594 lines
21 KiB
ReStructuredText
594 lines
21 KiB
ReStructuredText
.. _how-to-enable-secure-boot-for-windows:
|
|
|
|
Enable Secure Boot in Windows
|
|
#############################
|
|
|
|
This document shows how to enable secure boot to launch Windows 10
|
|
as a guest through OVMF on ACRNGT, including:
|
|
|
|
- Generate Platform Key
|
|
- Get KEK and DB from Microsoft
|
|
- Inject PK, KEK and DB into OVMF
|
|
|
|
Generate Platform Key (PK)
|
|
**************************
|
|
|
|
In UEFI secure boot, the Platform Key establishes a trust relationship
|
|
between the platform owner and the platform firmware. According to
|
|
`Microsoft's secure boot documentation
|
|
<https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-secure-boot-key-creation-and-management-guidance>`_,
|
|
section 1.5, the PK is a self-signed certificate owned by the OEM, and
|
|
the OEM can generate their own PK.
|
|
|
|
Here we show two ways to generate a PK: ``openssl`` and Microsoft tools.
|
|
|
|
Generate PK Using OpenSSL
|
|
=========================
|
|
|
|
- Generate a Self-Signed Certificate as PK from a new key using the
|
|
``openssl req`` command. You will need to answer the
|
|
Certificate Signing Request (CSR) information prompts to complete the
|
|
process; use your country, state, and other information as appropriate.
|
|
|
|
For example::
|
|
|
|
$ openssl req -newkey rsa:2048 -nodes -keyout PKpriv.key -x509 -days 365 -out PK.crt
|
|
Generating a 2048 bit RSA private key
|
|
....+++
|
|
.+++
|
|
writing new private key to 'PKpriv.key'
|
|
-----
|
|
You are about to be asked to enter information that will be incorporated
|
|
into your certificate request.
|
|
What you are about to enter is what is called a Distinguished Name or a DN.
|
|
There are quite a few fields but you can leave some blank
|
|
For some fields there will be a default value,
|
|
If you enter '.', the field will be left blank.
|
|
-----
|
|
Country Name (2 letter code) [AU]:CN
|
|
State or Province Name (full name) [Some-State]:Shanghai
|
|
Locality Name (eg, city) []:Shanghai
|
|
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Intel
|
|
Organizational Unit Name (eg, section) []:Intel
|
|
Common Name (e.g. server FQDN or YOUR name) []:
|
|
Email Address []:
|
|
|
|
- You can also generate the self-signed certificate from an existing
|
|
key, using the ``openssl req`` command, for example::
|
|
|
|
openssl req -key testpriv.key -new -x509 -days 365 -out PK.crt
|
|
|
|
- View the content of certificate using the ``openssl x509`` command::
|
|
|
|
$ openssl x509 -text -noout -in PK2.crt
|
|
|
|
Certificate:
