tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
audk/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf

53 lines
1.2 KiB
INI
Raw Normal View History

OvmfPkg: introduce EnrollDefaultKeys application Add the OvmfPkg/EnrollDefaultKeys shell application source as it is at the "edk2-20190308git89910a39dcfd-2.el8" tag in RHEL8's downstream "edk2" package. Further patches in this series will replace Red Hat-specific bits in the application, with a conduit to pass in parameters directly from the host side, on both QEMU and Xen. (Note: at the moment, Xen doesn't support Secure Boot, due to lacking a standards-conformant variable driver stack. However, that could change soon <https://fosdem.org/2019/schedule/event/vai_implementing_uefi_variable_services_in_qemu/>, and then this facility will become useful on Xen too.) The use case for this application (including why it is only being added to the DSC files) is explained in detail in <https://bugzilla.tianocore.org/show_bug.cgi?id=1747#c0>. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:15:13 +02:00
## @file
OvmfPkg/EnrollDefaultKeys: update @file comment blocks Refresh the sentence that states the purpose of the application. Extend the copyright notice to the year 2019. Replace the 2-clause BSD License banner with the BSD-2-Clause-Patent SPDX ID. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:33:44 +02:00
# Enroll default PK, KEK, db, dbx.
OvmfPkg: introduce EnrollDefaultKeys application Add the OvmfPkg/EnrollDefaultKeys shell application source as it is at the "edk2-20190308git89910a39dcfd-2.el8" tag in RHEL8's downstream "edk2" package. Further patches in this series will replace Red Hat-specific bits in the application, with a conduit to pass in parameters directly from the host side, on both QEMU and Xen. (Note: at the moment, Xen doesn't support Secure Boot, due to lacking a standards-conformant variable driver stack. However, that could change soon <https://fosdem.org/2019/schedule/event/vai_implementing_uefi_variable_services_in_qemu/>, and then this facility will become useful on Xen too.) The use case for this application (including why it is only being added to the DSC files) is explained in detail in <https://bugzilla.tianocore.org/show_bug.cgi?id=1747#c0>. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:15:13 +02:00
#
OvmfPkg/EnrollDefaultKeys: update @file comment blocks Refresh the sentence that states the purpose of the application. Extend the copyright notice to the year 2019. Replace the 2-clause BSD License banner with the BSD-2-Clause-Patent SPDX ID. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:33:44 +02:00
# Copyright (C) 2014-2019, Red Hat, Inc.
OvmfPkg: introduce EnrollDefaultKeys application Add the OvmfPkg/EnrollDefaultKeys shell application source as it is at the "edk2-20190308git89910a39dcfd-2.el8" tag in RHEL8's downstream "edk2" package. Further patches in this series will replace Red Hat-specific bits in the application, with a conduit to pass in parameters directly from the host side, on both QEMU and Xen. (Note: at the moment, Xen doesn't support Secure Boot, due to lacking a standards-conformant variable driver stack. However, that could change soon <https://fosdem.org/2019/schedule/event/vai_implementing_uefi_variable_services_in_qemu/>, and then this facility will become useful on Xen too.) The use case for this application (including why it is only being added to the DSC files) is explained in detail in <https://bugzilla.tianocore.org/show_bug.cgi?id=1747#c0>. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:15:13 +02:00
#
OvmfPkg/EnrollDefaultKeys: update @file comment blocks Refresh the sentence that states the purpose of the application. Extend the copyright notice to the year 2019. Replace the 2-clause BSD License banner with the BSD-2-Clause-Patent SPDX ID. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:33:44 +02:00
# SPDX-License-Identifier: BSD-2-Clause-Patent
OvmfPkg: introduce EnrollDefaultKeys application Add the OvmfPkg/EnrollDefaultKeys shell application source as it is at the "edk2-20190308git89910a39dcfd-2.el8" tag in RHEL8's downstream "edk2" package. Further patches in this series will replace Red Hat-specific bits in the application, with a conduit to pass in parameters directly from the host side, on both QEMU and Xen. (Note: at the moment, Xen doesn't support Secure Boot, due to lacking a standards-conformant variable driver stack. However, that could change soon <https://fosdem.org/2019/schedule/event/vai_implementing_uefi_variable_services_in_qemu/>, and then this facility will become useful on Xen too.) The use case for this application (including why it is only being added to the DSC files) is explained in detail in <https://bugzilla.tianocore.org/show_bug.cgi?id=1747#c0>. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:15:13 +02:00
##
[Defines]
OvmfPkg/EnrollDefaultKeys: refresh INF file Bump INF_VERSION to the latest edk2 INF specification. Regenerate FILE_GUID to distinguish this application from downstream-only versions. Remove the VALID_ARCHITECTURES comment as there is nothing ISA or platform specific in the application. Ensure all sections apart from [Defines] are alphabetically sorted. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:38:17 +02:00
INF_VERSION = 1.28
OvmfPkg: introduce EnrollDefaultKeys application Add the OvmfPkg/EnrollDefaultKeys shell application source as it is at the "edk2-20190308git89910a39dcfd-2.el8" tag in RHEL8's downstream "edk2" package. Further patches in this series will replace Red Hat-specific bits in the application, with a conduit to pass in parameters directly from the host side, on both QEMU and Xen. (Note: at the moment, Xen doesn't support Secure Boot, due to lacking a standards-conformant variable driver stack. However, that could change soon <https://fosdem.org/2019/schedule/event/vai_implementing_uefi_variable_services_in_qemu/>, and then this facility will become useful on Xen too.) The use case for this application (including why it is only being added to the DSC files) is explained in detail in <https://bugzilla.tianocore.org/show_bug.cgi?id=1747#c0>. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:15:13 +02:00
BASE_NAME = EnrollDefaultKeys
OvmfPkg/EnrollDefaultKeys: refresh INF file Bump INF_VERSION to the latest edk2 INF specification. Regenerate FILE_GUID to distinguish this application from downstream-only versions. Remove the VALID_ARCHITECTURES comment as there is nothing ISA or platform specific in the application. Ensure all sections apart from [Defines] are alphabetically sorted. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:38:17 +02:00
FILE_GUID = A0BAA8A3-041D-48A8-BC87-C36D121B5E3D
OvmfPkg: introduce EnrollDefaultKeys application Add the OvmfPkg/EnrollDefaultKeys shell application source as it is at the "edk2-20190308git89910a39dcfd-2.el8" tag in RHEL8's downstream "edk2" package. Further patches in this series will replace Red Hat-specific bits in the application, with a conduit to pass in parameters directly from the host side, on both QEMU and Xen. (Note: at the moment, Xen doesn't support Secure Boot, due to lacking a standards-conformant variable driver stack. However, that could change soon <https://fosdem.org/2019/schedule/event/vai_implementing_uefi_variable_services_in_qemu/>, and then this facility will become useful on Xen too.) The use case for this application (including why it is only being added to the DSC files) is explained in detail in <https://bugzilla.tianocore.org/show_bug.cgi?id=1747#c0>. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:15:13 +02:00
MODULE_TYPE = UEFI_APPLICATION
VERSION_STRING = 0.1
ENTRY_POINT = ShellCEntryLib
[Sources]
OvmfPkg/EnrollDefaultKeys: split out certificate and signature constants A large portion of "EnrollDefaultKeys.c" is hex-encoded X509 certificates, GUIDs, and signatures. These objects are constants, unlikely to see changes anytime soon. Move them out of the way, to "AuthData.c", so we can more easily work on functions in "EnrollDefaultKeys.c". Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 16:03:05 +02:00
AuthData.c
OvmfPkg: introduce EnrollDefaultKeys application Add the OvmfPkg/EnrollDefaultKeys shell application source as it is at the "edk2-20190308git89910a39dcfd-2.el8" tag in RHEL8's downstream "edk2" package. Further patches in this series will replace Red Hat-specific bits in the application, with a conduit to pass in parameters directly from the host side, on both QEMU and Xen. (Note: at the moment, Xen doesn't support Secure Boot, due to lacking a standards-conformant variable driver stack. However, that could change soon <https://fosdem.org/2019/schedule/event/vai_implementing_uefi_variable_services_in_qemu/>, and then this facility will become useful on Xen too.) The use case for this application (including why it is only being added to the DSC files) is explained in detail in <https://bugzilla.tianocore.org/show_bug.cgi?id=1747#c0>. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:15:13 +02:00
EnrollDefaultKeys.c
OvmfPkg/EnrollDefaultKeys: extract typedefs to a header file "EnrollDefaultKeys.c" defines three structure types: SINGLE_HEADER, REPEATING_HEADER, and SETTINGS. The definitions are scattered over the C file, and lack high-level summary comments. Extract the structures to "EnrollDefaultKeys.h", and add the missing comments. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 15:27:57 +02:00
EnrollDefaultKeys.h
OvmfPkg: introduce EnrollDefaultKeys application Add the OvmfPkg/EnrollDefaultKeys shell application source as it is at the "edk2-20190308git89910a39dcfd-2.el8" tag in RHEL8's downstream "edk2" package. Further patches in this series will replace Red Hat-specific bits in the application, with a conduit to pass in parameters directly from the host side, on both QEMU and Xen. (Note: at the moment, Xen doesn't support Secure Boot, due to lacking a standards-conformant variable driver stack. However, that could change soon <https://fosdem.org/2019/schedule/event/vai_implementing_uefi_variable_services_in_qemu/>, and then this facility will become useful on Xen too.) The use case for this application (including why it is only being added to the DSC files) is explained in detail in <https://bugzilla.tianocore.org/show_bug.cgi?id=1747#c0>. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:15:13 +02:00
[Packages]
MdeModulePkg/MdeModulePkg.dec
OvmfPkg/EnrollDefaultKeys: refresh INF file Bump INF_VERSION to the latest edk2 INF specification. Regenerate FILE_GUID to distinguish this application from downstream-only versions. Remove the VALID_ARCHITECTURES comment as there is nothing ISA or platform specific in the application. Ensure all sections apart from [Defines] are alphabetically sorted. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:38:17 +02:00
MdePkg/MdePkg.dec
OvmfPkg/EnrollDefaultKeys: extract MICROSOFT_VENDOR_GUID The GUID 77FA9ABD-0359-4D32-BD60-28F4E78F784B is specified in MSDN, at <https://msdn.microsoft.com/en-us/ie/dn932805(v=vs.94)>, therefore it deserves an entry in the package DEC file, and a header file under "Include/Guid". (Arguably, this GUID declaration / definition could even live under SecurityPkg, but the edk2 tradition has been to hoist GUIDs, protocols/PPIs, and lib classes from OvmfPkg to a core package only when dependent C code is added to the core package.) Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 21:49:38 +02:00
OvmfPkg/OvmfPkg.dec
OvmfPkg: introduce EnrollDefaultKeys application Add the OvmfPkg/EnrollDefaultKeys shell application source as it is at the "edk2-20190308git89910a39dcfd-2.el8" tag in RHEL8's downstream "edk2" package. Further patches in this series will replace Red Hat-specific bits in the application, with a conduit to pass in parameters directly from the host side, on both QEMU and Xen. (Note: at the moment, Xen doesn't support Secure Boot, due to lacking a standards-conformant variable driver stack. However, that could change soon <https://fosdem.org/2019/schedule/event/vai_implementing_uefi_variable_services_in_qemu/>, and then this facility will become useful on Xen too.) The use case for this application (including why it is only being added to the DSC files) is explained in detail in <https://bugzilla.tianocore.org/show_bug.cgi?id=1747#c0>. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:15:13 +02:00
SecurityPkg/SecurityPkg.dec
ShellPkg/ShellPkg.dec
[Guids]
gEfiCertPkcs7Guid
gEfiCertSha256Guid
gEfiCertX509Guid
gEfiCustomModeEnableGuid
gEfiGlobalVariableGuid
gEfiImageSecurityDatabaseGuid
gEfiSecureBootEnableDisableGuid
OvmfPkg/EnrollDefaultKeys: extract MICROSOFT_VENDOR_GUID The GUID 77FA9ABD-0359-4D32-BD60-28F4E78F784B is specified in MSDN, at <https://msdn.microsoft.com/en-us/ie/dn932805(v=vs.94)>, therefore it deserves an entry in the package DEC file, and a header file under "Include/Guid". (Arguably, this GUID declaration / definition could even live under SecurityPkg, but the edk2 tradition has been to hoist GUIDs, protocols/PPIs, and lib classes from OvmfPkg to a core package only when dependent C code is added to the core package.) Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 21:49:38 +02:00
gMicrosoftVendorGuid
OvmfPkg/EnrollDefaultKeys: enroll PK/KEK1 from the Type 11 SMBIOS table Disconnect the certificate that is enrolled as both Platform Key and first Key Exchange Key from Red Hat: expect the hypervisor to specify it, as part of SMBIOS. Example usage with QEMU: * Generate self-signed X509 certificate: openssl req \ -x509 \ -newkey rsa:2048 \ -outform PEM \ -keyout PkKek1.private.key \ -out PkKek1.pem (where "PEM" simply means "DER + base64 + header + footer"). * Strip the header, footer, and newline characters; prepend the application prefix: sed \ -e 's/^-----BEGIN CERTIFICATE-----$/4e32566d-8e9e-4f52-81d3-5bb9715f9727:/' \ -e '/^-----END CERTIFICATE-----$/d' \ PkKek1.pem \ | tr -d '\n' \ > PkKek1.oemstr * Pass the certificate to EnrollDefaultKeys with the following QEMU option: -smbios type=11,value="$(< PkKek1.oemstr)" (Note: for the above option to work correctly, a QEMU version is needed that includes commit 950c4e6c94b1 ("opts: don't silently truncate long option values", 2018-05-09). The first upstream release with that commit was v3.0.0. Once <https://bugs.launchpad.net/qemu/+bug/1826200> is fixed, QEMU will learn to read the file directly; passing the blob on the command will be necessary no more.) Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 23:15:14 +02:00
gOvmfPkKek1AppPrefixGuid
[Protocols]
gEfiSmbiosProtocolGuid ## CONSUMES
OvmfPkg: introduce EnrollDefaultKeys application Add the OvmfPkg/EnrollDefaultKeys shell application source as it is at the "edk2-20190308git89910a39dcfd-2.el8" tag in RHEL8's downstream "edk2" package. Further patches in this series will replace Red Hat-specific bits in the application, with a conduit to pass in parameters directly from the host side, on both QEMU and Xen. (Note: at the moment, Xen doesn't support Secure Boot, due to lacking a standards-conformant variable driver stack. However, that could change soon <https://fosdem.org/2019/schedule/event/vai_implementing_uefi_variable_services_in_qemu/>, and then this facility will become useful on Xen too.) The use case for this application (including why it is only being added to the DSC files) is explained in detail in <https://bugzilla.tianocore.org/show_bug.cgi?id=1747#c0>. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:15:13 +02:00
[LibraryClasses]
OvmfPkg/EnrollDefaultKeys: enroll PK/KEK1 from the Type 11 SMBIOS table Disconnect the certificate that is enrolled as both Platform Key and first Key Exchange Key from Red Hat: expect the hypervisor to specify it, as part of SMBIOS. Example usage with QEMU: * Generate self-signed X509 certificate: openssl req \ -x509 \ -newkey rsa:2048 \ -outform PEM \ -keyout PkKek1.private.key \ -out PkKek1.pem (where "PEM" simply means "DER + base64 + header + footer"). * Strip the header, footer, and newline characters; prepend the application prefix: sed \ -e 's/^-----BEGIN CERTIFICATE-----$/4e32566d-8e9e-4f52-81d3-5bb9715f9727:/' \ -e '/^-----END CERTIFICATE-----$/d' \ PkKek1.pem \ | tr -d '\n' \ > PkKek1.oemstr * Pass the certificate to EnrollDefaultKeys with the following QEMU option: -smbios type=11,value="$(< PkKek1.oemstr)" (Note: for the above option to work correctly, a QEMU version is needed that includes commit 950c4e6c94b1 ("opts: don't silently truncate long option values", 2018-05-09). The first upstream release with that commit was v3.0.0. Once <https://bugs.launchpad.net/qemu/+bug/1826200> is fixed, QEMU will learn to read the file directly; passing the blob on the command will be necessary no more.) Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 23:15:14 +02:00
BaseLib
OvmfPkg: introduce EnrollDefaultKeys application Add the OvmfPkg/EnrollDefaultKeys shell application source as it is at the "edk2-20190308git89910a39dcfd-2.el8" tag in RHEL8's downstream "edk2" package. Further patches in this series will replace Red Hat-specific bits in the application, with a conduit to pass in parameters directly from the host side, on both QEMU and Xen. (Note: at the moment, Xen doesn't support Secure Boot, due to lacking a standards-conformant variable driver stack. However, that could change soon <https://fosdem.org/2019/schedule/event/vai_implementing_uefi_variable_services_in_qemu/>, and then this facility will become useful on Xen too.) The use case for this application (including why it is only being added to the DSC files) is explained in detail in <https://bugzilla.tianocore.org/show_bug.cgi?id=1747#c0>. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:15:13 +02:00
BaseMemoryLib
DebugLib
MemoryAllocationLib
