[edk2-devel] [PATCH] EmulatorPkg: Enable support for Authenticated Variables

[edk2-devel] [PATCH] EmulatorPkg: Enable support for Authenticated Variables

[Wadhawan, Divneil R]

SECURE_BOOT_ENABLE feature flag is introduced to enable Authenticated
variable support by:
o Enabling storage space
o Enabling AuthLib support

Signed-off-by: Divneil Rai Wadhawan <divneil.r.wadhawan@intel.com>
---
 EmulatorPkg/EmulatorPkg.dsc | 17 ++++++++++++++++-
 EmulatorPkg/EmulatorPkg.fdf | 14 ++++++++++----
 2 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/EmulatorPkg/EmulatorPkg.dsc b/EmulatorPkg/EmulatorPkg.dsc
index 86a6271735..06cd8a9b4c 100644
--- a/EmulatorPkg/EmulatorPkg.dsc
+++ b/EmulatorPkg/EmulatorPkg.dsc
@@ -32,6 +32,7 @@
   DEFINE NETWORK_TLS_ENABLE       = FALSE
   DEFINE NETWORK_HTTP_BOOT_ENABLE = FALSE
   DEFINE NETWORK_ISCSI_ENABLE     = FALSE
+  DEFINE SECURE_BOOT_ENABLE       = TRUE
 
 [SkuIds]
   0|DEFAULT
@@ -89,6 +90,7 @@
   TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf
   SerialPortLib|MdePkg/Library/BaseSerialPortLibNull/BaseSerialPortLibNull.inf
   CapsuleLib|MdeModulePkg/Library/DxeCapsuleLibNull/DxeCapsuleLibNull.inf
+
   #
   # Platform
   #
@@ -106,12 +108,21 @@
   LockBoxLib|MdeModulePkg/Library/LockBoxNullLib/LockBoxNullLib.inf
   CpuExceptionHandlerLib|MdeModulePkg/Library/CpuExceptionHandlerLibNull/CpuExceptionHandlerLibNull.inf
   TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurementLibNull.inf
-  AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
   VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf
   SortLib|MdeModulePkg/Library/BaseSortLib/BaseSortLib.inf
   ShellLib|ShellPkg/Library/UefiShellLib/UefiShellLib.inf
   FileHandleLib|MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.inf
 
+  !if $(SECURE_BOOT_ENABLE) == TRUE
+    IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
+    OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+    PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
+    BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
+    AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+  !else
+    AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
+  !endif
+
 [LibraryClasses.common.SEC]
   PeiServicesLib|EmulatorPkg/Library/SecPeiServicesLib/SecPeiServicesLib.inf
   PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
@@ -190,6 +201,10 @@
   gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareFdSize|0x002a0000
   gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareBlockSize|0x10000
   gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareVolume|L"../FV/FV_RECOVERY.fd"
+  !if $(SECURE_BOOT_ENABLE) == TRUE
+    gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
+    gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE
+  !endif
 
   gEmulatorPkgTokenSpaceGuid.PcdEmuMemorySize|L"64!64"
 
diff --git a/EmulatorPkg/EmulatorPkg.fdf b/EmulatorPkg/EmulatorPkg.fdf
index 295f6f1db8..93552baf8b 100644
--- a/EmulatorPkg/EmulatorPkg.fdf
+++ b/EmulatorPkg/EmulatorPkg.fdf
@@ -46,10 +46,16 @@ DATA = {
   # Blockmap[1]: End
   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
   ## This is the VARIABLE_STORE_HEADER
-  #Signature: gEfiVariableGuid =
-  #  { 0xddcf3616, 0x3275, 0x4164, { 0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d }}
-  0x16, 0x36, 0xcf, 0xdd, 0x75, 0x32, 0x64, 0x41,
-  0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d,
+  !if $(SECURE_BOOT_ENABLE) == FALSE
+    #Signature: gEfiVariableGuid =
+    #  { 0xddcf3616, 0x3275, 0x4164, { 0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d }}
+    0x16, 0x36, 0xcf, 0xdd, 0x75, 0x32, 0x64, 0x41,
+    0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d,
+  !else
+    # Signature: gEfiAuthenticatedVariableGuid = { 0xaaf32c78, 0x947b, 0x439a, { 0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92 } }
+    0x78, 0x2c, 0xf3, 0xaa, 0x7b, 0x94, 0x9a, 0x43,
+    0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92,
+  !endif
   #Size: 0xc000 (gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize) - 0x48 (size of EFI_FIRMWARE_VOLUME_HEADER) = 0xBFB8
   # This can speed up the Variable Dispatch a bit.
   0xB8, 0xBF, 0x00, 0x00,
-- 
2.24.1.windows.2

Re: [edk2-devel] [PATCH] EmulatorPkg: Enable support for Authenticated Variables

[Michael D Kinney]

Cc EmulatorPkg maintainers.