|
|
Data:
|
|
Version: 3 (0x2)
|
|
Serial Number: 10097816361374596362 (0x8c22a67aeadc3d0a)
|
|
Signature Algorithm: sha256WithRSAEncryption
|
|
Issuer: C=CN, ST=Shanghai, L=Shanghai, O=Intel, OU=Intel
|
|
Validity
|
|
Not Before: Jun 26 06:29:14 2019 GMT
|
|
Not After : Jun 25 06:29:14 2020 GMT
|
|
Subject: C=CN, ST=Shanghai, L=Shanghai, O=Intel, OU=Intel
|
|
Subject Public Key Info:
|
|
Public Key Algorithm: rsaEncryption
|
|
Public-Key: (2048 bit)
|
|
Modulus:
|
|
00:9e:15:70:40:8c:b0:a7:c2:dd:45:15:e9:ab:c2:
|
|
d9:3d:d7:32:1e:7f:ec:1d:26:e3:d3:07:2c:5c:40:
|
|
8a:42:12:d3:31:59:2c:f0:b0:f7:3d:94:51:ae:b8:
|
|
25:16:ab:98:97:60:68:67:80:e1:77:85:aa:f2:70:
|
|
f3:47:fc:39:8c:9c:25:46:a8:ca:4f:aa:8f:d1:db:
|
|
f1:50:9b:d9:b6:3d:28:bf:5c:bf:1a:52:12:4c:e2:
|
|
04:dd:fe:04:f1:98:3a:9f:a7:ff:f9:43:43:f7:8b:
|
|
48:48:ee:d8:2e:b1:25:26:97:ca:1f:94:1c:00:1e:
|
|
68:8f:e1:30:3d:3c:1d:99:32:d0:d3:08:0b:ed:4c:
|
|
4b:b4:7c:42:b9:1c:e4:ef:df:47:cf:52:37:7e:6e:
|
|
a1:87:02:f9:23:6b:f4:22:e7:a8:8a:40:4c:5d:ff:
|
|
f2:9f:bd:05:68:15:5c:1a:03:e3:4b:80:55:08:38:
|
|
78:1f:e7:4c:dc:cd:49:22:ef:c0:60:4a:c2:b2:c9:
|
|
cb:2b:5c:e2:c8:1d:ec:9e:2d:eb:ed:b1:d7:53:54:
|
|
ea:ce:1a:f2:1c:f9:19:2e:c4:6f:fa:f2:46:bd:48:
|
|
bc:84:f2:a7:b4:1c:0c:60:26:eb:b1:31:d2:76:24:
|
|
df:21:0d:4e:fb:80:3d:ce:8e:a4:5c:8f:8d:b5:51:
|
|
88:a3
|
|
Exponent: 65537 (0x10001)
|
|
X509v3 extensions:
|
|
X509v3 Subject Key Identifier:
|
|
4D:A0:DC:F6:6C:56:1E:D2:25:C5:E3:EE:5D:0C:70:ED:71:E7:72:AA
|
|
X509v3 Authority Key Identifier:
|
|
keyid:4D:A0:DC:F6:6C:56:1E:D2:25:C5:E3:EE:5D:0C:70:ED:71:E7:72:AA
|
|
|
|
X509v3 Basic Constraints:
|
|
CA:TRUE
|
|
Signature Algorithm: sha256WithRSAEncryption
|
|
24:0a:38:57:49:e5:35:05:58:d9:88:03:eb:3a:8c:5b:0d:88:
|
|
70:58:ea:77:b2:4c:37:ff:87:52:b7:f3:bd:0f:6f:5e:7c:fc:
|
|
28:16:37:19:23:d0:90:af:ed:1e:f3:36:ee:9d:66:0e:7c:07:
|
|
5b:7d:0a:2a:fa:80:8c:6a:35:48:2d:50:9e:d2:f4:fc:d1:2a:
|
|
ed:f5:7f:e4:d9:ec:ac:09:10:52:5c:b9:c7:68:4a:91:98:33:
|
|
95:c3:23:4a:06:ca:ec:d3:ef:46:94:92:61:88:e4:e2:f5:db:
|
|
c1:7a:a7:98:9d:59:0d:43:c2:2a:46:11:74:53:44:37:08:cd:
|
|
b1:99:36:b6:3f:5e:51:f2:8c:d7:a0:0c:c5:9f:68:ba:2b:ab:
|
|
7a:57:1f:fd:c9:44:0d:b9:39:6e:52:8c:09:8b:eb:5f:ea:3d:
|
|
d4:3d:05:17:1a:7f:47:92:38:94:1d:e0:59:d2:66:bb:37:95:
|
|
1d:11:4b:70:a1:89:1f:09:5a:25:dc:80:ee:27:17:7e:4a:cc:
|
|
32:63:1d:e2:89:27:b1:44:99:9f:fb:4d:45:31:23:49:7b:ba:
|
|
21:05:eb:d8:8a:b3:d0:72:c0:19:97:2a:59:4b:d1:12:ce:04:
|
|
c4:c6:61:6f:19:e4:c2:fa:6a:0f:c7:70:c9:08:85:0c:65:97:
|
|
83:41:c6:4b
|
|
|
|
- Convert certificate from PEM to DER using the ``openssl x509``
|
|
command.
