On 11/20/2018 2:13 AM, Leif Lindholm wrote:
On Fri, Nov 16, 2018 at 02:56:54PM +0800, Ming Huang wrote:
When SECURE_BOOT_ENABLE is TRUE, FlashFvbDxe should use gEfiAuthenticatedVariableGuid, When SECURE_BOOT_ENABLE is FALSE, gEfiVariableGuid should be used.
Other platforms seem to resolve this by doing something like:
!if $(SECURE_BOOT_ENABLE) ... AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf !else AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf !endif
Can the same mechanism be used here instead?
I see Ard provide a patch which is similar to this patch, so modify this patch like that patch. Thanks.
I _really_ don't like the idea of adding vendor-specific Pcds to determine whether Secure Boot is enabled.
/ Leif
Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Ming Huang ming.huang@linaro.org
Silicon/Hisilicon/HisiPkg.dec | 1 + Platform/Hisilicon/D03/D03.dsc | 5 +++++ Platform/Hisilicon/D05/D05.dsc | 5 +++++ Platform/Hisilicon/D06/D06.dsc | 5 +++++ Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf | 2 ++ Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c | 14 ++++++++++++-- 6 files changed, 30 insertions(+), 2 deletions(-)
diff --git a/Silicon/Hisilicon/HisiPkg.dec b/Silicon/Hisilicon/HisiPkg.dec index 404a3ae4af9d..af9359e4d0e0 100644 --- a/Silicon/Hisilicon/HisiPkg.dec +++ b/Silicon/Hisilicon/HisiPkg.dec @@ -278,6 +278,7 @@ [PcdsFixedAtBuild] gHisiTokenSpaceGuid.Pcdsoctype|0|UINT32|0x00000061 gHisiTokenSpaceGuid.PcdSerDesFlowCtrlFlag|0|UINT32|0x40000056
- gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE|BOOLEAN|0x40000058
[PcdsFeatureFlag] gHisiTokenSpaceGuid.PcdIsItsSupported|FALSE|BOOLEAN|0x00000065 diff --git a/Platform/Hisilicon/D03/D03.dsc b/Platform/Hisilicon/D03/D03.dsc index aa1da5d61f83..ba3096672db0 100644 --- a/Platform/Hisilicon/D03/D03.dsc +++ b/Platform/Hisilicon/D03/D03.dsc @@ -281,6 +281,11 @@ [PcdsFixedAtBuild.common] gHisiTokenSpaceGuid.PcdHb0Rb2IoSize|0xffff #64K gHisiTokenSpaceGuid.Pcdsoctype|0x1610
- !if $(SECURE_BOOT_ENABLE) == TRUE
- gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
- !else
- gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
- !endif
################################################################################ # diff --git a/Platform/Hisilicon/D05/D05.dsc b/Platform/Hisilicon/D05/D05.dsc index 1040466633ef..b8500cef8742 100644 --- a/Platform/Hisilicon/D05/D05.dsc +++ b/Platform/Hisilicon/D05/D05.dsc @@ -422,6 +422,11 @@ [PcdsFixedAtBuild.common] gHisiTokenSpaceGuid.PcdHb1Rb7IoSize|0x10000 #64K gHisiTokenSpaceGuid.Pcdsoctype|0x1610
- !if $(SECURE_BOOT_ENABLE) == TRUE
- gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
- !else
- gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
- !endif
################################################################################ # diff --git a/Platform/Hisilicon/D06/D06.dsc b/Platform/Hisilicon/D06/D06.dsc index 1a479c160e80..b6ef9fedf0a7 100644 --- a/Platform/Hisilicon/D06/D06.dsc +++ b/Platform/Hisilicon/D06/D06.dsc @@ -243,6 +243,11 @@ [PcdsFixedAtBuild.common] gEfiMdeModulePkgTokenSpaceGuid.PcdSrIovSupport|FALSE gArmTokenSpaceGuid.PcdPciIoTranslation|0x0
- !if $(SECURE_BOOT_ENABLE) == TRUE
- gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
- !else
- gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
- !endif
################################################################################ # diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf index f8be4741ef7c..47965a707032 100644 --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf @@ -44,6 +44,7 @@ [LibraryClasses] UefiRuntimeLib [Guids]
- gEfiAuthenticatedVariableGuid gEfiSystemNvDataFvGuid gEfiVariableGuid
@@ -62,6 +63,7 @@ [Pcd.common] gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize gArmPlatformTokenSpaceGuid.PcdNorFlashCheckBlockLocked
- gHisiTokenSpaceGuid.PcdIsSecureBoot gHisiTokenSpaceGuid.PcdSFCMEM0BaseAddress
[Depex] diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c index e18cc9e06ec2..309941d6fe4d 100644 --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c @@ -189,7 +189,11 @@ InitializeFvAndVariableStoreHeaders ( // VARIABLE_STORE_HEADER // VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)Headers + (UINTN)FirmwareVolumeHeader->HeaderLength);
- CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);
- if (PcdGetBool (PcdIsSecureBoot)) {
CopyGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid);- } else {
CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);- } VariableStoreHeader->Size = PcdGet32(PcdFlashNvStorageVariableSize) - FirmwareVolumeHeader->HeaderLength; VariableStoreHeader->Format = VARIABLE_STORE_FORMATTED; VariableStoreHeader->State = VARIABLE_STORE_HEALTHY;
@@ -220,6 +224,7 @@ ValidateFvHeader ( VARIABLE_STORE_HEADER* VariableStoreHeader; UINTN VariableStoreLength; UINTN FvLength;
- EFI_GUID *Guid;
FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER*)Instance->RegionBaseAddress; @@ -258,7 +263,12 @@ ValidateFvHeader ( VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)FwVolHeader + (UINTN)FwVolHeader->HeaderLength); // Check the Variable Store Guid
- if ( CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) == FALSE )
- if (PcdGetBool (PcdIsSecureBoot)) {
Guid = &gEfiAuthenticatedVariableGuid;- } else {
Guid = &gEfiVariableGuid;- }
- if (CompareGuid (&VariableStoreHeader->Signature, Guid) == FALSE) { DEBUG ((EFI_D_ERROR, "ValidateFvHeader: Variable Store Guid non-compatible\n")); return EFI_NOT_FOUND;
-- 2.9.5