\r
       Status = EnrollPlatformKey (Private);\r
       if (EFI_ERROR (Status)) {\r


@@ -2766,27 +3473,28 @@ SecureBootCallback (
           NULL\r
           );\r
       } else {\r
           NULL\r
           );\r
       } else {\r

-        *ActionRequest = EFI_BROWSER_ACTION_REQUEST_RESET; \r
-      }        \r
+        *ActionRequest = EFI_BROWSER_ACTION_REQUEST_RESET;\r
+      }\r

       break;\r
 \r
     case KEY_VALUE_NO_SAVE_AND_EXIT_PK:\r
     case KEY_VALUE_NO_SAVE_AND_EXIT_KEK:\r
     case KEY_VALUE_NO_SAVE_AND_EXIT_DB:\r
     case KEY_VALUE_NO_SAVE_AND_EXIT_DBX:\r
       break;\r
 \r
     case KEY_VALUE_NO_SAVE_AND_EXIT_PK:\r
     case KEY_VALUE_NO_SAVE_AND_EXIT_KEK:\r
     case KEY_VALUE_NO_SAVE_AND_EXIT_DB:\r
     case KEY_VALUE_NO_SAVE_AND_EXIT_DBX:\r

+    case KEY_VALUE_NO_SAVE_AND_EXIT_DBT:\r

       if (Private->FileContext->FHandle != NULL) {\r
         CloseFile (Private->FileContext->FHandle);\r
         Private->FileContext->FHandle = NULL;\r
         Private->FileContext->FileName = NULL;\r
       }\r
       if (Private->FileContext->FHandle != NULL) {\r
         CloseFile (Private->FileContext->FHandle);\r
         Private->FileContext->FHandle = NULL;\r
         Private->FileContext->FileName = NULL;\r
       }\r

-   \r
+\r

       if (Private->SignatureGUID != NULL) {\r
         FreePool (Private->SignatureGUID);\r
         Private->SignatureGUID = NULL;\r
       }\r
       *ActionRequest = EFI_BROWSER_ACTION_REQUEST_EXIT;\r
       break;\r
       if (Private->SignatureGUID != NULL) {\r
         FreePool (Private->SignatureGUID);\r
         Private->SignatureGUID = NULL;\r
       }\r
       *ActionRequest = EFI_BROWSER_ACTION_REQUEST_EXIT;\r
       break;\r

-      \r
+\r

     case KEY_SECURE_BOOT_MODE:\r
       mIsEnterSecureBootForm = FALSE;\r
       break;\r
     case KEY_SECURE_BOOT_MODE:\r
       mIsEnterSecureBootForm = FALSE;\r
       break;\r


@@ -2794,6 +3502,7 @@ SecureBootCallback (
     case KEY_SECURE_BOOT_KEK_GUID:\r
     case KEY_SECURE_BOOT_SIGNATURE_GUID_DB:\r
     case KEY_SECURE_BOOT_SIGNATURE_GUID_DBX:\r
     case KEY_SECURE_BOOT_KEK_GUID:\r
     case KEY_SECURE_BOOT_SIGNATURE_GUID_DB:\r
     case KEY_SECURE_BOOT_SIGNATURE_GUID_DBX:\r

+    case KEY_SECURE_BOOT_SIGNATURE_GUID_DBT:\r

       ASSERT (Private->SignatureGUID != NULL);\r
       Status = StringToGuid (\r
                  IfrNvData->SignatureGuid,\r
       ASSERT (Private->SignatureGUID != NULL);\r
       Status = StringToGuid (\r
                  IfrNvData->SignatureGuid,\r


@@ -2854,13 +3563,13 @@ SecureBootCallback (
       FreePool (SecureBootMode);\r
     }\r
   }\r
       FreePool (SecureBootMode);\r
     }\r
   }\r

