NetworkPkg: Add WiFi profile sync protocol support

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3845

Enables KVM and One Click Recovery WLAN capability with WiFi Profile
Sync feature and protocol. Adding WiFiProfileSyncProtocol, which
supports the profilesync driver operations for transferring WiFi profiles
from AMT to the Supplicant. WiFiConnectionManager will check for the
WifiProfileSyncProtocol and if found will operate on the premise of a
One Click Recovery, or KVM flow with a Wifi profile provided by AMT.

Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Cc: Wu Jiaxin <jiaxin.wu@intel.com>
Cc: Andrei Otcheretianski <andrei.otcheretianski@intel.com>

Signed-off-by: Zachary Clark-Williams <zachary.clark-williams@intel.com>
Acked-by: Michael D Kinney <michael.d.kinney@intel.com>
Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>

6 files changed, 294 insertions, 73 deletions

diff --git a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionManagerDxe.inf b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionManagerDxe.inf
index 4394b6f4bb..47901d75ab 100644
--- a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionManagerDxe.inf
+++ b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionManagerDxe.inf
@@ -9,7 +9,7 @@
 #  2). WPA2 Personal Network

 #  3). EAP Networks (EAP-TLS, EAP-TTLS/MSCHAPv2 and PEAPv0/MSCHAPv2)

 #

-#  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>

+#  Copyright (c) 2019 - 2022, Intel Corporation. All rights reserved.<BR>

 #

 #  SPDX-License-Identifier: BSD-2-Clause-Patent

 #

@@ -71,6 +71,7 @@
   gEfiAdapterInformationProtocolGuid            ## SOMETIMES_CONSUMES

   gEfiSupplicantProtocolGuid                    ## SOMETIMES_CONSUMES

   gEfiEapConfigurationProtocolGuid              ## SOMETIMES_CONSUMES

+  gEdkiiWiFiProfileSyncProtocolGuid             ## SOMETIMES_CONSUMES

 

 [Guids]

   gWifiConfigGuid                               ## PRODUCES  ## GUID

diff --git a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrConfigNVDataStruct.h b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrConfigNVDataStruct.h
index b5518a74d8..dcc4bf7e27 100644
--- a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrConfigNVDataStruct.h
+++ b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrConfigNVDataStruct.h
@@ -25,7 +25,7 @@
 

 #define PASSWORD_MIN_LEN       8

 #define PASSWORD_MAX_LEN       63

-#define PASSWORD_STORAGE_SIZE  64

+#define PASSWORD_STORAGE_SIZE  65

 

 #define EAP_IDENTITY_LEN   63

 #define EAP_IDENTITY_SIZE  64

diff --git a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrDriver.c b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrDriver.c
index 67a01ca058..36c467025f 100644
--- a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrDriver.c
+++ b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrDriver.c
@@ -1,7 +1,7 @@
 /** @file

   The driver binding protocol for the WiFi Connection Manager.

 

-  Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>

+  Copyright (c) 2019 - 2022, Intel Corporation. All rights reserved.<BR>

 

   SPDX-License-Identifier: BSD-2-Clause-Patent

 

@@ -39,6 +39,11 @@ EFI_GUID  mWifiConfigNetworkListRefreshGuid = WIFI_CONFIG_NETWORK_LIST_REFRESH_G
 EFI_GUID  mWifiConfigConnectFormRefreshGuid = WIFI_CONFIG_CONNECT_FORM_REFRESH_GUID;

 EFI_GUID  mWifiConfigMainFormRefreshGuid    = WIFI_CONFIG_MAIN_FORM_REFRESH_GUID;

 

+//

+// Wifi connection attempt counter for retries

+//

+extern UINT8  mWifiConnectionCount;

+

 /**

   Tests to see if this driver supports a given controller. If a child device is provided,

   it further tests to see if this driver supports creating a handle for the specified child device.

