ArmPkg: Fix uninitialised variable in ArmMmuStandaloneMmLib

The following patches added support for StandaloneMM using FF-A:
9da5ee116a28 ArmPkg: Allow FF-A calls to set memory region's attributes
0e43e02b9bd8 ArmPkg: Allow FF-A calls to get memory region's attributes

However, in the error handling logic for the Get/Set Memory attributes,
the CLANG compiler reports that a status variable could be used without
initialisation. This issue is a false positive and is not seen with GCC.

The Get/Set Memory attributes operation is atomic and therefore an
FFA_INTERRUPT or FFA_SUCCESS response is not expected in response
to FFA_MSG_SEND_DIRECT_REQ. So the remaining cases that could occur
are:
 - the target sends FFA_MSG_SEND_DIRECT_RESP with a success or
   failure code.
 or
 - FFA_MSG_SEND_DIRECT_REQ transmission failure.

Therefore,
 - reorder the error handling conditions such that it prevents the
   uninitialised variable issue being flagged by CLANG.
 - move the repetitive code to a static helper function and add
   documentation at the appropriate places.
 - fix error handling in functions that invoke GetMemoryPermissions().

Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
Tested-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Reviewed-by: Sughosh Ganu <sughosh.ganu@linaro.org>

diff --git a/ArmPkg/Library/StandaloneMmMmuLib/AArch64/ArmMmuStandaloneMmLib.c b/ArmPkg/Library/StandaloneMmMmuLib/AArch64/ArmMmuStandaloneMmLib.c
index a30369af9c91fb8045dfec7a68e2bd072706d101..5f453d18e4156b1e076f503de7c56ada411aaa25 100644 (file)
--- a/ArmPkg/Library/StandaloneMmMmuLib/AArch64/ArmMmuStandaloneMmLib.c
+++ b/ArmPkg/Library/StandaloneMmMmuLib/AArch64/ArmMmuStandaloneMmLib.c
@@ -1,10 +1,15 @@
 /** @file\r
-*  File managing the MMU for ARMv8 architecture in S-EL0\r
-*\r
-*  Copyright (c) 2017 - 2021, Arm Limited. All rights reserved.<BR>\r
-*\r
-*  SPDX-License-Identifier: BSD-2-Clause-Patent\r
-*\r
+  File managing the MMU for ARMv8 architecture in S-EL0\r
+\r
+  Copyright (c) 2017 - 2021, Arm Limited. All rights reserved.<BR>\r
+  SPDX-License-Identifier: BSD-2-Clause-Patent\r
+\r
+  @par Reference(s):\r
+  - [1] SPM based on the MM interface.\r
+        (https://trustedfirmware-a.readthedocs.io/en/latest/components/\r
+         secure-partition-manager-mm.html)\r
+  - [2] Arm Firmware Framework for Armv8-A, DEN0077A, version 1.0\r
+        (https://developer.arm.com/documentation/den0077/a)\r
 **/\r
 \r
 #include <Uefi.h>\r
@@ -19,37 +24,37 @@
 #include <Library/DebugLib.h>\r
 #include <Library/PcdLib.h>\r
 \r
+/** Send memory permission request to target.\r
+\r
+  @param [in, out]  SvcArgs     Pointer to SVC arguments to send. On\r
+                                return it contains the response parameters.\r
+  @param [out]      RetVal      Pointer to return the response value.\r
+\r
+  @retval EFI_SUCCESS           Request successfull.\r
+  @retval EFI_INVALID_PARAMETER A parameter is invalid.\r
+  @retval EFI_NOT_READY         Callee is busy or not in a state to handle\r
