OvmfPkg: replace SECURE_BOOT_FEATURE_ENABLED with PcdSecureBootSupported

Drop the '-D SECURE_BOOT_FEATURE_ENABLED' compile time option,
use a new FeaturePcd instead.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

11 files changed, 20 insertions, 64 deletions

diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc
index cc2dd925bc..2a1139daaa 100644
--- a/OvmfPkg/CloudHv/CloudHvX64.dsc
+++ b/OvmfPkg/CloudHv/CloudHvX64.dsc
@@ -93,15 +93,6 @@
   INTEL:*_*_*_CC_FLAGS = /D DISABLE_NEW_DEPRECATED_INTERFACES

   GCC:*_*_*_CC_FLAGS = -D DISABLE_NEW_DEPRECATED_INTERFACES

 

-  #

-  # SECURE_BOOT_FEATURE_ENABLED

-  #

-!if $(SECURE_BOOT_ENABLE) == TRUE

-  MSFT:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED

-  INTEL:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED

-  GCC:*_*_*_CC_FLAGS = -D SECURE_BOOT_FEATURE_ENABLED

-!endif

-

 !include NetworkPkg/NetworkBuildOptions.dsc.inc

 

 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER]

@@ -477,6 +468,7 @@
   gEfiMdeModulePkgTokenSpaceGuid.PcdEnableVariableRuntimeCache|FALSE

 !endif

 !if $(SECURE_BOOT_ENABLE) == TRUE

+  gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported|TRUE

   gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE

 !endif

 

diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
index f734409055..d4403f11a7 100644
--- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
+++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
@@ -90,15 +90,6 @@
   INTEL:*_*_*_CC_FLAGS = /D TDX_PEI_LESS_BOOT

   GCC:*_*_*_CC_FLAGS = -D TDX_PEI_LESS_BOOT

 

-  #

-  # SECURE_BOOT_FEATURE_ENABLED

-  #

-!if $(SECURE_BOOT_ENABLE) == TRUE

-  MSFT:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED

-  INTEL:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED

-  GCC:*_*_*_CC_FLAGS = -D SECURE_BOOT_FEATURE_ENABLED

-!endif

-

 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER]

   GCC:*_*_*_DLINK_FLAGS = -z common-page-size=0x1000

   XCODE:*_*_*_DLINK_FLAGS = -seg1addr 0x1000 -segalign 0x1000

@@ -387,6 +378,7 @@
   gUefiOvmfPkgTokenSpaceGuid.PcdCsmEnable|TRUE

 !endif

 !if $(SECURE_BOOT_ENABLE) == TRUE

+  gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported|TRUE

   gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE

 !endif

 

diff --git a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c
index 72289da358..d4139b9115 100644
--- a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c
+++ b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c
@@ -28,14 +28,12 @@ ConnectNvVarsToFileSystem (
   IN EFI_HANDLE  FsHandle

   )

 {

- #ifdef SECURE_BOOT_FEATURE_ENABLED

-

-  return EFI_UNSUPPORTED;

-

- #else

-

   EFI_STATUS  Status;

 

+  if (FeaturePcdGet (PcdSecureBootSupported)) {

+    return EFI_UNSUPPORTED;

+  }

+

   //

   // We might fail to load the variable, since the file system initially

   // will not have the NvVars file.

@@ -52,7 +50,6 @@ ConnectNvVarsToFileSystem (
   }

 

   return Status;

- #endif

 }

 

 /**

diff --git a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.inf b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.inf
index 8cda78d0d0..f152c55046 100644
--- a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.inf
+++ b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.inf
@@ -47,6 +47,8 @@
 [Protocols]

   gEfiSimpleFileSystemProtocolGuid              ## CONSUMES

 

+[Pcd]

+  gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported

 

 [Guids]

   gEfiFileInfoGuid

diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
index e9aab51559..6fc11cc4d1 100644
--- a/OvmfPkg/Microvm/MicrovmX64.dsc
+++ b/OvmfPkg/Microvm/MicrovmX64.dsc
@@ -91,15 +91,6 @@
   INTEL:*_*_*_CC_FLAGS = /D DISABLE_NEW_DEPRECATED_INTERFACES

   GCC:*_*_*_CC_FLAGS = -D DISABLE_NEW_DEPRECATED_INTERFACES

 

-  #

-  # SECURE_BOOT_FEATURE_ENABLED

-  #

-!if $(SECURE_BOOT_ENABLE) == TRUE

-  MSFT:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED

-  INTEL:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED

-  GCC:*_*_*_CC_FLAGS = -D SECURE_BOOT_FEATURE_ENABLED

-!endif

-

 !include NetworkPkg/NetworkBuildOptions.dsc.inc

 

 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER]

@@ -473,6 +464,7 @@
   gEfiMdeModulePkgTokenSpaceGuid.PcdConOutUgaSupport|FALSE

   gEfiMdeModulePkgTokenSpaceGuid.PcdInstallAcpiSdtProtocol|TRUE

 !if $(SECURE_BOOT_ENABLE) == TRUE

+  gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported|TRUE

   gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE

 !endif

 

diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec
index 749fbd3b6b..03ae29e7b0 100644
--- a/OvmfPkg/OvmfPkg.dec
+++ b/OvmfPkg/OvmfPkg.dec
@@ -488,6 +488,9 @@
   #  used by OVMF, the varstore pflash chip, LockBox etc).

   gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire|FALSE|BOOLEAN|0x1e

 

+  ## This feature flag indicates the firmware build supports secure boot.

