OvmfPkg/EnrollDefaultKeys: extract MICROSOFT_VENDOR_GUID

The GUID

  77FA9ABD-0359-4D32-BD60-28F4E78F784B

is specified in MSDN, at
<https://msdn.microsoft.com/en-us/ie/dn932805(v=vs.94)>, therefore it
deserves an entry in the package DEC file, and a header file under
"Include/Guid".

(Arguably, this GUID declaration / definition could even live under
SecurityPkg, but the edk2 tradition has been to hoist GUIDs,
protocols/PPIs, and lib classes from OvmfPkg to a core package only when
dependent C code is added to the core package.)

Cc: Anthony Perard <anthony.perard@citrix.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Julien Grall <julien.grall@arm.com>
Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Gary Lin <glin@suse.com>

diff --git a/OvmfPkg/EnrollDefaultKeys/AuthData.c b/OvmfPkg/EnrollDefaultKeys/AuthData.c
index e0a543785fb531d20bff58e63c0e2daa537887bc..9a96dcc440b321146d502d88230dd96b9be8c158 100644 (file)
--- a/OvmfPkg/EnrollDefaultKeys/AuthData.c
+++ b/OvmfPkg/EnrollDefaultKeys/AuthData.c
@@ -523,31 +523,3 @@ CONST UINT8 mSha256OfDevNull[] = {
 };\r
 \r
 CONST UINTN mSizeOfSha256OfDevNull = sizeof mSha256OfDevNull;\r
-\r
-\r
-//\r
-// The following test cases of the Secure Boot Logo Test in the Microsoft\r
-// Hardware Certification Kit:\r
-//\r
-// - Microsoft.UefiSecureBootLogo.Tests.OutOfBoxVerifyMicrosoftKEKpresent\r
-// - Microsoft.UefiSecureBootLogo.Tests.OutOfBoxConfirmMicrosoftSignatureInDB\r
-//\r
-// expect the EFI_SIGNATURE_DATA.SignatureOwner GUID to be\r
-// 77FA9ABD-0359-4D32-BD60-28F4E78F784B, when the\r
-// EFI_SIGNATURE_DATA.SignatureData field carries any of the following X509\r
-// certificates:\r
-//\r
-// - "Microsoft Corporation KEK CA 2011" (in KEK)\r
-// - "Microsoft Windows Production PCA 2011" (in db)\r
-// - "Microsoft Corporation UEFI CA 2011" (in db)\r
-//\r
-// This is despite the fact that the UEFI specification requires\r
-// EFI_SIGNATURE_DATA.SignatureOwner to reflect the agent (i.e., OS,\r
-// application or driver) that enrolled and therefore owns\r
-// EFI_SIGNATURE_DATA.SignatureData, and not the organization that issued\r
-// EFI_SIGNATURE_DATA.SignatureData.\r
-//\r
-CONST EFI_GUID mMicrosoftOwnerGuid = {\r
-  0x77fa9abd, 0x0359, 0x4d32,\r
-  { 0xbd, 0x60, 0x28, 0xf4, 0xe7, 0x8f, 0x78, 0x4b },\r
-};\r

diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
index 528718b15ae9b2b8bcd6d3a753f8805967638e7e..e4f6a50e008b00fd41f3e01743099a9ee1a70a88 100644 (file)
--- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
+++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
@@ -8,6 +8,7 @@
 #include <Guid/AuthenticatedVariableFormat.h>    // gEfiCustomModeEnableGuid\r
 #include <Guid/GlobalVariable.h>                 // EFI_SETUP_MODE_NAME\r
 #include <Guid/ImageAuthentication.h>            // EFI_IMAGE_SECURITY_DATABASE\r
+#include <Guid/MicrosoftVendor.h>                // gMicrosoftVendorGuid\r
 #include <Library/BaseMemoryLib.h>               // CopyGuid()\r
 #include <Library/DebugLib.h>                    // ASSERT()\r
 #include <Library/MemoryAllocationLib.h>         // FreePool()\r
@@ -315,8 +316,8 @@ ShellAppMain (
              EFI_IMAGE_SECURITY_DATABASE,\r
              &gEfiImageSecurityDatabaseGuid,\r
              &gEfiCertX509Guid,\r
-             mMicrosoftPca,    mSizeOfMicrosoftPca,    &mMicrosoftOwnerGuid,\r
-             mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &mMicrosoftOwnerGuid,\r
+             mMicrosoftPca,    mSizeOfMicrosoftPca,    &gMicrosoftVendorGuid,\r
+             mMicrosoftUefiCa, mSizeOfMicrosoftUefiCa, &gMicrosoftVendorGuid,\r
              NULL);\r
   if (EFI_ERROR (Status)) {\r
     return 1;\r
@@ -337,7 +338,7 @@ ShellAppMain (
              &gEfiGlobalVariableGuid,\r
              &gEfiCertX509Guid,\r
              mRedHatPkKek1, mSizeOfRedHatPkKek1, &gEfiCallerIdGuid,\r
-             mMicrosoftKek, mSizeOfMicrosoftKek, &mMicrosoftOwnerGuid,\r
+             mMicrosoftKek, mSizeOfMicrosoftKek, &gMicrosoftVendorGuid,\r
              NULL);\r
   if (EFI_ERROR (Status)) {\r
     return 1;\r

diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h
index 07f4aa04e4691e72c07457d801445efec0ac7917..e3a7e43da4e375d15214a93f78bb63287479268e 100644 (file)
--- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h
+++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h
@@ -138,6 +138,4 @@ extern CONST UINTN mSizeOfMicrosoftUefiCa;
 extern CONST UINT8 mSha256OfDevNull[];\r
 extern CONST UINTN mSizeOfSha256OfDevNull;\r
 \r
-extern CONST EFI_GUID mMicrosoftOwnerGuid;\r
-\r
 #endif /* ENROLL_DEFAULT_KEYS_H_ */\r

diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf
index 3f093c7685854646fc690754774997bc8c891d6f..28db52586a9bd4e15aac6d3fec6a67a2df8732e4 100644 (file)
--- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf
+++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf
@@ -22,6 +22,7 @@
 [Packages]\r
   MdeModulePkg/MdeModulePkg.dec\r
   MdePkg/MdePkg.dec\r
+  OvmfPkg/OvmfPkg.dec\r
   SecurityPkg/SecurityPkg.dec\r
   ShellPkg/ShellPkg.dec\r
 \r
@@ -33,6 +34,7 @@
   gEfiGlobalVariableGuid\r
   gEfiImageSecurityDatabaseGuid\r
   gEfiSecureBootEnableDisableGuid\r
+  gMicrosoftVendorGuid\r
 \r
 [LibraryClasses]\r
   BaseMemoryLib\r

diff --git a/OvmfPkg/Include/Guid/MicrosoftVendor.h b/OvmfPkg/Include/Guid/MicrosoftVendor.h
new file mode 100644 (file)
index 0000000..db7a326
--- /dev/null
+++ b/OvmfPkg/Include/Guid/MicrosoftVendor.h
@@ -0,0 +1,55 @@
+/** @file\r
+  Declare the GUID that is expected:\r
+\r
+  - as EFI_SIGNATURE_DATA.SignatureOwner GUID in association with X509 and\r
+    RSA2048 Secure Boot certificates issued by/for Microsoft,\r
+\r
+  - as UEFI variable vendor GUID in association with (unspecified)\r
+    Microsoft-owned variables.\r
+\r
+  Copyright (C) 2014-2019, Red Hat, Inc.\r
+\r
+  SPDX-License-Identifier: BSD-2-Clause-Patent\r
+\r
+  @par Specification Reference:\r
+  - MSDN: System.Fundamentals.Firmware at\r
+    <https://msdn.microsoft.com/en-us/ie/dn932805(v=vs.94)>.\r
+**/\r
+\r
+#ifndef MICROSOFT_VENDOR_H_\r
+#define MICROSOFT_VENDOR_H_\r
+\r
+#include <Uefi/UefiBaseType.h>\r
+\r
+//\r
+// The following test cases of the Secure Boot Logo Test in the Microsoft\r
+// Hardware Certification Kit:\r
+//\r
+// - Microsoft.UefiSecureBootLogo.Tests.OutOfBoxVerifyMicrosoftKEKpresent\r
+// - Microsoft.UefiSecureBootLogo.Tests.OutOfBoxConfirmMicrosoftSignatureInDB\r
+//\r
+// expect the EFI_SIGNATURE_DATA.SignatureOwner GUID to be\r
+// 77FA9ABD-0359-4D32-BD60-28F4E78F784B, when the\r
+// EFI_SIGNATURE_DATA.SignatureData field carries any of the following X509\r
+// certificates:\r
+//\r
+// - "Microsoft Corporation KEK CA 2011" (in KEK)\r
+// - "Microsoft Windows Production PCA 2011" (in db)\r
+// - "Microsoft Corporation UEFI CA 2011" (in db)\r
+//\r
+// This is despite the fact that the UEFI specification requires\r
+// EFI_SIGNATURE_DATA.SignatureOwner to reflect the agent (i.e., OS,\r
+// application or driver) that enrolled and therefore owns\r
+// EFI_SIGNATURE_DATA.SignatureData, and not the organization that issued\r
+// EFI_SIGNATURE_DATA.SignatureData.\r
+//\r
+#define MICROSOFT_VENDOR_GUID                           \\r
+  { 0x77fa9abd,                                         \\r
+    0x0359,                                             \\r
+    0x4d32,                                             \\r
+    { 0xbd, 0x60, 0x28, 0xf4, 0xe7, 0x8f, 0x78, 0x4b }, \\r
+  }\r
+\r
+extern EFI_GUID gMicrosoftVendorGuid;\r
+\r
+#endif /* MICROSOFT_VENDOR_H_ */\r

diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec
index cc2a4909afd4a874a8dd954d94dac177ea84c8c8..922e061cc85cf488ecfb0b527d9f00fce47b8383 100644 (file)
--- a/OvmfPkg/OvmfPkg.dec
+++ b/OvmfPkg/OvmfPkg.dec
@@ -77,6 +77,7 @@
   gQemuRamfbGuid                      = {0x557423a1, 0x63ab, 0x406c, {0xbe, 0x7e, 0x91, 0xcd, 0xbc, 0x08, 0xc4, 0x57}}\r
   gXenBusRootDeviceGuid               = {0xa732241f, 0x383d, 0x4d9c, {0x8a, 0xe1, 0x8e, 0x09, 0x83, 0x75, 0x89, 0xd7}}\r
   gRootBridgesConnectedEventGroupGuid = {0x24a2d66f, 0xeedd, 0x4086, {0x90, 0x42, 0xf2, 0x6e, 0x47, 0x97, 0xee, 0x69}}\r
+  gMicrosoftVendorGuid                = {0x77fa9abd, 0x0359, 0x4d32, {0xbd, 0x60, 0x28, 0xf4, 0xe7, 0x8f, 0x78, 0x4b}}\r
 \r
 [Protocols]\r
   gVirtioDeviceProtocolGuid           = {0xfa920010, 0x6785, 0x4941, {0xb6, 0xec, 0x49, 0x8c, 0x57, 0x9f, 0x16, 0x0a}}\r