diff mbox series

[edk2,edk2-platforms,v1,07/12] Hisilicon/D0x: Fix secure boot bug in FlashFvbDxe

Message ID 20181029033249.45363-8-ming.huang@linaro.org
State Superseded
Headers show
Series [edk2,edk2-platforms,v1,01/12] Silicon/Hisilicon/D06: Add watchdog to GTDT | expand

Commit Message

Ming Huang Oct. 29, 2018, 3:32 a.m. UTC 
When SECURE_BOOT_ENABLE is TRUE, FlashFvbDxe should use
gEfiAuthenticatedVariableGuid, When SECURE_BOOT_ENABLE
is FALSE, gEfiVariableGuid should be used.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ming Huang <ming.huang@linaro.org>

---
 Silicon/Hisilicon/HisiPkg.dec                         |  1 +
 Platform/Hisilicon/D03/D03.dsc                        |  5 +++++
 Platform/Hisilicon/D05/D05.dsc                        |  5 +++++
 Platform/Hisilicon/D06/D06.dsc                        |  5 +++++
 Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf |  2 ++
 Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c   | 14 ++++++++++++--
 6 files changed, 30 insertions(+), 2 deletions(-)

-- 
2.18.0

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Comments

Leif Lindholm Nov. 13, 2018, 11:57 p.m. UTC | #1 
On Mon, Oct 29, 2018 at 11:32:44AM +0800, Ming Huang wrote:
> When SECURE_BOOT_ENABLE is TRUE, FlashFvbDxe should use

> gEfiAuthenticatedVariableGuid, When SECURE_BOOT_ENABLE

> is FALSE, gEfiVariableGuid should be used.

> 

> Contributed-under: TianoCore Contribution Agreement 1.1

> Signed-off-by: Ming Huang <ming.huang@linaro.org>

> ---

>  Silicon/Hisilicon/HisiPkg.dec                         |  1 +

>  Platform/Hisilicon/D03/D03.dsc                        |  5 +++++

>  Platform/Hisilicon/D05/D05.dsc                        |  5 +++++

>  Platform/Hisilicon/D06/D06.dsc                        |  5 +++++

>  Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf |  2 ++

>  Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c   | 14 ++++++++++++--

>  6 files changed, 30 insertions(+), 2 deletions(-)

> 

> diff --git a/Silicon/Hisilicon/HisiPkg.dec b/Silicon/Hisilicon/HisiPkg.dec

> index 404a3ae4af..8c197fa3c1 100644

> --- a/Silicon/Hisilicon/HisiPkg.dec

> +++ b/Silicon/Hisilicon/HisiPkg.dec

> @@ -278,6 +278,7 @@

>  

>    gHisiTokenSpaceGuid.Pcdsoctype|0|UINT32|0x00000061

>    gHisiTokenSpaceGuid.PcdSerDesFlowCtrlFlag|0|UINT32|0x40000056

> +  gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE|BOOLEAN|0x50000013


Why a token ID completely separate from the surrounding ones?

>  

>  [PcdsFeatureFlag]

>    gHisiTokenSpaceGuid.PcdIsItsSupported|FALSE|BOOLEAN|0x00000065

> diff --git a/Platform/Hisilicon/D03/D03.dsc b/Platform/Hisilicon/D03/D03.dsc

> index aa1da5d61f..ba3096672d 100644

> --- a/Platform/Hisilicon/D03/D03.dsc

> +++ b/Platform/Hisilicon/D03/D03.dsc

> @@ -281,6 +281,11 @@

>    gHisiTokenSpaceGuid.PcdHb0Rb2IoSize|0xffff #64K

>  

>    gHisiTokenSpaceGuid.Pcdsoctype|0x1610

> +  !if $(SECURE_BOOT_ENABLE) == TRUE

> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE

> +  !else

> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE

> +  !endif

>  

>  ################################################################################