The default in other platforms is SECURE_BOOT_ENABLE = FALSE.  This might be a good
default to use here as well so EmulatorPkg builds are faster without CryptoPkg/OpenSSL 
dependencies.  Developers wanting to use auth variables can enabled on the build 
command line using /D SECURE_BOOT_ENABLE=TRUE

I do not think this patch enables UEFI Secure Boot for PE/COFF image authentication.
Should we use a different define name such as AUTH_VARIABLE_ENABLE?

Thanks,

Mike

> -----Original Message-----
> From: Wadhawan, Divneil R <divneil.r.wadhawan@intel.com>
> Sent: Wednesday, September 2, 2020 10:44 AM
> To: devel@edk2.groups.io
> Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Wadhawan, Divneil R <divneil.r.wadhawan@intel.com>
> Subject: [edk2-devel] [PATCH] EmulatorPkg: Enable support for Authenticated Variables
> 
> SECURE_BOOT_ENABLE feature flag is introduced to enable Authenticated
> variable support by:
> o Enabling storage space
> o Enabling AuthLib support
> 
> Signed-off-by: Divneil Rai Wadhawan <divneil.r.wadhawan@intel.com>
> ---
>  EmulatorPkg/EmulatorPkg.dsc | 17 ++++++++++++++++-
>  EmulatorPkg/EmulatorPkg.fdf | 14 ++++++++++----
>  2 files changed, 26 insertions(+), 5 deletions(-)
> 
> diff --git a/EmulatorPkg/EmulatorPkg.dsc b/EmulatorPkg/EmulatorPkg.dsc
> index 86a6271735..06cd8a9b4c 100644
> --- a/EmulatorPkg/EmulatorPkg.dsc
> +++ b/EmulatorPkg/EmulatorPkg.dsc
> @@ -32,6 +32,7 @@
>    DEFINE NETWORK_TLS_ENABLE       = FALSE
>    DEFINE NETWORK_HTTP_BOOT_ENABLE = FALSE
>    DEFINE NETWORK_ISCSI_ENABLE     = FALSE
> +  DEFINE SECURE_BOOT_ENABLE       = TRUE
> 
>  [SkuIds]
>    0|DEFAULT
> @@ -89,6 +90,7 @@
>    TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf
>    SerialPortLib|MdePkg/Library/BaseSerialPortLibNull/BaseSerialPortLibNull.inf
>    CapsuleLib|MdeModulePkg/Library/DxeCapsuleLibNull/DxeCapsuleLibNull.inf
> +
>    #
>    # Platform
>    #
> @@ -106,12 +108,21 @@
>    LockBoxLib|MdeModulePkg/Library/LockBoxNullLib/LockBoxNullLib.inf
>    CpuExceptionHandlerLib|MdeModulePkg/Library/CpuExceptionHandlerLibNull/CpuExceptionHandlerLibNull.inf
>    TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasurementLibNull.inf
> -  AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
>    VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf
>    SortLib|MdeModulePkg/Library/BaseSortLib/BaseSortLib.inf
>    ShellLib|ShellPkg/Library/UefiShellLib/UefiShellLib.inf
>    FileHandleLib|MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.inf
> 
> +  !if $(SECURE_BOOT_ENABLE) == TRUE
> +    IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
> +    OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
> +    PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
> +    BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
> +    AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> +  !else
> +    AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
> +  !endif
> +
>  [LibraryClasses.common.SEC]
>    PeiServicesLib|EmulatorPkg/Library/SecPeiServicesLib/SecPeiServicesLib.inf
>    PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
> @@ -190,6 +201,10 @@
>    gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareFdSize|0x002a0000
>    gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareBlockSize|0x10000
>    gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareVolume|L"../FV/FV_RECOVERY.fd"
> +  !if $(SECURE_BOOT_ENABLE) == TRUE
> +    gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
> +    gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE
> +  !endif
> 
>    gEmulatorPkgTokenSpaceGuid.PcdEmuMemorySize|L"64!64"
> 
> diff --git a/EmulatorPkg/EmulatorPkg.fdf b/EmulatorPkg/EmulatorPkg.fdf
> index 295f6f1db8..93552baf8b 100644
> --- a/EmulatorPkg/EmulatorPkg.fdf
> +++ b/EmulatorPkg/EmulatorPkg.fdf
> @@ -46,10 +46,16 @@ DATA = {
>    # Blockmap[1]: End
>    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
>    ## This is the VARIABLE_STORE_HEADER
> -  #Signature: gEfiVariableGuid =
> -  #  { 0xddcf3616, 0x3275, 0x4164, { 0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d }}
> -  0x16, 0x36, 0xcf, 0xdd, 0x75, 0x32, 0x64, 0x41,
> -  0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d,
> +  !if $(SECURE_BOOT_ENABLE) == FALSE
> +    #Signature: gEfiVariableGuid =
> +    #  { 0xddcf3616, 0x3275, 0x4164, { 0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d }}
> +    0x16, 0x36, 0xcf, 0xdd, 0x75, 0x32, 0x64, 0x41,
> +    0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d,
> +  !else
> +    # Signature: gEfiAuthenticatedVariableGuid = { 0xaaf32c78, 0x947b, 0x439a, { 0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92 } }
> +    0x78, 0x2c, 0xf3, 0xaa, 0x7b, 0x94, 0x9a, 0x43,
> +    0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92,
> +  !endif
>    #Size: 0xc000 (gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize) - 0x48 (size of EFI_FIRMWARE_VOLUME_HEADER) = 0xBFB8
>    # This can speed up the Variable Dispatch a bit.
>    0xB8, 0xBF, 0x00, 0x00,
> --
> 2.24.1.windows.2

