OvmfPkg: Enable secure-boot support when SECURE_BOOT_ENABLE==TRUE

[mirror_edk2.git] / OvmfPkg / OvmfPkgIa32X64.dsc

diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
index 1ee74376ec3821e5ec4b58aee410fde01226f8c4..be10ba6f6c38d42d47690444c4d62fa2fff31007 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -106,7 +106,18 @@
 \r
   ResetSystemLib|OvmfPkg/Library/ResetSystemLib/ResetSystemLib.inf\r
   LocalApicLib|UefiCpuPkg/Library/BaseXApicLib/BaseXApicLib.inf\r
-  DebugPrintErrorLevelLib|MdePkg/Library/BaseDebugPrintErrorLevelLib/BaseDebugPrintErrorLevelLib.inf  \r
+  DebugPrintErrorLevelLib|MdePkg/Library/BaseDebugPrintErrorLevelLib/BaseDebugPrintErrorLevelLib.inf\r
+\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf\r
+  IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf\r
+  OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
+!endif\r
+\r
+[LibraryClasses.common]\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
+!endif\r
 \r
 [LibraryClasses.common.SEC]\r
   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf\r
@@ -170,6 +181,9 @@
   PcdLib|MdePkg/Library/DxePcdLib/DxePcdLib.inf\r
   UefiRuntimeLib|MdePkg/Library/UefiRuntimeLib/UefiRuntimeLib.inf\r
   DxeServicesTableLib|MdePkg/Library/DxeServicesTableLib/DxeServicesTableLib.inf\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf\r
+!endif\r
 \r
 [LibraryClasses.common.UEFI_DRIVER]\r
   HobLib|MdePkg/Library/DxeHobLib/DxeHobLib.inf\r
@@ -223,7 +237,11 @@
   gEfiMdePkgTokenSpaceGuid.PcdMaximumGuidedExtractHandler|0x10\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdPeiCoreMaxFvSupported|6\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdPeiCoreMaxPeimPerFv|32\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x10000\r
+!else\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x400\r
+!endif\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxHardwareErrorVariableSize|0x8000\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xc000\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize|0xc000\r
@@ -240,6 +258,13 @@
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x2F\r
 !endif\r
 \r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  # override the default values from SecurityPkg to ensure images from all sources are verified in secure boot\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x05\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy|0x05\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy|0x05\r
+!endif\r
+\r
 !ifdef $(SOURCE_DEBUG_ENABLE)\r
   gEfiSourceLevelDebugPkgTokenSpaceGuid.PcdDebugLoadImageMethod|0x2\r
 !endif\r
@@ -311,7 +336,18 @@
   }\r
 \r
   MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf\r
+\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {\r
+    <LibraryClasses>\r
+      NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf\r
+      BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
+      OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
+       }\r
+!else\r
   MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf\r
+!endif\r
+\r
   MdeModulePkg/Universal/EbcDxe/EbcDxe.inf\r
   PcAtChipsetPkg/8259InterruptControllerDxe/8259.inf\r
   UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf\r
@@ -453,3 +489,10 @@
   }\r
 !endif\r
 \r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf {\r
+    <LibraryClasses>\r
+      BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf\r
+      OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
+  }\r
+!endif\r