SecurityPkg: Fix SecureBootDefaultKeysDxe failed to start

The dbt and dbx keys are optional, the driver entry should return
EFI_SUCCESS to start if they are not found in the firmware flash. This
patch is to fix it and update the description of retval as well.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Grzegorz Bernacki <gjb@semihalf.com>
Signed-off-by: Nhi Pham <nhi@os.amperecomputing.com>
Reviewed-by: Grzegorz Bernacki <gjb@semihalf.com>
Acked-by: Jiewen Yao <jiewen.yao@intel.com>

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c
index f51d5243b7e8772423d0c4783b0b7932476d609a..10bdb1b58e6f1dfe82fd972412b8864cdeb63dda 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c
+++ b/SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c
@@ -3,6 +3,7 @@
 \r
 Copyright (c) 2021, ARM Ltd. All rights reserved.<BR>\r
 Copyright (c) 2021, Semihalf All rights reserved.<BR>\r
+Copyright (c) 2021, Ampere Computing LLC. All rights reserved.<BR>\r
 SPDX-License-Identifier: BSD-2-Clause-Patent\r
 \r
 **/\r
@@ -23,10 +24,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
   @param[in]  ImageHandle        The image handle of the driver.\r
   @param[in]  SystemTable        The system table.\r
 \r
-  @retval EFI_ALREADY_STARTED    The driver already exists in system.\r
-  @retval EFI_OUT_OF_RESOURCES   Fail to execute entry point due to lack of resources.\r
-  @retval EFI_SUCCESS            All the related protocols are installed on the driver.\r
-  @retval Others                 Fail to get the SecureBootEnable variable.\r
+  @retval EFI_SUCCESS            The secure default keys are initialized successfully.\r
+  @retval EFI_UNSUPPORTED        One of the secure default keys already exists.\r
+  @retval EFI_NOT_FOUND          One of the PK, KEK, or DB default keys is not found.\r
+  @retval Others                 Fail to initialize the secure default keys.\r
 \r
 **/\r
 EFI_STATUS\r
@@ -56,14 +57,20 @@ SecureBootDefaultKeysEntryPoint (
   }\r
 \r
   Status = SecureBootInitDbtDefault ();\r
-  if (EFI_ERROR (Status)) {\r
+  if (Status == EFI_NOT_FOUND) {\r
     DEBUG ((DEBUG_INFO, "%a: dbtDefault not initialized\n", __FUNCTION__));\r
+  } else if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_ERROR, "%a: Cannot initialize dbtDefault: %r\n", __FUNCTION__, Status));\r
+    return Status;\r
   }\r
 \r
   Status = SecureBootInitDbxDefault ();\r
-  if (EFI_ERROR (Status)) {\r
+  if (Status == EFI_NOT_FOUND) {\r
     DEBUG ((DEBUG_INFO, "%a: dbxDefault not initialized\n", __FUNCTION__));\r
+  } else if (EFI_ERROR (Status)) {\r
+    DEBUG ((DEBUG_ERROR, "%a: Cannot initialize dbxDefault: %r\n", __FUNCTION__, Status));\r
+    return Status;\r
   }\r
 \r
-  return Status;\r
+  return EFI_SUCCESS;\r
 }\r