From 92da8a154fc0a1b0f42ab0ec4aee7dd2933f1a0a Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Fri, 21 Apr 2023 08:55:44 +0200 Subject: OvmfPkg: replace SECURE_BOOT_FEATURE_ENABLED with PcdSecureBootSupported Drop the '-D SECURE_BOOT_FEATURE_ENABLED' compile time option, use a new FeaturePcd instead. Signed-off-by: Gerd Hoffmann --- OvmfPkg/CloudHv/CloudHvX64.dsc | 10 +--------- OvmfPkg/IntelTdx/IntelTdxX64.dsc | 10 +--------- OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c | 11 ++++------- OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.inf | 2 ++ OvmfPkg/Microvm/MicrovmX64.dsc | 10 +--------- OvmfPkg/OvmfPkg.dec | 3 +++ OvmfPkg/OvmfPkgIa32.dsc | 10 +--------- OvmfPkg/OvmfPkgIa32X64.dsc | 10 +--------- OvmfPkg/OvmfPkgX64.dsc | 10 +--------- OvmfPkg/PlatformPei/Platform.c | 7 ++++--- OvmfPkg/PlatformPei/PlatformPei.inf | 1 + 11 files changed, 20 insertions(+), 64 deletions(-) (limited to 'OvmfPkg') diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc index cc2dd925bc..2a1139daaa 100644 --- a/OvmfPkg/CloudHv/CloudHvX64.dsc +++ b/OvmfPkg/CloudHv/CloudHvX64.dsc @@ -93,15 +93,6 @@ INTEL:*_*_*_CC_FLAGS = /D DISABLE_NEW_DEPRECATED_INTERFACES GCC:*_*_*_CC_FLAGS = -D DISABLE_NEW_DEPRECATED_INTERFACES - # - # SECURE_BOOT_FEATURE_ENABLED - # -!if $(SECURE_BOOT_ENABLE) == TRUE - MSFT:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED - INTEL:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED - GCC:*_*_*_CC_FLAGS = -D SECURE_BOOT_FEATURE_ENABLED -!endif - !include NetworkPkg/NetworkBuildOptions.dsc.inc [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] @@ -477,6 +468,7 @@ gEfiMdeModulePkgTokenSpaceGuid.PcdEnableVariableRuntimeCache|FALSE !endif !if $(SECURE_BOOT_ENABLE) == TRUE + gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported|TRUE gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE !endif diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc index f734409055..d4403f11a7 100644 --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc @@ -90,15 +90,6 @@ INTEL:*_*_*_CC_FLAGS = /D TDX_PEI_LESS_BOOT GCC:*_*_*_CC_FLAGS = -D TDX_PEI_LESS_BOOT - # - # SECURE_BOOT_FEATURE_ENABLED - # -!if $(SECURE_BOOT_ENABLE) == TRUE - MSFT:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED - INTEL:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED - GCC:*_*_*_CC_FLAGS = -D SECURE_BOOT_FEATURE_ENABLED -!endif - [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] GCC:*_*_*_DLINK_FLAGS = -z common-page-size=0x1000 XCODE:*_*_*_DLINK_FLAGS = -seg1addr 0x1000 -segalign 0x1000 @@ -387,6 +378,7 @@ gUefiOvmfPkgTokenSpaceGuid.PcdCsmEnable|TRUE !endif !if $(SECURE_BOOT_ENABLE) == TRUE + gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported|TRUE gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE !endif diff --git a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c index 72289da358..d4139b9115 100644 --- a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c +++ b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c @@ -28,14 +28,12 @@ ConnectNvVarsToFileSystem ( IN EFI_HANDLE FsHandle ) { - #ifdef SECURE_BOOT_FEATURE_ENABLED - - return EFI_UNSUPPORTED; - - #else - EFI_STATUS Status; + if (FeaturePcdGet (PcdSecureBootSupported)) { + return EFI_UNSUPPORTED; + } + // // We might fail to load the variable, since the file system initially // will not have the NvVars file. @@ -52,7 +50,6 @@ ConnectNvVarsToFileSystem ( } return Status; - #endif } /** diff --git a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.inf b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.inf index 8cda78d0d0..f152c55046 100644 --- a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.inf +++ b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.inf @@ -47,6 +47,8 @@ [Protocols] gEfiSimpleFileSystemProtocolGuid ## CONSUMES +[Pcd] + gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported [Guids] gEfiFileInfoGuid diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc index e9aab51559..6fc11cc4d1 100644 --- a/OvmfPkg/Microvm/MicrovmX64.dsc +++ b/OvmfPkg/Microvm/MicrovmX64.dsc @@ -91,15 +91,6 @@ INTEL:*_*_*_CC_FLAGS = /D DISABLE_NEW_DEPRECATED_INTERFACES GCC:*_*_*_CC_FLAGS = -D DISABLE_NEW_DEPRECATED_INTERFACES - # - # SECURE_BOOT_FEATURE_ENABLED - # -!if $(SECURE_BOOT_ENABLE) == TRUE - MSFT:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED - INTEL:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED - GCC:*_*_*_CC_FLAGS = -D SECURE_BOOT_FEATURE_ENABLED -!endif - !include NetworkPkg/NetworkBuildOptions.dsc.inc [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] @@ -473,6 +464,7 @@ gEfiMdeModulePkgTokenSpaceGuid.PcdConOutUgaSupport|FALSE