On Mon, 21 Sept 2026 at 16:12, Vincent Stehlé <[email protected]> wrote: > > Add three ECPT entries for the EBBR versions 2.2, 2.3 and 2.4 > conformance profiles: > - Define the three EFI_CONFORMANCE_PROFILE_EBBR_2_[234]_GUIDs. > - Introduce the three HAVE_EFI_EBBR_2_[234] non-visible configuration > symbols to compute the actual system conformance status with the > dependencies. > - Add the three EFI_EBBR_2_[234]_CONFORMANCE configuration menu entries > to control the addition of the corresponding GUIDs in the ECPT. > > Following what was done for version 2.1, as many entries as possible are > added optimistically by default in the ECPT, and this can be overridden > manually by the system integrator after inspection if necessary. > > Conformance cheat sheet: > > EBBR Additional requirements > ---- --------------------------------------------------- > 2.2 TCG2 & capsule "on disk" > 2.3 Authenticated capsules in FMP format & boot manager > 2.4 Non-UEFI (privileged firmware) > > We do the following configurations dependencies approximations: > > Configuration symbol Used to approximate > ------------------------ ------------------------------------ > EFI_HAVE_CAPSULE_SUPPORT Firmware update is performed in-band > TPM_V2 A TPM is present > > Signed-off-by: Vincent Stehlé <[email protected]> > Cc: Heinrich Schuchardt <[email protected]> > Cc: Ilias Apalodimas <[email protected]> > Cc: Tom Rini <[email protected]> > ---
Reviewed-by: Ilias Apalodimas <[email protected]> > include/efi_api.h | 12 ++++++++++ > lib/efi_loader/Kconfig | 51 > ++++++++++++++++++++++++++++++++++++++++ > lib/efi_loader/efi_conformance.c | 9 +++++++ > 3 files changed, 72 insertions(+) > > diff --git a/include/efi_api.h b/include/efi_api.h > index d4fdd50c49e..17e55118cda 100644 > --- a/include/efi_api.h > +++ b/include/efi_api.h > @@ -238,6 +238,18 @@ enum efi_reset_type { > EFI_GUID(0xcce33c35, 0x74ac, 0x4087, 0xbc, 0xe7, \ > 0x8b, 0x29, 0xb0, 0x2e, 0xeb, 0x27) > > +#define EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID \ > + EFI_GUID(0x9073eed4, 0xe50d, 0x11ee, 0xb8, 0xb0, \ > + 0x8b, 0x68, 0xda, 0x62, 0xfc, 0x80) > + > +#define EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID \ > + EFI_GUID(0x7721fc77, 0xa724, 0x11ef, 0x8e, 0xaa, \ > + 0xf7, 0xc9, 0xb1, 0x94, 0xba, 0x75) > + > +#define EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID \ > + EFI_GUID(0xf2bb0422, 0xda8e, 0x11f0, 0xa6, 0x7b, \ > + 0x1b, 0xe2, 0x20, 0x85, 0x40, 0x98) > + > #define EFI_DEBUG_IMAGE_INFO_TABLE_GUID \ > EFI_GUID(0x49152e77, 0x1ada, 0x4764, 0xb7, 0xa2, \ > 0x7a, 0xfe, 0xfe, 0xd9, 0x5e, 0x8b) > diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig > index aad8f860868..81231533946 100644 > --- a/lib/efi_loader/Kconfig > +++ b/lib/efi_loader/Kconfig > @@ -577,6 +577,26 @@ config HAVE_EFI_EBBR_2_1 > depends on EFI_CAPSULE_FIRMWARE || !EFI_HAVE_CAPSULE_SUPPORT > default y > > +config HAVE_EFI_EBBR_2_2 > + bool > + depends on HAVE_EFI_EBBR_2_1 > + depends on EFI_TCG2_PROTOCOL || !TPM_V2 > + depends on EFI_CAPSULE_ON_DISK || !EFI_HAVE_CAPSULE_SUPPORT > + default y > + > +config HAVE_EFI_EBBR_2_3 > + bool > + depends on HAVE_EFI_EBBR_2_2 > + depends on EFI_CAPSULE_AUTHENTICATE || !EFI_HAVE_CAPSULE_SUPPORT > + depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT || > !EFI_HAVE_CAPSULE_SUPPORT > + depends on EFI_BOOTMGR > + default y > + > +config HAVE_EFI_EBBR_2_4 > + bool > + depends on HAVE_EFI_EBBR_2_3 > + default y > + > config EFI_ECPT > bool "Enable the UEFI ECPT generation" > default y > @@ -592,6 +612,37 @@ config EFI_EBBR_2_1_CONFORMANCE > Enabling this option adds the Embedded Base Boot Requirements (EBBR) > v2.1 conformance entry to the ECPT. > > +config EFI_EBBR_2_2_CONFORMANCE > + bool "Add the EBBR v2.2 conformance entry to the ECPT" > + depends on EFI_ECPT && HAVE_EFI_EBBR_2_2 > + default y > + help > + Enabling this option adds the Embedded Base Boot Requirements (EBBR) > + v2.2 conformance entry to the ECPT. > + > + Version 2.2 adds requirements around TCG2 and capsule "on disk". > + > +config EFI_EBBR_2_3_CONFORMANCE > + bool "Add the EBBR v2.3 conformance entry to the ECPT" > + depends on EFI_ECPT && HAVE_EFI_EBBR_2_3 > + default y > + help > + Enabling this option adds the Embedded Base Boot Requirements (EBBR) > + v2.3 conformance entry to the ECPT. > + > + Version 2.3 adds requirements around authenticated capsules in FMP > + format and the boot manager. > + > +config EFI_EBBR_2_4_CONFORMANCE > + bool "Add the EBBR v2.4 conformance entry to the ECPT" > + depends on EFI_ECPT && HAVE_EFI_EBBR_2_4 > + default y > + help > + Enabling this option adds the Embedded Base Boot Requirements (EBBR) > + v2.4 conformance entry to the ECPT. > + > + Version 2.4 adds non-UEFI requirements. > + > config EFI_CONSOLE_DISABLE_ANSI > bool "Disable ANSI escape sequence queries for console size" > help > diff --git a/lib/efi_loader/efi_conformance.c > b/lib/efi_loader/efi_conformance.c > index 470141af483..c1234681bb6 100644 > --- a/lib/efi_loader/efi_conformance.c > +++ b/lib/efi_loader/efi_conformance.c > @@ -29,6 +29,15 @@ efi_status_t efi_ecpt_register(void) > #if CONFIG_IS_ENABLED(EFI_EBBR_2_1_CONFORMANCE) > EFI_CONFORMANCE_PROFILE_EBBR_2_1_GUID, > #endif > + #if CONFIG_IS_ENABLED(EFI_EBBR_2_2_CONFORMANCE) > + EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID, > + #endif > + #if CONFIG_IS_ENABLED(EFI_EBBR_2_3_CONFORMANCE) > + EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID, > + #endif > + #if CONFIG_IS_ENABLED(EFI_EBBR_2_4_CONFORMANCE) > + EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID, > + #endif > }; > > ecpt_size = sizeof(profiles) > > -- > 2.53.0 >
