OvmfPkg: introduce OVMF_PK_KEK1_APP_PREFIX_GUID

For the EnrollDefaultKeys application, the hypervisor is expected to add a
string entry to the "OEM Strings" (Type 11) SMBIOS table, with the
following format:

4e32566d-8e9e-4f52-81d3-5bb9715f9727:<Base64 X509 cert for PK and first KEK>

The string representation of the GUID at the front is the "application
prefix", in terms of QEMU commit
<https://git.qemu.org/?p=qemu.git;a=commit;h=2d6dcbf93fb0>.

Introduce this GUID in the usual manner.

Cc: Anthony Perard <anthony.perard@citrix.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Julien Grall <julien.grall@arm.com>
Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Gary Lin <glin@suse.com>

diff --git a/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h b/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h
new file mode 100644 (file)
index 0000000..e05d2fe
--- /dev/null
+++ b/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h
@@ -0,0 +1,45 @@
+/** @file\r
+  Declare the application prefix string as a GUID, for locating the PK/KEK1\r
+  X509 certificate to enroll, in the "OEM Strings" SMBIOS table.\r
+\r
+  Copyright (C) 2019, Red Hat, Inc.\r
+\r
+  SPDX-License-Identifier: BSD-2-Clause-Patent\r
+\r
+  @par Specification Reference:\r
+  - https://git.qemu.org/?p=qemu.git;a=commit;h=2d6dcbf93fb0\r
+  - https://libvirt.org/formatdomain.html#elementsSysinfo\r
+  - https://bugs.launchpad.net/qemu/+bug/1826200\r
+  - https://bugzilla.tianocore.org/show_bug.cgi?id=1747\r
+**/\r
+\r
+#ifndef OVMF_PK_KEK1_APP_PREFIX_H_\r
+#define OVMF_PK_KEK1_APP_PREFIX_H_\r
+\r
+#include <Uefi/UefiBaseType.h>\r
+\r
+//\r
+// For the EnrollDefaultKeys application, the hypervisor is expected to add a\r
+// string entry to the "OEM Strings" (Type 11) SMBIOS table, with the following\r
+// format:\r
+//\r
+// 4e32566d-8e9e-4f52-81d3-5bb9715f9727:<Base64 X509 cert for PK and first KEK>\r
+//\r
+// The string representation of the GUID at the front is the "application\r
+// prefix". It is matched by EnrollDefaultKeys case-insensitively.\r
+//\r
+// The base64-encoded blob following the application prefix and the colon (:)\r
+// is an X509 certificate in DER representation; the hypervisor instructs\r
+// EnrollDefaultKeys to enroll this certificate as both Platform Key and first\r
+// Key Exchange Key.\r
+//\r
+#define OVMF_PK_KEK1_APP_PREFIX_GUID                    \\r
+  { 0x4e32566d,                                         \\r
+    0x8e9e,                                             \\r
+    0x4f52,                                             \\r
+    { 0x81, 0xd3, 0x5b, 0xb9, 0x71, 0x5f, 0x97, 0x27 }, \\r
+  }\r
+\r
+extern EFI_GUID gOvmfPkKek1AppPrefixGuid;\r
+\r
+#endif /* OVMF_PK_KEK1_APP_PREFIX_H_ */\r

diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec
index 922e061cc85cf488ecfb0b527d9f00fce47b8383..0e555c5c78c57c819efc6199b3533ccc7572835e 100644 (file)
--- a/OvmfPkg/OvmfPkg.dec
+++ b/OvmfPkg/OvmfPkg.dec
@@ -72,6 +72,7 @@
 [Guids]\r
   gUefiOvmfPkgTokenSpaceGuid          = {0x93bb96af, 0xb9f2, 0x4eb8, {0x94, 0x62, 0xe0, 0xba, 0x74, 0x56, 0x42, 0x36}}\r
   gEfiXenInfoGuid                     = {0xd3b46f3b, 0xd441, 0x1244, {0x9a, 0x12, 0x0, 0x12, 0x27, 0x3f, 0xc1, 0x4d}}\r
+  gOvmfPkKek1AppPrefixGuid            = {0x4e32566d, 0x8e9e, 0x4f52, {0x81, 0xd3, 0x5b, 0xb9, 0x71, 0x5f, 0x97, 0x27}}\r
   gOvmfPlatformConfigGuid             = {0x7235c51c, 0x0c80, 0x4cab, {0x87, 0xac, 0x3b, 0x08, 0x4a, 0x63, 0x04, 0xb1}}\r
   gVirtioMmioTransportGuid            = {0x837dca9e, 0xe874, 0x4d82, {0xb2, 0x9a, 0x23, 0xfe, 0x0e, 0x23, 0xd1, 0xe2}}\r
   gQemuRamfbGuid                      = {0x557423a1, 0x63ab, 0x406c, {0xbe, 0x7e, 0x91, 0xcd, 0xbc, 0x08, 0xc4, 0x57}}\r