@@ -167,8 +172,10 @@ WifiMgrDxeDriverBindingStart (
   EFI_WIRELESS_MAC_CONNECTION_II_PROTOCOL  *Wmp;

   EFI_SUPPLICANT_PROTOCOL                  *Supplicant;

   EFI_EAP_CONFIGURATION_PROTOCOL           *EapConfig;

+  EDKII_WIFI_PROFILE_SYNC_PROTOCOL         *WiFiProfileSyncProtocol;

 

-  Nic = NULL;

+  mWifiConnectionCount = 0;

+  Nic                  = NULL;

 

   //

   // Open Protocols

@@ -236,47 +243,73 @@ WifiMgrDxeDriverBindingStart (
   InitializeListHead (&Nic->ProfileList);

 

   //

-  // Record the MAC address of the incoming NIC.

+  // WiFi profile sync protocol installation check for OS recovery flow.

   //

-  Status = NetLibGetMacAddress (

-             ControllerHandle,

-             (EFI_MAC_ADDRESS *)&Nic->MacAddress,

-             &AddressSize

-             );

-  if (EFI_ERROR (Status)) {

-    goto ERROR2;

-  }

-

-  //

-  // Create and start the timer for the status check

-  //

-  Status = gBS->CreateEvent (

-                  EVT_NOTIFY_SIGNAL | EVT_TIMER,

-                  TPL_CALLBACK,

-                  WifiMgrOnTimerTick,

-                  Nic,

-                  &Nic->TickTimer

+  Status = gBS->LocateProtocol (

+                  &gEdkiiWiFiProfileSyncProtocolGuid,

+                  NULL,

+                  (VOID **)&WiFiProfileSyncProtocol

                   );

-  if (EFI_ERROR (Status)) {

-    goto ERROR2;

-  }

+  if (!EFI_ERROR (Status)) {

+    Nic->ConnectPendingNetwork = (WIFI_MGR_NETWORK_PROFILE *)AllocateZeroPool (sizeof (WIFI_MGR_NETWORK_PROFILE));

+    if (Nic->ConnectPendingNetwork == NULL) {

+      Status = EFI_OUT_OF_RESOURCES;

+      goto ERROR1;

+    }

 

-  Status = gBS->SetTimer (Nic->TickTimer, TimerPeriodic, EFI_TIMER_PERIOD_MILLISECONDS (500));

-  if (EFI_ERROR (Status)) {

-    goto ERROR3;

-  }

+    WiFiProfileSyncProtocol->GetProfile (Nic->ConnectPendingNetwork, Nic->MacAddress);

+    if (Nic->ConnectPendingNetwork != NULL) {

+      Status = WifiMgrConnectToNetwork (Nic, Nic->ConnectPendingNetwork);

+      if (!EFI_ERROR (Status)) {

+        goto ERROR1;

+      }

+

+      WiFiProfileSyncProtocol->SetConnectState (Status);

+    }

+  } else {

+    //

+    // Record the MAC address of the incoming NIC.

+    //

+    Status = NetLibGetMacAddress (

+               ControllerHandle,

+               (EFI_MAC_ADDRESS *)&Nic->MacAddress,

+               &AddressSize

+               );

+    if (EFI_ERROR (Status)) {

+      goto ERROR2;

+    }

 

-  Nic->ConnectState = WifiMgrDisconnected;

-  Nic->ScanState    = WifiMgrScanFinished;

+    //

+    // Create and start the timer for the status check

+    //

+    Status = gBS->CreateEvent (

+                    EVT_NOTIFY_SIGNAL | EVT_TIMER,

+                    TPL_CALLBACK,

+                    WifiMgrOnTimerTick,

+                    Nic,

+                    &Nic->TickTimer

+                    );

+    if (EFI_ERROR (Status)) {

+      goto ERROR2;

+    }

 

-  OldTpl = gBS->RaiseTPL (TPL_CALLBACK);

-  InsertTailList (&mPrivate->NicList, &Nic->Link);

-  Nic->NicIndex = mPrivate->NicCount++;

-  if (mPrivate->CurrentNic == NULL) {

-    mPrivate->CurrentNic = Nic;

-  }

+    Status = gBS->SetTimer (Nic->TickTimer, TimerPeriodic, EFI_TIMER_PERIOD_MILLISECONDS (500));

+    if (EFI_ERROR (Status)) {

+      goto ERROR3;

+    }

 

-  gBS->RestoreTPL (OldTpl);

+    Nic->ConnectState = WifiMgrDisconnected;

+    Nic->ScanState    = WifiMgrScanFinished;

+

+    OldTpl = gBS->RaiseTPL (TPL_CALLBACK);

