UefiPayloadPkg: Add Secure Boot support

[Sean-StarLabs]

Introduce Secure Boot functionality within UefiPayloadPkg by adding necessary modules and configurations. A new build flag, SECURE_BOOT_ENABLE, is introduced to control the activation of Secure Boot.

This patch also overrides values in SecurityPkg to enforce image verification from all sources.

A new FV (SECURITY_FV) for security modules is added for components and the firmware volume sizes to accommodate additional Secure Boot components.

Cc: Guo Dong [email protected]
Cc: Ray Ni [email protected]
Cc: James Lu [email protected]
Cc: Gua Guo [email protected]

[benjamindoron]

This always adds SecureBootConfigDxe into the main UefiPayload FV. I'm assuming that the purpose of the SECURITY_FV is for UPL, to allow builders to override features at the security/network/BDS scope. Shouldn't we follow the example of BdsDxe, for example, and not include it in the main FV in the case of UPL?

Also, this isn't yet hooked up for UPL. I believe 05da2d2 is an example of how you can do it, but the script has changed a bit since.

[benjamindoron]

I think we should follow the example of other 'UPL' FVs, and conditionally compile the drivers into either the main FV or a feature-specific 'UPL' one, but not both.

[LeanSheng]

@gdong1 wonder if @Sean-StarLabs should also add secureboot to yaml CI like this?616b048

But we have no idea how would it work, wonder if you know?

[LeanSheng]

@Sean-StarLabs do you want to mark those comments as resolved? Only you can do it I think.

[tianocore-assign-reviewers]

⚠ WARNING: Cannot add some reviewers: A user specified as a reviewer for this PR is not a collaborator of the repository. Please add them as a collaborator to the repository so they can be requested in the future.

Non-collaborators requested:

• @benjamindoron

Attn Admins:

• @jljusten
• @bcran
• @lgao4
• @mdkinney
• @vincent-j-zimmer
• @jkmathews
• @miki-intel-work

---

Admin Instructions:

• Add the non-collaborators as collaborators to the appropriate team(s) listed in teams
• If they are no longer needed as reviewers, remove them from Maintainers.txt

[LeanSheng]

@Sean-StarLabs can you rebase it? or how can maintainer help to rebase it?

[gdong1]

To merge this PR, need fix the CI failures.