From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: redhat.com, ip: 209.132.183.28, mailfrom: lersek@redhat.com) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by groups.io with SMTP; Fri, 26 Apr 2019 17:54:13 -0700 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 31E29F93F5; Sat, 27 Apr 2019 00:54:13 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-121-104.rdu2.redhat.com [10.10.121.104]) by smtp.corp.redhat.com (Postfix) with ESMTP id B1F3B5D71A; Sat, 27 Apr 2019 00:54:11 +0000 (UTC) From: "Laszlo Ersek" To: edk2-devel-groups-io Cc: Anthony Perard , Ard Biesheuvel , Jordan Justen , Julien Grall Subject: [PATCH 14/16] OvmfPkg: introduce OVMF_PK_KEK1_APP_PREFIX_GUID Date: Sat, 27 Apr 2019 02:53:26 +0200 Message-Id: <20190427005328.27005-15-lersek@redhat.com> In-Reply-To: <20190427005328.27005-1-lersek@redhat.com> References: <20190427005328.27005-1-lersek@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Sat, 27 Apr 2019 00:54:13 +0000 (UTC) Content-Transfer-Encoding: quoted-printable For the EnrollDefaultKeys application, the hypervisor is expected to add = a string entry to the "OEM Strings" (Type 11) SMBIOS table, with the following format: 4e32566d-8e9e-4f52-81d3-5bb9715f9727: The string representation of the GUID at the front is the "application prefix", in terms of QEMU commit . Introduce this GUID in the usual manner. Cc: Anthony Perard Cc: Ard Biesheuvel Cc: Jordan Justen Cc: Julien Grall Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=3D1747 Signed-off-by: Laszlo Ersek --- OvmfPkg/OvmfPkg.dec | 1 + OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h | 45 ++++++++++++++++++++ 2 files changed, 46 insertions(+) diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index 922e061cc85c..0e555c5c78c5 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -67,16 +67,17 @@ [LibraryClasses] =20 ## @libraryclass Manage XenBus device path and I/O handles # XenIoMmioLib|Include/Library/XenIoMmioLib.h =20 [Guids] gUefiOvmfPkgTokenSpaceGuid =3D {0x93bb96af, 0xb9f2, 0x4eb8, {= 0x94, 0x62, 0xe0, 0xba, 0x74, 0x56, 0x42, 0x36}} gEfiXenInfoGuid =3D {0xd3b46f3b, 0xd441, 0x1244, {= 0x9a, 0x12, 0x0, 0x12, 0x27, 0x3f, 0xc1, 0x4d}} + gOvmfPkKek1AppPrefixGuid =3D {0x4e32566d, 0x8e9e, 0x4f52, {= 0x81, 0xd3, 0x5b, 0xb9, 0x71, 0x5f, 0x97, 0x27}} gOvmfPlatformConfigGuid =3D {0x7235c51c, 0x0c80, 0x4cab, {= 0x87, 0xac, 0x3b, 0x08, 0x4a, 0x63, 0x04, 0xb1}} gVirtioMmioTransportGuid =3D {0x837dca9e, 0xe874, 0x4d82, {= 0xb2, 0x9a, 0x23, 0xfe, 0x0e, 0x23, 0xd1, 0xe2}} gQemuRamfbGuid =3D {0x557423a1, 0x63ab, 0x406c, {= 0xbe, 0x7e, 0x91, 0xcd, 0xbc, 0x08, 0xc4, 0x57}} gXenBusRootDeviceGuid =3D {0xa732241f, 0x383d, 0x4d9c, {= 0x8a, 0xe1, 0x8e, 0x09, 0x83, 0x75, 0x89, 0xd7}} gRootBridgesConnectedEventGroupGuid =3D {0x24a2d66f, 0xeedd, 0x4086, {= 0x90, 0x42, 0xf2, 0x6e, 0x47, 0x97, 0xee, 0x69}} gMicrosoftVendorGuid =3D {0x77fa9abd, 0x0359, 0x4d32, {= 0xbd, 0x60, 0x28, 0xf4, 0xe7, 0x8f, 0x78, 0x4b}} =20 [Protocols] diff --git a/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h b/OvmfPkg/Include= /Guid/OvmfPkKek1AppPrefix.h new file mode 100644 index 000000000000..e05d2fe021b7 --- /dev/null +++ b/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h @@ -0,0 +1,45 @@ +/** @file + Declare the application prefix string as a GUID, for locating the PK/K= EK1 + X509 certificate to enroll, in the "OEM Strings" SMBIOS table. + + Copyright (C) 2019, Red Hat, Inc. + + SPDX-License-Identifier: BSD-2-Clause-Patent + + @par Specification Reference: + - https://git.qemu.org/?p=3Dqemu.git;a=3Dcommit;h=3D2d6dcbf93fb0 + - https://libvirt.org/formatdomain.html#elementsSysinfo + - https://bugs.launchpad.net/qemu/+bug/1826200 + - https://bugzilla.tianocore.org/show_bug.cgi?id=3D1747 +**/ + +#ifndef OVMF_PK_KEK1_APP_PREFIX_H_ +#define OVMF_PK_KEK1_APP_PREFIX_H_ + +#include + +// +// For the EnrollDefaultKeys application, the hypervisor is expected to = add a +// string entry to the "OEM Strings" (Type 11) SMBIOS table, with the fo= llowing +// format: +// +// 4e32566d-8e9e-4f52-81d3-5bb9715f9727: +// +// The string representation of the GUID at the front is the "applicatio= n +// prefix". It is matched by EnrollDefaultKeys case-insensitively. +// +// The base64-encoded blob following the application prefix and the colo= n (:) +// is an X509 certificate in DER representation; the hypervisor instruct= s +// EnrollDefaultKeys to enroll this certificate as both Platform Key and= first +// Key Exchange Key. +// +#define OVMF_PK_KEK1_APP_PREFIX_GUID \ + { 0x4e32566d, \ + 0x8e9e, \ + 0x4f52, \ + { 0x81, 0xd3, 0x5b, 0xb9, 0x71, 0x5f, 0x97, 0x27 }, \ + } + +extern EFI_GUID gOvmfPkKek1AppPrefixGuid; + +#endif /* OVMF_PK_KEK1_APP_PREFIX_H_ */ --=20 2.19.1.3.g30247aa5d201