+    InsertTailList (&mPrivate->NicList, &Nic->Link);

+    Nic->NicIndex = mPrivate->NicCount++;

+    if (mPrivate->CurrentNic == NULL) {

+      mPrivate->CurrentNic = Nic;

+    }

+

+    gBS->RestoreTPL (OldTpl);

+  }

 

   Status = gBS->InstallProtocolInterface (

                   &ControllerHandle,

@@ -385,10 +418,11 @@ WifiMgrDxeDriverBindingStop (
   IN EFI_HANDLE                   *ChildHandleBuffer OPTIONAL

   )

 {

-  EFI_STATUS                 Status;

-  EFI_TPL                    OldTpl;

-  WIFI_MGR_PRIVATE_PROTOCOL  *WifiMgrIdentifier;

-  WIFI_MGR_DEVICE_DATA       *Nic;

+  EFI_STATUS                        Status;

+  EFI_TPL                           OldTpl;

+  WIFI_MGR_PRIVATE_PROTOCOL         *WifiMgrIdentifier;

+  WIFI_MGR_DEVICE_DATA              *Nic;

+  EDKII_WIFI_PROFILE_SYNC_PROTOCOL  *WiFiProfileSyncProtocol;

 

   Status = gBS->OpenProtocol (

                   ControllerHandle,

@@ -481,7 +515,15 @@ WifiMgrDxeDriverBindingStop (
   //

   OldTpl = gBS->RaiseTPL (TPL_CALLBACK);

 

-  RemoveEntryList (&Nic->Link);

+  Status = gBS->LocateProtocol (

+                  &gEdkiiWiFiProfileSyncProtocolGuid,

+                  NULL,

+                  (VOID **)&WiFiProfileSyncProtocol

+                  );

+  if (EFI_ERROR (Status)) {

+    RemoveEntryList (&Nic->Link);

+  }

+

   mPrivate->NicCount--;

   if (mPrivate->CurrentNic == Nic) {

     mPrivate->CurrentNic = NULL;

diff --git a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrDxe.h b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrDxe.h
index 7b2e41e155..047f85dbc2 100644
--- a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrDxe.h
+++ b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrDxe.h
@@ -47,6 +47,7 @@
 #include <Protocol/SimpleNetwork.h>

 #include <Protocol/SimpleFileSystem.h>

 #include <Protocol/EapConfiguration.h>

+#include <Protocol/WiFiProfileSyncProtocol.h>

 

 //

 // Produced Protocols

@@ -73,7 +74,8 @@
 //

 #define WIFI_MGR_DXE_VERSION  0xb

 

-#define OUI_IEEE_80211I  0xAC0F00

+#define OUI_IEEE_80211I              0xAC0F00

+#define MAX_WIFI_CONNETION_ATTEMPTS  3

 

 typedef enum {

   Ieee80211PairwiseCipherSuiteUseGroupCipherSuite = 0,

diff --git a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrImpl.c b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrImpl.c
index 59bac48c42..2e596c1981 100644
--- a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrImpl.c
+++ b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrImpl.c
@@ -19,6 +19,8 @@ EFI_EAP_TYPE  mEapSecondAuthMethod[] = {
   EFI_EAP_TYPE_MSCHAPV2

 };

 

+UINT8  mWifiConnectionCount = 0;

+

 /**

   The callback function for scan operation. This function updates networks

   according to the latest scan result, and trigger UI refresh.

@@ -424,18 +426,26 @@ WifiMgrConfigPassword (
     return EFI_NOT_FOUND;

   }

 

-  AsciiPassword = AllocateZeroPool ((StrLen (Profile->Password) + 1) * sizeof (UINT8));

+  if (StrLen (Profile->Password) >= PASSWORD_STORAGE_SIZE) {

+    ASSERT (EFI_INVALID_PARAMETER);

+    return EFI_INVALID_PARAMETER;

+  }

+

+  AsciiPassword = AllocateZeroPool ((StrLen (Profile->Password) + 1) * sizeof (CHAR8));

   if (AsciiPassword == NULL) {

     return EFI_OUT_OF_RESOURCES;

   }

 

-  UnicodeStrToAsciiStrS (Profile->Password, (CHAR8 *)AsciiPassword, PASSWORD_STORAGE_SIZE);