>  #

> diff --git a/Platform/Hisilicon/D05/D05.dsc b/Platform/Hisilicon/D05/D05.dsc

> index 1040466633..b8500cef87 100644

> --- a/Platform/Hisilicon/D05/D05.dsc

> +++ b/Platform/Hisilicon/D05/D05.dsc

> @@ -422,6 +422,11 @@

>    gHisiTokenSpaceGuid.PcdHb1Rb7IoSize|0x10000 #64K

>  

>    gHisiTokenSpaceGuid.Pcdsoctype|0x1610

> +  !if $(SECURE_BOOT_ENABLE) == TRUE

> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE

> +  !else

> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE

> +  !endif

>  

>  ################################################################################

>  #

> diff --git a/Platform/Hisilicon/D06/D06.dsc b/Platform/Hisilicon/D06/D06.dsc

> index 1a479c160e..b6ef9fedf0 100644

> --- a/Platform/Hisilicon/D06/D06.dsc

> +++ b/Platform/Hisilicon/D06/D06.dsc

> @@ -243,6 +243,11 @@

>  

>    gEfiMdeModulePkgTokenSpaceGuid.PcdSrIovSupport|FALSE

>    gArmTokenSpaceGuid.PcdPciIoTranslation|0x0

> +  !if $(SECURE_BOOT_ENABLE) == TRUE

> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE

> +  !else

> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE

> +  !endif

>  

>  ################################################################################

>  #

> diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf

> index f8be4741ef..934c86c79b 100644

> --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf

> +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf

> @@ -46,6 +46,7 @@

>  [Guids]

>    gEfiSystemNvDataFvGuid

>    gEfiVariableGuid

> +  gEfiAuthenticatedVariableGuid


Please move up two lines to insert sorted.

/
    Leif

>  

>  [Protocols]

>    gEfiBlockIoProtocolGuid

> @@ -62,6 +63,7 @@

>    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize

>  

>    gArmPlatformTokenSpaceGuid.PcdNorFlashCheckBlockLocked

> +  gHisiTokenSpaceGuid.PcdIsSecureBoot

>    gHisiTokenSpaceGuid.PcdSFCMEM0BaseAddress

>  

>  [Depex]

> diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c

> index e18cc9e06e..309941d6fe 100644

> --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c

> +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c

> @@ -189,7 +189,11 @@ InitializeFvAndVariableStoreHeaders (

>      // VARIABLE_STORE_HEADER

>      //

>      VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)Headers + (UINTN)FirmwareVolumeHeader->HeaderLength);

> -    CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);

> +    if (PcdGetBool (PcdIsSecureBoot)) {

> +      CopyGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid);

> +    } else {

> +      CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);

> +    }

>      VariableStoreHeader->Size = PcdGet32(PcdFlashNvStorageVariableSize) - FirmwareVolumeHeader->HeaderLength;

>      VariableStoreHeader->Format            = VARIABLE_STORE_FORMATTED;

>      VariableStoreHeader->State             = VARIABLE_STORE_HEALTHY;

> @@ -220,6 +224,7 @@ ValidateFvHeader (

>      VARIABLE_STORE_HEADER*      VariableStoreHeader;

>      UINTN                       VariableStoreLength;

>      UINTN                       FvLength;

> +    EFI_GUID                    *Guid;

>  

>      FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER*)Instance->RegionBaseAddress;

>  

> @@ -258,7 +263,12 @@ ValidateFvHeader (

>      VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)FwVolHeader + (UINTN)FwVolHeader->HeaderLength);

>  

>      // Check the Variable Store Guid

> -    if ( CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) == FALSE )

> +    if (PcdGetBool (PcdIsSecureBoot)) {

> +      Guid = &gEfiAuthenticatedVariableGuid;

> +    } else {

> +      Guid = &gEfiVariableGuid;

> +    }

> +    if (CompareGuid (&VariableStoreHeader->Signature, Guid) == FALSE)

>      {

>          DEBUG ((EFI_D_ERROR, "ValidateFvHeader: Variable Store Guid non-compatible\n"));

>          return EFI_NOT_FOUND;

> -- 

> 2.18.0

> 

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Ming Huang Nov. 15, 2018, 7:09 a.m. UTC | #2 
On 11/14/2018 7:57 AM, Leif Lindholm wrote:
> On Mon, Oct 29, 2018 at 11:32:44AM +0800, Ming Huang wrote:

>> When SECURE_BOOT_ENABLE is TRUE, FlashFvbDxe should use

>> gEfiAuthenticatedVariableGuid, When SECURE_BOOT_ENABLE

>> is FALSE, gEfiVariableGuid should be used.