+                                this request.\r
+  @retval EFI_UNSUPPORTED       This function is not implemented by the\r
+                                callee.\r
+  @retval EFI_ABORTED           Message target ran into an unexpected error\r
+                                and has aborted.\r
+  @retval EFI_ACCESS_DENIED     Access denied.\r
+  @retval EFI_OUT_OF_RESOURCES  Out of memory to perform operation.\r
+**/\r
 STATIC\r
 EFI_STATUS\r
-GetMemoryPermissions (\r
-  IN  EFI_PHYSICAL_ADDRESS      BaseAddress,\r
-  OUT UINT32                    *MemoryAttributes\r
+SendMemoryPermissionRequest (\r
+  IN OUT  ARM_SVC_ARGS *SvcArgs,\r
+     OUT  INT32        *RetVal\r
   )\r
 {\r
-  INT32         Ret;\r
-  ARM_SVC_ARGS  GetMemoryPermissionsSvcArgs;\r
-  BOOLEAN       FfaEnabled;\r
-\r
-  ZeroMem (&GetMemoryPermissionsSvcArgs, sizeof (ARM_SVC_ARGS));\r
-\r
-  FfaEnabled = FeaturePcdGet (PcdFfaEnable);\r
-  if (FfaEnabled) {\r
-    GetMemoryPermissionsSvcArgs.Arg0 = ARM_SVC_ID_FFA_MSG_SEND_DIRECT_REQ_AARCH64;\r
-    GetMemoryPermissionsSvcArgs.Arg1 = ARM_FFA_DESTINATION_ENDPOINT_ID;\r
-    GetMemoryPermissionsSvcArgs.Arg2 = 0;\r
-    GetMemoryPermissionsSvcArgs.Arg3 = ARM_SVC_ID_SP_GET_MEM_ATTRIBUTES_AARCH64;\r
-    GetMemoryPermissionsSvcArgs.Arg4 = BaseAddress;\r
-  } else {\r
-    GetMemoryPermissionsSvcArgs.Arg0 = ARM_SVC_ID_SP_GET_MEM_ATTRIBUTES_AARCH64;\r
-    GetMemoryPermissionsSvcArgs.Arg1 = BaseAddress;\r
-    GetMemoryPermissionsSvcArgs.Arg2 = 0;\r
-    GetMemoryPermissionsSvcArgs.Arg3 = 0;\r
+  if ((SvcArgs == NULL) || (RetVal == NULL)) {\r
+    return EFI_INVALID_PARAMETER;\r
   }\r
 \r
-  *MemoryAttributes = 0;\r
-  ArmCallSvc (&GetMemoryPermissionsSvcArgs);\r
-  if (FfaEnabled) {\r
-    // Getting memory attributes is an atomic call, with\r
+  ArmCallSvc (SvcArgs);\r
+  if (FeaturePcdGet (PcdFfaEnable)) {\r
+    // Get/Set memory attributes is an atomic call, with\r
     // StandaloneMm at S-EL0 being the caller and the SPM\r
     // core being the callee. Thus there won't be a\r
     // FFA_INTERRUPT or FFA_SUCCESS response to the Direct\r
@@ -57,148 +62,178 @@ GetMemoryPermissions (
     // for other Direct Request calls which are not atomic\r
     // We therefore check only for Direct Response by the\r
     // callee.\r
-    if (GetMemoryPermissionsSvcArgs.Arg0 !=\r
-        ARM_SVC_ID_FFA_MSG_SEND_DIRECT_RESP_AARCH64) {\r
+    if (SvcArgs->Arg0 == ARM_SVC_ID_FFA_MSG_SEND_DIRECT_RESP_AARCH64) {\r
+      // A Direct Response means FF-A success\r
+      // Now check the payload for errors\r
+      // The callee sends back the return value\r
+      // in Arg3\r
+      *RetVal = SvcArgs->Arg3;\r
+    } else {\r
       // If Arg0 is not a Direct Response, that means we\r
       // have an FF-A error. We need to check Arg2 for the\r
       // FF-A error code.\r
-      Ret = GetMemoryPermissionsSvcArgs.Arg2;\r
-      switch (Ret) {\r
-      case ARM_FFA_SPM_RET_INVALID_PARAMETERS:\r
+      // See [2], Table 10.8: FFA_ERROR encoding.\r
+      *RetVal = SvcArgs->Arg2;\r