Re: [edk2-devel] [PATCH] EmulatorPkg: Enable support for Authenticated Variables

[Wadhawan, Divneil R]

Hi Mike,

I have a new patch enabling secure boot menu and authenticated execution of images, so, I am dropping this patch.
The new patch will include the content of this patch too.

Regards,
Divneil

-----Original Message-----
From: Kinney, Michael D <michael.d.kinney@intel.com> 
Sent: Thursday, September 3, 2020 1:42 AM
To: Wadhawan, Divneil R <divneil.r.wadhawan@intel.com>; devel@edk2.groups.io; Kinney, Michael D <michael.d.kinney@intel.com>
Cc: Ni, Ray <ray.ni@intel.com>; Andrew Fish (afish@apple.com) <afish@apple.com>; Justen, Jordan L <jordan.l.justen@intel.com>
Subject: RE: [edk2-devel] [PATCH] EmulatorPkg: Enable support for Authenticated Variables

Cc EmulatorPkg maintainers.

The default in other platforms is SECURE_BOOT_ENABLE = FALSE.  This might be a good default to use here as well so EmulatorPkg builds are faster without CryptoPkg/OpenSSL dependencies.  Developers wanting to use auth variables can enabled on the build command line using /D SECURE_BOOT_ENABLE=TRUE

I do not think this patch enables UEFI Secure Boot for PE/COFF image authentication.
Should we use a different define name such as AUTH_VARIABLE_ENABLE?