|
|
|
|
Only a DER format encoded certificate is supported. After conversion, save
|
|
``PK.der`` for use::
|
|
|
|
openssl x509 -in PK.crt -outform der -out PK.der
|
|
|
|
Using Microsoft Tools
|
|
=====================
|
|
|
|
Microsoft documents explain `how to use Microsoft tools to generate a secure boot key
|
|
<https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/secure-boot-key-generation-and-signing-using-hsm--example>`_,
|
|
which we'll summarize below.
|
|
|
|
- Using ``certutil.exe`` to list the Cryptographic Service Providers
|
|
(CSP)
|
|
|
|
For the detailed information of each Microsoft Cryptographic Service
|
|
Provider, check the `Microsoft CRP document
|
|
<https://docs.microsoft.com/en-us/windows/desktop/seccrypto/microsoft-cryptographic-service-providers>`_
|
|
|
|
Here, we chose "Microsoft Strong Cryptographic Provider" for example::
|
|
|
|
C:\\CertReq\\test> certutil -csplist
|
|
Provider Name: Microsoft Base Cryptographic Provider v1.0
|
|
Provider Type: 1 - PROV_RSA_FULL
|
|
|
|
Provider Name: Microsoft Base DSS and Diffie-Hellman Cryptographic Provider
|
|
Provider Type: 13 - PROV_DSS_DH
|
|
|
|
Provider Name: Microsoft Base DSS Cryptographic Provider
|
|
Provider Type: 3 - PROV_DSS
|
|
|
|
Provider Name: Microsoft Base Smart Card Crypto Provider
|
|
Provider Type: 1 - PROV_RSA_FULL
|
|
|
|
Provider Name: Microsoft DH SChannel Cryptographic Provider
|
|
Provider Type: 18 - PROV_DH_SCHANNEL
|
|
|
|
Provider Name: Microsoft Enhanced Cryptographic Provider v1.0
|
|
Provider Type: 1 - PROV_RSA_FULL
|
|
|
|
Provider Name: Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider
|
|
Provider Type: 13 - PROV_DSS_DH
|
|
|
|
Provider Name: Microsoft Enhanced RSA and AES Cryptographic Provider
|
|
Provider Type: 24 - PROV_RSA_AES
|
|
|
|
Provider Name: Microsoft RSA SChannel Cryptographic Provider
|
|
Provider Type: 12 - PROV_RSA_SCHANNEL
|
|
|
|
Provider Name: Microsoft Strong Cryptographic Provider
|
|
Provider Type: 1 - PROV_RSA_FULL
|
|
|
|
Provider Name: Microsoft Software Key Storage Provider
|
|
|
|
Provider Name: Microsoft Passport Key Storage Provider
|
|
|
|
Provider Name: Microsoft Platform Crypto Provider
|
|
|
|
Provider Name: Microsoft Smart Card Key Storage Provider
|
|
CertUtil: -csplist command completed successfully.
|
|
|
|
- Create request ``inf`` file, for example::
|
|
|
|
[Version]
|
|
Signature= "$Windows NT$"
|
|
[NewRequest]
|
|
ValidityPeriod = Years
|
|
ValidityPeriodUnits = 6
|
|
Subject = "CN=Corporation TODO Platform Key,O=TODO Corporation,L=TODO_City,S=TODO_State,C=TODO_Country"