-  \r
+\r

   if (!EFI_ERROR (Status)) {\r
     BufferSize = sizeof (SECUREBOOT_CONFIGURATION);\r
     HiiSetBrowserData (&gSecureBootConfigFormSetGuid, mSecureBootStorageName, BufferSize, (UINT8*) IfrNvData, NULL);\r
   }\r
   FreePool (IfrNvData);\r
   if (!EFI_ERROR (Status)) {\r
     BufferSize = sizeof (SECUREBOOT_CONFIGURATION);\r
     HiiSetBrowserData (&gSecureBootConfigFormSetGuid, mSecureBootStorageName, BufferSize, (UINT8*) IfrNvData, NULL);\r
   }\r
   FreePool (IfrNvData);\r

-  \r
+\r

   return EFI_SUCCESS;\r
 }\r
 \r
   return EFI_SUCCESS;\r
 }\r
 \r


@@ -2926,15 +3635,15 @@ InstallSecureBootConfigForm (
 \r
   PrivateData->FileContext = AllocateZeroPool (sizeof (SECUREBOOT_FILE_CONTEXT));\r
   PrivateData->MenuEntry   = AllocateZeroPool (sizeof (SECUREBOOT_MENU_ENTRY));\r
 \r
   PrivateData->FileContext = AllocateZeroPool (sizeof (SECUREBOOT_FILE_CONTEXT));\r
   PrivateData->MenuEntry   = AllocateZeroPool (sizeof (SECUREBOOT_MENU_ENTRY));\r

-  \r
+\r

   if (PrivateData->FileContext == NULL || PrivateData->MenuEntry == NULL) {\r
     UninstallSecureBootConfigForm (PrivateData);\r
     return EFI_OUT_OF_RESOURCES;\r
   }\r
   if (PrivateData->FileContext == NULL || PrivateData->MenuEntry == NULL) {\r
     UninstallSecureBootConfigForm (PrivateData);\r
     return EFI_OUT_OF_RESOURCES;\r
   }\r

-  \r
+\r

   PrivateData->FeCurrentState = FileExplorerStateInActive;\r
   PrivateData->FeDisplayContext = FileExplorerDisplayUnknown;\r
   PrivateData->FeCurrentState = FileExplorerStateInActive;\r
   PrivateData->FeDisplayContext = FileExplorerDisplayUnknown;\r

-  \r
+\r

   InitializeListHead (&FsOptionMenu.Head);\r
   InitializeListHead (&DirectoryMenu.Head);\r
 \r
   InitializeListHead (&FsOptionMenu.Head);\r
   InitializeListHead (&DirectoryMenu.Head);\r
 \r


@@ -2975,7 +3684,7 @@ InstallSecureBootConfigForm (
                                        );\r
   mEndLabel->ExtendOpCode = EFI_IFR_EXTEND_OP_LABEL;\r
   mEndLabel->Number       = LABEL_END;\r
                                        );\r
   mEndLabel->ExtendOpCode = EFI_IFR_EXTEND_OP_LABEL;\r
   mEndLabel->Number       = LABEL_END;\r

-  \r
+\r

   return EFI_SUCCESS;\r
 }\r
 \r
   return EFI_SUCCESS;\r
 }\r
 \r

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h
index f87afbe709b9155458cbe91442ebf3cad3073320..228f44bde81441fca00c2625cb40b8f9b1af8a25 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.h
@@ -2,7 +2,7 @@
   The header file of HII Config Access protocol implementation of SecureBoot\r
   configuration module.\r
 \r
   The header file of HII Config Access protocol implementation of SecureBoot\r
   configuration module.\r
 \r

-Copyright (c) 2011 - 2012, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2011 - 2014, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -73,9 +73,18 @@ extern  EFI_IFR_GUID_LABEL         *mEndLabel;
 //\r
 #define SHA256_DIGEST_SIZE  32\r
 //\r
 //\r
 #define SHA256_DIGEST_SIZE  32\r
 //\r

-// Set max digest size as SHA256 Output (32 bytes) by far\r
+// SHA-384 digest size in bytes\r

 //\r
 //\r

-#define MAX_DIGEST_SIZE    SHA256_DIGEST_SIZE\r
+#define SHA384_DIGEST_SIZE  48\r
+//\r
+// SHA-512 digest size in bytes\r
+//\r
+#define SHA512_DIGEST_SIZE  64\r
+\r
+//\r
+// Set max digest size as SHA512 Output (64 bytes) by far\r
+//\r
+#define MAX_DIGEST_SIZE    SHA512_DIGEST_SIZE\r