-  Status = Supplicant->SetData (

-                         Supplicant,

-                         EfiSupplicant80211PskPassword,

-                         AsciiPassword,

-                         (StrLen (Profile->Password) + 1) * sizeof (UINT8)

-                         );

+  Status = UnicodeStrToAsciiStrS (Profile->Password, (CHAR8 *)AsciiPassword, (StrLen (Profile->Password) + 1));

+  if (!EFI_ERROR (Status)) {

+    Status = Supplicant->SetData (

+                           Supplicant,

+                           EfiSupplicant80211PskPassword,

+                           AsciiPassword,

+                           (StrLen (Profile->Password) + 1) * sizeof (CHAR8)

+                           );

+  }

+

   ZeroMem (AsciiPassword, AsciiStrLen ((CHAR8 *)AsciiPassword) + 1);

   FreePool (AsciiPassword);

 

@@ -465,19 +475,20 @@ WifiMgrConfigEap (
   IN    WIFI_MGR_NETWORK_PROFILE  *Profile

   )

 {

-  EFI_STATUS                      Status;

-  EFI_EAP_CONFIGURATION_PROTOCOL  *EapConfig;

-  EFI_EAP_TYPE                    EapAuthMethod;

-  EFI_EAP_TYPE                    EapSecondAuthMethod;

-  EFI_EAP_TYPE                    *AuthMethodList;

-  CHAR8                           *Identity;

-  UINTN                           IdentitySize;

-  CHAR16                          *Password;

-  UINTN                           PasswordSize;

-  UINTN                           EncryptPasswordLen;

-  CHAR8                           *AsciiEncryptPassword;

-  UINTN                           AuthMethodListSize;

-  UINTN                           Index;

+  EFI_STATUS                        Status;

+  EDKII_WIFI_PROFILE_SYNC_PROTOCOL  *WiFiProfileSyncProtocol;

+  EFI_EAP_CONFIGURATION_PROTOCOL    *EapConfig;

+  EFI_EAP_TYPE                      EapAuthMethod;

+  EFI_EAP_TYPE                      EapSecondAuthMethod;

+  EFI_EAP_TYPE                      *AuthMethodList;

+  CHAR8                             *Identity;

+  UINTN                             IdentitySize;

+  CHAR16                            *Password;

+  UINTN                             PasswordSize;

+  UINTN                             EncryptPasswordLen;

+  CHAR8                             *AsciiEncryptPassword;

+  UINTN                             AuthMethodListSize;

+  UINTN                             Index;

 

   if ((Nic == NULL) || (Nic->EapConfig == NULL) || (Profile == NULL)) {

     return EFI_INVALID_PARAMETER;

@@ -567,7 +578,13 @@ WifiMgrConfigEap (
       return EFI_OUT_OF_RESOURCES;

     }

 

-    UnicodeStrToAsciiStrS (Profile->EapIdentity, Identity, IdentitySize);

+    Status = gBS->LocateProtocol (&gEdkiiWiFiProfileSyncProtocolGuid, NULL, (VOID **)&WiFiProfileSyncProtocol);

+    if (!EFI_ERROR (Status)) {

+      CopyMem (Identity, &Profile->EapIdentity, IdentitySize);

+    } else {

+      UnicodeStrToAsciiStrS (Profile->EapIdentity, Identity, IdentitySize);

+    }

+

     Status = EapConfig->SetData (

                           EapConfig,

                           EFI_EAP_TYPE_IDENTITY,

@@ -893,6 +910,133 @@ WifiMgrPrepareConnection (
 }

 

 /**

+  Will reset NiC data, get profile from profile sync driver, and send for

+  another connection attempt.This function should not be called more than

+  3 times.

+

+  @param[in]  WiFiProfileSyncProtocol  The target network profile to connect.

+

+  @retval EFI_SUCCESS                  The operation is completed.

+  @retval other                        Operation failure.