|
|
MachineKeySet = true
|
|
RequestType=Cert
|
|
Exportable = FALSE
|
|
HashAlgorithm = SHA256
|
|
KeyAlgorithm = RSA
|
|
KeyLength = 2048
|
|
ProviderName = "Microsoft Strong Cryptographic Provider"
|
|
KeyUsage = 0xf0
|
|
|
|
- Generate the Platform Key using ``certreq.exe``::
|
|
|
|
C:\WINDOWS\system32>certreq.exe -v -new -binary request.inf PKtestDER.cer
|
|
Cert: 4 -> 4
|
|
Years: 6 -> 6
|
|
Installed Certificate:
|
|
Serial Number: 285c6f1ec39cc186495f8e55fa053593
|
|
Subject: CN=Intel Platform Key, O=Intel, L=Shanghai, S=Shanghai, C=CN
|
|
NotBefore: 3/30/2021 10:30 55.000s
|
|
NotAfter: 3/30/2027 10:40 55.000s
|
|
Thumbprint: 8d79139f90b9fa47200eedbc8c29039869cc4adc
|
|
Microsoft Strong Cryptographic Provider
|
|
c387aac7266d5db5d81da8a6aa21c703_163d773d-a567-4430-aabf-893dc207fa3d
|
|
|
|
CertReq: Certificate Created and Installed
|
|
|
|
- Validate the Platform Key certificate has been generated correctly::
|
|
|
|
C:\\PKtest> certutil -store -v my "3f675d4b64156f9c48ccf30793121147"
|
|
my "Personal"
|
|
================ Certificate 0 ================
|
|
X509 Certificate:
|
|
Version: 3
|
|
Serial Number: 3f675d4b64156f9c48ccf30793121147
|
|
Signature Algorithm:
|
|
Algorithm ObjectId: 1.2.840.113549.1.1.11 sha256RSA
|
|
Algorithm Parameters:
|
|
05 00
|
|
Issuer:
|
|
CN=Intel Platform Key
|
|
O=Intel
|
|
L=Shanghai
|
|
S=Shanghai
|
|
C=CN
|
|
Name Hash(sha1): 732312795479b01208e0ade51c695eddd8f2b2d7
|
|
Name Hash(md5): 9264adf01062b20e8fe4351369c55cc4
|
|
|
|
NotBefore: 6/26/2019 10:40 AM
|
|
NotAfter: 6/26/2025 10:50 AM
|
|
|
|
Subject:
|
|
CN=Intel Platform Key
|
|
O=Intel
|
|
L=Shanghai
|
|
S=Shanghai
|
|
C=CN
|
|
Name Hash(sha1): 732312795479b01208e0ade51c695eddd8f2b2d7
|
|
Name Hash(md5): 9264adf01062b20e8fe4351369c55cc4
|
|
|
|
Public Key Algorithm:
|
|
Algorithm ObjectId: 1.2.840.113549.1.1.1 RSA
|
|
Algorithm Parameters:
|
|
05 00
|
|
Public Key Length: 2048 bits
|
|
Public Key: UnusedBits = 0
|
|
0000 30 82 01 0a 02 82 01 01 00 b9 72 bb ae ff 44 55
|
|
0010 01 a5 53 6c bd b1 6e b1 32 4a e5 07 04 f9 97 41
|
|
0020 49 a5 95 c9 77 b7 db c0 b0 0d 51 6a 17 d4 a1 91
|
|
0030 21 8b 1c 14 8a 29 f2 45 78 c0 d3 d3 99 19 b6 de
|
|
0040 8b cd 43 05 61 95 d1 c1 84 97 83 c7 ce 93 c7 9a
|
|
0050 90 37 ba 9d 7a 2a d1 6b ad f6 ba da 6d 18 1a ae
|
|
0060 ec 16 80 fe 29 4e 25 8a 2d 22 bd fb 25 02 f3 f3
|
|
0070 ad ae 0e df 37 4b 9d e0 b1 cb b8 40 d2 ff c8 bd
|
|
0080 6b bc 9f 61 68 be d4 33 61 01 b7 b9 ef f3 32 ee
|
|
0090 7e b4 24 c3 68 9c 19 85 4a d6 7f e6 8b 28 81 5f
|
|
