On 4/27/19 2:53 AM, Laszlo Ersek wrote: > For the EnrollDefaultKeys application, the hypervisor is expected to add a > string entry to the "OEM Strings" (Type 11) SMBIOS table, with the > following format: > > 4e32566d-8e9e-4f52-81d3-5bb9715f9727:<Base64 X509 cert for PK and first KEK> > > The string representation of the GUID at the front is the "application > prefix", in terms of QEMU commit > <https://git.qemu.org/?p=qemu.git;a=commit;h=2d6dcbf93fb0>. > > Introduce this GUID in the usual manner. > > Cc: Anthony Perard <anthony.per...@citrix.com> > Cc: Ard Biesheuvel <ard.biesheu...@linaro.org> > Cc: Jordan Justen <jordan.l.jus...@intel.com> > Cc: Julien Grall <julien.gr...@arm.com> > Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 > Signed-off-by: Laszlo Ersek <ler...@redhat.com> > --- > OvmfPkg/OvmfPkg.dec | 1 + > OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h | 45 ++++++++++++++++++++ > 2 files changed, 46 insertions(+) > > diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec > index 922e061cc85c..0e555c5c78c5 100644 > --- a/OvmfPkg/OvmfPkg.dec > +++ b/OvmfPkg/OvmfPkg.dec > @@ -67,16 +67,17 @@ [LibraryClasses] > > ## @libraryclass Manage XenBus device path and I/O handles > # > XenIoMmioLib|Include/Library/XenIoMmioLib.h > > [Guids] > gUefiOvmfPkgTokenSpaceGuid = {0x93bb96af, 0xb9f2, 0x4eb8, {0x94, > 0x62, 0xe0, 0xba, 0x74, 0x56, 0x42, 0x36}} > gEfiXenInfoGuid = {0xd3b46f3b, 0xd441, 0x1244, {0x9a, > 0x12, 0x0, 0x12, 0x27, 0x3f, 0xc1, 0x4d}} > + gOvmfPkKek1AppPrefixGuid = {0x4e32566d, 0x8e9e, 0x4f52, {0x81, > 0xd3, 0x5b, 0xb9, 0x71, 0x5f, 0x97, 0x27}} > gOvmfPlatformConfigGuid = {0x7235c51c, 0x0c80, 0x4cab, {0x87, > 0xac, 0x3b, 0x08, 0x4a, 0x63, 0x04, 0xb1}} > gVirtioMmioTransportGuid = {0x837dca9e, 0xe874, 0x4d82, {0xb2, > 0x9a, 0x23, 0xfe, 0x0e, 0x23, 0xd1, 0xe2}} > gQemuRamfbGuid = {0x557423a1, 0x63ab, 0x406c, {0xbe, > 0x7e, 0x91, 0xcd, 0xbc, 0x08, 0xc4, 0x57}} > gXenBusRootDeviceGuid = {0xa732241f, 0x383d, 0x4d9c, {0x8a, > 0xe1, 0x8e, 0x09, 0x83, 0x75, 0x89, 0xd7}} > gRootBridgesConnectedEventGroupGuid = {0x24a2d66f, 0xeedd, 0x4086, {0x90, > 0x42, 0xf2, 0x6e, 0x47, 0x97, 0xee, 0x69}} > gMicrosoftVendorGuid = {0x77fa9abd, 0x0359, 0x4d32, {0xbd, > 0x60, 0x28, 0xf4, 0xe7, 0x8f, 0x78, 0x4b}} > > [Protocols] > diff --git a/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h > b/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h > new file mode 100644 > index 000000000000..e05d2fe021b7 > --- /dev/null > +++ b/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h > @@ -0,0 +1,45 @@ > +/** @file > + Declare the application prefix string as a GUID, for locating the PK/KEK1 > + X509 certificate to enroll, in the "OEM Strings" SMBIOS table. > + > + Copyright (C) 2019, Red Hat, Inc. > + > + SPDX-License-Identifier: BSD-2-Clause-Patent > + > + @par Specification Reference: > + - https://git.qemu.org/?p=qemu.git;a=commit;h=2d6dcbf93fb0 > + - https://libvirt.org/formatdomain.html#elementsSysinfo > + - https://bugs.launchpad.net/qemu/+bug/1826200 > + - https://bugzilla.tianocore.org/show_bug.cgi?id=1747 > +**/ > + > +#ifndef OVMF_PK_KEK1_APP_PREFIX_H_ > +#define OVMF_PK_KEK1_APP_PREFIX_H_ > + > +#include <Uefi/UefiBaseType.h> > + > +// > +// For the EnrollDefaultKeys application, the hypervisor is expected to add a > +// string entry to the "OEM Strings" (Type 11) SMBIOS table, with the > following > +// format: > +// > +// 4e32566d-8e9e-4f52-81d3-5bb9715f9727:<Base64 X509 cert for PK and first > KEK> > +// > +// The string representation of the GUID at the front is the "application > +// prefix". It is matched by EnrollDefaultKeys case-insensitively. > +// > +// The base64-encoded blob following the application prefix and the colon (:) > +// is an X509 certificate in DER representation; the hypervisor instructs > +// EnrollDefaultKeys to enroll this certificate as both Platform Key and > first > +// Key Exchange Key. > +// > +#define OVMF_PK_KEK1_APP_PREFIX_GUID \ > + { 0x4e32566d, \ > + 0x8e9e, \ > + 0x4f52, \ > + { 0x81, 0xd3, 0x5b, 0xb9, 0x71, 0x5f, 0x97, 0x27 }, \ > + } > + > +extern EFI_GUID gOvmfPkKek1AppPrefixGuid; > + > +#endif /* OVMF_PK_KEK1_APP_PREFIX_H_ */ >
Reviewed-by: Philippe Mathieu-Daude <phi...@redhat.com> -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#39827): https://edk2.groups.io/g/devel/message/39827 Mute This Topic: https://groups.io/mt/31359387/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
