Giter VIP home page Giter VIP logo

edk2's People

Watchers

avatar avatar avatar avatar avatar avatar

Forkers

60eight comexr fleaplus

edk2's Issues

"Delete System76 and Microsoft keys (Use your own)" doesn't actually delete them

After choosing "Delete System76 and Microsoft keys (Use your own)" in the firmware setup menu, both System76 and Microsoft keys can still be seen with sbkeysync from Linux.

The code hints that only PK is deleted and the computer is immediately rebooted, but the keys of System76 and Microsoft are not actually deleted:

edk2/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr

Line 108 in 42a443d

key = KEY_SECURE_BOOT_DELETE_PK;

edk2/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c

Lines 4521 to 4523 in 42a443d

case KEY_SECURE_BOOT_DELETE_PK:
Status = DeletePlatformKey();
break;

edk2/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c

Lines 4842 to 4858 in 42a443d

case KEY_SECURE_BOOT_DELETE_PK:
//GetVariable2 (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&SetupMode, NULL);
//if (SetupMode == NULL || (*SetupMode) == SETUP_MODE) {
// IfrNvData->DeletePk = TRUE;
// IfrNvData->HasPk = FALSE;
// *ActionRequest = EFI_BROWSER_ACTION_REQUEST_SUBMIT;
//} else {
// IfrNvData->DeletePk = FALSE;
// IfrNvData->HasPk = TRUE;
// *ActionRequest = EFI_BROWSER_ACTION_REQUEST_FORM_APPLY;
//}
//if (SetupMode != NULL) {
// FreePool (SetupMode);
//}
// XXX: Is this safe?
gRT->ResetSystem(EfiResetCold, Status, 0, NULL);
break;

I would expect all these steps to be performed to actually delete vendor keys:

edk2/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c

Lines 4181 to 4210 in 42a443d

// Clear all the keys and databases
Status = DeleteDb ();
if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
DEBUG ((DEBUG_ERROR, "Fail to clear DB: %r\n", Status));
return Status;
}
Status = DeleteDbx ();
if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
DEBUG ((DEBUG_ERROR, "Fail to clear DBX: %r\n", Status));
return Status;
}
Status = DeleteDbt ();
if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
DEBUG ((DEBUG_ERROR, "Fail to clear DBT: %r\n", Status));
return Status;
}
Status = DeleteKEK ();
if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
DEBUG ((DEBUG_ERROR, "Fail to clear KEK: %r\n", Status));
return Status;
}
Status = DeletePlatformKey ();
if (EFI_ERROR (Status) && (Status != EFI_NOT_FOUND)) {
DEBUG ((DEBUG_ERROR, "Fail to clear PK: %r\n", Status));
return Status;
}

ME note needs to be changed for models which need ME

PXL_20201123_212750651

Some models will need the note about the ME being disabled to be modified. It looks like a check just hasn't been implemented yet:

edk2/MdeModulePkg/Application/UiApp/FrontPage.c

Lines 745 to 750 in 6ad3ee1

Token = STRING_TOKEN(STR_ME_STATUS);
//TODO: proper test for ME
BOOLEAN me_active = FALSE;
if (!me_active) {
HiiSetString (gFrontPagePrivate.HiiHandle, Token, L"The Intel Management Engine is disabled at runtime to increase security.", NULL);
}

Rebase on TianoCore

Work being done in wip/uefipayloadpkg.

Remaining work for rebasing on tianocore/edk2:

  • Fix BMM behavior
    • "Discard changes and exit" only restores list order the first time
  • Press Space to go to systemd-boot menu
    • Handled in system76 by 9768421
    • BdsDxe flushes all key events before booting (BdsReadKeys())
  • Don't show non-bootable devices
    • Logic in BmEnumerateBootOptions()
    • Use BmIsLoadOptionPeHeaderValid()?
  • Add warning if no bootable media found
  • Port any remaining, required changes from system76

Build Error

I get the following error when trying to build https://github.com/system76/firmware-open with both the latest code and the code as of hash system76/firmware-open@b337ac6 (the last safe commit for 10th gen and older):

/home/user/Development/system76/firmware-open/edk2/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBus.c: In function ‘UsbIoBulkTransfer’:
/home/user/Development/system76/firmware-open/edk2/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBus.c:267:13: error: ‘UsbHcBulkTransfer’ accessing 80 bytes in a region of size 8 [-Werror=stringop-overflow=]
  267 |   Status  = UsbHcBulkTransfer (
      |             ^~~~~~~~~~~~~~~~~~~
  268 |               Dev->Bus,
      |               ~~~~~~~~~
  269 |               Dev->Address,
      |               ~~~~~~~~~~~~~
  270 |               Endpoint,
      |               ~~~~~~~~~
  271 |               Dev->Speed,
      |               ~~~~~~~~~~~
  272 |               EpDesc->Desc.MaxPacketSize,
      |               ~~~~~~~~~~~~~~~~~~~~~~~~~~~
  273 |               BufNum,
      |               ~~~~~~~
  274 |               &Data,
      |               ~~~~~~
  275 |               DataLength,
      |               ~~~~~~~~~~~
  276 |               &Toggle,
      |               ~~~~~~~~
  277 |               Timeout,
      |               ~~~~~~~~
  278 |               &Dev->Translator,
      |               ~~~~~~~~~~~~~~~~~
  279 |               UsbStatus
      |               ~~~~~~~~~
  280 |               );
      |               ~
/home/user/Development/system76/firmware-open/edk2/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBus.c:267:13: note: referencing argument 7 of type ‘void *[10]’
In file included from /home/user/Development/system76/firmware-open/edk2/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBus.h:40,
                 from /home/user/Development/system76/firmware-open/edk2/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBus.c:10:
/home/user/Development/system76/firmware-open/edk2/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbUtility.h:145:1: note: in a call to function ‘UsbHcBulkTransfer’
  145 | UsbHcBulkTransfer (
      | ^~~~~~~~~~~~~~~~~
make: Nothing to be done for 'tbuild'.
Building ... /home/user/Development/system76/firmware-open/edk2/MdeModulePkg/Universal/Disk/DiskIoDxe/DiskIoDxe.inf [X64]
make: Nothing to be done for 'tbuild'.
Building ... /home/user/Development/system76/firmware-open/edk2/UefiCpuPkg/CpuDxe/CpuDxe.inf [X64]
cc1: all warnings being treated as errors
make: *** [GNUmakefile:365: /home/user/Development/system76/firmware-open/edk2/Build/UefiPayloadPkgX64/RELEASE_COREBOOT/X64/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBusDxe/OUTPUT/UsbBus.obj] Error 1


build.py...
 : error 7000: Failed to execute command
        make tbuild [/home/user/Development/system76/firmware-open/edk2/Build/UefiPayloadPkgX64/RELEASE_COREBOOT/X64/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBusDxe]


build.py...
 : error 7000: Failed to execute command
        make tbuild [/home/user/Development/system76/firmware-open/edk2/Build/UefiPayloadPkgX64/RELEASE_COREBOOT/X64/UefiCpuPkg/CpuDxe/CpuDxe]


build.py...
 : error F002: Failed to build module
        /home/user/Development/system76/firmware-open/edk2/MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBusDxe.inf [X64, COREBOOT, RELEASE]

Full log: https://gist.github.com/MilesBHuff/145df4d28f359504d691e2a41da93887#file-build-log

OS: OpenSUSE Tumbleweed
I've installed all of the dependencies in scripts/deps.sh, afaict.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.