00a0 7a 41 fa f7 0c 21 c2 10 1f df b2 89 9d 2d 1a b8
|
|
00b0 ac 9f 09 11 c9 85 1d fb 96 00 55 95 73 d9 d5 ae
|
|
00c0 c2 9e 10 8b c8 7d ec 6c d9 b1 15 80 50 3d 4e 25
|
|
00d0 cb 8a d7 fc 22 27 a7 be 71 15 22 86 0e 88 e9 c0
|
|
00e0 b6 af e6 9b 56 0a 99 6f 88 c7 4c e3 15 dc 6f 03
|
|
00f0 8a b3 21 cc 09 df 8c 3b aa c0 2d 31 0b 39 01 13
|
|
0100 29 e4 f4 85 8e f7 69 db 05 02 03 01 00 01
|
|
Certificate Extensions: 2
|
|
2.5.29.15: Flags = 1(Critical), Length = 4
|
|
Key Usage
|
|
Digital Signature, Non-Repudiation, Key Encipherment, Data Encipherment (f0)
|
|
|
|
2.5.29.14: Flags = 0, Length = 16
|
|
Subject Key Identifier
|
|
29c42c8b73d48fb46118895ae59806eac7bf0098
|
|
|
|
Signature Algorithm:
|
|
Algorithm ObjectId: 1.2.840.113549.1.1.11 sha256RSA
|
|
Algorithm Parameters:
|
|
05 00
|
|
|
|
Signature: UnusedBits=0
|
|
0000 d4 89 92 e6 e1 ef 7e ce d3 c6 c2 b2 15 63 5c 68
|
|
0010 ea 16 13 7e 90 81 e3 75 64 75 da ac 85 fc c6 3a
|
|
0020 65 3b 60 1e 81 2d 20 58 ec b3 07 3c a3 a8 8a 57
|
|
0030 cf 33 a2 8c 08 fe 74 2b c5 d9 e7 f2 f7 69 8d ca
|
|
0040 68 81 33 3d 5c 25 63 60 17 51 4e 0c 1d bd de 68
|
|
0050 07 52 c6 50 da d9 5e 5b bd 4f 33 84 0c f8 ea 61
|
|
0060 f9 c3 00 db 78 f6 b2 4f 4e 4b 8d cf c9 0f d6 8a
|
|
0070 5c f2 8b 87 0d a5 a5 5e ab ce ac a4 ff dd d2 aa
|
|
0080 4c 22 8a c2 3e 23 7c de 4e 1c 18 f5 f9 a3 c1 4e
|
|
0090 b5 1e 9a af 92 0e 20 0e 17 82 2f 0c b4 c4 a3 f1
|
|
00a0 32 5a 0f e8 63 3e 5e 36 a2 8c ea de 02 78 58 b8
|
|
00b0 5a 0d d3 82 e4 b1 a6 72 9a dc 4a dc 5b 93 de 3c
|
|
00c0 2c ea b0 8d a5 6e 5c d6 c7 f8 78 ef 56 16 ed 7f
|
|
00d0 1e a5 5b a2 35 87 41 4d 5c 9d 34 c9 5b 82 68 94
|
|
00e0 8a 52 9c 8e 80 50 0d d7 10 34 cb 9c 96 8a b3 5e
|
|
00f0 9c bb bd 07 b5 18 b0 ea d2 93 8f 79 e9 dd 32 7a
|
|
Signature matches Public Key
|
|
Root Certificate: Subject matches Issuer
|
|
Key Id Hash(rfc-sha1): 29c42c8b73d48fb46118895ae59806eac7bf0098
|
|
Key Id Hash(sha1): 2e442e6469555a714423002b2e0748b373a27952
|
|
Key Id Hash(bcrypt-sha1): 66f3c2ecf18079b65d6de0b85be1786749a9eb75
|
|
Key Id Hash(bcrypt-sha256): edd9c90796d56e97db92f506953da26c44d7e8640875c3b60e5788f4cd5f7058
|
|
Key Id Hash(md5): 99e508cd7c5c5e2077648312097c18ab
|
|
Key Id Hash(sha256): 3401abc0a80dc1731990b0a99a1b5c7e1e60e107a667b295ced40a2056e43ce4
|
|
Key Id Hash(pin-sha256): 0wf9owhuRaJxiwsN4Mt8zAaXgTrp3dMJFopvr+oB1wA=
|
|
Key Id Hash(pin-sha256-hex): d307fda3086e45a2718b0b0de0cb7ccc0697813ae9ddd309168a6fafea01d700
|
|
Cert Hash(md5): e95f4760524981cf90bc3198e3075f44
|
|
Cert Hash(sha1): ff2771bd5bd1f7086ab96fb9532b594ed8619c3b
|
|