+

+**/

+EFI_STATUS

+ConnectionRetry (

+  IN   EDKII_WIFI_PROFILE_SYNC_PROTOCOL  *WiFiProfileSyncProtocol

+  )

+{

+  EFI_STATUS                               Status;

+  WIFI_MGR_DEVICE_DATA                     *Nic;

+  EFI_WIRELESS_MAC_CONNECTION_II_PROTOCOL  *Wmp;

+  EFI_SUPPLICANT_PROTOCOL                  *Supplicant;

+  EFI_EAP_CONFIGURATION_PROTOCOL           *EapConfig;

+

+  Nic = NULL;

+

+  Status = gBS->LocateProtocol (

+                  &gEfiWiFi2ProtocolGuid,

+                  NULL,

+                  (VOID **)&Wmp

+                  );

+  if (EFI_ERROR (Status)) {

+    return Status;

+  }

+

+  Status = gBS->LocateProtocol (

+                  &gEfiSupplicantProtocolGuid,

+                  NULL,

+                  (VOID **)&Supplicant

+                  );

+  if (EFI_ERROR (Status)) {

+    Supplicant = NULL;

+  }

+

+  Status = gBS->LocateProtocol (

+                  &gEfiEapConfigurationProtocolGuid,

+                  NULL,

+                  (VOID **)&EapConfig

+                  );

+  if (EFI_ERROR (Status)) {

+    EapConfig = NULL;

+  }

+

+  //

+  // Initialize Nic device data

+  //

+  Nic = AllocateZeroPool (sizeof (WIFI_MGR_DEVICE_DATA));

+  if (Nic == NULL) {

+    Status = EFI_OUT_OF_RESOURCES;

+    return Status;

+  }

+

+  Nic->Signature           = WIFI_MGR_DEVICE_DATA_SIGNATURE;

+  Nic->Private             = mPrivate;

+  Nic->Wmp                 = Wmp;

+  Nic->Supplicant          = Supplicant;

+  Nic->EapConfig           = EapConfig;

+  Nic->UserSelectedProfile = NULL;

+  Nic->OneTimeScanRequest  = FALSE;

+

+  if (Nic->Supplicant != NULL) {

+    Status = WifiMgrGetSupportedSuites (Nic);

+  }

+

+  if (!EFI_ERROR (Status)) {

+    InitializeListHead (&Nic->ProfileList);

+

+    Nic->ConnectPendingNetwork = (WIFI_MGR_NETWORK_PROFILE *)AllocateZeroPool (sizeof (WIFI_MGR_NETWORK_PROFILE));

+    if (Nic->ConnectPendingNetwork == NULL) {

+      Status = EFI_OUT_OF_RESOURCES;

+      DEBUG ((DEBUG_ERROR, "[WiFi Connection Manager] Failed to allocate memory for ConnectPendingNetwork\n"));

+      goto ERROR;

+    }

+

+    Status = WiFiProfileSyncProtocol->GetProfile (Nic->ConnectPendingNetwork, Nic->MacAddress);

+    if (!EFI_ERROR (Status) && (Nic->ConnectPendingNetwork != NULL)) {

+      Status = WifiMgrConnectToNetwork (Nic, Nic->ConnectPendingNetwork);

+      if (!EFI_ERROR (Status)) {

+        return Status;

+      }

+    } else {

+      DEBUG ((DEBUG_ERROR, "[WiFi Connection Manager] Failed to get WiFi profile with status %r\n", Status));

+    }

+  } else {

+    DEBUG ((DEBUG_ERROR, "[WiFi Connection Manager] Failed to get Supported suites with status %r\n", Status));

+  }

+

+  if (Nic->ConnectPendingNetwork != NULL) {

+    if (Nic->ConnectPendingNetwork->Network.AKMSuite != NULL) {

+      FreePool (Nic->ConnectPendingNetwork->Network.AKMSuite);

+    }

+

+    if (Nic->ConnectPendingNetwork->Network.CipherSuite != NULL) {

+      FreePool (Nic->ConnectPendingNetwork->Network.CipherSuite);

+    }

+

+    FreePool (Nic->ConnectPendingNetwork);

+  }

+

+ERROR:

+  if (Nic->Supplicant != NULL) {

+    if (Nic->SupportedSuites.SupportedAKMSuites != NULL) {

+      FreePool (Nic->SupportedSuites.SupportedAKMSuites);

+    }

+

+    if (Nic->SupportedSuites.SupportedSwCipherSuites != NULL) {

+      FreePool (Nic->SupportedSuites.SupportedSwCipherSuites);

+    }

+

+    if (Nic->SupportedSuites.SupportedHwCipherSuites != NULL) {

+      FreePool (Nic->SupportedSuites.SupportedHwCipherSuites);

+    }

+  }

+

+  FreePool (Nic);

+

+  return Status;

+}

+

+/**

   The callback function for connect operation.

 

   ASSERT when errors occur in config token.

@@ -908,12 +1052,13 @@ WifiMgrOnConnectFinished (
   IN  VOID       *Context

   )

 {

-  EFI_STATUS                 Status;

-  WIFI_MGR_MAC_CONFIG_TOKEN  *ConfigToken;

-  WIFI_MGR_NETWORK_PROFILE   *ConnectedProfile;

-  UINT8                      SecurityType;

-  UINT8                      SSIdLen;

-  CHAR8                      *AsciiSSId;

+  EFI_STATUS                        Status;

+  WIFI_MGR_MAC_CONFIG_TOKEN         *ConfigToken;

+  WIFI_MGR_NETWORK_PROFILE          *ConnectedProfile;

+  UINT8                             SecurityType;

+  UINT8                             SSIdLen;

+  CHAR8                             *AsciiSSId;

+  EDKII_WIFI_PROFILE_SYNC_PROTOCOL  *WiFiProfileSyncProtocol;

 

   ASSERT (Context != NULL);

 

@@ -925,6 +1070,24 @@ WifiMgrOnConnectFinished (
   ASSERT (ConfigToken->Type == TokenTypeConnectNetworkToken);

 

   ASSERT (ConfigToken->Token.ConnectNetworkToken != NULL);

+

+  Status = gBS->LocateProtocol (&gEdkiiWiFiProfileSyncProtocolGuid, NULL, (VOID **)&WiFiProfileSyncProtocol);

+  if (!EFI_ERROR (Status)) {

+    WiFiProfileSyncProtocol->SetConnectState (ConfigToken->Token.ConnectNetworkToken->ResultCode);

+    if ((mWifiConnectionCount < MAX_WIFI_CONNETION_ATTEMPTS) &&

+        (ConfigToken->Token.ConnectNetworkToken->ResultCode != ConnectSuccess))

+    {

+      mWifiConnectionCount++;

+      gBS->CloseEvent (Event);

+      Status = ConnectionRetry (WiFiProfileSyncProtocol);

+      if (!EFI_ERROR (Status)) {

+        return;

+      }

+

+      WiFiProfileSyncProtocol->SetConnectState (Status);

+    }

+  }

+

   if (ConfigToken->Token.ConnectNetworkToken->Status != EFI_SUCCESS) {

     if (ConfigToken->Nic->OneTimeConnectRequest) {

       //

diff --git a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrMisc.c b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrMisc.c
index 4ad5643c24..154f2968c7 100644
--- a/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrMisc.c
+++ b/NetworkPkg/WifiConnectionManagerDxe/WifiConnectionMgrMisc.c
@@ -672,10 +672,23 @@ WifiMgrCleanProfileSecrets (
   IN  WIFI_MGR_NETWORK_PROFILE  *Profile

   )

 {

+  EFI_STATUS                        Status;

+  EDKII_WIFI_PROFILE_SYNC_PROTOCOL  *WiFiProfileSyncProtocol;

+

   ZeroMem (Profile->Password, sizeof (CHAR16) * PASSWORD_STORAGE_SIZE);

   ZeroMem (Profile->EapPassword, sizeof (CHAR16) * PASSWORD_STORAGE_SIZE);

   ZeroMem (Profile->PrivateKeyPassword, sizeof (CHAR16) * PASSWORD_STORAGE_SIZE);

 

+  //

+  //  When EFI WiFi profile sync protocol is found the system is performing a recovery boot in secure

+  //  boot mode. The profile sync driver will manage the CA certificate, client certificate, and key

+  //  data, cleaning them at exit boot services.

+  //

+  Status = gBS->LocateProtocol (&gEdkiiWiFiProfileSyncProtocolGuid, NULL, (VOID **)&WiFiProfileSyncProtocol);

+  if (!EFI_ERROR (Status)) {

+    return;

+  }

+

   if (Profile->CACertData != NULL) {

     ZeroMem (Profile->CACertData, Profile->CACertSize);

     FreePool (Profile->CACertData);