* [PATCH 1/1] SecurityPkg: Fix SecureBootDefaultKeysDxe failed to start
@ 2021-09-27 7:46 Nhi Pham
2021-09-29 8:36 ` [edk2-devel] " Grzegorz Bernacki
0 siblings, 1 reply; 4+ messages in thread
From: Nhi Pham @ 2021-09-27 7:46 UTC (permalink / raw)
To: devel; +Cc: patches, Nhi Pham, Jiewen Yao, Jian J Wang, Grzegorz Bernacki
The dbt and dbx keys are optional, the driver entry should return
EFI_SUCCESS to start if they are not found in the firmware flash. This
patch is to fix it and update the description of retval as well.
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Grzegorz Bernacki <gjb@semihalf.com>
Signed-off-by: Nhi Pham <nhi@os.amperecomputing.com>
---
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c | 21 +++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c
index f51d5243b7e8..10bdb1b58e6f 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c
+++ b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c
@@ -3,6 +3,7 @@
Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
Copyright (c) 2021, Semihalf All rights reserved.<BR>
+Copyright (c) 2021, Ampere Computing LLC. All rights reserved.<BR>
SPDX-License-Identifier: BSD-2-Clause-Patent
**/
@@ -23,10 +24,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
@param[in] ImageHandle The image handle of the driver.
@param[in] SystemTable The system table.
- @retval EFI_ALREADY_STARTED The driver already exists in system.
- @retval EFI_OUT_OF_RESOURCES Fail to execute entry point due to lack of resources.
- @retval EFI_SUCCESS All the related protocols are installed on the driver.
- @retval Others Fail to get the SecureBootEnable variable.
+ @retval EFI_SUCCESS The secure default keys are initialized successfully.
+ @retval EFI_UNSUPPORTED One of the secure default keys already exists.
+ @retval EFI_NOT_FOUND One of the PK, KEK, or DB default keys is not found.
+ @retval Others Fail to initialize the secure default keys.
**/
EFI_STATUS
@@ -56,14 +57,20 @@ SecureBootDefaultKeysEntryPoint (
}
Status = SecureBootInitDbtDefault ();
- if (EFI_ERROR (Status)) {
+ if (Status == EFI_NOT_FOUND) {
DEBUG ((DEBUG_INFO, "%a: dbtDefault not initialized\n", __FUNCTION__));
+ } else if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "%a: Cannot initialize dbtDefault: %r\n", __FUNCTION__, Status));
+ return Status;
}
Status = SecureBootInitDbxDefault ();
- if (EFI_ERROR (Status)) {
+ if (Status == EFI_NOT_FOUND) {
DEBUG ((DEBUG_INFO, "%a: dbxDefault not initialized\n", __FUNCTION__));
+ } else if (EFI_ERROR (Status)) {
+ DEBUG ((DEBUG_ERROR, "%a: Cannot initialize dbxDefault: %r\n", __FUNCTION__, Status));
+ return Status;
}
- return Status;
+ return EFI_SUCCESS;
}
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [edk2-devel] [PATCH 1/1] SecurityPkg: Fix SecureBootDefaultKeysDxe failed to start
2021-09-27 7:46 [PATCH 1/1] SecurityPkg: Fix SecureBootDefaultKeysDxe failed to start Nhi Pham
@ 2021-09-29 8:36 ` Grzegorz Bernacki
2021-09-30 14:32 ` Yao, Jiewen
[not found] ` <16A9A01413E21ADC.4587@groups.io>
0 siblings, 2 replies; 4+ messages in thread
From: Grzegorz Bernacki @ 2021-09-29 8:36 UTC (permalink / raw)
To: edk2-devel-groups-io, nhi; +Cc: patches, Jiewen Yao, Jian J Wang
Hi,
Looks good to me...
Reviewed-by: Grzegorz Bernacki <gjb@semihalf.com>
pon., 27 wrz 2021 o 09:48 Nhi Pham via groups.io
<nhi=os.amperecomputing.com@groups.io> napisał(a):
>
> The dbt and dbx keys are optional, the driver entry should return
> EFI_SUCCESS to start if they are not found in the firmware flash. This
> patch is to fix it and update the description of retval as well.
