UefiPayloadPkg/Library/PlatformBootManagerLib: Check vboot flags befo…

…re showing popup Also make the popup wording less alarming and more informative. Signed-off-by: Michał Kopeć <[email protected]>
Dasharo · Feb 29, 2024 · 335fd1d · 335fd1d
1 parent c911e95
commit 335fd1d
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 9 deletions.
diff --git a/UefiPayloadPkg/Include/Coreboot.h b/UefiPayloadPkg/Include/Coreboot.h
@@ -774,7 +774,7 @@ enum vb2_context_flags {
 	 * support two RW slots.
 	 */
 	VB2_CONTEXT_SLOT_A_ONLY = (1 << 29),
-}
+};
 
 /* MAX_SIZE should not be changed without bumping up DATA_VERSION_MAJOR. */
 #define VB2_CONTEXT_MAX_SIZE 384

diff --git a/UefiPayloadPkg/Include/Library/BlParseLib.h b/UefiPayloadPkg/Include/Library/BlParseLib.h
@@ -18,6 +18,7 @@
 #include <Guid/SmmStoreInfoGuid.h>
 #include <Guid/TcgPhysicalPresenceGuid.h>
 #include <Ppi/SecPerformance.h>
+#include <Coreboot.h>
 
 #ifndef __BOOTLOADER_PARSE_LIB__
 #define __BOOTLOADER_PARSE_LIB__

diff --git a/UefiPayloadPkg/Library/PlatformBootManagerLib/PlatformBootManager.c b/UefiPayloadPkg/Library/PlatformBootManagerLib/PlatformBootManager.c
@@ -792,10 +792,13 @@ WarnIfRecoveryBoot (
   BOOLEAN        CursorVisible;
   UINTN          CurrentAttribute;
   UINTN          SecondsLeft;
+  UINT32         VbootFlags;
 
-  RetStatus = ParseVBootWorkbuf (&RecoveryCode, &RecoveryReason);
+  RetStatus = ParseVBootWorkbuf (&VbootFlags, &RecoveryCode, &RecoveryReason);
 
-  if (RetStatus != RETURN_SUCCESS || RecoveryCode == 0) {
+  if (RetStatus != RETURN_SUCCESS
+        || !(VbootFlags & VB2_CONTEXT_RECOVERY_MODE)
+        || RecoveryCode == 0) {
     return;
   }
 
@@ -844,13 +847,16 @@ WarnIfRecoveryBoot (
 
     CreateMultiStringPopUp (
         78,
-        12,
+        15,
         L"!!! WARNING !!!",
         L"",
-        L"This message is displayed because the platform has booted from the recovery",
-        L"firmware partition. If you have just updated firmware, it is likely that",
-        L"the signature verification process failed. Please verify again that the",
-        L"firmware was downloaded from the proper source and try updating again.",
+        L"Recovery boot mode is active."
+        L"",
+        L"If you just updated your firmware, this may mean the update did not install",
+        L"correctly. Check docs.dasharo.com for up-to-date firmware update",
+        L"instructions.",
+        L"If this message persists after a re-boot, or you did not just update your",
+        L"firmware, this may indicate attempted tampering.",
         L"",
         RecoveryCodeLine,
         RecoveryMsgLine,
@@ -1403,7 +1409,7 @@ SaveSmBiosFieldToEfiVar (
   if (EFI_ERROR (Status)) {
     NeedUpdate = TRUE;
   } else {
-    if (CurrentSize != FieldSize) 
+    if (CurrentSize != FieldSize)
       NeedUpdate = TRUE;
     else if (CompareMem (CurrentValue, FieldValue, FieldSize) != 0)
       NeedUpdate = TRUE;