+  gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported|FALSE|BOOLEAN|0x6d

+

   ## Informs modules (including pre-DXE-phase modules) whether the platform

   #  firmware contains a CSM (Compatibility Support Module).

   #

diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
index 0ee97c35b0..e33805ddc2 100644
--- a/OvmfPkg/OvmfPkgIa32.dsc
+++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -96,15 +96,6 @@
   INTEL:*_*_*_CC_FLAGS = /D DISABLE_NEW_DEPRECATED_INTERFACES

   GCC:*_*_*_CC_FLAGS = -D DISABLE_NEW_DEPRECATED_INTERFACES

 

-  #

-  # SECURE_BOOT_FEATURE_ENABLED

-  #

-!if $(SECURE_BOOT_ENABLE) == TRUE

-  MSFT:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED

-  INTEL:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED

-  GCC:*_*_*_CC_FLAGS = -D SECURE_BOOT_FEATURE_ENABLED

-!endif

-

 !include NetworkPkg/NetworkBuildOptions.dsc.inc

 

 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER]

@@ -486,6 +477,7 @@
   gEfiMdeModulePkgTokenSpaceGuid.PcdEnableVariableRuntimeCache|FALSE

 !endif

 !if $(SECURE_BOOT_ENABLE) == TRUE

+  gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported|TRUE

   gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE

 !endif

 

diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
index 19c197a407..6c2c33ec0f 100644
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -100,15 +100,6 @@
   INTEL:*_*_*_CC_FLAGS = /D DISABLE_NEW_DEPRECATED_INTERFACES

   GCC:*_*_*_CC_FLAGS = -D DISABLE_NEW_DEPRECATED_INTERFACES

 

-  #

-  # SECURE_BOOT_FEATURE_ENABLED

-  #

-!if $(SECURE_BOOT_ENABLE) == TRUE

-  MSFT:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED

-  INTEL:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED

-  GCC:*_*_*_CC_FLAGS = -D SECURE_BOOT_FEATURE_ENABLED

-!endif

-

 !include NetworkPkg/NetworkBuildOptions.dsc.inc

 

 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER]

@@ -492,6 +483,7 @@
   gEfiMdeModulePkgTokenSpaceGuid.PcdEnableVariableRuntimeCache|FALSE

 !endif

 !if $(SECURE_BOOT_ENABLE) == TRUE

+  gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported|TRUE

   gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE

 !endif

 

diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index c5ab0df784..ac4d459345 100644
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -114,15 +114,6 @@
   INTEL:*_*_*_CC_FLAGS = /D TDX_GUEST_SUPPORTED

   GCC:*_*_*_CC_FLAGS = -D TDX_GUEST_SUPPORTED

 

-  #

-  # SECURE_BOOT_FEATURE_ENABLED

-  #

-!if $(SECURE_BOOT_ENABLE) == TRUE

-  MSFT:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED

-  INTEL:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED

-  GCC:*_*_*_CC_FLAGS = -D SECURE_BOOT_FEATURE_ENABLED

-!endif

-

 !include NetworkPkg/NetworkBuildOptions.dsc.inc

 

 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER]

@@ -513,6 +504,7 @@
   gEfiMdeModulePkgTokenSpaceGuid.PcdEnableVariableRuntimeCache|FALSE

 !endif

 !if $(SECURE_BOOT_ENABLE) == TRUE

+  gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported|TRUE

   gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE

 !endif

 

diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
index cc9384ba5c..c56247e294 100644
--- a/OvmfPkg/PlatformPei/Platform.c
+++ b/OvmfPkg/PlatformPei/Platform.c
@@ -222,9 +222,10 @@ ReserveEmuVariableNvStore (
   VariableStore = (EFI_PHYSICAL_ADDRESS)(UINTN)PlatformReserveEmuVariableNvStore ();

   PcdStatus     = PcdSet64S (PcdEmuVariableNvStoreReserved, VariableStore);

 

- #ifdef SECURE_BOOT_FEATURE_ENABLED

-  PlatformInitEmuVariableNvStore ((VOID *)(UINTN)VariableStore);

- #endif

+  if (FeaturePcdGet (PcdSecureBootSupported)) {

+    // restore emulated VarStore from pristine ROM copy

+    PlatformInitEmuVariableNvStore ((VOID *)(UINTN)VariableStore);

+  }

 

   ASSERT_RETURN_ERROR (PcdStatus);

 }

diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf
index 1fadadeb55..3934aeed95 100644
--- a/OvmfPkg/PlatformPei/PlatformPei.inf
+++ b/OvmfPkg/PlatformPei/PlatformPei.inf
@@ -94,6 +94,7 @@
   gUefiOvmfPkgTokenSpaceGuid.PcdQ35SmramAtDefaultSmbase

   gUefiOvmfPkgTokenSpaceGuid.PcdXenPvhStartOfDayStructPtr

   gUefiOvmfPkgTokenSpaceGuid.PcdXenPvhStartOfDayStructPtrSize

+  gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported

   gEfiMdePkgTokenSpaceGuid.PcdGuidedExtractHandlerTableAddress

   gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress

   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize