]> git.proxmox.com Git - mirror_edk2.git/commit - OvmfPkg/VarStore.fdf.inc
OvmfPkg: simplify VARIABLE_STORE_HEADER generation
authorLaszlo Ersek <lersek@redhat.com>
Fri, 5 Feb 2016 19:35:30 +0000 (20:35 +0100)
committerLaszlo Ersek <lersek@redhat.com>
Mon, 15 Feb 2016 16:47:29 +0000 (17:47 +0100)
commitd92eaabefbe0667bdd15c28c8e1fcd92a12fa97c
tree983e1ae41533a1665e23f8ba88ec7f1c2db7dc6b
parent2eb989bc29c2c0bacae6d79fc7e066c58ec12b5e
OvmfPkg: simplify VARIABLE_STORE_HEADER generation

Before the merger of the authenticated and non-authenticated variable
drivers (commit fa0737a839d0), we had to match the varstore header GUID in
"OvmfPkg/VarStore.fdf.inc" to SECURE_BOOT_ENABLE, because the opposite
GUID would cause either driver to fail an assertion. The header structures
for individual variables residing in the varstore were different
(VARIABLE_HEADER vs. AUTHENTICATED_VARIABLE_HEADER), and each driver could
only handle its own, so this GUID enforcement was necessary.

Since the unification of the variable driver however, it treats (a)
variable store format, and (b) AuthVariableLib instance as independent
characteristics; it can always manipulate variable stores with both header
types. All variations boot now; the difference is whether authenticated
variables, and special variables computed from them (like SecureBoot) are
supported at runtime:

    variable store                                  non-auth   auth and SB
    header GUID            AuthVariableLib          variables  variables
--  ---------------------  -------------------  ->  ---------  -----------
 1  Variable               SecurityPkg/...          supported  unsupported
 2  Variable               AuthVariableLibNull      supported  unsupported
 3  AuthenticatedVariable  SecurityPkg/...          supported  supported
 4  AuthenticatedVariable  AuthVariableLibNull      supported  unsupported

At the moment, SECURE_BOOT_ENABLE selects between cases #2 (FALSE) and #3
(TRUE). That is, it controls both the varstore header GUID in
"OvmfPkg/VarStore.fdf.inc", and the AuthVariableLib resolution in the DSC
files.

Exploiting the unified driver's flexibility, we can simplify
"OvmfPkg/VarStore.fdf.inc" by picking the AuthenticatedVariable GUID as a
constant, and letting SECURE_BOOT_ENABLE control only the AuthVariableLib
resolution. This amounts to SECURE_BOOT_ENABLE choosing between cases #3
(TRUE) and #4 (FALSE), with identical results as before.

Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Ref: http://thread.gmane.org/gmane.comp.bios.edk2.devel/7319/focus=7344
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Jordan Justen <jordan.l.justen@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
OvmfPkg/VarStore.fdf.inc