OvmfPkg: Add custom mode setup if the Secure Boot build option is specified.

If –D SECURE_BOOT_ENABLE is specified with the build command, Secure Boot support is enabled including custom mode setup.

This allows Secure Boot to be configured through setup allowing OvmfPkgX64, OvmfPkgIa32 and OvmfPkg3264 to be a fully functional Secure Boot reference platforms.
Remove redundant library class definitions for BaseCryptLib and OpenSslLib.

Signed-off-by: Lee Rosenbaum <lee.g.rosenbaum@intel.com>
Reviewed-by: Jordan Justen <jordan.l.justen@intel.com>
Reviewed-by: Erik Bjorge <erik.c.bjorge@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13160 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.c b/OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.c
index 956ff9e2c58b34cd1a17332638222e20ab9a77de..de0e4fa93851c030770323bb10b99f7749d5e544 100644 (file)
--- a/OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.c
+++ b/OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.c
@@ -15,36 +15,19 @@
 \r
 /**\r
 \r
-  This function detects whether a secure platform-specific method to clear PK(Platform Key)\r
-  is configured by platform owner. This method is provided for users force to clear PK\r
-  in case incorrect enrollment mis-haps.\r
+  This function provides a platform-specific method to detect whether the platform\r
+  is operating by a physically present user. \r
 \r
-  UEFI231 spec chapter 27.5.2 stipulates: The platform key may also be cleared using\r
-  a secure platform-specific method. In  this case, the global variable SetupMode\r
-  must also be updated to 1.\r
+  Programmatic changing of platform security policy (such as disable Secure Boot,\r
+  or switch between Standard/Custom Secure Boot mode) MUST NOT be possible during\r
+  Boot Services or after exiting EFI Boot Services. Only a physically present user\r
+  is allowed to perform these operations.\r
 \r
   NOTE THAT: This function cannot depend on any EFI Variable Service since they are\r
   not available when this function is called in AuthenticateVariable driver.\r
-\r
-  @retval  TRUE       The Platform owner wants to force clear PK.\r
-  @retval  FALSE      The Platform owner doesn't want to force clear PK.\r
-\r
-**/\r
-BOOLEAN\r
-EFIAPI\r
-ForceClearPK (\r
-  VOID\r
-  )\r
-{\r
-    return TRUE;\r
-}\r
-\r
-/**\r
-\r
-  This function detects whether current platform is operated by a physical present user.\r
-\r
-  @retval  TRUE       The Platform is operated by a physical present user.\r
-  @retval  FALSE      The Platform is NOT operated by a physical persent user.\r
+  \r
+  @retval  TRUE       The platform is operated by a physically present user.\r
+  @retval  FALSE      The platform is NOT operated by a physically present user.\r
 \r
 **/\r
 BOOLEAN\r

diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
index 2b0011cf5514fc9667fee684b01debe9c740b86d..c7d50e47189425da8fbc13e8c10ae599f6d9d9d7 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32.dsc
+++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -340,8 +340,6 @@
   MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {\r
     <LibraryClasses>\r
       NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf\r
-      BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
-      OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
        }\r
 !else\r
   MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf\r
@@ -494,4 +492,5 @@
       BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf\r
       OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
   }\r
+  SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf\r
 !endif\r

diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
index 235e3227775e59fbff4495c19c660322a09bf0f0..eda00ce0974b9c9e6c5b5653650743ae1bc7f752 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32.fdf
+++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -1,7 +1,7 @@
 ## @file\r
 #  Open Virtual Machine Firmware: FDF\r
 #\r
-#  Copyright (c) 2006 - 2011, Intel Corporation. All rights reserved.<BR>\r
+#  Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
 #\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
@@ -167,11 +167,14 @@ INF  PcAtChipsetPkg/PcatRealTimeClockRuntimeDxe/PcatRealTimeClockRuntimeDxe.inf
 INF  OvmfPkg/BlockMmioToBlockIoDxe/BlockIo.inf\r
 INF  OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf\r
 INF  MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf\r
+\r
 !if $(SECURE_BOOT_ENABLE) == TRUE\r
   INF  SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf\r
+  INF  SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf\r
 !else\r
   INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf\r
 !endif\r
+\r
 INF  MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf\r
 INF  MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf\r
 INF  MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf\r

diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
index 3b8257daa2c7c7c6c1a017697c0030f8a2acb132..df3b24a4b1c69d40a96bcf6a1d68d8e571116024 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -342,8 +342,6 @@
   MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {\r
     <LibraryClasses>\r
       NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf\r
-      BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
-      OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
        }\r
 !else\r
   MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf\r
@@ -496,4 +494,5 @@
       BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf\r
       OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
   }\r
+  SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf\r
 !endif\r

diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
index 2351e563ab64220da7b6d1192446318dda96fb67..7c98a6a2a8c731d71eae772b637573db1e0439d3 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32X64.fdf
+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -1,7 +1,7 @@
 ## @file\r
 #  Open Virtual Machine Firmware: FDF\r
 #\r
-#  Copyright (c) 2006 - 2011, Intel Corporation. All rights reserved.<BR>\r
+#  Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
 #\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
@@ -170,6 +170,7 @@ INF  MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
 \r
 !if $(SECURE_BOOT_ENABLE) == TRUE\r
   INF  SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf\r
+  INF  SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf\r
 !else\r
   INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf\r
 !endif\r

diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index 2c174ba05b62f37f20f2be45b304054d1cf4dac6..eec0f1b07d598f8c686a12e6a8af3c83d05098e3 100644 (file)
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -341,8 +341,6 @@
   MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {\r
     <LibraryClasses>\r
       NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf\r
-      BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
-      OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
        }\r
 !else\r
   MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf\r
@@ -495,4 +493,5 @@
       BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf\r
       OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
   }\r
+  SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf\r
 !endif\r

diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
index 16f21fe3c877f45fe7819801f9eebe65338846a8..490829844855241227b1d02794d8309ccdff8181 100644 (file)
--- a/OvmfPkg/OvmfPkgX64.fdf
+++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -1,7 +1,7 @@
 ## @file\r
 #  Open Virtual Machine Firmware: FDF\r
 #\r
-#  Copyright (c) 2006 - 2011, Intel Corporation. All rights reserved.<BR>\r
+#  Copyright (c) 2006 - 2012, Intel Corporation. All rights reserved.<BR>\r
 #\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions of the BSD License\r
@@ -170,6 +170,7 @@ INF  MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
 \r
 !if $(SECURE_BOOT_ENABLE) == TRUE\r
   INF  SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf\r
+  INF  SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf\r
 !else\r
   INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf\r
 !endif\r