mbox series

[v8,0/9] Enable EFI capsule generation through binman

Message ID 20230810142338.3402963-1-sughosh.ganu@linaro.org
Headers show
Series Enable EFI capsule generation through binman | expand

Message

Sughosh Ganu Aug. 10, 2023, 2:23 p.m. UTC 
This patch series adds support for generation of EFI capsules as part
of u-boot build flow. The capsules can be generated as part of u-boot
build, and this is being achieved through binman, by adding a capsule
entry type. The parameters needed for capsule generation are specified
as properties under the capsule entry node.

Changes have also been made to the efi capsule update feature testing
setup on the sandbox variants. Currently, the capsule files and the
keys for testing capsule authentication are generated after u-boot has
been built. As part of this patch series, the private and public keys
along with the EFI Signature List(ESL) needed for testing the capsule
update functionality on the sandbox plaform are placed in the board
directory. The test logic has been changed so that the capsules which
were generated as part of the test setup are now being generated as
part of the build for sandbox platform. The document has been updated
to reflect the above changes.

Changes since V7:

This version has dropped the changes for embedding the public key ESL
into the DTB as there are discussions currently in progress on the
solution. The capsule generation changes OTOH are close to getting
merged. Hence the separation of the patches.

The following are changes per individual patches

* Change the file names to highlight good and bad keys as suggested by
  Simon Glass.
* Rebase on top of current upstream.
* Drop the ReadEntries method as suggested by Simon Glass.
* Add logic to allow specifying a string 'binman-test' for GUIDs in
  binman tests.
* Add a todo comment for getting the capsule contents from the tool.
* Move the capsule generation logic to sandbox_capsule.dtsi and
  include that explicitly in test.dts and sandbox.dts.
* Drop the u-boot.dtsi file which kept the capsule and signature
  nodes.
* Remove capsule generation logic from capsule update test setup.
* Keep the logic to embed the public key in DTB in the test setup.
* Change the name of the file which contains the capsule entry binman
  nodes.


Sughosh Ganu (9):
  binman: bintool: Build a tool from a list of commands
  nuvoton: npcm845-evb: Add a newline at the end of file
  sandbox: capsule: Add keys and certificates needed for capsule update
    testing
  sandbox: Build the mkeficapsule tool for the sandbox variants
  btool: mkeficapsule: Add a bintool for EFI capsule generation
  binman: capsule: Add support for generating EFI capsules
  sandbox: capsule: Generate capsule related files through binman
  doc: Add documentation to highlight capsule generation related updates
  sandbox: trace: Increase trace buffer size

 .azure-pipelines.yml                          |   2 +-
 .gitlab-ci.yml                                |   2 +-
 arch/arm/dts/nuvoton-npcm845-evb.dts          |   2 +-
 arch/sandbox/dts/sandbox.dts                  |   4 +
 arch/sandbox/dts/sandbox_capsule.dtsi         | 340 ++++++++++++++++++
 arch/sandbox/dts/test.dts                     |   4 +
 board/sandbox/capsule_priv_key_bad.key        |  28 ++
 board/sandbox/capsule_priv_key_good.key       |  28 ++
 board/sandbox/capsule_pub_esl_good.esl        | Bin 0 -> 831 bytes
 board/sandbox/capsule_pub_key_bad.crt         |  19 +
 board/sandbox/capsule_pub_key_good.crt        |  19 +
 doc/develop/uefi/uefi.rst                     |  16 +
 include/sandbox_efi_capsule.h                 |  21 ++
 test/py/tests/test_efi_capsule/conftest.py    | 155 +-------
 .../tests/test_efi_capsule/uboot_bin_env.its  |  36 --
 test/py/tests/test_trace.py                   |   2 +-
 tools/Kconfig                                 |   6 +-
 tools/binman/bintool.py                       |  19 +-
 tools/binman/btool/mkeficapsule.py            | 101 ++++++
 tools/binman/entries.rst                      |  64 ++++
 tools/binman/etype/efi_capsule.py             | 143 ++++++++
 tools/binman/ftest.py                         | 118 ++++++
 tools/binman/test/311_capsule.dts             |  21 ++
 tools/binman/test/312_capsule_signed.dts      |  23 ++
 tools/binman/test/313_capsule_version.dts     |  22 ++
 tools/binman/test/314_capsule_signed_ver.dts  |  24 ++
 tools/binman/test/315_capsule_oemflags.dts    |  22 ++
 tools/binman/test/316_capsule_missing_key.dts |  22 ++
 .../binman/test/317_capsule_missing_index.dts |  20 ++
 .../binman/test/318_capsule_missing_guid.dts  |  19 +
 30 files changed, 1112 insertions(+), 190 deletions(-)
 create mode 100644 arch/sandbox/dts/sandbox_capsule.dtsi
 create mode 100644 board/sandbox/capsule_priv_key_bad.key
 create mode 100644 board/sandbox/capsule_priv_key_good.key
 create mode 100644 board/sandbox/capsule_pub_esl_good.esl
 create mode 100644 board/sandbox/capsule_pub_key_bad.crt
 create mode 100644 board/sandbox/capsule_pub_key_good.crt
 create mode 100644 include/sandbox_efi_capsule.h
 delete mode 100644 test/py/tests/test_efi_capsule/uboot_bin_env.its
 create mode 100644 tools/binman/btool/mkeficapsule.py
 create mode 100644 tools/binman/etype/efi_capsule.py
 create mode 100644 tools/binman/test/311_capsule.dts
 create mode 100644 tools/binman/test/312_capsule_signed.dts
 create mode 100644 tools/binman/test/313_capsule_version.dts
 create mode 100644 tools/binman/test/314_capsule_signed_ver.dts
 create mode 100644 tools/binman/test/315_capsule_oemflags.dts
 create mode 100644 tools/binman/test/316_capsule_missing_key.dts
 create mode 100644 tools/binman/test/317_capsule_missing_index.dts
 create mode 100644 tools/binman/test/318_capsule_missing_guid.dts