Cert Hash(sha256): 3abc3ab573d67e1fb491b2fd7e4ae0e5d9941ac7d55ee085c1d73d684891001a
|
|
Signature Hash: 4106dbf78737c3b54009b231eb9fe00e57a1ac6c94e0d5046e9bc7a62febde85
|
|
|
|
CERT_REQUEST_ORIGINATOR_PROP_ID(71):
|
|
xyzzy.ccr.corp.intel.com
|
|
|
|
CERT_KEY_PROV_INFO_PROP_ID(2):
|
|
Key Container = 3d40ebea7d109ee93b238b96721f0e6d_4be58f30-7127-42f5-9b76-f47187495247
|
|
Simple container name: {EA75381E-6D9B-4BDC-B6C7-5144C96507DD}
|
|
Provider = Microsoft Strong Cryptographic Provider
|
|
ProviderType = 1
|
|
Flags = 20 (32)
|
|
|
|
CRYPT_MACHINE_KEYSET -- 20 (32)
|
|
KeySpec = 2 -- AT_SIGNATURE
|
|
|
|
CERT_SUBJECT_PUB_KEY_BIT_LENGTH_PROP_ID(92):
|
|
0x00000800 (2048)
|
|
|
|
CERT_SHA1_HASH_PROP_ID(3):
|
|
ff2771bd5bd1f7086ab96fb9532b594ed8619c3b
|
|
|
|
CERT_SUBJECT_PUBLIC_KEY_MD5_HASH_PROP_ID(25):
|
|
99e508cd7c5c5e2077648312097c18ab
|
|
|
|
CERT_KEY_IDENTIFIER_PROP_ID(20):
|
|
29c42c8b73d48fb46118895ae59806eac7bf0098
|
|
|
|
CERT_SIGNATURE_HASH_PROP_ID(15) disallowedHash:
|
|
4106dbf78737c3b54009b231eb9fe00e57a1ac6c94e0d5046e9bc7a62febde85
|
|
|
|
CERT_MD5_HASH_PROP_ID(4):
|
|
e95f4760524981cf90bc3198e3075f44
|
|
|
|
CERT_ACCESS_STATE_PROP_ID(14):
|
|
AccessState = 6
|
|
|
|
CERT_ACCESS_STATE_SYSTEM_STORE_FLAG -- 2
|
|
|
|
CERT_ACCESS_STATE_LM_SYSTEM_STORE_FLAG -- 4
|
|
Provider = Microsoft Strong Cryptographic Provider
|
|
ProviderType = 1
|
|
Simple container name: {EA75381E-6D9B-4BDC-B6C7-5144C96507DD}
|
|
|
|
RSA
|
|
|
|
PP_KEYSTORAGE = 1
|
|
|
|
CRYPT_SEC_DESCR -- 1
|
|
|
|
KP_PERMISSIONS = 3b (59)
|
|
|
|
CRYPT_ENCRYPT -- 1
|
|
|
|
CRYPT_DECRYPT -- 2
|
|
|
|
CRYPT_READ -- 8
|
|
|
|
CRYPT_WRITE -- 10 (16)
|
|
|
|
CRYPT_MAC -- 20 (32)
|
|
|
|
D:PAI(A;;GAGR;;;BA)(A;;GAGR;;;SY)
|
|
|
|
Allow Full Control BUILTIN\\Administrators
|
|
Allow Full Control NT AUTHORITY\\SYSTEM
|
|
|
|
Private key is NOT exportable
|
|
Signature test passed
|
|
CertUtil: -store command completed successfully.
|
|
|
|
Download KEK and DB From Microsoft
|
|
**********************************
|
|
|
|
KEK (Key Exchange Key):
|
|
`Microsoft Corporation KEK CA 2011
|
|
<https://go.microsoft.com/fwlink/p/?linkid=321185>`_:
|
|
allows updates to DB and DBX.
|
|
|
|
DB (Allowed Signature database):
|
|
`Microsoft Windows Production CA 2011
|
|
<https://go.microsoft.com/fwlink/?LinkId=321192>`_:
|
|
This CA in the Signature Database (DB) allows Windows to boot.
|
|
|
|
`Microsoft Corporation UEFI CA 2011
|
|
<https://go.microsoft.com/fwlink/p/?LinkID=321194>`_:
|
|
Microsoft signer for third party UEFI binaries via DevCenter program.