Thanks,

Mike

> -----Original Message-----
> From: Wadhawan, Divneil R <divneil.r.wadhawan@intel.com>
> Sent: Wednesday, September 2, 2020 10:44 AM
> To: devel@edk2.groups.io
> Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Wadhawan, Divneil 
> R <divneil.r.wadhawan@intel.com>
> Subject: [edk2-devel] [PATCH] EmulatorPkg: Enable support for 
> Authenticated Variables
> 
> SECURE_BOOT_ENABLE feature flag is introduced to enable Authenticated 
> variable support by:
> o Enabling storage space
> o Enabling AuthLib support
> 
> Signed-off-by: Divneil Rai Wadhawan <divneil.r.wadhawan@intel.com>
> ---
>  EmulatorPkg/EmulatorPkg.dsc | 17 ++++++++++++++++-  
> EmulatorPkg/EmulatorPkg.fdf | 14 ++++++++++----
>  2 files changed, 26 insertions(+), 5 deletions(-)
> 
> diff --git a/EmulatorPkg/EmulatorPkg.dsc b/EmulatorPkg/EmulatorPkg.dsc 
> index 86a6271735..06cd8a9b4c 100644
> --- a/EmulatorPkg/EmulatorPkg.dsc
> +++ b/EmulatorPkg/EmulatorPkg.dsc
> @@ -32,6 +32,7 @@
>    DEFINE NETWORK_TLS_ENABLE       = FALSE
>    DEFINE NETWORK_HTTP_BOOT_ENABLE = FALSE
>    DEFINE NETWORK_ISCSI_ENABLE     = FALSE
> +  DEFINE SECURE_BOOT_ENABLE       = TRUE
> 
>  [SkuIds]
>    0|DEFAULT
> @@ -89,6 +90,7 @@
>    TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf
>    SerialPortLib|MdePkg/Library/BaseSerialPortLibNull/BaseSerialPortLibNull.inf
>    
> CapsuleLib|MdeModulePkg/Library/DxeCapsuleLibNull/DxeCapsuleLibNull.in
> f
> +
>    #
>    # Platform
>    #
> @@ -106,12 +108,21 @@
>    LockBoxLib|MdeModulePkg/Library/LockBoxNullLib/LockBoxNullLib.inf
>    CpuExceptionHandlerLib|MdeModulePkg/Library/CpuExceptionHandlerLibNull/CpuExceptionHandlerLibNull.inf
>    
> TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/TpmMeasur
> ementLibNull.inf
> -  AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
>    VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf
>    SortLib|MdeModulePkg/Library/BaseSortLib/BaseSortLib.inf
>    ShellLib|ShellPkg/Library/UefiShellLib/UefiShellLib.inf
>    
> FileHandleLib|MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.inf
> 
> +  !if $(SECURE_BOOT_ENABLE) == TRUE
> +    IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
> +    OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
> +    PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
> +    BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
> +    
> + AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.
> + inf
> +  !else
> +    
> + AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariabl
> + eLibNull.inf
> +  !endif
> +
>  [LibraryClasses.common.SEC]
>    PeiServicesLib|EmulatorPkg/Library/SecPeiServicesLib/SecPeiServicesLib.inf
>    PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
> @@ -190,6 +201,10 @@
>    gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareFdSize|0x002a0000
>    gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareBlockSize|0x10000
>    gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareVolume|L"../FV/FV_RECOVERY.fd"
> +  !if $(SECURE_BOOT_ENABLE) == TRUE
> +    gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
> +    gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE
> +  !endif
> 
>    gEmulatorPkgTokenSpaceGuid.PcdEmuMemorySize|L"64!64"
> 
> diff --git a/EmulatorPkg/EmulatorPkg.fdf b/EmulatorPkg/EmulatorPkg.fdf 
> index 295f6f1db8..93552baf8b 100644
> --- a/EmulatorPkg/EmulatorPkg.fdf
> +++ b/EmulatorPkg/EmulatorPkg.fdf
> @@ -46,10 +46,16 @@ DATA = {
>    # Blockmap[1]: End
>    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
>    ## This is the VARIABLE_STORE_HEADER
> -  #Signature: gEfiVariableGuid =
> -  #  { 0xddcf3616, 0x3275, 0x4164, { 0x98, 0xb6, 0xfe, 0x85, 0x70, 
> 0x7f, 0xfe, 0x7d }}
> -  0x16, 0x36, 0xcf, 0xdd, 0x75, 0x32, 0x64, 0x41,
> -  0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d,
> +  !if $(SECURE_BOOT_ENABLE) == FALSE
> +    #Signature: gEfiVariableGuid =
> +    #  { 0xddcf3616, 0x3275, 0x4164, { 0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d }}
> +    0x16, 0x36, 0xcf, 0xdd, 0x75, 0x32, 0x64, 0x41,
> +    0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d,  !else
> +    # Signature: gEfiAuthenticatedVariableGuid = { 0xaaf32c78, 0x947b, 0x439a, { 0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92 } }
> +    0x78, 0x2c, 0xf3, 0xaa, 0x7b, 0x94, 0x9a, 0x43,
> +    0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92,  !endif
>    #Size: 0xc000 (gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize) - 0x48 (size of EFI_FIRMWARE_VOLUME_HEADER) = 0xBFB8
>    # This can speed up the Variable Dispatch a bit.
>    0xB8, 0xBF, 0x00, 0x00,
> --
> 2.24.1.windows.2

Re: [edk2-devel] [PATCH] EmulatorPkg: Enable support for Authenticated Variables

[Ni, Ray]

I assume you did the test.

