Add support for setting OEM flags in the capsule header. As per the
UEFI specification, bits 0-15 of the flags member of the capsule
header can be defined per capsule GUID.
The oemflags will be used for the FWU Multi Bank update feature, as
specified by the Dependable Boot specification[1]. Bit
15 of the flags member will be used to determine if the
acceptance/rejection of the updated images is to be done by the
firmware or an external component like the OS.
[1] - https://git.codelinaro.org/linaro/dependable-boot/mbfw/uploads/
6f7ddfe3be24e18d4319e108a758d02e/mbfw.pdf
Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Generate a firmware revert empty capsule
.TP
Generate a firmware revert empty capsule
.TP
+.BI "-o\fR,\fB --capoemflag "
+Capsule OEM flag, value between 0x0000 to 0xffff
+
+.TP
.BR -h ", " --help
Print a help message
.BR -h ", " --help
Print a help message
efi_guid_t efi_guid_fm_capsule = EFI_FIRMWARE_MANAGEMENT_CAPSULE_ID_GUID;
efi_guid_t efi_guid_cert_type_pkcs7 = EFI_CERT_TYPE_PKCS7_GUID;
efi_guid_t efi_guid_fm_capsule = EFI_FIRMWARE_MANAGEMENT_CAPSULE_ID_GUID;
efi_guid_t efi_guid_cert_type_pkcs7 = EFI_CERT_TYPE_PKCS7_GUID;
-static const char *opts_short = "g:i:I:v:p:c:m:dhAR";
+static const char *opts_short = "g:i:I:v:p:c:m:o:dhAR";
enum {
CAPSULE_NORMAL_BLOB = 0,
enum {
CAPSULE_NORMAL_BLOB = 0,
{"dump-sig", no_argument, NULL, 'd'},
{"fw-accept", no_argument, NULL, 'A'},
{"fw-revert", no_argument, NULL, 'R'},
{"dump-sig", no_argument, NULL, 'd'},
{"fw-accept", no_argument, NULL, 'A'},
{"fw-revert", no_argument, NULL, 'R'},
+ {"capoemflag", required_argument, NULL, 'o'},
{"help", no_argument, NULL, 'h'},
{NULL, 0, NULL, 0},
};
{"help", no_argument, NULL, 'h'},
{NULL, 0, NULL, 0},
};
"\t-d, --dump_sig dump signature (*.p7)\n"
"\t-A, --fw-accept firmware accept capsule, requires GUID, no image blob\n"
"\t-R, --fw-revert firmware revert capsule, takes no GUID, no image blob\n"
"\t-d, --dump_sig dump signature (*.p7)\n"
"\t-A, --fw-accept firmware accept capsule, requires GUID, no image blob\n"
"\t-R, --fw-revert firmware revert capsule, takes no GUID, no image blob\n"
+ "\t-o, --capoemflag Capsule OEM Flag, an integer between 0x0000 and 0xffff\n"
"\t-h, --help print a help message\n",
tool_name);
}
"\t-h, --help print a help message\n",
tool_name);
}
* @mcount: Monotonic count in authentication information
* @private_file: Path to a private key file
* @cert_file: Path to a certificate file
* @mcount: Monotonic count in authentication information
* @private_file: Path to a private key file
* @cert_file: Path to a certificate file
+ * @oemflags: Capsule OEM Flags, bits 0-15
*
* This function actually does the job of creating an uefi capsule file.
* All the arguments must be supplied.
*
* This function actually does the job of creating an uefi capsule file.
* All the arguments must be supplied.
*/
static int create_fwbin(char *path, char *bin, efi_guid_t *guid,
unsigned long index, unsigned long instance,
*/
static int create_fwbin(char *path, char *bin, efi_guid_t *guid,
unsigned long index, unsigned long instance,
- uint64_t mcount, char *privkey_file, char *cert_file)
+ uint64_t mcount, char *privkey_file, char *cert_file,
+ uint16_t oemflags)
{
struct efi_capsule_header header;
struct efi_firmware_management_capsule_header capsule;
{
struct efi_capsule_header header;
struct efi_firmware_management_capsule_header capsule;
header.header_size = sizeof(header);
/* TODO: The current implementation ignores flags */
header.flags = CAPSULE_FLAGS_PERSIST_ACROSS_RESET;
header.header_size = sizeof(header);
/* TODO: The current implementation ignores flags */
header.flags = CAPSULE_FLAGS_PERSIST_ACROSS_RESET;
+ if (oemflags)
+ header.flags |= oemflags;
header.capsule_image_size = sizeof(header)
+ sizeof(capsule) + sizeof(uint64_t)
+ sizeof(image)
header.capsule_image_size = sizeof(header)
+ sizeof(capsule) + sizeof(uint64_t)
+ sizeof(image)
unsigned char uuid_buf[16];
unsigned long index, instance;
uint64_t mcount;
unsigned char uuid_buf[16];
unsigned long index, instance;
uint64_t mcount;
+ unsigned long oemflags;
char *privkey_file, *cert_file;
int c, idx;
char *privkey_file, *cert_file;
int c, idx;
cert_file = NULL;
dump_sig = 0;
capsule_type = CAPSULE_NORMAL_BLOB;
cert_file = NULL;
dump_sig = 0;
capsule_type = CAPSULE_NORMAL_BLOB;
for (;;) {
c = getopt_long(argc, argv, opts_short, options, &idx);
if (c == -1)
for (;;) {
c = getopt_long(argc, argv, opts_short, options, &idx);
if (c == -1)
}
capsule_type = CAPSULE_REVERT;
break;
}
capsule_type = CAPSULE_REVERT;
break;
+ case 'o':
+ oemflags = strtoul(optarg, NULL, 0);
+ if (oemflags > 0xffff) {
+ fprintf(stderr,
+ "oemflags must be between 0x0 and 0xffff\n");
+ exit(1);
+ }
+ break;
default:
print_usage();
exit(EXIT_SUCCESS);
default:
print_usage();
exit(EXIT_SUCCESS);
}
} else if (create_fwbin(argv[argc - 1], argv[argc - 2], guid,
index, instance, mcount, privkey_file,
}
} else if (create_fwbin(argv[argc - 1], argv[argc - 2], guid,
index, instance, mcount, privkey_file,
+ cert_file, (uint16_t)oemflags) < 0) {
fprintf(stderr, "Creating firmware capsule failed\n");
exit(EXIT_FAILURE);
}
fprintf(stderr, "Creating firmware capsule failed\n");
exit(EXIT_FAILURE);
}