OvmfPkg: Enable secure-boot support when SECURE_BOOT_ENABLE==TRUE

Adjust PCD settings, library mappings and driver usage
to enable secure-boot when -D SECURE_BOOT_ENABLE=TRUE
is used on the build command line.

Signed-off-by: lgrosenb
Reviewed-by: jljusten
Reviewed-by: mdkinney
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13093 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
index 03fde20b43eb65d8c69f2e4a0fbbc76e69254a46..1b35b8c05b88731cf88cc99c74b31eaaf74646fb 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32.dsc
+++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -105,7 +105,18 @@
 \r
   ResetSystemLib|OvmfPkg/Library/ResetSystemLib/ResetSystemLib.inf\r
   LocalApicLib|UefiCpuPkg/Library/BaseXApicLib/BaseXApicLib.inf\r
-  DebugPrintErrorLevelLib|MdePkg/Library/BaseDebugPrintErrorLevelLib/BaseDebugPrintErrorLevelLib.inf  \r
+  DebugPrintErrorLevelLib|MdePkg/Library/BaseDebugPrintErrorLevelLib/BaseDebugPrintErrorLevelLib.inf\r
+\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf\r
+  IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf\r
+  OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
+!endif\r
+\r
+[LibraryClasses.common]\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
+!endif\r
 \r
 [LibraryClasses.common.SEC]\r
   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf\r
@@ -169,6 +180,9 @@
   PcdLib|MdePkg/Library/DxePcdLib/DxePcdLib.inf\r
   UefiRuntimeLib|MdePkg/Library/UefiRuntimeLib/UefiRuntimeLib.inf\r
   DxeServicesTableLib|MdePkg/Library/DxeServicesTableLib/DxeServicesTableLib.inf\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf\r
+!endif\r
 \r
 [LibraryClasses.common.UEFI_DRIVER]\r
   HobLib|MdePkg/Library/DxeHobLib/DxeHobLib.inf\r
@@ -222,7 +236,11 @@
   gEfiMdePkgTokenSpaceGuid.PcdMaximumGuidedExtractHandler|0x10\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdPeiCoreMaxFvSupported|6\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdPeiCoreMaxPeimPerFv|32\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x10000\r
+!else\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x400\r
+!endif\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxHardwareErrorVariableSize|0x8000\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xc000\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize|0xc000\r
@@ -239,6 +257,13 @@
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x2F\r
 !endif\r
 \r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  # override the default values from SecurityPkg to ensure images from all sources are verified in secure boot\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x05\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy|0x05\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy|0x05\r
+!endif\r
+\r
 !ifdef $(SOURCE_DEBUG_ENABLE)\r
   gEfiSourceLevelDebugPkgTokenSpaceGuid.PcdDebugLoadImageMethod|0x2\r
 !endif\r
@@ -309,7 +334,18 @@
   }\r
 \r
   MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf\r
+\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {\r
+    <LibraryClasses>\r
+      NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf\r
+      BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
+      OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
+       }\r
+!else\r
   MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf\r
+!endif\r
+\r
   MdeModulePkg/Universal/EbcDxe/EbcDxe.inf\r
   PcAtChipsetPkg/8259InterruptControllerDxe/8259.inf\r
   UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf\r
@@ -451,3 +487,10 @@
   }\r
 !endif\r
 \r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf {\r
+    <LibraryClasses>\r
+      BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf\r
+      OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
+  }\r
+!endif\r

diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
index c67a7829b26bccff7981518d2e6460caaae1a2d5..235e3227775e59fbff4495c19c660322a09bf0f0 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32.fdf
+++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -167,7 +167,11 @@ INF  PcAtChipsetPkg/PcatRealTimeClockRuntimeDxe/PcatRealTimeClockRuntimeDxe.inf
 INF  OvmfPkg/BlockMmioToBlockIoDxe/BlockIo.inf\r
 INF  OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf\r
 INF  MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf\r
-INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  INF  SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf\r
+!else\r
+  INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf\r
+!endif\r
 INF  MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf\r
 INF  MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf\r
 INF  MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf\r

diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
index 1ee74376ec3821e5ec4b58aee410fde01226f8c4..be10ba6f6c38d42d47690444c4d62fa2fff31007 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -106,7 +106,18 @@
 \r
   ResetSystemLib|OvmfPkg/Library/ResetSystemLib/ResetSystemLib.inf\r
   LocalApicLib|UefiCpuPkg/Library/BaseXApicLib/BaseXApicLib.inf\r
-  DebugPrintErrorLevelLib|MdePkg/Library/BaseDebugPrintErrorLevelLib/BaseDebugPrintErrorLevelLib.inf  \r
+  DebugPrintErrorLevelLib|MdePkg/Library/BaseDebugPrintErrorLevelLib/BaseDebugPrintErrorLevelLib.inf\r
+\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf\r
+  IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf\r
+  OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
+!endif\r
+\r
+[LibraryClasses.common]\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
+!endif\r
 \r
 [LibraryClasses.common.SEC]\r
   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf\r
@@ -170,6 +181,9 @@
   PcdLib|MdePkg/Library/DxePcdLib/DxePcdLib.inf\r
   UefiRuntimeLib|MdePkg/Library/UefiRuntimeLib/UefiRuntimeLib.inf\r
   DxeServicesTableLib|MdePkg/Library/DxeServicesTableLib/DxeServicesTableLib.inf\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf\r
+!endif\r
 \r
 [LibraryClasses.common.UEFI_DRIVER]\r
   HobLib|MdePkg/Library/DxeHobLib/DxeHobLib.inf\r
@@ -223,7 +237,11 @@
   gEfiMdePkgTokenSpaceGuid.PcdMaximumGuidedExtractHandler|0x10\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdPeiCoreMaxFvSupported|6\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdPeiCoreMaxPeimPerFv|32\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x10000\r
+!else\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x400\r
+!endif\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxHardwareErrorVariableSize|0x8000\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xc000\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize|0xc000\r
@@ -240,6 +258,13 @@
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x2F\r
 !endif\r
 \r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  # override the default values from SecurityPkg to ensure images from all sources are verified in secure boot\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x05\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy|0x05\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy|0x05\r
+!endif\r
+\r
 !ifdef $(SOURCE_DEBUG_ENABLE)\r
   gEfiSourceLevelDebugPkgTokenSpaceGuid.PcdDebugLoadImageMethod|0x2\r
 !endif\r
@@ -311,7 +336,18 @@
   }\r
 \r
   MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf\r
+\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {\r
+    <LibraryClasses>\r
+      NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf\r
+      BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
+      OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
+       }\r
+!else\r
   MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf\r
+!endif\r
+\r
   MdeModulePkg/Universal/EbcDxe/EbcDxe.inf\r
   PcAtChipsetPkg/8259InterruptControllerDxe/8259.inf\r
   UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf\r
@@ -453,3 +489,10 @@
   }\r
 !endif\r
 \r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf {\r
+    <LibraryClasses>\r
+      BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf\r
+      OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
+  }\r
+!endif\r

diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
index c2dde19ff46daf5db079853d31e0819068c117c8..2351e563ab64220da7b6d1192446318dda96fb67 100644 (file)
--- a/OvmfPkg/OvmfPkgIa32X64.fdf
+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -167,7 +167,13 @@ INF  PcAtChipsetPkg/PcatRealTimeClockRuntimeDxe/PcatRealTimeClockRuntimeDxe.inf
 INF  OvmfPkg/BlockMmioToBlockIoDxe/BlockIo.inf\r
 INF  OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf\r
 INF  MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf\r
-INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf\r
+\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  INF  SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf\r
+!else\r
+  INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf\r
+!endif\r
+\r
 INF  MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf\r
 INF  MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf\r
 INF  MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf\r

diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index 855ded45a711006d9f85f759446b4fb903f8dce5..f4a5eec107b528ee9d981cfcc04ceec1c8be12f2 100644 (file)
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -106,7 +106,18 @@
 \r
   ResetSystemLib|OvmfPkg/Library/ResetSystemLib/ResetSystemLib.inf\r
   LocalApicLib|UefiCpuPkg/Library/BaseXApicLib/BaseXApicLib.inf\r
-  DebugPrintErrorLevelLib|MdePkg/Library/BaseDebugPrintErrorLevelLib/BaseDebugPrintErrorLevelLib.inf  \r
+  DebugPrintErrorLevelLib|MdePkg/Library/BaseDebugPrintErrorLevelLib/BaseDebugPrintErrorLevelLib.inf\r
+\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf\r
+  IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf\r
+  OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
+!endif\r
+\r
+[LibraryClasses.common]\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
+!endif\r
 \r
 [LibraryClasses.common.SEC]\r
   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf\r
@@ -170,6 +181,9 @@
   PcdLib|MdePkg/Library/DxePcdLib/DxePcdLib.inf\r
   UefiRuntimeLib|MdePkg/Library/UefiRuntimeLib/UefiRuntimeLib.inf\r
   DxeServicesTableLib|MdePkg/Library/DxeServicesTableLib/DxeServicesTableLib.inf\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf\r
+!endif\r
 \r
 [LibraryClasses.common.UEFI_DRIVER]\r
   HobLib|MdePkg/Library/DxeHobLib/DxeHobLib.inf\r
@@ -223,7 +237,11 @@
   gEfiMdePkgTokenSpaceGuid.PcdMaximumGuidedExtractHandler|0x10\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdPeiCoreMaxFvSupported|6\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdPeiCoreMaxPeimPerFv|32\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x10000\r
+!else\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x400\r
+!endif\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxHardwareErrorVariableSize|0x8000\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xc000\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize|0xc000\r
@@ -240,6 +258,13 @@
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x2F\r
 !endif\r
 \r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  # override the default values from SecurityPkg to ensure images from all sources are verified in secure boot\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x05\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy|0x05\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy|0x05\r
+!endif\r
+\r
 !ifdef $(SOURCE_DEBUG_ENABLE)\r
   gEfiSourceLevelDebugPkgTokenSpaceGuid.PcdDebugLoadImageMethod|0x2\r
 !endif\r
@@ -310,7 +335,18 @@
   }\r
 \r
   MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf\r
+\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {\r
+    <LibraryClasses>\r
+      NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf\r
+      BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
+      OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
+       }\r
+!else\r
   MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf\r
+!endif\r
+\r
   MdeModulePkg/Universal/EbcDxe/EbcDxe.inf\r
   PcAtChipsetPkg/8259InterruptControllerDxe/8259.inf\r
   UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf\r
@@ -452,3 +488,10 @@
   }\r
 !endif\r
 \r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf {\r
+    <LibraryClasses>\r
+      BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf\r
+      OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf\r
+  }\r
+!endif\r

diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
index b08be66443c71110aa3fe008c5d61655c728bd30..16f21fe3c877f45fe7819801f9eebe65338846a8 100644 (file)
--- a/OvmfPkg/OvmfPkgX64.fdf
+++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -167,7 +167,13 @@ INF  PcAtChipsetPkg/PcatRealTimeClockRuntimeDxe/PcatRealTimeClockRuntimeDxe.inf
 INF  OvmfPkg/BlockMmioToBlockIoDxe/BlockIo.inf\r
 INF  OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf\r
 INF  MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf\r
-INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf\r
+\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  INF  SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf\r
+!else\r
+  INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf\r
+!endif\r
+\r
 INF  MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf\r
 INF  MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf\r
 INF  MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf\r