>>

>> Contributed-under: TianoCore Contribution Agreement 1.1

>> Signed-off-by: Ming Huang <ming.huang@linaro.org>

>> ---

>>  Silicon/Hisilicon/HisiPkg.dec                         |  1 +

>>  Platform/Hisilicon/D03/D03.dsc                        |  5 +++++

>>  Platform/Hisilicon/D05/D05.dsc                        |  5 +++++

>>  Platform/Hisilicon/D06/D06.dsc                        |  5 +++++

>>  Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf |  2 ++

>>  Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c   | 14 ++++++++++++--

>>  6 files changed, 30 insertions(+), 2 deletions(-)

>>

>> diff --git a/Silicon/Hisilicon/HisiPkg.dec b/Silicon/Hisilicon/HisiPkg.dec

>> index 404a3ae4af..8c197fa3c1 100644

>> --- a/Silicon/Hisilicon/HisiPkg.dec

>> +++ b/Silicon/Hisilicon/HisiPkg.dec

>> @@ -278,6 +278,7 @@

>>  

>>    gHisiTokenSpaceGuid.Pcdsoctype|0|UINT32|0x00000061

>>    gHisiTokenSpaceGuid.PcdSerDesFlowCtrlFlag|0|UINT32|0x40000056

>> +  gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE|BOOLEAN|0x50000013

> 

> Why a token ID completely separate from the surrounding ones?


I add this Pcd in another .dec file and then move it to HisiPkg.dec.
I will modify the token ID.

> 

>>  

>>  [PcdsFeatureFlag]

>>    gHisiTokenSpaceGuid.PcdIsItsSupported|FALSE|BOOLEAN|0x00000065

>> diff --git a/Platform/Hisilicon/D03/D03.dsc b/Platform/Hisilicon/D03/D03.dsc

>> index aa1da5d61f..ba3096672d 100644

>> --- a/Platform/Hisilicon/D03/D03.dsc

>> +++ b/Platform/Hisilicon/D03/D03.dsc

>> @@ -281,6 +281,11 @@

>>    gHisiTokenSpaceGuid.PcdHb0Rb2IoSize|0xffff #64K

>>  

>>    gHisiTokenSpaceGuid.Pcdsoctype|0x1610

>> +  !if $(SECURE_BOOT_ENABLE) == TRUE

>> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE

>> +  !else

>> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE

>> +  !endif

>>  

>>  ################################################################################

>>  #

>> diff --git a/Platform/Hisilicon/D05/D05.dsc b/Platform/Hisilicon/D05/D05.dsc

>> index 1040466633..b8500cef87 100644

>> --- a/Platform/Hisilicon/D05/D05.dsc

>> +++ b/Platform/Hisilicon/D05/D05.dsc

>> @@ -422,6 +422,11 @@

>>    gHisiTokenSpaceGuid.PcdHb1Rb7IoSize|0x10000 #64K

>>  

>>    gHisiTokenSpaceGuid.Pcdsoctype|0x1610

>> +  !if $(SECURE_BOOT_ENABLE) == TRUE

>> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE

>> +  !else

>> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE

>> +  !endif

>>  

>>  ################################################################################

>>  #

>> diff --git a/Platform/Hisilicon/D06/D06.dsc b/Platform/Hisilicon/D06/D06.dsc

>> index 1a479c160e..b6ef9fedf0 100644

>> --- a/Platform/Hisilicon/D06/D06.dsc

>> +++ b/Platform/Hisilicon/D06/D06.dsc

>> @@ -243,6 +243,11 @@

>>  

>>    gEfiMdeModulePkgTokenSpaceGuid.PcdSrIovSupport|FALSE

>>    gArmTokenSpaceGuid.PcdPciIoTranslation|0x0

>> +  !if $(SECURE_BOOT_ENABLE) == TRUE

>> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE

>> +  !else

>> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE

>> +  !endif

>>  

>>  ################################################################################

>>  #

>> diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf

>> index f8be4741ef..934c86c79b 100644

>> --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf

>> +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf

>> @@ -46,6 +46,7 @@

>>  [Guids]

>>    gEfiSystemNvDataFvGuid

>>    gEfiVariableGuid

>> +  gEfiAuthenticatedVariableGuid

> 

> Please move up two lines to insert sorted.