gEfiMdeModulePkgTokenSpaceGuid.PcdInstallAcpiSdtProtocol|TRUE !if $(SECURE_BOOT_ENABLE) == TRUE + gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported|TRUE gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE !endif diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index 749fbd3b6b..03ae29e7b0 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -488,6 +488,9 @@ # used by OVMF, the varstore pflash chip, LockBox etc). gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire|FALSE|BOOLEAN|0x1e + ## This feature flag indicates the firmware build supports secure boot. + gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported|FALSE|BOOLEAN|0x6d + ## Informs modules (including pre-DXE-phase modules) whether the platform # firmware contains a CSM (Compatibility Support Module). # diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 0ee97c35b0..e33805ddc2 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -96,15 +96,6 @@ INTEL:*_*_*_CC_FLAGS = /D DISABLE_NEW_DEPRECATED_INTERFACES GCC:*_*_*_CC_FLAGS = -D DISABLE_NEW_DEPRECATED_INTERFACES - # - # SECURE_BOOT_FEATURE_ENABLED - # -!if $(SECURE_BOOT_ENABLE) == TRUE - MSFT:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED - INTEL:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED - GCC:*_*_*_CC_FLAGS = -D SECURE_BOOT_FEATURE_ENABLED -!endif - !include NetworkPkg/NetworkBuildOptions.dsc.inc [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] @@ -486,6 +477,7 @@ gEfiMdeModulePkgTokenSpaceGuid.PcdEnableVariableRuntimeCache|FALSE !endif !if $(SECURE_BOOT_ENABLE) == TRUE + gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported|TRUE gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE !endif diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index 19c197a407..6c2c33ec0f 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -100,15 +100,6 @@ INTEL:*_*_*_CC_FLAGS = /D DISABLE_NEW_DEPRECATED_INTERFACES GCC:*_*_*_CC_FLAGS = -D DISABLE_NEW_DEPRECATED_INTERFACES - # - # SECURE_BOOT_FEATURE_ENABLED - # -!if $(SECURE_BOOT_ENABLE) == TRUE - MSFT:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED - INTEL:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED - GCC:*_*_*_CC_FLAGS = -D SECURE_BOOT_FEATURE_ENABLED -!endif - !include NetworkPkg/NetworkBuildOptions.dsc.inc [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] @@ -492,6 +483,7 @@ gEfiMdeModulePkgTokenSpaceGuid.PcdEnableVariableRuntimeCache|FALSE !endif !if $(SECURE_BOOT_ENABLE) == TRUE + gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported|TRUE gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE !endif diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index c5ab0df784..ac4d459345 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -114,15 +114,6 @@ INTEL:*_*_*_CC_FLAGS = /D TDX_GUEST_SUPPORTED GCC:*_*_*_CC_FLAGS = -D TDX_GUEST_SUPPORTED - # - # SECURE_BOOT_FEATURE_ENABLED - # -!if $(SECURE_BOOT_ENABLE) == TRUE - MSFT:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED - INTEL:*_*_*_CC_FLAGS = /D SECURE_BOOT_FEATURE_ENABLED - GCC:*_*_*_CC_FLAGS = -D SECURE_BOOT_FEATURE_ENABLED -!endif - !include NetworkPkg/NetworkBuildOptions.dsc.inc [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] @@ -513,6 +504,7 @@ gEfiMdeModulePkgTokenSpaceGuid.PcdEnableVariableRuntimeCache|FALSE !endif !if $(SECURE_BOOT_ENABLE) == TRUE + gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported|TRUE gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE !endif diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c index cc9384ba5c..c56247e294 100644 --- a/OvmfPkg/PlatformPei/Platform.c +++ b/OvmfPkg/PlatformPei/Platform.c @@ -222,9 +222,10 @@ ReserveEmuVariableNvStore ( VariableStore = (EFI_PHYSICAL_ADDRESS)(UINTN)PlatformReserveEmuVariableNvStore (); PcdStatus = PcdSet64S (PcdEmuVariableNvStoreReserved, VariableStore); - #ifdef SECURE_BOOT_FEATURE_ENABLED - PlatformInitEmuVariableNvStore ((VOID *)(UINTN)VariableStore); - #endif + if (FeaturePcdGet (PcdSecureBootSupported)) { + // restore emulated VarStore from pristine ROM copy + PlatformInitEmuVariableNvStore ((VOID *)(UINTN)VariableStore); + } ASSERT_RETURN_ERROR (PcdStatus); } diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf index 1fadadeb55..3934aeed95 100644 --- a/OvmfPkg/PlatformPei/PlatformPei.inf +++ b/OvmfPkg/PlatformPei/PlatformPei.inf @@ -94,6 +94,7 @@ gUefiOvmfPkgTokenSpaceGuid.PcdQ35SmramAtDefaultSmbase gUefiOvmfPkgTokenSpaceGuid.PcdXenPvhStartOfDayStructPtr gUefiOvmfPkgTokenSpaceGuid.PcdXenPvhStartOfDayStructPtrSize + gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootSupported gEfiMdePkgTokenSpaceGuid.PcdGuidedExtractHandlerTableAddress gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize -- cgit v1.2.3