>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Grzegorz Bernacki <gjb@semihalf.com>
> Signed-off-by: Nhi Pham <nhi@os.amperecomputing.com>
> ---
> SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c | 21 +++++++++++++-------
> 1 file changed, 14 insertions(+), 7 deletions(-)
>
> diff --git a/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c
> index f51d5243b7e8..10bdb1b58e6f 100644
> --- a/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c
> +++ b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c
> @@ -3,6 +3,7 @@
>
> Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
> Copyright (c) 2021, Semihalf All rights reserved.<BR>
> +Copyright (c) 2021, Ampere Computing LLC. All rights reserved.<BR>
> SPDX-License-Identifier: BSD-2-Clause-Patent
>
> **/
> @@ -23,10 +24,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> @param[in] ImageHandle The image handle of the driver.
> @param[in] SystemTable The system table.
>
> - @retval EFI_ALREADY_STARTED The driver already exists in system.
> - @retval EFI_OUT_OF_RESOURCES Fail to execute entry point due to lack of resources.
> - @retval EFI_SUCCESS All the related protocols are installed on the driver.
> - @retval Others Fail to get the SecureBootEnable variable.
> + @retval EFI_SUCCESS The secure default keys are initialized successfully.
> + @retval EFI_UNSUPPORTED One of the secure default keys already exists.
> + @retval EFI_NOT_FOUND One of the PK, KEK, or DB default keys is not found.
> + @retval Others Fail to initialize the secure default keys.
>
> **/
> EFI_STATUS
> @@ -56,14 +57,20 @@ SecureBootDefaultKeysEntryPoint (
> }
>
> Status = SecureBootInitDbtDefault ();
> - if (EFI_ERROR (Status)) {
> + if (Status == EFI_NOT_FOUND) {
> DEBUG ((DEBUG_INFO, "%a: dbtDefault not initialized\n", __FUNCTION__));
> + } else if (EFI_ERROR (Status)) {
> + DEBUG ((DEBUG_ERROR, "%a: Cannot initialize dbtDefault: %r\n", __FUNCTION__, Status));
> + return Status;
> }
>
> Status = SecureBootInitDbxDefault ();
> - if (EFI_ERROR (Status)) {
> + if (Status == EFI_NOT_FOUND) {
> DEBUG ((DEBUG_INFO, "%a: dbxDefault not initialized\n", __FUNCTION__));
> + } else if (EFI_ERROR (Status)) {
> + DEBUG ((DEBUG_ERROR, "%a: Cannot initialize dbxDefault: %r\n", __FUNCTION__, Status));
> + return Status;
> }
>
> - return Status;
> + return EFI_SUCCESS;
> }
> --
> 2.17.1
>
>
>
>
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [edk2-devel] [PATCH 1/1] SecurityPkg: Fix SecureBootDefaultKeysDxe failed to start
2021-09-29 8:36 ` [edk2-devel] " Grzegorz Bernacki
@ 2021-09-30 14:32 ` Yao, Jiewen
[not found] ` <16A9A01413E21ADC.4587@groups.io>
1 sibling, 0 replies; 4+ messages in thread
From: Yao, Jiewen @ 2021-09-30 14:32 UTC (permalink / raw)
To: devel@edk2.groups.io, gjb@semihalf.com,
nhi@os.amperecomputing.com
Cc: patches@amperecomputing.com, Wang, Jian J
Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Grzegorz
> Bernacki
> Sent: Wednesday, September 29, 2021 4:36 PM
> To: edk2-devel-groups-io <devel@edk2.groups.io>;
> nhi@os.amperecomputing.com
> Cc: patches@amperecomputing.com; Yao, Jiewen <jiewen.yao@intel.com>;
> Wang, Jian J <jian.j.wang@intel.com>
> Subject: Re: [edk2-devel] [PATCH 1/1] SecurityPkg: Fix
> SecureBootDefaultKeysDxe failed to start
>
> Hi,
>
> Looks good to me...
> Reviewed-by: Grzegorz Bernacki <gjb@semihalf.com>
>
> pon., 27 wrz 2021 o 09:48 Nhi Pham via groups.io
> <nhi=os.amperecomputing.com@groups.io> napisał(a):
> >
> > The dbt and dbx keys are optional, the driver entry should return
> > EFI_SUCCESS to start if they are not found in the firmware flash. This
> > patch is to fix it and update the description of retval as well.