 \r
 #define WIN_CERT_UEFI_RSA2048_SIZE               256\r
 \r
 \r
 #define WIN_CERT_UEFI_RSA2048_SIZE               256\r
 \r


@@ -87,6 +96,7 @@ extern  EFI_IFR_GUID_LABEL         *mEndLabel;
 #define HASHALG_SHA256                         0x00000002\r
 #define HASHALG_SHA384                         0x00000003\r
 #define HASHALG_SHA512                         0x00000004\r
 #define HASHALG_SHA256                         0x00000002\r
 #define HASHALG_SHA384                         0x00000003\r
 #define HASHALG_SHA512                         0x00000004\r

+#define HASHALG_RAW                            0x00000005\r

 #define HASHALG_MAX                            0x00000005\r
 \r
 \r
 #define HASHALG_MAX                            0x00000005\r
 \r
 \r


@@ -120,6 +130,7 @@ typedef enum _FILE_EXPLORER_STATE {
   FileExplorerStateEnrollKekFile,\r
   FileExplorerStateEnrollSignatureFileToDb,\r
   FileExplorerStateEnrollSignatureFileToDbx,\r
   FileExplorerStateEnrollKekFile,\r
   FileExplorerStateEnrollSignatureFileToDb,\r
   FileExplorerStateEnrollSignatureFileToDbx,\r

+  FileExplorerStateEnrollSignatureFileToDbt,\r

   FileExplorerStateUnknown\r
 } FILE_EXPLORER_STATE;\r
 \r
   FileExplorerStateUnknown\r
 } FILE_EXPLORER_STATE;\r
 \r


@@ -316,7 +327,7 @@ BOOLEAN
 typedef struct {\r
   CHAR16                   *Name;           ///< Name for Hash Algorithm\r
   UINTN                    DigestLength;    ///< Digest Length\r
 typedef struct {\r
   CHAR16                   *Name;           ///< Name for Hash Algorithm\r
   UINTN                    DigestLength;    ///< Digest Length\r

-  UINT8                    *OidValue;       ///< Hash Algorithm OID ASN.1 Value \r
+  UINT8                    *OidValue;       ///< Hash Algorithm OID ASN.1 Value\r

   UINTN                    OidLength;       ///< Length of Hash OID Value\r
   HASH_GET_CONTEXT_SIZE    GetContextSize;  ///< Pointer to Hash GetContentSize function\r
   HASH_INIT                HashInit;        ///< Pointer to Hash Init function\r
   UINTN                    OidLength;       ///< Length of Hash OID Value\r
   HASH_GET_CONTEXT_SIZE    GetContextSize;  ///< Pointer to Hash GetContentSize function\r
   HASH_INIT                HashInit;        ///< Pointer to Hash Init function\r


@@ -471,7 +482,7 @@ DevicePathToStr (
 \r
 \r
 /**\r
 \r
 \r
 /**\r

-  Clean up the dynamic opcode at label and form specified by both LabelId. \r
+  Clean up the dynamic opcode at label and form specified by both LabelId.\r

 \r
   @param[in] LabelId         It is both the Form ID and Label ID for opcode deletion.\r
   @param[in] PrivateData     Module private data.\r
 \r
   @param[in] LabelId         It is both the Form ID and Label ID for opcode deletion.\r
   @param[in] PrivateData     Module private data.\r


@@ -505,7 +516,7 @@ UpdateFileExplorer (
   Free resources allocated in Allocate Rountine.\r
 \r
   @param[in, out]  MenuOption        Menu to be freed\r
   Free resources allocated in Allocate Rountine.\r
 \r
   @param[in, out]  MenuOption        Menu to be freed\r

-  \r
+\r

 **/\r
 VOID\r
 FreeMenu (\r
 **/\r
 VOID\r
 FreeMenu (\r


@@ -514,15 +525,15 @@ FreeMenu (
 \r
 \r
 /**\r
 \r
 \r
 /**\r

-  Read file content into BufferPtr, the size of the allocate buffer \r
+  Read file content into BufferPtr, the size of the allocate buffer\r

   is *FileSize plus AddtionAllocateSize.\r
 \r
   @param[in]       FileHandle            The file to be read.\r
   @param[in, out]  BufferPtr             Pointers to the pointer of allocated buffer.\r
   @param[out]      FileSize              Size of input file\r
   is *FileSize plus AddtionAllocateSize.\r
 \r
   @param[in]       FileHandle            The file to be read.\r
   @param[in, out]  BufferPtr             Pointers to the pointer of allocated buffer.\r
   @param[out]      FileSize              Size of input file\r

-  @param[in]       AddtionAllocateSize   Addtion size the buffer need to be allocated. \r
+  @param[in]       AddtionAllocateSize   Addtion size the buffer need to be allocated.\r

                                          In case the buffer need to contain others besides the file content.\r
                                          In case the buffer need to contain others besides the file content.\r

-  \r
+\r

   @retval   EFI_SUCCESS                  The file was read into the buffer.\r
   @retval   EFI_INVALID_PARAMETER        A parameter was invalid.\r
   @retval   EFI_OUT_OF_RESOURCES         A memory allocation failed.\r
   @retval   EFI_SUCCESS                  The file was read into the buffer.\r
   @retval   EFI_INVALID_PARAMETER        A parameter was invalid.\r
   @retval   EFI_OUT_OF_RESOURCES         A memory allocation failed.\r


@@ -542,7 +553,7 @@ ReadFileContent (
   Close an open file handle.\r
 \r
   @param[in] FileHandle           The file handle to close.\r
   Close an open file handle.\r
 \r
   @param[in] FileHandle           The file handle to close.\r

-  \r
+\r

 **/\r
 VOID\r
 CloseFile (\r
 **/\r
 VOID\r
 CloseFile (\r


@@ -555,7 +566,7 @@ CloseFile (
 \r
   @param[in]   Integer          Pointer to the nonnegative integer to be converted\r
   @param[in]   IntSizeInWords   Length of integer buffer in words\r
 \r
   @param[in]   Integer          Pointer to the nonnegative integer to be converted\r
   @param[in]   IntSizeInWords   Length of integer buffer in words\r

-  @param[out]  OctetString      Converted octet string of the specified length \r
+  @param[out]  OctetString      Converted octet string of the specified length\r

   @param[in]   OSSizeInBytes    Intended length of resulting octet string in bytes\r
 \r
 Returns:\r
   @param[in]   OSSizeInBytes    Intended length of resulting octet string in bytes\r
 \r
 Returns:\r


@@ -587,8 +598,8 @@ Int2OctStr (
 **/\r
 EFI_STATUS\r
 StringToGuid (\r
 **/\r
 EFI_STATUS\r
 StringToGuid (\r

-  IN   CHAR16           *Str, \r
-  IN   UINTN            StrLen, \r
+  IN   CHAR16           *Str,\r
+  IN   UINTN            StrLen,\r

   OUT  EFI_GUID         *Guid\r
   );\r
 \r
   OUT  EFI_GUID         *Guid\r
   );\r
 \r


@@ -599,7 +610,7 @@ StringToGuid (
   @param[in]     Guid          Pointer to GUID to print.\r
   @param[in]     Buffer        Buffer to print Guid into.\r
   @param[in]     BufferSize    Size of Buffer.\r
   @param[in]     Guid          Pointer to GUID to print.\r
   @param[in]     Buffer        Buffer to print Guid into.\r
   @param[in]     BufferSize    Size of Buffer.\r

-  \r
+\r

   @retval    Number of characters printed.\r
 \r
 **/\r
   @retval    Number of characters printed.\r
 \r
 **/\r


@@ -610,4 +621,4 @@ GuidToString (
   IN  UINTN     BufferSize\r
   );\r
 \r
   IN  UINTN     BufferSize\r
   );\r
 \r

-#endif\r
+#endif
\ No newline at end of file

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
index 7d68b3981fa4d3c833b6b2ffa8e218956b8cc5b9..b628bcb1f5324faecbea278778bfea0ab3976122 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigNvData.h
@@ -2,12 +2,12 @@
   Header file for NV data structure definition.\r
 \r
 Copyright (c) 2011 - 2014, Intel Corporation. All rights reserved.<BR>\r
   Header file for NV data structure definition.\r
 \r
 Copyright (c) 2011 - 2014, Intel Corporation. All rights reserved.<BR>\r

-This program and the accompanying materials \r
-are licensed and made available under the terms and conditions of the BSD License \r
-which accompanies this distribution.  The full text of the license may be found at \r
+This program and the accompanying materials\r
+are licensed and made available under the terms and conditions of the BSD License\r
+which accompanies this distribution.  The full text of the license may be found at\r

 http://opensource.org/licenses/bsd-license.php\r
 \r
 http://opensource.org/licenses/bsd-license.php\r
 \r

-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, \r
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r

 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
 \r
 **/\r
 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
 \r
 **/\r


@@ -41,6 +41,10 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define FORM_FILE_EXPLORER_ID_KEK             0x11\r
 #define FORM_FILE_EXPLORER_ID_DB              0x12\r
 #define FORM_FILE_EXPLORER_ID_DBX             0x13\r
 #define FORM_FILE_EXPLORER_ID_KEK             0x11\r
 #define FORM_FILE_EXPLORER_ID_DB              0x12\r
 #define FORM_FILE_EXPLORER_ID_DBX             0x13\r

+#define FORMID_SECURE_BOOT_DBT_OPTION_FORM    0x14\r
+#define SECUREBOOT_ENROLL_SIGNATURE_TO_DBT    0x15\r
+#define SECUREBOOT_DELETE_SIGNATURE_FROM_DBT  0x16\r
+#define FORM_FILE_EXPLORER_ID_DBT             0x17\r

 \r
 #define SECURE_BOOT_MODE_CUSTOM               0x01\r
 #define SECURE_BOOT_MODE_STANDARD             0x00\r
 \r
 #define SECURE_BOOT_MODE_CUSTOM               0x01\r
 #define SECURE_BOOT_MODE_STANDARD             0x00\r


@@ -56,6 +60,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define KEY_VALUE_SAVE_AND_EXIT_DBX           0x100a\r
 #define KEY_VALUE_NO_SAVE_AND_EXIT_DBX        0x100b\r
 #define KEY_HIDE_SECURE_BOOT                  0x100c\r
 #define KEY_VALUE_SAVE_AND_EXIT_DBX           0x100a\r
 #define KEY_VALUE_NO_SAVE_AND_EXIT_DBX        0x100b\r
 #define KEY_HIDE_SECURE_BOOT                  0x100c\r

+#define KEY_VALUE_SAVE_AND_EXIT_DBT           0x100d\r
+#define KEY_VALUE_NO_SAVE_AND_EXIT_DBT        0x100e\r

 \r
 #define KEY_SECURE_BOOT_OPTION                0x1100\r
 #define KEY_SECURE_BOOT_PK_OPTION             0x1101\r
 \r
 #define KEY_SECURE_BOOT_OPTION                0x1100\r
 #define KEY_SECURE_BOOT_PK_OPTION             0x1101\r


@@ -69,10 +75,13 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define KEY_SECURE_BOOT_KEK_GUID              0x110a\r
 #define KEY_SECURE_BOOT_SIGNATURE_GUID_DB     0x110b\r
 #define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX    0x110c\r
 #define KEY_SECURE_BOOT_KEK_GUID              0x110a\r
 #define KEY_SECURE_BOOT_SIGNATURE_GUID_DB     0x110b\r
 #define KEY_SECURE_BOOT_SIGNATURE_GUID_DBX    0x110c\r

+#define KEY_SECURE_BOOT_DBT_OPTION            0x110d\r
+#define KEY_SECURE_BOOT_SIGNATURE_GUID_DBT    0x110e\r