+      switch (*RetVal) {\r
+        case ARM_FFA_SPM_RET_INVALID_PARAMETERS:\r
+          return EFI_INVALID_PARAMETER;\r
 \r
-        return EFI_INVALID_PARAMETER;\r
+        case ARM_FFA_SPM_RET_DENIED:\r
+          return EFI_ACCESS_DENIED;\r
 \r
-      case ARM_FFA_SPM_RET_DENIED:\r
-        return EFI_NOT_READY;\r
+        case ARM_FFA_SPM_RET_NOT_SUPPORTED:\r
+          return EFI_UNSUPPORTED;\r
 \r
-      case ARM_FFA_SPM_RET_NOT_SUPPORTED:\r
-        return EFI_UNSUPPORTED;\r
+        case ARM_FFA_SPM_RET_BUSY:\r
+          return EFI_NOT_READY;\r
 \r
-      case ARM_FFA_SPM_RET_BUSY:\r
-        return EFI_NOT_READY;\r
+        case ARM_FFA_SPM_RET_ABORTED:\r
+          return EFI_ABORTED;\r
 \r
-      case ARM_FFA_SPM_RET_ABORTED:\r
-        return EFI_ABORTED;\r
+        default:\r
+          // Undefined error code received.\r
+          ASSERT (0);\r
+          return EFI_INVALID_PARAMETER;\r
       }\r
-    } else if (GetMemoryPermissionsSvcArgs.Arg0 ==\r
-               ARM_SVC_ID_FFA_MSG_SEND_DIRECT_RESP_AARCH64) {\r
-      // A Direct Response means FF-A success\r
-      // Now check the payload for errors\r
-      // The callee sends back the return value\r
-      // in Arg3\r
-      Ret = GetMemoryPermissionsSvcArgs.Arg3;\r
     }\r
   } else {\r
-    Ret = GetMemoryPermissionsSvcArgs.Arg0;\r
+    *RetVal = SvcArgs->Arg0;\r
   }\r
 \r
-  if (Ret & BIT31) {\r
+  // Check error response from Callee.\r
+  if (*RetVal & BIT31) {\r
     // Bit 31 set means there is an error retured\r
-    switch (Ret) {\r
-    case ARM_SVC_SPM_RET_INVALID_PARAMS:\r
-      return EFI_INVALID_PARAMETER;\r
+    // See [1], Section 13.5.5.1 MM_SP_MEMORY_ATTRIBUTES_GET_AARCH64 and\r
+    // Section 13.5.5.2 MM_SP_MEMORY_ATTRIBUTES_SET_AARCH64.\r
+    switch (*RetVal) {\r
+      case ARM_SVC_SPM_RET_NOT_SUPPORTED:\r
+        return EFI_UNSUPPORTED;\r
+\r
+      case ARM_SVC_SPM_RET_INVALID_PARAMS:\r
+        return EFI_INVALID_PARAMETER;\r
+\r
+      case ARM_SVC_SPM_RET_DENIED:\r
+        return EFI_ACCESS_DENIED;\r
+\r
+      case ARM_SVC_SPM_RET_NO_MEMORY:\r
+        return EFI_OUT_OF_RESOURCES;\r
 \r
-    case ARM_SVC_SPM_RET_NOT_SUPPORTED:\r
-      return EFI_UNSUPPORTED;\r
+      default:\r
+        // Undefined error code received.\r
+        ASSERT (0);\r
+        return EFI_INVALID_PARAMETER;\r
     }\r
-  } else {\r
-    *MemoryAttributes = Ret;\r
   }\r
 \r
   return EFI_SUCCESS;\r
 }\r
 \r
+/** Request the permission attributes of a memory region from S-EL0.\r
+\r
+  @param [in]   BaseAddress          Base address for the memory region.\r
+  @param [out]  MemoryAttributes     Pointer to return the memory attributes.\r
+\r
+  @retval EFI_SUCCESS             Request successfull.\r
+  @retval EFI_INVALID_PARAMETER   A parameter is invalid.\r
+  @retval EFI_NOT_READY           Callee is busy or not in a state to handle\r
+                                  this request.\r
+  @retval EFI_UNSUPPORTED         This function is not implemented by the\r
