From bbd64eb8658e9a33eab4227d9f4e51ad78d9f687 Mon Sep 17 00:00:00 2001
From: Laszlo Ersek <lersek@redhat.com>
Date: Tue, 4 Nov 2014 23:02:53 +0100
Subject: OvmfPkg: allow exclusion of the shell from the firmware image (RH
 only)

Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
RHEL-8.0/20180508-ee3198e672e2 rebase:

- reorder the rebase changelog in the commit message so that it reads like
  a blog: place more recent entries near the top
- no changes to the patch body

Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:

- no change

Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:

- no changes

Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:

- no changes

Message-id: <1415138578-27173-14-git-send-email-lersek@redhat.com>
Patchwork-id: 62119
O-Subject:  [RHEL-7.1 ovmf PATCH v2 13/18] OvmfPkg: allow exclusion of the shell
	from the firmware image (RH only)
Bugzilla: 1147592
Acked-by: Andrew Jones <drjones@redhat.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>

When '-D EXCLUDE_SHELL_FROM_FD' is passed to 'build', exclude the shell
binary from the firmware image.

Peter Jones advised us that firmware vendors for physical systems disable
the memory-mapped, firmware image-contained UEFI shell in
SecureBoot-enabled builds. The reason being that the memory-mapped shell
can always load, it may have direct access to various hardware in the
system, and it can run UEFI shell scripts (which cannot be signed at all).

Intended use of the new build option:

- In-tree builds: don't pass '-D EXCLUDE_SHELL_FROM_FD'. The resultant
  firmware image will contain a shell binary, independently of SecureBoot
  enablement, which is flexible for interactive development. (Ie. no
  change for in-tree builds.)

- RPM builds: pass both '-D SECURE_BOOT_ENABLE' and
  '-D EXCLUDE_SHELL_FROM_FD'. The resultant RPM will provide:

  - OVMF_CODE.fd: SecureBoot-enabled firmware, without builtin UEFI shell,

  - OVMF_VARS.fd: variable store template matching OVMF_CODE.fd,

  - UefiShell.iso: a bootable ISO image with the shell on it as default
    boot loader. The shell binary will load when SecureBoot is turned off,
    and won't load when SecureBoot is turned on (because it is not
    signed).

    UefiShell.iso is the reason we're not excluding the shell from the DSC
    files as well, only the FDF files -- when '-D EXCLUDE_SHELL_FROM_FD'
    is specified, the shell binary needs to be built the same, only it
    will be included in UefiShell.iso.

Signed-off-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit 9c391def70366cabae08e6008814299c3372fafd)
(cherry picked from commit d9dd9ee42937b2611fe37183cc9ec7f62d946933)
(cherry picked from commit 23df46ebbe7b09451d3a05034acd4d3a25e7177b)
(cherry picked from commit f0303f71d576c51b01c4ff961b429d0e0e707245)
---
 OvmfPkg/OvmfPkgIa32.fdf    | 2 ++
 OvmfPkg/OvmfPkgIa32X64.fdf | 2 ++
 OvmfPkg/OvmfPkgX64.fdf     | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
index f552bc9..73007dd 100644
--- a/OvmfPkg/OvmfPkgIa32.fdf
+++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -288,12 +288,14 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 
+!ifndef $(EXCLUDE_SHELL_FROM_FD)
 !ifndef $(USE_OLD_SHELL)
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 INF  ShellPkg/Application/Shell/Shell.inf
 !else
 INF  RuleOverride = BINARY EdkShellBinPkg/FullShell/FullShell.inf
 !endif
+!endif
 
 !if ($(SECURE_BOOT_ENABLE) == TRUE) || ($(TLS_ENABLE) == TRUE)
 INF MdeModulePkg/Logo/LogoOpenSSLDxe.inf
diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
index ee77ae1..116b3c6 100644
--- a/OvmfPkg/OvmfPkgIa32X64.fdf
+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -289,12 +289,14 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 
+!ifndef $(EXCLUDE_SHELL_FROM_FD)
 !ifndef $(USE_OLD_SHELL)
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 INF  ShellPkg/Application/Shell/Shell.inf
 !else
 INF  RuleOverride = BINARY USE = X64 EdkShellBinPkg/FullShell/FullShell.inf
 !endif
+!endif
 
 !if ($(SECURE_BOOT_ENABLE) == TRUE) || ($(TLS_ENABLE) == TRUE)
 INF MdeModulePkg/Logo/LogoOpenSSLDxe.inf
diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
index 505d25d..84d5845 100644
--- a/OvmfPkg/OvmfPkgX64.fdf
+++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -289,12 +289,14 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 
+!ifndef $(EXCLUDE_SHELL_FROM_FD)
 !ifndef $(USE_OLD_SHELL)
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 INF  ShellPkg/Application/Shell/Shell.inf
 !else
 INF  RuleOverride = BINARY EdkShellBinPkg/FullShell/FullShell.inf
 !endif
+!endif
 
 !if ($(SECURE_BOOT_ENABLE) == TRUE) || ($(TLS_ENABLE) == TRUE)
 INF MdeModulePkg/Logo/LogoOpenSSLDxe.inf
-- 
1.8.3.1