On 26 August 2015 at 10:59, Ard Biesheuvel <[email protected]> wrote:
> This allows the FVP target to be built with UEFI Secure Boot enabled, > by passing -D SECURE_BOOT_ENABLE to the build command line. Note that > you will need to disable the ARM BDS (-D USE_ARM_BDS=FALSE) or you will > not be able to enroll certificates, since the ARM BDS does not provide > a GUI to do so. > > The FVP Base model is recommended in this case, since the certificate > store is kept in NOR flash, which the Foundation model does not emulate. > > Contributed-under: TianoCore Contribution Agreement 1.0 > Signed-off-by: Ard Biesheuvel <[email protected]> > Reviewd-by: Ryan Harkin <[email protected]> > --- > ArmPlatformPkg/ArmVExpressPkg/ArmVExpress-FVP-AArch64.dsc | 12 ++++++++++ > ArmPlatformPkg/ArmVExpressPkg/ArmVExpress-FVP-AArch64.fdf | 7 ++++++ > ArmPlatformPkg/ArmVExpressPkg/ArmVExpress.dsc.inc | 25 > ++++++++++++++++++++ > 3 files changed, 44 insertions(+) > > diff --git a/ArmPlatformPkg/ArmVExpressPkg/ArmVExpress-FVP-AArch64.dsc > b/ArmPlatformPkg/ArmVExpressPkg/ArmVExpress-FVP-AArch64.dsc > index 159194c8c731..ec29e65e3de5 100644 > --- a/ArmPlatformPkg/ArmVExpressPkg/ArmVExpress-FVP-AArch64.dsc > +++ b/ArmPlatformPkg/ArmVExpressPkg/ArmVExpress-FVP-AArch64.dsc > @@ -251,7 +251,15 @@ [Components.common] > # > ArmPkg/Drivers/CpuDxe/CpuDxe.inf > MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf > +!if $(SECURE_BOOT_ENABLE) == TRUE > + MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf { > + <LibraryClasses> > + > NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf > + } > + > SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf > +!else > MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf > +!endif > MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf { > <LibraryClasses> > @@ -272,7 +280,11 @@ [Components.common] > MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf > > ArmPkg/Drivers/ArmGic/ArmGicDxe.inf > +!if $(SECURE_BOOT_ENABLE) == TRUE > + ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashAuthenticatedDxe.inf > +!else > ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashDxe.inf > +!endif > ArmPkg/Drivers/TimerDxe/TimerDxe.inf > > ArmPlatformPkg/Drivers/LcdGraphicsOutputDxe/PL111LcdGraphicsOutputDxe.inf > ArmPlatformPkg/Drivers/SP805WatchdogDxe/SP805WatchdogDxe.inf > diff --git a/ArmPlatformPkg/ArmVExpressPkg/ArmVExpress-FVP-AArch64.fdf > b/ArmPlatformPkg/ArmVExpressPkg/ArmVExpress-FVP-AArch64.fdf > index 2ab99e98c238..9b54e3967466 100644 > --- a/ArmPlatformPkg/ArmVExpressPkg/ArmVExpress-FVP-AArch64.fdf > +++ b/ArmPlatformPkg/ArmVExpressPkg/ArmVExpress-FVP-AArch64.fdf > @@ -139,6 +139,9 @@ [FV.FvMain] > INF MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf > INF MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf > INF MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf > +!if $(SECURE_BOOT_ENABLE) == TRUE > + INF > SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf > +!endif > INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf > INF > MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf > INF > MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf > @@ -159,7 +162,11 @@ [FV.FvMain] > > INF ArmPkg/Drivers/ArmGic/ArmGicDxe.inf > INF ArmPkg/Drivers/TimerDxe/TimerDxe.inf > +!if $(SECURE_BOOT_ENABLE) == TRUE > + INF ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashAuthenticatedDxe.inf > +!else > INF ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashDxe.inf > +!endif > INF > ArmPlatformPkg/Drivers/LcdGraphicsOutputDxe/PL111LcdGraphicsOutputDxe.inf > INF ArmPlatformPkg/Drivers/SP805WatchdogDxe/SP805WatchdogDxe.inf > > diff --git a/ArmPlatformPkg/ArmVExpressPkg/ArmVExpress.dsc.inc > b/ArmPlatformPkg/ArmVExpressPkg/ArmVExpress.dsc.inc > index 1f0040d29f1d..39b25385932d 100644 > --- a/ArmPlatformPkg/ArmVExpressPkg/ArmVExpress.dsc.inc > +++ b/ArmPlatformPkg/ArmVExpressPkg/ArmVExpress.dsc.inc > @@ -14,6 +14,7 @@ > > [Defines] > USE_ARM_BDS = TRUE > + SECURE_BOOT_ENABLE = FALSE > > [BuildOptions.AARCH64.EDKII.DXE_RUNTIME_DRIVER] > GCC:*_*_AARCH64_DLINK_FLAGS = -z common-page-size=0x10000 > @@ -131,8 +132,22 @@ [LibraryClasses.common] > FileHandleLib|MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.inf > SortLib|MdeModulePkg/Library/UefiSortLib/UefiSortLib.inf > > + # > + # Secure Boot dependencies > + # > +!if $(SECURE_BOOT_ENABLE) == TRUE > + IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf > + OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf > + > TpmMeasurementLib|SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf > + AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf > + BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf > + > + # re-use the UserPhysicalPresent() dummy implementation from the ovmf > tree > + > PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf > +!else > > > TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurementLibNull.inf > > > AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf > +!endif > VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf > > !if $(USE_ARM_BDS) == FALSE > @@ -236,6 +251,9 @@ [LibraryClasses.common.DXE_RUNTIME_DRIVER] > > > ReportStatusCodeLib|IntelFrameworkModulePkg/Library/DxeReportStatusCodeLibFramework/DxeReportStatusCodeLib.inf > CapsuleLib|MdeModulePkg/Library/DxeCapsuleLibNull/DxeCapsuleLibNull.inf > > > ArmPlatformSysConfigLib|ArmPlatformPkg/ArmVExpressPkg/Library/ArmVExpressSysConfigRuntimeLib/ArmVExpressSysConfigRuntimeLib.inf > +!if $(SECURE_BOOT_ENABLE) == TRUE > + BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf > +!endif > > [LibraryClasses.AARCH64.DXE_RUNTIME_DRIVER] > # > @@ -413,6 +431,13 @@ [PcdsFixedAtBuild.common] > gEfiIntelFrameworkModulePkgTokenSpaceGuid.PcdShellFile|{ 0x83, 0xA5, > 0x04, 0x7C, 0x3E, 0x9E, 0x1C, 0x4F, 0xAD, 0x65, 0xE0, 0x52, 0x68, 0xD0, > 0xB4, 0xD1 } > !endif > > +!if $(SECURE_BOOT_ENABLE) == TRUE > + # override the default values from SecurityPkg to ensure images from > all sources are verified in secure boot > + gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x04 > + gEfiSecurityPkgTokenSpaceGuid.PcdFixedMediaImageVerificationPolicy|0x04 > + > gEfiSecurityPkgTokenSpaceGuid.PcdRemovableMediaImageVerificationPolicy|0x04 > +!endif > + > [Components.common] > MdeModulePkg/Universal/PCD/Dxe/Pcd.inf > > -- > 1.9.1 > > _______________________________________________ edk2-devel mailing list [email protected] https://lists.01.org/mailman/listinfo/edk2-devel
