ArmVirtPkg: Move secure boot support to ArmVirt.dsc.inc

The following platforms support secure boot:
- ArmVirtCloudHv.dsc
- ArmVirtQemu.dsc
- ArmVirtQemuKernel.dsc
and can disable it with a build-time option.
Make this build time option generic to all ArmVirtPkg platforms
while preventing Xen/Kvmtool platforms from enabling secure boot.

No functional change.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>

6 files changed, 46 insertions, 57 deletions

diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
index b56825716a..26f3dfb5e4 100644
--- a/ArmVirtPkg/ArmVirt.dsc.inc
+++ b/ArmVirtPkg/ArmVirt.dsc.inc
@@ -28,6 +28,16 @@
   DEFINE ENABLE_PCI              = TRUE

 !endif

 

+  #

+  # Catch invalid MACRO configurations from .dsc files

+  #

+!if $(SECURE_BOOT_ENABLE) == TRUE && $(SECURE_BOOT_ENABLE_SUPPORTED) == FALSE

+  !error SECURE_BOOT_ENABLE=TRUE is not supported for this platform.

+!endif

+!if $(TPM2_ENABLE) == TRUE && $(TPM2_ENABLE_SUPPORTED) == FALSE

+  !error TPM2_ENABLE=TRUE is not supported for this platform.

+!endif

+

 # Various builds now exceed 2MB so choose 3MB as the default.

 DEFINE FD_SIZE_IN_MB    = 3

 

@@ -422,6 +432,13 @@ DEFINE FD_SIZE_IN_MB    = 3
 

   gEfiMdeModulePkgTokenSpaceGuid.PcdResetOnMemoryTypeInformationChange|FALSE

 

+!if $(SECURE_BOOT_ENABLE) == TRUE

+  # override the default values from SecurityPkg to ensure images from all sources are verified in secure boot

+  gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x04

+  gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy|0x04

+  gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy|0x04

+!endif

+

 [PcdsDynamicDefault.common]

   #

   # ARM Timers

@@ -481,6 +498,19 @@ DEFINE FD_SIZE_IN_MB    = 3
   MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf

   MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf

   MdeModulePkg/Universal/Metronome/Metronome.inf

+!if $(SECURE_BOOT_ENABLE) == TRUE

+  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {

+    <LibraryClasses>

+      NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf

+!if $(TPM2_ENABLE) == TRUE

+      NULL|SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf

+!endif

+  }

+  SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf

+  OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf

+!else

+  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf

+!endif

 

   #

   # DXE

diff --git a/ArmVirtPkg/ArmVirtCloudHv.dsc b/ArmVirtPkg/ArmVirtCloudHv.dsc
index 2f9ba9a2e5..661c2f5c97 100644
--- a/ArmVirtPkg/ArmVirtCloudHv.dsc
+++ b/ArmVirtPkg/ArmVirtCloudHv.dsc
@@ -29,6 +29,11 @@
   DEFINE TTY_TERMINAL            = FALSE

   DEFINE SECURE_BOOT_ENABLE      = FALSE

 

+  #

+  # Defines for _SUPPORTED values, allowing to identify supported features.

+  #

+  DEFINE SECURE_BOOT_ENABLE_SUPPORTED                = TRUE

+

 # This comes at the beginning of includes to pick all relevant defines early on.

 !include ArmVirtPkg/ArmVirtStackCookies.dsc.inc

 

@@ -123,13 +128,6 @@
   #

   gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack|TRUE

 

-!if $(SECURE_BOOT_ENABLE) == TRUE

-  # override the default values from SecurityPkg to ensure images from all sources are verified in secure boot

-  gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x04

-  gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy|0x04

-  gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy|0x04

-!endif

-

   gEfiMdePkgTokenSpaceGuid.PcdReportStatusCodePropertyMask|3

   gEfiShellPkgTokenSpaceGuid.PcdShellFileOperationSize|0x20000

 

@@ -190,16 +188,6 @@
       # don't use unaligned CopyMem () on the UEFI varstore NOR flash region

       BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf

   }

-!if $(SECURE_BOOT_ENABLE) == TRUE

-  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {

-    <LibraryClasses>

-      NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf

-  }

-  SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf

-  OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf

-!else

-  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf

-!endif

   MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf

   EmbeddedPkg/RealTimeClockRuntimeDxe/RealTimeClockRuntimeDxe.inf {

     <LibraryClasses>

diff --git a/ArmVirtPkg/ArmVirtKvmTool.dsc b/ArmVirtPkg/ArmVirtKvmTool.dsc
index 86660e0a04..8409609d7d 100644
--- a/ArmVirtPkg/ArmVirtKvmTool.dsc
+++ b/ArmVirtPkg/ArmVirtKvmTool.dsc
@@ -218,7 +218,6 @@
       BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf

   }

 

-  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf

   MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf {

     <LibraryClasses>

       NULL|ArmVirtPkg/Library/NorFlashKvmtoolLib/NorFlashKvmtoolLib.inf

diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
index 36208fe86d..4167e67824 100644
--- a/ArmVirtPkg/ArmVirtQemu.dsc
+++ b/ArmVirtPkg/ArmVirtQemu.dsc
@@ -47,6 +47,12 @@
   DEFINE NETWORK_ISCSI_ENABLE            = FALSE

   DEFINE NETWORK_PXE_BOOT_ENABLE         = TRUE

 

+  #

+  # Defines for _SUPPORTED values, allowing to identify supported features.

+  #

+  DEFINE SECURE_BOOT_ENABLE_SUPPORTED              = TRUE

+  DEFINE TPM2_ENABLE_SUPPORTED                     = TRUE

+

 # This comes at the beginning of includes to pick all relevant defines early on.

 !include ArmVirtPkg/ArmVirtStackCookies.dsc.inc

 

@@ -207,13 +213,6 @@
   #

   gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack|TRUE

 

-!if $(SECURE_BOOT_ENABLE) == TRUE

-  # override the default values from SecurityPkg to ensure images from all sources are verified in secure boot

-  gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x04

-  gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy|0x04

-  gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy|0x04

-!endif

-

   gEfiMdePkgTokenSpaceGuid.PcdReportStatusCodePropertyMask|3

   gEfiShellPkgTokenSpaceGuid.PcdShellFileOperationSize|0x20000

 

@@ -368,19 +367,6 @@
       BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf

   }

 !endif

-!if $(SECURE_BOOT_ENABLE) == TRUE

-  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {

-    <LibraryClasses>

-      NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf

-!if $(TPM2_ENABLE) == TRUE

-      NULL|SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf

-!endif

-  }

-  SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf

-  OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf

-!else

-  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf

-!endif

   MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf {

     <LibraryClasses>

       NULL|EmbeddedPkg/Library/NvVarStoreFormattedLib/NvVarStoreFormattedLib.inf

diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
index 1ba016f161..284e578be8 100644
--- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
+++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
@@ -43,6 +43,11 @@
   DEFINE NETWORK_ISCSI_ENABLE            = FALSE

   DEFINE NETWORK_PXE_BOOT_ENABLE         = TRUE

 

+  #

+  # Defines for _SUPPORTED values, allowing to identify supported features.

+  #

+  DEFINE SECURE_BOOT_ENABLE_SUPPORTED                = TRUE

+

 # This comes at the beginning of includes to pick all relevant defines early on.

 !include ArmVirtPkg/ArmVirtStackCookies.dsc.inc

 

@@ -159,13 +164,6 @@
   #

   gEmbeddedTokenSpaceGuid.PcdPrePiCpuIoSize|16

 

-!if $(SECURE_BOOT_ENABLE) == TRUE

-  # override the default values from SecurityPkg to ensure images from all sources are verified in secure boot

-  gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x04

-  gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy|0x04

-  gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy|0x04

-!endif

-

   gEfiMdePkgTokenSpaceGuid.PcdReportStatusCodePropertyMask|3

   gEfiShellPkgTokenSpaceGuid.PcdShellFileOperationSize|0x20000

 

@@ -262,16 +260,6 @@
       BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf

   }

 !endif

-!if $(SECURE_BOOT_ENABLE) == TRUE

-  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {

-    <LibraryClasses>

-      NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf

-  }

-  SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf

-  OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf

-!else

-  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf

-!endif

   MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf {

     <LibraryClasses>

       NULL|EmbeddedPkg/Library/NvVarStoreFormattedLib/NvVarStoreFormattedLib.inf

diff --git a/ArmVirtPkg/ArmVirtXen.dsc b/ArmVirtPkg/ArmVirtXen.dsc
index ef7e70d367..639bf76b1b 100644
--- a/ArmVirtPkg/ArmVirtXen.dsc
+++ b/ArmVirtPkg/ArmVirtXen.dsc
@@ -125,8 +125,6 @@
   #

   # Architectural Protocols

   #

-  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf

-

   MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf {

     <LibraryClasses>

       NULL|MdeModulePkg/Library/VarCheckUefiLib/VarCheckUefiLib.inf