Reset the platform when user choose to enroll/delete the PK variable.

[mirror_edk2.git] / SecurityPkg / VariableAuthenticated / SecureBootConfigDxe / SecureBootConfigImpl.c

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
index 0dc9c2b22d5c98dec7afa5024dd901d48a9baa24..a680473a7d49109e8dc10d23fee0900964483c12 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
@@ -1016,7 +1016,21 @@ HashPeImage (
   // Measuring PE/COFF Image Header;\r
   // But CheckSum field and SECURITY data directory (certificate) are excluded\r
   //\r
-  Magic = mNtHeader.Pe32->OptionalHeader.Magic;\r
+  if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\r
+    //\r
+    // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value \r
+    //       in the PE/COFF Header. If the MachineType is Itanium(IA64) and the \r
+    //       Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC\r
+    //       then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC\r
+    //\r
+    Magic = EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC;\r
+  } else {\r
+    //\r
+    // Get the magic value from the PE/COFF Optional Header\r
+    //\r
+    Magic = mNtHeader.Pe32->OptionalHeader.Magic;\r
+  }\r
+  \r
   //\r
   // 3.  Calculate the distance from the base of the image header to the image checksum address.\r
   // 4.  Hash the image header from its base to beginning of the image checksum.\r
@@ -2055,27 +2069,25 @@ SecureBootExtractConfigFromVariable (
 {\r
   UINT8   *SecureBootEnable;\r
   UINT8   *SetupMode;\r
+  UINT8   *SecureBoot;\r
   UINT8   *SecureBootMode;\r
 \r
   SecureBootEnable = NULL;\r
   SetupMode        = NULL;\r
+  SecureBoot       = NULL;\r
   SecureBootMode   = NULL;\r
   \r
-  //\r
-  // Get the SecureBootEnable Variable\r
-  //\r
-  GetVariable2 (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &SecureBootEnable, NULL);\r
-\r
   //\r
   // If the SecureBootEnable Variable doesn't exist, hide the SecureBoot Enable/Disable\r
   // Checkbox.\r
   //\r
+  GetVariable2 (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, (VOID**)&SecureBootEnable, NULL);\r
   if (SecureBootEnable == NULL) {\r
     ConfigData->HideSecureBoot = TRUE;\r
   } else {\r
     ConfigData->HideSecureBoot = FALSE;\r
-    ConfigData->SecureBootState = *SecureBootEnable;\r
   }\r
+  \r
   //\r
   // If it is Physical Presence User, set the PhysicalPresent to true.\r
   //\r
@@ -2088,17 +2100,27 @@ SecureBootExtractConfigFromVariable (
   //\r
   // If there is no PK then the Delete Pk button will be gray.\r
   //\r
-  GetVariable2 (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &SetupMode, NULL);\r
-  if (SetupMode == NULL || (*SetupMode) == 1) {\r
+  GetVariable2 (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&SetupMode, NULL);\r
+  if (SetupMode == NULL || (*SetupMode) == SETUP_MODE) {\r
     ConfigData->HasPk = FALSE;\r
   } else  {\r
     ConfigData->HasPk = TRUE;\r
   }\r
+  \r
+  //\r
+  // If the value of SecureBoot variable is 1, the platform is operating in secure boot mode.\r
+  //\r
+  GetVariable2 (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&SecureBoot, NULL);\r
+  if (SecureBoot != NULL && *SecureBoot == SECURE_BOOT_MODE_ENABLE) {\r
+    ConfigData->SecureBootState = TRUE;\r
+  } else {\r
+    ConfigData->SecureBootState = FALSE;\r
+  }\r
 \r
   //\r
   // Get the SecureBootMode from CustomMode variable.\r
   //\r
-  GetVariable2 (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &SecureBootMode, NULL);\r
+  GetVariable2 (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, (VOID**)&SecureBootMode, NULL);\r
   if (SecureBootMode == NULL) {\r
     ConfigData->SecureBootMode = STANDARD_SECURE_BOOT_MODE;\r
   } else {\r
@@ -2329,7 +2351,7 @@ SecureBootCallback (
 \r
     switch (QuestionId) {\r
     case KEY_SECURE_BOOT_ENABLE:\r
-      GetVariable2 (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &SecureBootEnable, NULL);\r
+      GetVariable2 (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, (VOID**)&SecureBootEnable, NULL);\r
       if (NULL != SecureBootEnable) {\r
         if (EFI_ERROR (SaveSecureBootVariable (Value->u8))) {\r
           CreatePopUp (\r
@@ -2495,7 +2517,7 @@ SecureBootCallback (
           NULL\r
           );\r
       } else {\r
-        *ActionRequest = EFI_BROWSER_ACTION_REQUEST_EXIT; \r
+        *ActionRequest = EFI_BROWSER_ACTION_REQUEST_RESET; \r
       }        \r
       break;\r
 \r
@@ -2517,7 +2539,7 @@ SecureBootCallback (
       break;\r
       \r
     case KEY_SECURE_BOOT_MODE:\r
-      GetVariable2 (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &SecureBootEnable, NULL);\r
+      GetVariable2 (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, (VOID**)&SecureBootEnable, NULL);\r
       if (NULL != SecureBootEnable) {\r
         Status = gRT->SetVariable (                          \r
                         EFI_CUSTOM_MODE_NAME,\r