> >
> > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > Cc: Jian J Wang <jian.j.wang@intel.com>
> > Cc: Grzegorz Bernacki <gjb@semihalf.com>
> > Signed-off-by: Nhi Pham <nhi@os.amperecomputing.com>
> > ---
> >
> SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa
> ultKeysDxe.c | 21 +++++++++++++-------
> > 1 file changed, 14 insertions(+), 7 deletions(-)
> >
> > diff --git
> a/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootD
> efaultKeysDxe.c
> b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootD
> efaultKeysDxe.c
> > index f51d5243b7e8..10bdb1b58e6f 100644
> > ---
> a/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootD
> efaultKeysDxe.c
> > +++
> b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootD
> efaultKeysDxe.c
> > @@ -3,6 +3,7 @@
> >
> > Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
> > Copyright (c) 2021, Semihalf All rights reserved.<BR>
> > +Copyright (c) 2021, Ampere Computing LLC. All rights reserved.<BR>
> > SPDX-License-Identifier: BSD-2-Clause-Patent
> >
> > **/
> > @@ -23,10 +24,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> > @param[in] ImageHandle The image handle of the driver.
> > @param[in] SystemTable The system table.
> >
> > - @retval EFI_ALREADY_STARTED The driver already exists in system.
> > - @retval EFI_OUT_OF_RESOURCES Fail to execute entry point due to lack of
> resources.
> > - @retval EFI_SUCCESS All the related protocols are installed on the
> driver.
> > - @retval Others Fail to get the SecureBootEnable variable.
> > + @retval EFI_SUCCESS The secure default keys are initialized
> successfully.
> > + @retval EFI_UNSUPPORTED One of the secure default keys already
> exists.
> > + @retval EFI_NOT_FOUND One of the PK, KEK, or DB default keys is not
> found.
> > + @retval Others Fail to initialize the secure default keys.
> >
> > **/
> > EFI_STATUS
> > @@ -56,14 +57,20 @@ SecureBootDefaultKeysEntryPoint (
> > }
> >
> > Status = SecureBootInitDbtDefault ();
> > - if (EFI_ERROR (Status)) {
> > + if (Status == EFI_NOT_FOUND) {
> > DEBUG ((DEBUG_INFO, "%a: dbtDefault not initialized\n", __FUNCTION__));
> > + } else if (EFI_ERROR (Status)) {
> > + DEBUG ((DEBUG_ERROR, "%a: Cannot initialize dbtDefault: %r\n",
> __FUNCTION__, Status));
> > + return Status;
> > }
> >
> > Status = SecureBootInitDbxDefault ();
> > - if (EFI_ERROR (Status)) {
> > + if (Status == EFI_NOT_FOUND) {
> > DEBUG ((DEBUG_INFO, "%a: dbxDefault not initialized\n", __FUNCTION__));
> > + } else if (EFI_ERROR (Status)) {
> > + DEBUG ((DEBUG_ERROR, "%a: Cannot initialize dbxDefault: %r\n",
> __FUNCTION__, Status));
> > + return Status;
> > }
> >
> > - return Status;
> > + return EFI_SUCCESS;
> > }
> > --
> > 2.17.1
> >
> >
> >
> >
> >
> >
>
>
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [edk2-devel] [PATCH 1/1] SecurityPkg: Fix SecureBootDefaultKeysDxe failed to start
[not found] ` <16A9A01413E21ADC.4587@groups.io>
@ 2021-09-30 14:58 ` Yao, Jiewen
0 siblings, 0 replies; 4+ messages in thread
From: Yao, Jiewen @ 2021-09-30 14:58 UTC (permalink / raw)
To: devel@edk2.groups.io, Yao, Jiewen, gjb@semihalf.com,
nhi@os.amperecomputing.com
Cc: patches@amperecomputing.com, Wang, Jian J
Pushed 22737996771c8053189b8fe2839cf4a96272784a
> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Yao, Jiewen
> Sent: Thursday, September 30, 2021 10:32 PM
> To: devel@edk2.groups.io; gjb@semihalf.com; nhi@os.amperecomputing.com
> Cc: patches@amperecomputing.com; Wang, Jian J <jian.j.wang@intel.com>
> Subject: Re: [edk2-devel] [PATCH 1/1] SecurityPkg: Fix
> SecureBootDefaultKeysDxe failed to start
>
> Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
>
>
> > -----Original Message-----
> > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Grzegorz
> > Bernacki
> > Sent: Wednesday, September 29, 2021 4:36 PM
> > To: edk2-devel-groups-io <devel@edk2.groups.io>;
> > nhi@os.amperecomputing.com
> > Cc: patches@amperecomputing.com; Yao, Jiewen <jiewen.yao@intel.com>;
> > Wang, Jian J <jian.j.wang@intel.com>
> > Subject: Re: [edk2-devel] [PATCH 1/1] SecurityPkg: Fix
> > SecureBootDefaultKeysDxe failed to start
> >
> > Hi,
> >
> > Looks good to me...
