From dc53c5fe4b90e1b4a24a9d2b04c8ea9a36b35394 Mon Sep 17 00:00:00 2001 From: Laszlo Ersek Date: Tue, 4 Nov 2014 23:02:53 +0100 Subject: OvmfPkg: allow exclusion of the shell from the firmware image (RH only) Message-id: <1415138578-27173-14-git-send-email-lersek@redhat.com> Patchwork-id: 62119 O-Subject: [RHEL-7.1 ovmf PATCH v2 13/18] OvmfPkg: allow exclusion of the shell from the firmware image (RH only) Bugzilla: 1147592 Acked-by: Andrew Jones Acked-by: Gerd Hoffmann Acked-by: Vitaly Kuznetsov When '-D EXCLUDE_SHELL_FROM_FD' is passed to 'build', exclude the shell binary from the firmware image. Peter Jones advised us that firmware vendors for physical systems disable the memory-mapped, firmware image-contained UEFI shell in SecureBoot-enabled builds. The reason being that the memory-mapped shell can always load, it may have direct access to various hardware in the system, and it can run UEFI shell scripts (which cannot be signed at all). Intended use of the new build option: - In-tree builds: don't pass '-D EXCLUDE_SHELL_FROM_FD'. The resultant firmware image will contain a shell binary, independently of SecureBoot enablement, which is flexible for interactive development. (Ie. no change for in-tree builds.) - RPM builds: pass both '-D SECURE_BOOT_ENABLE' and '-D EXCLUDE_SHELL_FROM_FD'. The resultant RPM will provide: - OVMF_CODE.fd: SecureBoot-enabled firmware, without builtin UEFI shell, - OVMF_VARS.fd: variable store template matching OVMF_CODE.fd, - UefiShell.iso: a bootable ISO image with the shell on it as default boot loader. The shell binary will load when SecureBoot is turned off, and won't load when SecureBoot is turned on (because it is not signed). UefiShell.iso is the reason we're not excluding the shell from the DSC files as well, only the FDF files -- when '-D EXCLUDE_SHELL_FROM_FD' is specified, the shell binary needs to be built the same, only it will be included in UefiShell.iso. Signed-off-by: Laszlo Ersek --- OvmfPkg/OvmfPkgIa32.fdf | 2 ++ OvmfPkg/OvmfPkgIa32X64.fdf | 2 ++ OvmfPkg/OvmfPkgX64.fdf | 2 ++ 3 files changed, 6 insertions(+) diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf index 89c0dbc..27db6ec 100644 --- a/OvmfPkg/OvmfPkgIa32.fdf +++ b/OvmfPkg/OvmfPkgIa32.fdf @@ -282,11 +282,13 @@ INF MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf INF FatPkg/EnhancedFatDxe/Fat.inf +!ifndef $(EXCLUDE_SHELL_FROM_FD) !ifndef $(USE_OLD_SHELL) INF ShellPkg/Application/Shell/Shell.inf !else INF RuleOverride = BINARY EdkShellBinPkg/FullShell/FullShell.inf !endif +!endif FILE FREEFORM = PCD(gEfiIntelFrameworkModulePkgTokenSpaceGuid.PcdLogoFile) { SECTION RAW = MdeModulePkg/Logo/Logo-OpenSSL.bmp diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf index 0265ff6..36f4999 100644 --- a/OvmfPkg/OvmfPkgIa32X64.fdf +++ b/OvmfPkg/OvmfPkgIa32X64.fdf @@ -282,11 +282,13 @@ INF MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf INF FatPkg/EnhancedFatDxe/Fat.inf +!ifndef $(EXCLUDE_SHELL_FROM_FD) !ifndef $(USE_OLD_SHELL) INF ShellPkg/Application/Shell/Shell.inf !else INF RuleOverride = BINARY USE = X64 EdkShellBinPkg/FullShell/FullShell.inf !endif +!endif FILE FREEFORM = PCD(gEfiIntelFrameworkModulePkgTokenSpaceGuid.PcdLogoFile) { SECTION RAW = MdeModulePkg/Logo/Logo-OpenSSL.bmp diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf index 1ae0450..9d3895b 100644 --- a/OvmfPkg/OvmfPkgX64.fdf +++ b/OvmfPkg/OvmfPkgX64.fdf @@ -282,11 +282,13 @@ INF MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf INF FatPkg/EnhancedFatDxe/Fat.inf +!ifndef $(EXCLUDE_SHELL_FROM_FD) !ifndef $(USE_OLD_SHELL) INF ShellPkg/Application/Shell/Shell.inf !else INF RuleOverride = BINARY EdkShellBinPkg/FullShell/FullShell.inf !endif +!endif FILE FREEFORM = PCD(gEfiIntelFrameworkModulePkgTokenSpaceGuid.PcdLogoFile) { SECTION RAW = MdeModulePkg/Logo/Logo-OpenSSL.bmp -- 1.8.3.1