+                                  callee.\r
+  @retval EFI_ABORTED             Message target ran into an unexpected error\r
+                                  and has aborted.\r
+  @retval EFI_ACCESS_DENIED       Access denied.\r
+  @retval EFI_OUT_OF_RESOURCES    Out of memory to perform operation.\r
+**/\r
 STATIC\r
 EFI_STATUS\r
-RequestMemoryPermissionChange (\r
+GetMemoryPermissions (\r
   IN  EFI_PHYSICAL_ADDRESS      BaseAddress,\r
-  IN  UINT64                    Length,\r
-  IN  UINTN                     Permissions\r
+  OUT UINT32                    *MemoryAttributes\r
   )\r
 {\r
+  EFI_STATUS    Status;\r
   INT32         Ret;\r
-  BOOLEAN       FfaEnabled;\r
-  ARM_SVC_ARGS  ChangeMemoryPermissionsSvcArgs;\r
-\r
-  ZeroMem (&ChangeMemoryPermissionsSvcArgs, sizeof (ARM_SVC_ARGS));\r
+  ARM_SVC_ARGS  SvcArgs;\r
 \r
-  FfaEnabled = FeaturePcdGet (PcdFfaEnable);\r
-\r
-  if (FfaEnabled) {\r
-    ChangeMemoryPermissionsSvcArgs.Arg0 = ARM_SVC_ID_FFA_MSG_SEND_DIRECT_REQ_AARCH64;\r
-    ChangeMemoryPermissionsSvcArgs.Arg1 = ARM_FFA_DESTINATION_ENDPOINT_ID;\r
-    ChangeMemoryPermissionsSvcArgs.Arg2 = 0;\r
-    ChangeMemoryPermissionsSvcArgs.Arg3 = ARM_SVC_ID_SP_SET_MEM_ATTRIBUTES_AARCH64;\r
-    ChangeMemoryPermissionsSvcArgs.Arg4 = BaseAddress;\r
-    ChangeMemoryPermissionsSvcArgs.Arg5 = EFI_SIZE_TO_PAGES (Length);\r
-    ChangeMemoryPermissionsSvcArgs.Arg6 = Permissions;\r
-  } else {\r
-    ChangeMemoryPermissionsSvcArgs.Arg0 = ARM_SVC_ID_SP_SET_MEM_ATTRIBUTES_AARCH64;\r
-    ChangeMemoryPermissionsSvcArgs.Arg1 = BaseAddress;\r
-    ChangeMemoryPermissionsSvcArgs.Arg2 = EFI_SIZE_TO_PAGES (Length);\r
-    ChangeMemoryPermissionsSvcArgs.Arg3 = Permissions;\r
+  if (MemoryAttributes == NULL) {\r
+    return EFI_INVALID_PARAMETER;\r
   }\r
 \r
-  ArmCallSvc (&ChangeMemoryPermissionsSvcArgs);\r
-\r
-  if (FfaEnabled) {\r
-    // Setting memory attributes is an atomic call, with\r
-    // StandaloneMm at S-EL0 being the caller and the SPM\r
-    // core being the callee. Thus there won't be a\r
-    // FFA_INTERRUPT or FFA_SUCCESS response to the Direct\r
-    // Request sent above. This will have to be considered\r
-    // for other Direct Request calls which are not atomic\r
-    // We therefore check only for Direct Response by the\r
-    // callee.\r
-    if (ChangeMemoryPermissionsSvcArgs.Arg0 !=\r
-        ARM_SVC_ID_FFA_MSG_SEND_DIRECT_RESP_AARCH64) {\r
-      // If Arg0 is not a Direct Response, that means we\r
-      // have an FF-A error. We need to check Arg2 for the\r
-      // FF-A error code.\r
-      Ret = ChangeMemoryPermissionsSvcArgs.Arg2;\r
-      switch (Ret) {\r
-      case ARM_FFA_SPM_RET_INVALID_PARAMETERS:\r
-        return EFI_INVALID_PARAMETER;\r
-\r
-      case ARM_FFA_SPM_RET_DENIED:\r
-        return EFI_NOT_READY;\r
-\r
-      case ARM_FFA_SPM_RET_NOT_SUPPORTED:\r
-        return EFI_UNSUPPORTED;\r
-\r
-      case ARM_FFA_SPM_RET_BUSY:\r
-        return EFI_NOT_READY;\r
-\r
-      case ARM_FFA_SPM_RET_ABORTED:\r
-        return EFI_ABORTED;\r
-      }\r