Reviewed-by: Ray Ni <ray.ni@intel.com>


> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Wadhawan,
> Divneil R
> Sent: Thursday, September 3, 2020 1:44 AM
> To: devel@edk2.groups.io
> Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Wadhawan, Divneil R
> <divneil.r.wadhawan@intel.com>
> Subject: [edk2-devel] [PATCH] EmulatorPkg: Enable support for Authenticated
> Variables
> 
> SECURE_BOOT_ENABLE feature flag is introduced to enable Authenticated
> variable support by:
> o Enabling storage space
> o Enabling AuthLib support
> 
> Signed-off-by: Divneil Rai Wadhawan <divneil.r.wadhawan@intel.com>
> ---
>  EmulatorPkg/EmulatorPkg.dsc | 17 ++++++++++++++++-
>  EmulatorPkg/EmulatorPkg.fdf | 14 ++++++++++----
>  2 files changed, 26 insertions(+), 5 deletions(-)
> 
> diff --git a/EmulatorPkg/EmulatorPkg.dsc b/EmulatorPkg/EmulatorPkg.dsc
> index 86a6271735..06cd8a9b4c 100644
> --- a/EmulatorPkg/EmulatorPkg.dsc
> +++ b/EmulatorPkg/EmulatorPkg.dsc
> @@ -32,6 +32,7 @@
>    DEFINE NETWORK_TLS_ENABLE       = FALSE
>    DEFINE NETWORK_HTTP_BOOT_ENABLE = FALSE
>    DEFINE NETWORK_ISCSI_ENABLE     = FALSE
> +  DEFINE SECURE_BOOT_ENABLE       = TRUE
> 
>  [SkuIds]
>    0|DEFAULT
> @@ -89,6 +90,7 @@
> 
> TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTempl
> ate.inf
> 
> SerialPortLib|MdePkg/Library/BaseSerialPortLibNull/BaseSerialPortLibNull.inf
>    CapsuleLib|MdeModulePkg/Library/DxeCapsuleLibNull/DxeCapsuleLibNull.inf
> +
>    #
>    # Platform
>    #
> @@ -106,12 +108,21 @@
>    LockBoxLib|MdeModulePkg/Library/LockBoxNullLib/LockBoxNullLib.inf
> 
> CpuExceptionHandlerLib|MdeModulePkg/Library/CpuExceptionHandlerLibNull/
> CpuExceptionHandlerLibNull.inf
> 
> TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/Tpm
> MeasurementLibNull.inf
> -
> AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLib
> Null.inf
>    VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf
>    SortLib|MdeModulePkg/Library/BaseSortLib/BaseSortLib.inf
>    ShellLib|ShellPkg/Library/UefiShellLib/UefiShellLib.inf
>    FileHandleLib|MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.inf
> 
> +  !if $(SECURE_BOOT_ENABLE) == TRUE
> +    IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
> +    OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
> +
> PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecure
> LibNull.inf
> +    BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
> +    AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> +  !else
> +
> AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLib
> Null.inf
> +  !endif
> +
>  [LibraryClasses.common.SEC]
>    PeiServicesLib|EmulatorPkg/Library/SecPeiServicesLib/SecPeiServicesLib.inf
>    PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
> @@ -190,6 +201,10 @@
>    gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareFdSize|0x002a0000
>    gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareBlockSize|0x10000
> 
> gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareVolume|L"../FV/FV_RECOVERY
> .fd"
> +  !if $(SECURE_BOOT_ENABLE) == TRUE
> +    gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
> +    gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE
> +  !endif
> 
>    gEmulatorPkgTokenSpaceGuid.PcdEmuMemorySize|L"64!64"
> 
> diff --git a/EmulatorPkg/EmulatorPkg.fdf b/EmulatorPkg/EmulatorPkg.fdf
> index 295f6f1db8..93552baf8b 100644
> --- a/EmulatorPkg/EmulatorPkg.fdf
> +++ b/EmulatorPkg/EmulatorPkg.fdf
> @@ -46,10 +46,16 @@ DATA = {
>    # Blockmap[1]: End
>    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
>    ## This is the VARIABLE_STORE_HEADER
> -  #Signature: gEfiVariableGuid =
> -  #  { 0xddcf3616, 0x3275, 0x4164, { 0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe,
> 0x7d }}
> -  0x16, 0x36, 0xcf, 0xdd, 0x75, 0x32, 0x64, 0x41,
> -  0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d,
> +  !if $(SECURE_BOOT_ENABLE) == FALSE
> +    #Signature: gEfiVariableGuid =
> +    #  { 0xddcf3616, 0x3275, 0x4164, { 0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe,
> 0x7d }}
> +    0x16, 0x36, 0xcf, 0xdd, 0x75, 0x32, 0x64, 0x41,
> +    0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d,
> +  !else
> +    # Signature: gEfiAuthenticatedVariableGuid = { 0xaaf32c78, 0x947b, 0x439a,
> { 0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92 } }
> +    0x78, 0x2c, 0xf3, 0xaa, 0x7b, 0x94, 0x9a, 0x43,
> +    0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92,
> +  !endif
>    #Size: 0xc000
> (gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize) - 0x48
> (size of EFI_FIRMWARE_VOLUME_HEADER) = 0xBFB8
>    # This can speed up the Variable Dispatch a bit.
>    0xB8, 0xBF, 0x00, 0x00,
> --
> 2.24.1.windows.2
> 
> 
>