 \r
 #define LABEL_KEK_DELETE                      0x1200\r
 #define LABEL_DB_DELETE                       0x1201\r
 #define LABEL_DBX_DELETE                      0x1202\r
 \r
 #define LABEL_KEK_DELETE                      0x1200\r
 #define LABEL_DB_DELETE                       0x1201\r
 #define LABEL_DBX_DELETE                      0x1202\r

+#define LABEL_DBT_DELETE                      0x1203\r

 #define LABEL_END                             0xffff\r
 \r
 #define SECURE_BOOT_MAX_ATTEMPTS_NUM          255\r
 #define LABEL_END                             0xffff\r
 \r
 #define SECURE_BOOT_MAX_ATTEMPTS_NUM          255\r


@@ -93,7 +102,12 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 //\r
 // Question ID 0x4000 ~ 0x4FFF is for DBX\r
 //\r
 //\r
 // Question ID 0x4000 ~ 0x4FFF is for DBX\r
 //\r

-#define OPTION_DEL_DBX_QUESTION_ID            0x4000 \r
+#define OPTION_DEL_DBX_QUESTION_ID            0x4000\r
+\r
+//\r
+// Question ID 0x5000 ~ 0x5FFF is for DBT\r
+//\r
+#define OPTION_DEL_DBT_QUESTION_ID            0x5000\r

 \r
 #define FILE_OPTION_GOTO_OFFSET               0xC000\r
 #define FILE_OPTION_OFFSET                    0x8000\r
 \r
 #define FILE_OPTION_GOTO_OFFSET               0xC000\r
 #define FILE_OPTION_OFFSET                    0x8000\r


@@ -102,18 +116,21 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 #define SECURE_BOOT_GUID_SIZE                 36\r
 #define SECURE_BOOT_GUID_STORAGE_SIZE         37\r
 \r
 #define SECURE_BOOT_GUID_SIZE                 36\r
 #define SECURE_BOOT_GUID_STORAGE_SIZE         37\r
 \r

-\r

 //\r
 // Nv Data structure referenced by IFR\r
 //\r
 typedef struct {\r
 //\r
 // Nv Data structure referenced by IFR\r
 //\r
 typedef struct {\r

-  BOOLEAN AttemptSecureBoot;  //Attempt to enable/disable Secure Boot.\r
-  BOOLEAN HideSecureBoot;  //Hiden Attempt Secure Boot\r
+  BOOLEAN AttemptSecureBoot;   // Attempt to enable/disable Secure Boot\r
+  BOOLEAN HideSecureBoot;      // Hiden Attempt Secure Boot\r

   CHAR16  SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE];\r
   CHAR16  SignatureGuid[SECURE_BOOT_GUID_STORAGE_SIZE];\r

-  BOOLEAN PhysicalPresent; //If a Physical Present User;\r
-  UINT8   SecureBootMode;  //Secure Boot Mode: Standard Or Custom\r
-  BOOLEAN DeletePk; \r
-  BOOLEAN HasPk;           //If Pk is existed it is true;\r
+  BOOLEAN PhysicalPresent;     // If a Physical Present User\r
+  UINT8   SecureBootMode;      // Secure Boot Mode: Standard Or Custom\r
+  BOOLEAN DeletePk;\r
+  BOOLEAN HasPk;               // If Pk is existed it is true\r
+  BOOLEAN AlwaysRevocation;    // If the certificate is always revoked. Revocation time is hidden\r
+  UINT8   CertificateFormat;   // The type of the certificate\r
+  EFI_HII_DATE RevocationDate; // The revocation date of the certificate\r
+  EFI_HII_TIME RevocationTime; // The revocation time of the certificate\r

 } SECUREBOOT_CONFIGURATION;\r
 \r
 } SECUREBOOT_CONFIGURATION;\r
 \r

-#endif\r
+#endif
\ No newline at end of file

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni
index 8a4cb36f72d307197e01abfa64c130a1f8bebc59..063a10d44d125cda13a2b62d56dc4cbed528f01c 100644 (file)
Binary files a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni and b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigStrings.uni differ