|
|
|
|
Compile OVMF With Secure Boot Support
|
|
*************************************
|
|
|
|
.. code-block:: bash
|
|
|
|
git clone https://github.com/projectacrn/acrn-edk2.git
|
|
|
|
cd acrn-edk2
|
|
|
|
git checkout -b ovmf b64fe247c434e2a4228b9804c522575804550f82
|
|
|
|
git submodule update --init CryptoPkg/Library/OpensslLib/openssl
|
|
|
|
source edksetup.sh
|
|
make -C BaseTools
|
|
|
|
Edit the ``Conf/target.txt`` file and set these values::
|
|
|
|
ACTIVE_PLATFORM = OvmfPkg/OvmfPkgX64.dsc
|
|
TARGET_ARCH = X64
|
|
TOOL_CHAIN_TAG = GCC5
|
|
|
|
Then continue doing the build::
|
|
|
|
build -DFD_SIZE_2MB -DDEBUG_ON_SERIAL_PORT=TRUE -DSECURE_BOOT_ENABLE
|
|
|
|
|
|
Notes:
|
|
|
|
- ``source edksetup.sh``, this step is needed for compilation every time
|
|
a shell is created.
|
|
|
|
- This will generate the ``fw`` section at
|
|
``Build/OvmfX64/DEBUG_GCC5/FV/OVMF_CODE.fd`` or
|
|
``Build/OvmfX64/RELEASE_GCC5/FV/OVMF_CODE.fd``
|
|
|
|
This will also generate an empty template VARS file at
|
|
``Build/OvmfX64/DEBUG_GCC5/FV/OVMF_VARS.fd`` or
|
|
``Build/OvmfX64/RELEASE_GCC5/FV/OVMF_VARS.fd``
|
|
|
|
Both ``OVMF_CODE.fd`` and ``OVMF_VARS.fd`` will be used later.
|
|
|
|
- Make sure your GCC is 5.X. GCC 6 and above is NOT supported.
|
|
|
|
.. _qemu_inject_boot_keys:
|
|
|
|
Use QEMU to Inject Secure Boot Keys Into OVMF
|
|
*********************************************
|
|
|
|
We follow the `openSUSE: UEFI Secure boot using qemu-kvm document
|
|
<https://en.opensuse.org/openSUSE:UEFI_Secure_boot_using_qemu-kvm>`_
|
|
to import PK, KEK, and DB into OVMF, Ubuntu 16.04 used.
|
|
|
|
|
|
1. Install KVM, QEMU
|
|
|
|
2. Prepare the environment
|
|
|
|
a) Create a OVMFKeys working directory::
|
|
|
|
mkdir OVMFKeys
|
|
|
|
b) Copy the build out OVMF binary into OVMFKeys::
|
|
|
|
cp edk2/Build/OvmfX64/DEBUG_GCC5/FV/OVMF_CODE.fd OVMFKeys
|
|
cp edk2/Build/OvmfX64/DEBUG_GCC5/FV/OVMF_VARS.fd OVMFKeys
|
|
|
|
c) copy ``OVMF_CODE_QEMU.fd`` into OVMFKeys::
|
|
|
|
cp OVMF_CODE_QEMU.fd OVMFKeys
|
|
|
|
d) Make a working directory for hda-contents::
|
|
|
|
cd OVMFKeys
|
|
mkdir hda-contents
|
|
|
|
e) Copy PK, KEK and DB into hda-contents::
|
|
|
|
cp PKtestDER.cer hda-contents
|
|
cp MicCorKEKCA2011_2011-06-24.crt hda-contents
|
|
cp MicWinProPCA2011_2011-10-19.crt hda-contents
|
|
|
|
3. Use QEMU to inject secure boot keys
|
|
|
|
a) Run qemu-system-x86_64 to launch virtual machine::
|
|
|
|
cd OVMFKeys
|
|
qemu-system-x86_64 -L . \
|
|
-drive if=pflash,format=raw,readonly,file=OVMF_CODE_QEMU.fd \
|
|
-drive if=pflash,format=raw,file=OVMF_VARS.fd \
|
|
-hda fat:hda-contents \
|
|
-net none
|
|
|
|
After booting, you can see the UEFI shell.
