diff options
| author | Laszlo Ersek <lersek@redhat.com> | 2019-04-26 00:17:17 +0200 |
|---|---|---|
| committer | Laszlo Ersek <lersek@redhat.com> | 2019-04-30 14:26:45 +0200 |
| commit | 392404167fb1c4cc537b37079505dd9192968367 (patch) | |
| tree | 804f6809878b8ff8a16babd2729466270008ac92 /OvmfPkg/Include | |
| parent | c9727ff1df0d45fb4a18212292f5b07288e48d22 (diff) | |
| download | edk2-392404167fb1c4cc537b37079505dd9192968367.tar.gz edk2-392404167fb1c4cc537b37079505dd9192968367.tar.bz2 edk2-392404167fb1c4cc537b37079505dd9192968367.zip | |
OvmfPkg: introduce OVMF_PK_KEK1_APP_PREFIX_GUID
For the EnrollDefaultKeys application, the hypervisor is expected to add a
string entry to the "OEM Strings" (Type 11) SMBIOS table, with the
following format:
4e32566d-8e9e-4f52-81d3-5bb9715f9727:<Base64 X509 cert for PK and first KEK>
The string representation of the GUID at the front is the "application
prefix", in terms of QEMU commit
<https://git.qemu.org/?p=qemu.git;a=commit;h=2d6dcbf93fb0>.
Introduce this GUID in the usual manner.
Cc: Anthony Perard <anthony.perard@citrix.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Julien Grall <julien.grall@arm.com>
Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Gary Lin <glin@suse.com>
Diffstat (limited to 'OvmfPkg/Include')
| -rw-r--r-- | OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h b/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h new file mode 100644 index 0000000000..e05d2fe021 --- /dev/null +++ b/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h @@ -0,0 +1,45 @@ +/** @file
+ Declare the application prefix string as a GUID, for locating the PK/KEK1
+ X509 certificate to enroll, in the "OEM Strings" SMBIOS table.
+
+ Copyright (C) 2019, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+ @par Specification Reference:
+ - https://git.qemu.org/?p=qemu.git;a=commit;h=2d6dcbf93fb0
+ - https://libvirt.org/formatdomain.html#elementsSysinfo
+ - https://bugs.launchpad.net/qemu/+bug/1826200
+ - https://bugzilla.tianocore.org/show_bug.cgi?id=1747
+**/
+
+#ifndef OVMF_PK_KEK1_APP_PREFIX_H_
+#define OVMF_PK_KEK1_APP_PREFIX_H_
+
+#include <Uefi/UefiBaseType.h>
+
+//
+// For the EnrollDefaultKeys application, the hypervisor is expected to add a
+// string entry to the "OEM Strings" (Type 11) SMBIOS table, with the following
+// format:
+//
+// 4e32566d-8e9e-4f52-81d3-5bb9715f9727:<Base64 X509 cert for PK and first KEK>
+//
+// The string representation of the GUID at the front is the "application
+// prefix". It is matched by EnrollDefaultKeys case-insensitively.
+//
+// The base64-encoded blob following the application prefix and the colon (:)
+// is an X509 certificate in DER representation; the hypervisor instructs
+// EnrollDefaultKeys to enroll this certificate as both Platform Key and first
+// Key Exchange Key.
+//
+#define OVMF_PK_KEK1_APP_PREFIX_GUID \
+ { 0x4e32566d, \
+ 0x8e9e, \
+ 0x4f52, \
+ { 0x81, 0xd3, 0x5b, 0xb9, 0x71, 0x5f, 0x97, 0x27 }, \
+ }
+
+extern EFI_GUID gOvmfPkKek1AppPrefixGuid;
+
+#endif /* OVMF_PK_KEK1_APP_PREFIX_H_ */
|