> > Reviewed-by: Grzegorz Bernacki <gjb@semihalf.com>
> >
> > pon., 27 wrz 2021 o 09:48 Nhi Pham via groups.io
> > <nhi=os.amperecomputing.com@groups.io> napisał(a):
> > >
> > > The dbt and dbx keys are optional, the driver entry should return
> > > EFI_SUCCESS to start if they are not found in the firmware flash. This
> > > patch is to fix it and update the description of retval as well.
> > >
> > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > Cc: Jian J Wang <jian.j.wang@intel.com>
> > > Cc: Grzegorz Bernacki <gjb@semihalf.com>
> > > Signed-off-by: Nhi Pham <nhi@os.amperecomputing.com>
> > > ---
> > >
> >
> SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa
> > ultKeysDxe.c | 21 +++++++++++++-------
> > > 1 file changed, 14 insertions(+), 7 deletions(-)
> > >
> > > diff --git
> >
> a/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootD
> > efaultKeysDxe.c
> >
> b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootD
> > efaultKeysDxe.c
> > > index f51d5243b7e8..10bdb1b58e6f 100644
> > > ---
> >
> a/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootD
> > efaultKeysDxe.c
> > > +++
> >
> b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootD
> > efaultKeysDxe.c
> > > @@ -3,6 +3,7 @@
> > >
> > > Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>
> > > Copyright (c) 2021, Semihalf All rights reserved.<BR>
> > > +Copyright (c) 2021, Ampere Computing LLC. All rights reserved.<BR>
> > > SPDX-License-Identifier: BSD-2-Clause-Patent
> > >
> > > **/
> > > @@ -23,10 +24,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> > > @param[in] ImageHandle The image handle of the driver.
> > > @param[in] SystemTable The system table.
> > >
> > > - @retval EFI_ALREADY_STARTED The driver already exists in system.
> > > - @retval EFI_OUT_OF_RESOURCES Fail to execute entry point due to lack
> of
> > resources.
> > > - @retval EFI_SUCCESS All the related protocols are installed on the
> > driver.
> > > - @retval Others Fail to get the SecureBootEnable variable.
> > > + @retval EFI_SUCCESS The secure default keys are initialized
> > successfully.
> > > + @retval EFI_UNSUPPORTED One of the secure default keys already
> > exists.
> > > + @retval EFI_NOT_FOUND One of the PK, KEK, or DB default keys is
> not
> > found.
> > > + @retval Others Fail to initialize the secure default keys.
> > >
> > > **/
> > > EFI_STATUS
> > > @@ -56,14 +57,20 @@ SecureBootDefaultKeysEntryPoint (
> > > }
> > >
> > > Status = SecureBootInitDbtDefault ();
> > > - if (EFI_ERROR (Status)) {
> > > + if (Status == EFI_NOT_FOUND) {
> > > DEBUG ((DEBUG_INFO, "%a: dbtDefault not initialized\n",
> __FUNCTION__));
> > > + } else if (EFI_ERROR (Status)) {
> > > + DEBUG ((DEBUG_ERROR, "%a: Cannot initialize dbtDefault: %r\n",
> > __FUNCTION__, Status));
> > > + return Status;
> > > }
> > >
> > > Status = SecureBootInitDbxDefault ();
> > > - if (EFI_ERROR (Status)) {
> > > + if (Status == EFI_NOT_FOUND) {
> > > DEBUG ((DEBUG_INFO, "%a: dbxDefault not initialized\n",
> __FUNCTION__));
> > > + } else if (EFI_ERROR (Status)) {
> > > + DEBUG ((DEBUG_ERROR, "%a: Cannot initialize dbxDefault: %r\n",
> > __FUNCTION__, Status));
> > > + return Status;
> > > }
> > >
> > > - return Status;
> > > + return EFI_SUCCESS;
> > > }
> > > --
> > > 2.17.1
> > >
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
> >
>
>
>
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-09-30 14:58 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-09-27 7:46 [PATCH 1/1] SecurityPkg: Fix SecureBootDefaultKeysDxe failed to start Nhi Pham
2021-09-29 8:36 ` [edk2-devel] " Grzegorz Bernacki
2021-09-30 14:32 ` Yao, Jiewen
[not found] ` <16A9A01413E21ADC.4587@groups.io>
2021-09-30 14:58 ` Yao, Jiewen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox