mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-20 11:28:58 +00:00
Code Issues Projects Releases Wiki Activity

runqemu: Add support to handle EnrollDefaultKeys PK/KEK1 certificate

Browse Source 
The EnrollDefaultKeys.efi application (distributed in ovmf-shell-image)
expects the hypervisor to provide a Platform Key and first Key Exchange
Key certificate.

For QEMU, this is done by adding an OEM string in the Type 11 SMBIOS
table. The string contains the EnrollDefaultKeys application GUID followed
by the certificate string. For now, the string is passed in the command
line until QEMU understands OEM strings from regular files (please see
https://bugs.launchpad.net/qemu/+bug/1826200).

If runqemu detects it is given an OVMF binary with support for Secure Boot
(i.e., ovmf.secboot* binaries), extract the certificate string from the
OvmfPkKek1.pem certificate and modify the command-line parameters to
provide the key. Such certificate is created when building OVMF with
support for Secure Boot.

Cc: Ross Burton <ross.burton@intel.com>
Cc: Patrick Ohly <patrick.ohly@intel.com>
(From OE-Core rev: 5e47316ae62f7632fb62bc3b8093ac42f9e3541c)

Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Ricardo Neri
2019-08-05 18:18:23 -04:00
committed by Richard Purdie
parent c7fb87ee6f
commit 9b90717e91
1 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
scripts/runqemu
View File

@@ -148,6 +148,10 @@ class BaseConfig(object):
# Setting one also adds "-vga std" because that is all that
# OVMF supports.
self.ovmf_bios = []
# When enrolling default Secure Boot keys, the hypervisor
# must provide the Platform Key and the first Key Exchange Key
# certificate in the Type 11 SMBIOS table.
self.ovmf_secboot_pkkek1 = ''
self.qemuboot = ''
self.qbconfload = False
self.kernel = ''
@@ -638,6 +642,23 @@ class BaseConfig(object):
if not os.path.exists(self.rootfs):
raise RunQemuError("Can't find rootfs: %s" % self.rootfs)
def setup_pkkek1(self):
"""
Extract from PEM certificate the Platform Key and first Key
Exchange Key certificate string. The hypervisor needs to provide
it in the Type 11 SMBIOS table
"""
pemcert = '%s/%s' % (self.get('DEPLOY_DIR_IMAGE'), 'OvmfPkKek1.pem')
try:
with open(pemcert, 'r') as pemfile:
key = pemfile.read().replace('\n', ''). \
replace('-----BEGIN CERTIFICATE-----', ''). \
replace('-----END CERTIFICATE-----', '')
self.ovmf_secboot_pkkek1 = key
except FileNotFoundError:
raise RunQemuError("Can't open PEM certificate %s " % pemcert)
def check_ovmf(self):
"""Check and set full path for OVMF firmware and variable file(s)."""
@@ -648,6 +669,8 @@ class BaseConfig(object):
path = '%s/%s.%s' % (self.get('DEPLOY_DIR_IMAGE'), ovmf, suffix)
if os.path.exists(path):
self.ovmf_bios[index] = path
if ovmf.endswith('secboot'):
self.setup_pkkek1()
break
else:
raise RunQemuError("Can't find OVMF firmware: %s" % ovmf)
@@ -914,6 +937,8 @@ class BaseConfig(object):
print('ROOTFS: [%s]' % self.rootfs)
if self.ovmf_bios:
print('OVMF: %s' % self.ovmf_bios)
if (self.ovmf_secboot_pkkek1):
print('SECBOOT PKKEK1: [%s...]' % self.ovmf_secboot_pkkek1[0:100])
print('CONFFILE: [%s]' % self.qemuboot)
print('')
@@ -1262,6 +1287,13 @@ class BaseConfig(object):
self.qemu_opt += ' ' + self.qemu_opt_script
if self.ovmf_secboot_pkkek1:
# Provide the Platform Key and first Key Exchange Key certificate as an
# OEM string in the SMBIOS Type 11 table. Prepend the certificate string
# with "application prefix" of the EnrollDefaultKeys.efi application
self.qemu_opt += ' -smbios type=11,value=4e32566d-8e9e-4f52-81d3-5bb9715f9727:' \
+ self.ovmf_secboot_pkkek1
# Append qemuparams to override previous settings
if self.qemuparams:
self.qemu_opt += ' ' + self.qemuparams