> 

> /

>     Leif

> 

>>  

>>  [Protocols]

>>    gEfiBlockIoProtocolGuid

>> @@ -62,6 +63,7 @@

>>    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize

>>  

>>    gArmPlatformTokenSpaceGuid.PcdNorFlashCheckBlockLocked

>> +  gHisiTokenSpaceGuid.PcdIsSecureBoot

>>    gHisiTokenSpaceGuid.PcdSFCMEM0BaseAddress

>>  

>>  [Depex]

>> diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c

>> index e18cc9e06e..309941d6fe 100644

>> --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c

>> +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c

>> @@ -189,7 +189,11 @@ InitializeFvAndVariableStoreHeaders (

>>      // VARIABLE_STORE_HEADER

>>      //

>>      VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)Headers + (UINTN)FirmwareVolumeHeader->HeaderLength);

>> -    CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);

>> +    if (PcdGetBool (PcdIsSecureBoot)) {

>> +      CopyGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid);

>> +    } else {

>> +      CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);

>> +    }

>>      VariableStoreHeader->Size = PcdGet32(PcdFlashNvStorageVariableSize) - FirmwareVolumeHeader->HeaderLength;

>>      VariableStoreHeader->Format            = VARIABLE_STORE_FORMATTED;

>>      VariableStoreHeader->State             = VARIABLE_STORE_HEALTHY;

>> @@ -220,6 +224,7 @@ ValidateFvHeader (

>>      VARIABLE_STORE_HEADER*      VariableStoreHeader;

>>      UINTN                       VariableStoreLength;

>>      UINTN                       FvLength;

>> +    EFI_GUID                    *Guid;

>>  

>>      FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER*)Instance->RegionBaseAddress;

>>  

>> @@ -258,7 +263,12 @@ ValidateFvHeader (

>>      VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)FwVolHeader + (UINTN)FwVolHeader->HeaderLength);

>>  

>>      // Check the Variable Store Guid

>> -    if ( CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) == FALSE )

>> +    if (PcdGetBool (PcdIsSecureBoot)) {

>> +      Guid = &gEfiAuthenticatedVariableGuid;

>> +    } else {

>> +      Guid = &gEfiVariableGuid;

>> +    }

>> +    if (CompareGuid (&VariableStoreHeader->Signature, Guid) == FALSE)

>>      {

>>          DEBUG ((EFI_D_ERROR, "ValidateFvHeader: Variable Store Guid non-compatible\n"));

>>          return EFI_NOT_FOUND;

>> -- 

>> 2.18.0

>>

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
diff mbox series

Patch

diff --git a/Silicon/Hisilicon/HisiPkg.dec b/Silicon/Hisilicon/HisiPkg.dec
index 404a3ae4af..8c197fa3c1 100644
--- a/Silicon/Hisilicon/HisiPkg.dec
+++ b/Silicon/Hisilicon/HisiPkg.dec
@@ -278,6 +278,7 @@ 
 
   gHisiTokenSpaceGuid.Pcdsoctype|0|UINT32|0x00000061
   gHisiTokenSpaceGuid.PcdSerDesFlowCtrlFlag|0|UINT32|0x40000056
+  gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE|BOOLEAN|0x50000013
 
 [PcdsFeatureFlag]
   gHisiTokenSpaceGuid.PcdIsItsSupported|FALSE|BOOLEAN|0x00000065
diff --git a/Platform/Hisilicon/D03/D03.dsc b/Platform/Hisilicon/D03/D03.dsc
index aa1da5d61f..ba3096672d 100644
--- a/Platform/Hisilicon/D03/D03.dsc
+++ b/Platform/Hisilicon/D03/D03.dsc
@@ -281,6 +281,11 @@ 
   gHisiTokenSpaceGuid.PcdHb0Rb2IoSize|0xffff #64K
 
   gHisiTokenSpaceGuid.Pcdsoctype|0x1610
+  !if $(SECURE_BOOT_ENABLE) == TRUE
+    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
+  !else
+    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
+  !endif
 