-    } else if (ChangeMemoryPermissionsSvcArgs.Arg0 ==\r
-               ARM_SVC_ID_FFA_MSG_SEND_DIRECT_RESP_AARCH64) {\r
-      // A Direct Response means FF-A success\r
-      // Now check the payload for errors\r
-      // The callee sends back the return value\r
-      // in Arg3\r
-      Ret = ChangeMemoryPermissionsSvcArgs.Arg3;\r
-    }\r
+  // Prepare the message parameters.\r
+  // See [1], Section 13.5.5.1 MM_SP_MEMORY_ATTRIBUTES_GET_AARCH64.\r
+  ZeroMem (&SvcArgs, sizeof (ARM_SVC_ARGS));\r
+  if (FeaturePcdGet (PcdFfaEnable)) {\r
+    // See [2], Section 10.2 FFA_MSG_SEND_DIRECT_REQ.\r
+    SvcArgs.Arg0 = ARM_SVC_ID_FFA_MSG_SEND_DIRECT_REQ_AARCH64;\r
+    SvcArgs.Arg1 = ARM_FFA_DESTINATION_ENDPOINT_ID;\r
+    SvcArgs.Arg2 = 0;\r
+    SvcArgs.Arg3 = ARM_SVC_ID_SP_GET_MEM_ATTRIBUTES_AARCH64;\r
+    SvcArgs.Arg4 = BaseAddress;\r
   } else {\r
-    Ret = ChangeMemoryPermissionsSvcArgs.Arg0;\r
+    SvcArgs.Arg0 = ARM_SVC_ID_SP_GET_MEM_ATTRIBUTES_AARCH64;\r
+    SvcArgs.Arg1 = BaseAddress;\r
+    SvcArgs.Arg2 = 0;\r
+    SvcArgs.Arg3 = 0;\r
   }\r
 \r
-  switch (Ret) {\r
-  case ARM_SVC_SPM_RET_NOT_SUPPORTED:\r
-    return EFI_UNSUPPORTED;\r
-\r
-  case ARM_SVC_SPM_RET_INVALID_PARAMS:\r
-    return EFI_INVALID_PARAMETER;\r
+  Status = SendMemoryPermissionRequest (&SvcArgs, &Ret);\r
+  if (EFI_ERROR (Status)) {\r
+    *MemoryAttributes = 0;\r
+    return Status;\r
+  }\r
 \r
-  case ARM_SVC_SPM_RET_DENIED:\r
-    return EFI_ACCESS_DENIED;\r
+  *MemoryAttributes = Ret;\r
+  return Status;\r
+}\r
 \r
-  case ARM_SVC_SPM_RET_NO_MEMORY:\r
-    return EFI_BAD_BUFFER_SIZE;\r
+/** Set the permission attributes of a memory region from S-EL0.\r
+\r
+  @param [in]  BaseAddress     Base address for the memory region.\r
+  @param [in]  Length          Length of the memory region.\r
+  @param [in]  Permissions     Memory access controls attributes.\r
+\r
+  @retval EFI_SUCCESS             Request successfull.\r
+  @retval EFI_INVALID_PARAMETER   A parameter is invalid.\r
+  @retval EFI_NOT_READY           Callee is busy or not in a state to handle\r
+                                  this request.\r
+  @retval EFI_UNSUPPORTED         This function is not implemented by the\r
+                                  callee.\r
+  @retval EFI_ABORTED             Message target ran into an unexpected error\r
+                                  and has aborted.\r
+  @retval EFI_ACCESS_DENIED       Access denied.\r
+  @retval EFI_OUT_OF_RESOURCES    Out of memory to perform operation.\r
+**/\r
+STATIC\r
+EFI_STATUS\r
+RequestMemoryPermissionChange (\r
+  IN  EFI_PHYSICAL_ADDRESS      BaseAddress,\r
+  IN  UINT64                    Length,\r
+  IN  UINT32                    Permissions\r
+  )\r
+{\r
+  INT32         Ret;\r
+  ARM_SVC_ARGS  SvcArgs;\r
+\r
+  // Prepare the message parameters.\r
+  // See [1], Section 13.5.5.2 MM_SP_MEMORY_ATTRIBUTES_SET_AARCH64.\r
+  ZeroMem (&SvcArgs, sizeof (ARM_SVC_ARGS));\r
+  if (FeaturePcdGet (PcdFfaEnable)) {\r
+    // See [2], Section 10.2 FFA_MSG_SEND_DIRECT_REQ.\r
+    SvcArgs.Arg0 = ARM_SVC_ID_FFA_MSG_SEND_DIRECT_REQ_AARCH64;\r
+    SvcArgs.Arg1 = ARM_FFA_DESTINATION_ENDPOINT_ID;\r
+    SvcArgs.Arg2 = 0;\r
+    SvcArgs.Arg3 = ARM_SVC_ID_SP_SET_MEM_ATTRIBUTES_AARCH64;\r
+    SvcArgs.Arg4 = BaseAddress;\r
+    SvcArgs.Arg5 = EFI_SIZE_TO_PAGES (Length);\r
+    SvcArgs.Arg6 = Permissions;\r
+  } else {\r
+    SvcArgs.Arg0 = ARM_SVC_ID_SP_SET_MEM_ATTRIBUTES_AARCH64;\r
+    SvcArgs.Arg1 = BaseAddress;\r
+    SvcArgs.Arg2 = EFI_SIZE_TO_PAGES (Length);\r
+    SvcArgs.Arg3 = Permissions;\r
   }\r
 \r
-  return EFI_SUCCESS;\r
+  return SendMemoryPermissionRequest (&SvcArgs, &Ret);\r
 }\r
 \r
 EFI_STATUS\r
@@ -212,7 +247,7 @@ ArmSetMemoryRegionNoExec (
   UINT32 CodePermission;\r
 \r
   Status = GetMemoryPermissions (BaseAddress, &MemoryAttributes);\r
-  if (Status != EFI_INVALID_PARAMETER) {\r
+  if (!EFI_ERROR (Status)) {\r
     CodePermission = SET_MEM_ATTR_CODE_PERM_XN << SET_MEM_ATTR_CODE_PERM_SHIFT;\r
     return RequestMemoryPermissionChange (\r
              BaseAddress,\r
@@ -220,7 +255,7 @@ ArmSetMemoryRegionNoExec (
              MemoryAttributes | CodePermission\r
              );\r
   }\r
-  return EFI_INVALID_PARAMETER;\r
+  return Status;\r
 }\r
 \r
 EFI_STATUS\r
@@ -234,7 +269,7 @@ ArmClearMemoryRegionNoExec (
   UINT32 CodePermission;\r
 \r
   Status = GetMemoryPermissions (BaseAddress, &MemoryAttributes);\r
-  if (Status != EFI_INVALID_PARAMETER) {\r
+  if (!EFI_ERROR (Status)) {\r
     CodePermission = SET_MEM_ATTR_CODE_PERM_XN << SET_MEM_ATTR_CODE_PERM_SHIFT;\r
     return RequestMemoryPermissionChange (\r
              BaseAddress,\r
@@ -242,7 +277,7 @@ ArmClearMemoryRegionNoExec (
              MemoryAttributes & ~CodePermission\r
              );\r
   }\r
-  return EFI_INVALID_PARAMETER;\r
+  return Status;\r
 }\r
 \r
 EFI_STATUS\r
@@ -256,7 +291,7 @@ ArmSetMemoryRegionReadOnly (
   UINT32 DataPermission;\r
 \r
   Status = GetMemoryPermissions (BaseAddress, &MemoryAttributes);\r
-  if (Status != EFI_INVALID_PARAMETER) {\r
+  if (!EFI_ERROR (Status)) {\r
     DataPermission = SET_MEM_ATTR_DATA_PERM_RO << SET_MEM_ATTR_DATA_PERM_SHIFT;\r
     return RequestMemoryPermissionChange (\r
              BaseAddress,\r
@@ -264,7 +299,7 @@ ArmSetMemoryRegionReadOnly (
              MemoryAttributes | DataPermission\r
              );\r
   }\r
-  return EFI_INVALID_PARAMETER;\r
+  return Status;\r
 }\r
 \r
 EFI_STATUS\r
@@ -278,7 +313,7 @@ ArmClearMemoryRegionReadOnly (
   UINT32 PermissionRequest;\r
 \r
   Status = GetMemoryPermissions (BaseAddress, &MemoryAttributes);\r
-  if (Status != EFI_INVALID_PARAMETER) {\r
+  if (!EFI_ERROR (Status)) {\r
     PermissionRequest = SET_MEM_ATTR_MAKE_PERM_REQUEST (SET_MEM_ATTR_DATA_PERM_RW,\r
                                                         MemoryAttributes);\r
     return RequestMemoryPermissionChange (\r
@@ -287,5 +322,5 @@ ArmClearMemoryRegionReadOnly (
              PermissionRequest\r
              );\r
   }\r
-  return EFI_INVALID_PARAMETER;\r
+  return Status;\r
 }\r