From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 30E03C4332F for ; Fri, 11 Nov 2022 12:33:38 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id C30E484DF8; Fri, 11 Nov 2022 13:33:36 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="TQGTdPgR"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id D1A5A850E0; Fri, 11 Nov 2022 13:33:35 +0100 (CET) Received: from mail-ej1-x631.google.com (mail-ej1-x631.google.com [IPv6:2a00:1450:4864:20::631]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 51DEA84D17 for ; Fri, 11 Nov 2022 13:33:33 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x631.google.com with SMTP id f27so12335713eje.1 for ; Fri, 11 Nov 2022 04:33:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=Ldri8xnupdwy0ChUfbrt0BqqnP0gw6Doc9piG5IoaxM=; b=TQGTdPgRHW9FDT5IkK4POkIBLXS14MnbDO255sSXYIZgLG/Ji4Lfwltz4K3UXPGHef PTuW1x9yDVClbkqHmNcF/zmlzxFuxzmC0Se79P04TkeqKP5K258zlq6XKYAGkzab0BzN IO0aiwGYpldo9E5W++6qXcKzzPuhloAU+gQ0Lex+rZcxexBafnGLlTW3J3QyDslwTvS8 F9Xq8FN22zBqJzcpw4X6CnBwfhFDFtfR1Y1WTU4olC+u/WpLwjHwlYTkKmE1RdI6WPeh IGE/n3l8lgAtj7jBZdBWVeQHI/H8kGQEWZbMx8DzI5biZqZ+p5eQ0N1cXxXB91GDnGJd GG3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Ldri8xnupdwy0ChUfbrt0BqqnP0gw6Doc9piG5IoaxM=; b=jBTgAKrDA7RHHrb22X57wW4h32IGE7Gv8sDQofukRyurWqQRQma0Xu7BMhqNwFoBb1 Dubiky2tIoZPymHJxKkF3f8zyAEFZNpG241pIis3LAuaUntkDyFfT2xPU52BOHdpsOwN 4PdC4htFmNCXAaxQrLTBLfMGIxdKwozdqGqXN6ZpYVFiIxsadBSezF6ki56u8O1cw2GQ DD1STQbIXupVqi8mIi1ajANRnKBNcRIYepGPhhTgGyELgXSzx7+AhNuTu56giq86bNVQ EBbCBK9T4D3yGWBUVcg3QWGdlBosC8gvRaS8i2S66VDFFQDR8yZzAPH2r7NYVZNAYewi zppQ== X-Gm-Message-State: ANoB5pl/HlYPS689WjX4vJxnJLSJSH7nDXo7rFKD0PCTf7W+hWNJ4Sxa MK6dPy71iKAQKr1MuTf2fjCy+w== X-Google-Smtp-Source: AA0mqf4rvHW8c3P/eSEoCCnu9mnCtfRmn1d+4rIJhb1meqDswpnZjJPT4aN7gFCDpuXeSxXPNJ9IiQ== X-Received: by 2002:a17:906:411b:b0:7a4:22c4:ade7 with SMTP id j27-20020a170906411b00b007a422c4ade7mr1648542ejk.722.1668170012897; Fri, 11 Nov 2022 04:33:32 -0800 (PST) Received: from hera ([46.198.253.211]) by smtp.gmail.com with ESMTPSA id p5-20020a170906784500b0078907275a44sm844246ejm.42.2022.11.11.04.33.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 11 Nov 2022 04:33:32 -0800 (PST) Date: Fri, 11 Nov 2022 14:33:29 +0200 From: Ilias Apalodimas To: Masahisa Kojima Cc: u-boot@lists.denx.de, Heinrich Schuchardt , Simon Glass , Takahiro Akashi , Etienne Carriere , Roger Knecht , Ashok Reddy Soma , Ovidiu Panait Subject: Re: [PATCH v8 4/5] eficonfig: add UEFI Secure Boot Key enrollment interface Message-ID: References: <20221110083054.11950-1-masahisa.kojima@linaro.org> <20221110083054.11950-5-masahisa.kojima@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20221110083054.11950-5-masahisa.kojima@linaro.org> X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean Hello Kojima-san! [...] > + file_info.current_path = calloc(1, EFICONFIG_FILE_PATH_BUF_SIZE); > + if (!file_info.current_path) { > + ret = EFI_OUT_OF_RESOURCES; > + goto out; > + } > + > + ret = eficonfig_process_select_file(&file_info); > + if (ret != EFI_SUCCESS) > + goto out; > + > + ret = efi_open_volume_int(file_info.current_volume, &root); > + if (ret != EFI_SUCCESS) > + goto out; > + > + ret = efi_file_open_int(root, &f, file_info.current_path, EFI_FILE_MODE_READ, 0); > + if (ret != EFI_SUCCESS) > + goto out; > + > + ret = efi_file_size(f, &size); > + if (ret != EFI_SUCCESS) > + goto out; > + > + buf = calloc(1, size); > + if (!buf) { > + ret = EFI_OUT_OF_RESOURCES; > + goto out; > + } > + if (size == 0) { > + eficonfig_print_msg("ERROR! File is empty."); > + goto out; > + } This needs to move before the allocation and if (!size) > + > + ret = efi_file_read_int(f, &size, buf); > + if (ret != EFI_SUCCESS) { > + eficonfig_print_msg("ERROR! Failed to read file."); > + goto out; > + } > + if (!file_have_auth_header(buf, size)) { > + eficonfig_print_msg("ERROR! Invalid file format. Only .auth variables is allowed."); > + ret = EFI_INVALID_PARAMETER; > + goto out; > + } > + > + attr = EFI_VARIABLE_NON_VOLATILE | > + EFI_VARIABLE_BOOTSERVICE_ACCESS | > + EFI_VARIABLE_RUNTIME_ACCESS | > + EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS; > + > + /* PK can enroll only one certificate */ > + if (u16_strcmp(data, u"PK")) { > + efi_uintn_t db_size = 0; > + > + /* check the variable exists. If exists, add APPEND_WRITE attribute */ > + ret = efi_get_variable_int(data, efi_auth_var_get_guid(data), NULL, > + &db_size, NULL, NULL); > + if (ret == EFI_BUFFER_TOO_SMALL) > + attr |= EFI_VARIABLE_APPEND_WRITE; > + } > + > + ret = efi_set_variable_int((u16 *)data, efi_auth_var_get_guid((u16 *)data), > + attr, size, buf, false); > + if (ret != EFI_SUCCESS) > + eficonfig_print_msg("ERROR! Failed to update signature database"); > + > +out: > + free(file_info.current_path); > + free(buf); > + if (f) > + efi_file_close_int(f); > + > + /* return to the parent menu */ > + ret = (ret == EFI_ABORTED) ? EFI_NOT_READY : ret; I assume we are changing the return message here because the upper layers can't handle EFI_ABORTED? > + > + return ret; > +} > + > +static struct eficonfig_item key_config_menu_items[] = { > + {"Enroll New Key", eficonfig_process_enroll_key}, > + {"Quit", eficonfig_process_quit}, > +}; > + with the size changes Reviewed-by: Ilias Apalodimas