OvmfPkg/EnrollDefaultKeys: enroll PK/KEK1 from the Type 11 SMBIOS table Disconnect the certificate that is enrolled as both Platform Key and first Key Exchange Key from Red Hat: expect the hypervisor to specify it, as part of SMBIOS. Example usage with QEMU: * Generate self-signed X509 certificate: openssl req \ -x509 \ -newkey rsa:2048 \ -outform PEM \ -keyout PkKek1.private.key \ -out PkKek1.pem (where "PEM" simply means "DER + base64 + header + footer"). * Strip the header, footer, and newline characters; prepend the application prefix: sed \ -e 's/^-----BEGIN CERTIFICATE-----$/4e32566d-8e9e-4f52-81d3-5bb9715f9727:/' \ -e '/^-----END CERTIFICATE-----$/d' \ PkKek1.pem \ | tr -d '\n' \ > PkKek1.oemstr * Pass the certificate to EnrollDefaultKeys with the following QEMU option: -smbios type=11,value="$(< PkKek1.oemstr)" (Note: for the above option to work correctly, a QEMU version is needed that includes commit 950c4e6c94b1 ("opts: don't silently truncate long option values", 2018-05-09). The first upstream release with that commit was v3.0.0. Once <https://bugs.launchpad.net/qemu/+bug/1826200> is fixed, QEMU will learn to read the file directly; passing the blob on the command will be necessary no more.) Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 23:15:14 +02:00
PrintLib
OvmfPkg: introduce EnrollDefaultKeys application Add the OvmfPkg/EnrollDefaultKeys shell application source as it is at the "edk2-20190308git89910a39dcfd-2.el8" tag in RHEL8's downstream "edk2" package. Further patches in this series will replace Red Hat-specific bits in the application, with a conduit to pass in parameters directly from the host side, on both QEMU and Xen. (Note: at the moment, Xen doesn't support Secure Boot, due to lacking a standards-conformant variable driver stack. However, that could change soon <https://fosdem.org/2019/schedule/event/vai_implementing_uefi_variable_services_in_qemu/>, and then this facility will become useful on Xen too.) The use case for this application (including why it is only being added to the DSC files) is explained in detail in <https://bugzilla.tianocore.org/show_bug.cgi?id=1747#c0>. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:15:13 +02:00
ShellCEntryLib
OvmfPkg/EnrollDefaultKeys: enroll PK/KEK1 from the Type 11 SMBIOS table Disconnect the certificate that is enrolled as both Platform Key and first Key Exchange Key from Red Hat: expect the hypervisor to specify it, as part of SMBIOS. Example usage with QEMU: * Generate self-signed X509 certificate: openssl req \ -x509 \ -newkey rsa:2048 \ -outform PEM \ -keyout PkKek1.private.key \ -out PkKek1.pem (where "PEM" simply means "DER + base64 + header + footer"). * Strip the header, footer, and newline characters; prepend the application prefix: sed \ -e 's/^-----BEGIN CERTIFICATE-----$/4e32566d-8e9e-4f52-81d3-5bb9715f9727:/' \ -e '/^-----END CERTIFICATE-----$/d' \ PkKek1.pem \ | tr -d '\n' \ > PkKek1.oemstr * Pass the certificate to EnrollDefaultKeys with the following QEMU option: -smbios type=11,value="$(< PkKek1.oemstr)" (Note: for the above option to work correctly, a QEMU version is needed that includes commit 950c4e6c94b1 ("opts: don't silently truncate long option values", 2018-05-09). The first upstream release with that commit was v3.0.0. Once <https://bugs.launchpad.net/qemu/+bug/1826200> is fixed, QEMU will learn to read the file directly; passing the blob on the command will be necessary no more.) Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 23:15:14 +02:00
UefiBootServicesTableLib
OvmfPkg: introduce EnrollDefaultKeys application Add the OvmfPkg/EnrollDefaultKeys shell application source as it is at the "edk2-20190308git89910a39dcfd-2.el8" tag in RHEL8's downstream "edk2" package. Further patches in this series will replace Red Hat-specific bits in the application, with a conduit to pass in parameters directly from the host side, on both QEMU and Xen. (Note: at the moment, Xen doesn't support Secure Boot, due to lacking a standards-conformant variable driver stack. However, that could change soon <https://fosdem.org/2019/schedule/event/vai_implementing_uefi_variable_services_in_qemu/>, and then this facility will become useful on Xen too.) The use case for this application (including why it is only being added to the DSC files) is explained in detail in <https://bugzilla.tianocore.org/show_bug.cgi?id=1747#c0>. Cc: Anthony Perard <anthony.perard@citrix.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Julien Grall <julien.grall@arm.com> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com> Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Reviewed-by: Gary Lin <glin@suse.com>
2019-04-25 13:15:13 +02:00
UefiLib
UefiRuntimeServicesTableLib