|
|
|
|
.. image:: images/waag_secure_boot_image5.png
|
|
:align: center
|
|
:width: 600px
|
|
|
|
b) Enter "exit" to close UEFI shell and enter UEFI configuration menu.
|
|
|
|
.. image:: images/waag_secure_boot_image6.png
|
|
:align: center
|
|
:width: 600px
|
|
|
|
c) Go to secure boot configuration (Device Manager / Secure Boot
|
|
Configuration / Secure Boot Mode) and change from "Standard Mode"
|
|
to "Custom Mode".
|
|
|
|
.. image:: images/waag_secure_boot_image7.png
|
|
:align: center
|
|
:width: 600px
|
|
|
|
After change to "Custom Mode", "Custom Secure Boot Options" will show
|
|
up, click and enter.
|
|
|
|
.. image:: images/waag_secure_boot_image8.png
|
|
:align: center
|
|
:width: 600px
|
|
|
|
d) Import PK
|
|
|
|
PK Options / Enroll PK / Enroll PK Using File: select the only one
|
|
HD, space select ``PKtestDer.cer``. (Note: only DER format certificate is
|
|
supported.)
|
|
|
|
.. image:: images/waag_secure_boot_image9.png
|
|
:align: center
|
|
:width: 600px
|
|
|
|
Then, select "Commit Changes and Exit", PK will be imported into
|
|
OVMF.
|
|
|
|
e) Import KEK
|
|
|
|
The process is the same as import PK, bit select "KEK options" to
|
|
inject "Microsoft Corporation KEK CA 2011".
|
|
|
|
KEK Options / Enroll KEK / Enroll KEK Using File: select the only one
|
|
HD, space select ``MicCorKEKCA2011_2011-06-24.crt``. Commit Changes
|
|
and Exit.
|
|
|
|
f) Import DB
|
|
|
|
Use the same process to inject "Microsoft Windows Production CA 2011".
|
|
|
|
DB Options / Enroll Signature / Enroll Signature Using File: select the
|
|
only one HD, space select ``MicWinProPCA2011_2011-10-19.crt``. Commit
|
|
Changes and Exit.
|
|
|
|
Repeat the steps to inject "Microsoft Corporation UEFI CA 2011".
|
|
|
|
DB Options / Enroll Signature / Enroll Signature Using File: select the
|
|
only one HD, space select ``MicCorUEFCA2011_2011-06-27.crt``. Commit
|
|
Changes and Exit.
|
|
|
|
After import PK, KEK and DB, the secure boot state is now "Enabled".
|
|
|
|
.. image:: images/waag_secure_boot_image10.png
|
|
:align: center
|
|
:width: 600px
|
|
|
|
4. Generate ``OVMF.fd`` for ACRN with the updated keys manually::
|
|
|
|
cat /path/to/OVMF_VARS.fd /path/to/OVMF_CODE.fd > OVMF.fd
|
|
|
|
5. Update ``OVMF.fd`` into ACRNGT+OVMF+Win10 to start Windows.
|
|
|
|
Notes:
|
|
|
|
1. According to Microsoft documentation, after enabling secure boot, the kernel
|
|
mode driver must be signed by a trusted certification authority
|
|
(CA). Specify the acrn-dm parameter ``--windows`` to use the Windows
|
|
ORACLE virtio device driver. The default REDHAT virtio device driver is
|
|
not signed and may lead to problems in the secure boot process.
|
|
|
|
2. A cross-signed driver using a SHA-1 or SHA-256 certificate issued
|
|
after July 29th, 2015 is not recommended for Windows 10.
|
|
|
|
3. After enable secure boot, standard mechanisms such as kernel
|
|
debugging and test signing will not be permitted.
|
|
|
|
See these references for more information:
|
|
|
|
- https://docs.microsoft.com/en-us/windows/desktop/w8cookbook/secured-boot-signing-requirements-for-kernel-mode-drivers
|
|
|
|
- https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate
|