 ################################################################################
 #
diff --git a/Platform/Hisilicon/D05/D05.dsc b/Platform/Hisilicon/D05/D05.dsc
index 1040466633..b8500cef87 100644
--- a/Platform/Hisilicon/D05/D05.dsc
+++ b/Platform/Hisilicon/D05/D05.dsc
@@ -422,6 +422,11 @@ 
   gHisiTokenSpaceGuid.PcdHb1Rb7IoSize|0x10000 #64K
 
   gHisiTokenSpaceGuid.Pcdsoctype|0x1610
+  !if $(SECURE_BOOT_ENABLE) == TRUE
+    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
+  !else
+    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
+  !endif
 
 ################################################################################
 #
diff --git a/Platform/Hisilicon/D06/D06.dsc b/Platform/Hisilicon/D06/D06.dsc
index 1a479c160e..b6ef9fedf0 100644
--- a/Platform/Hisilicon/D06/D06.dsc
+++ b/Platform/Hisilicon/D06/D06.dsc
@@ -243,6 +243,11 @@ 
 
   gEfiMdeModulePkgTokenSpaceGuid.PcdSrIovSupport|FALSE
   gArmTokenSpaceGuid.PcdPciIoTranslation|0x0
+  !if $(SECURE_BOOT_ENABLE) == TRUE
+    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
+  !else
+    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
+  !endif
 
 ################################################################################
 #
diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
index f8be4741ef..934c86c79b 100644
--- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
+++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
@@ -46,6 +46,7 @@ 
 [Guids]
   gEfiSystemNvDataFvGuid
   gEfiVariableGuid
+  gEfiAuthenticatedVariableGuid
 
 [Protocols]
   gEfiBlockIoProtocolGuid
@@ -62,6 +63,7 @@ 
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
 
   gArmPlatformTokenSpaceGuid.PcdNorFlashCheckBlockLocked
+  gHisiTokenSpaceGuid.PcdIsSecureBoot
   gHisiTokenSpaceGuid.PcdSFCMEM0BaseAddress
 
 [Depex]
diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
index e18cc9e06e..309941d6fe 100644
--- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
+++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
@@ -189,7 +189,11 @@  InitializeFvAndVariableStoreHeaders (
     // VARIABLE_STORE_HEADER
     //
     VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)Headers + (UINTN)FirmwareVolumeHeader->HeaderLength);
-    CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);
+    if (PcdGetBool (PcdIsSecureBoot)) {
+      CopyGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid);
+    } else {
+      CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);
+    }
     VariableStoreHeader->Size = PcdGet32(PcdFlashNvStorageVariableSize) - FirmwareVolumeHeader->HeaderLength;
     VariableStoreHeader->Format            = VARIABLE_STORE_FORMATTED;
     VariableStoreHeader->State             = VARIABLE_STORE_HEALTHY;
@@ -220,6 +224,7 @@  ValidateFvHeader (
     VARIABLE_STORE_HEADER*      VariableStoreHeader;
     UINTN                       VariableStoreLength;
     UINTN                       FvLength;
+    EFI_GUID                    *Guid;
 
     FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER*)Instance->RegionBaseAddress;
 
@@ -258,7 +263,12 @@  ValidateFvHeader (
     VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)FwVolHeader + (UINTN)FwVolHeader->HeaderLength);
 
     // Check the Variable Store Guid
-    if ( CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) == FALSE )
+    if (PcdGetBool (PcdIsSecureBoot)) {
+      Guid = &gEfiAuthenticatedVariableGuid;
+    } else {
+      Guid = &gEfiVariableGuid;
+    }
+    if (CompareGuid (&VariableStoreHeader->Signature, Guid) == FALSE)
     {
         DEBUG ((EFI_D_ERROR, "ValidateFvHeader: Variable Store Guid non-compatible\n"));
         return EFI_NOT_FOUND;