Add three ECPT entries for the EBBR versions 2.2, 2.3 and 2.4
conformance profiles:
- Define the three EFI_CONFORMANCE_PROFILE_EBBR_2_[234]_GUIDs.
- Introduce the three HAVE_EFI_EBBR_2_[234] non-visible configuration
symbols to compute the actual system conformance status with the
dependencies.
- Add the three EFI_EBBR_2_[234]_CONFORMANCE configuration menu entries
to control the addition of the corresponding GUIDs in the ECPT.
Following what was done for version 2.1, as many entries as possible are
added optimistically by default in the ECPT, and this can be overridden
manually by the system integrator after inspection if necessary.
Conformance cheat sheet:
EBBR Additional requirements
---- ---------------------------------------------------
2.2 TCG2 & capsule "on disk"
2.3 Authenticated capsules in FMP format & boot manager
2.4 Non-UEFI (privileged firmware)
We do the following configurations dependencies approximations:
Configuration symbol Used to approximate
------------------------ ------------------------------------
EFI_HAVE_CAPSULE_SUPPORT Firmware update is performed in-band
TPM_V2 A TPM is present
Signed-off-by: Vincent Stehlé <[email protected]>
Cc: Heinrich Schuchardt <[email protected]>
Cc: Ilias Apalodimas <[email protected]>
Cc: Tom Rini <[email protected]>
---
include/efi_api.h | 12 ++++++++++
lib/efi_loader/Kconfig | 52 ++++++++++++++++++++++++++++++++++++++++
lib/efi_loader/efi_conformance.c | 9 +++++++
3 files changed, 73 insertions(+)
diff --git a/include/efi_api.h b/include/efi_api.h
index d4fdd50c49e..17e55118cda 100644
--- a/include/efi_api.h
+++ b/include/efi_api.h
@@ -238,6 +238,18 @@ enum efi_reset_type {
EFI_GUID(0xcce33c35, 0x74ac, 0x4087, 0xbc, 0xe7, \
0x8b, 0x29, 0xb0, 0x2e, 0xeb, 0x27)
+#define EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID \
+ EFI_GUID(0x9073eed4, 0xe50d, 0x11ee, 0xb8, 0xb0, \
+ 0x8b, 0x68, 0xda, 0x62, 0xfc, 0x80)
+
+#define EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID \
+ EFI_GUID(0x7721fc77, 0xa724, 0x11ef, 0x8e, 0xaa, \
+ 0xf7, 0xc9, 0xb1, 0x94, 0xba, 0x75)
+
+#define EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID \
+ EFI_GUID(0xf2bb0422, 0xda8e, 0x11f0, 0xa6, 0x7b, \
+ 0x1b, 0xe2, 0x20, 0x85, 0x40, 0x98)
+
#define EFI_DEBUG_IMAGE_INFO_TABLE_GUID \
EFI_GUID(0x49152e77, 0x1ada, 0x4764, 0xb7, 0xa2, \
0x7a, 0xfe, 0xfe, 0xd9, 0x5e, 0x8b)
diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
index 40380876959..8ac4165b996 100644
--- a/lib/efi_loader/Kconfig
+++ b/lib/efi_loader/Kconfig
@@ -578,6 +578,27 @@ config HAVE_EFI_EBBR_2_1
depends on EFI_CAPSULE_FIRMWARE || !EFI_HAVE_CAPSULE_SUPPORT
default y
+config HAVE_EFI_EBBR_2_2
+ bool
+ depends on HAVE_EFI_EBBR_2_1
+ depends on EFI_TCG2_PROTOCOL || !TPM_V2
+ depends on EFI_CAPSULE_ON_DISK || !EFI_HAVE_CAPSULE_SUPPORT
+ default y
+
+config HAVE_EFI_EBBR_2_3
+ bool
+ depends on HAVE_EFI_EBBR_2_2
+ depends on EFI_CAPSULE_AUTHENTICATE || !EFI_HAVE_CAPSULE_SUPPORT
+ depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT || !EFI_HAVE_CAPSULE_SUPPORT
+ depends on EFI_BOOTMGR
+ depends on BOOTMETH_EFI_BOOTMGR
+ default y
+
+config HAVE_EFI_EBBR_2_4
+ bool
+ depends on HAVE_EFI_EBBR_2_3
+ default y
+
config EFI_ECPT
bool "Enable the UEFI ECPT generation"
default y
@@ -593,6 +614,37 @@ config EFI_EBBR_2_1_CONFORMANCE
Enabling this option adds the Embedded Base Boot Requirements (EBBR)
v2.1 conformance entry to the ECPT.
+config EFI_EBBR_2_2_CONFORMANCE
+ bool "Add the EBBR v2.2 conformance entry to the ECPT"
+ depends on EFI_ECPT && HAVE_EFI_EBBR_2_2
+ default y
+ help
+ Enabling this option adds the Embedded Base Boot Requirements (EBBR)
+ v2.2 conformance entry to the ECPT.
+
+ Version 2.2 adds requirements around TCG2 and capsule "on disk".
+
+config EFI_EBBR_2_3_CONFORMANCE
+ bool "Add the EBBR v2.3 conformance entry to the ECPT"
+ depends on EFI_ECPT && HAVE_EFI_EBBR_2_3
+ default y
+ help
+ Enabling this option adds the Embedded Base Boot Requirements (EBBR)
+ v2.3 conformance entry to the ECPT.
+
+ Version 2.3 adds requirements around authenticated capsules in FMP
+ format and the boot manager.
+
+config EFI_EBBR_2_4_CONFORMANCE
+ bool "Add the EBBR v2.4 conformance entry to the ECPT"
+ depends on EFI_ECPT && HAVE_EFI_EBBR_2_4
+ default y
+ help
+ Enabling this option adds the Embedded Base Boot Requirements (EBBR)
+ v2.4 conformance entry to the ECPT.
+
+ Version 2.4 adds non-UEFI requirements.
+
config EFI_CONSOLE_DISABLE_ANSI
bool "Disable ANSI escape sequence queries for console size"
help
diff --git a/lib/efi_loader/efi_conformance.c b/lib/efi_loader/efi_conformance.c
index 470141af483..c1234681bb6 100644
--- a/lib/efi_loader/efi_conformance.c
+++ b/lib/efi_loader/efi_conformance.c
@@ -29,6 +29,15 @@ efi_status_t efi_ecpt_register(void)
#if CONFIG_IS_ENABLED(EFI_EBBR_2_1_CONFORMANCE)
EFI_CONFORMANCE_PROFILE_EBBR_2_1_GUID,
#endif
+ #if CONFIG_IS_ENABLED(EFI_EBBR_2_2_CONFORMANCE)
+ EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID,
+ #endif
+ #if CONFIG_IS_ENABLED(EFI_EBBR_2_3_CONFORMANCE)
+ EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID,
+ #endif
+ #if CONFIG_IS_ENABLED(EFI_EBBR_2_4_CONFORMANCE)
+ EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID,
+ #endif
};
ecpt_size = sizeof(profiles)
--
2.53.0
