erebion/coreboot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Makefile.mk: generate EDK2 update capsule

Browse source 
Generate a signed UEFI capsule from the final coreboot ROM image using
EDK2 BaseTools.

When using an EDK2 payload and enabling DRIVERS_EFI_UPDATE_CAPSULES and
DRIVERS_EFI_GENERATE_CAPSULE, the build produces build/coreboot.cap once
the ROM is finalised (after all files were added to CBFS). The capsule
can also be generated explicitly with `make capsule`.

Move the capsule generation and certificate preparation into
payloads/external/edk2/Makefile, including generating the trusted root
certificate PCD include via BinToPcd.

Support capsule flows with an embedded FmpDxe driver by optionally
embedding FmpDxe.efi into generated capsules, and wiring the
embedded-driver Kconfig options through to the EDK2 payload build and
capsule generation.

Always set PersistAcrossReset on the capsule. Make InitiateReset
configurable (default off) because Linux rejects capsules with
InitiateReset when writing via /dev/efi_capsule_loader.

Use CONFIG_DRIVERS_EFI_MAIN_FW_VERSION for GenerateCapsule
--fw-version, but fall back to parsing a leading <major>.<minor> from
CONFIG_LOCALVERSION when it is left at 0. If
CONFIG_DRIVERS_EFI_MAIN_FW_LSV is 0, use the resolved firmware version.

Document capsule generation and embedded driver configuration.

Corresponding edk2 patches can be found at:
https://github.com/tianocore/edk2/pull/12053

Change-Id: I5f56b894d40ddb49f3158bb72f0143d0ebe9c34c
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/90862
Reviewed-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This commit is contained in:
Sean Rhodes 2026-01-21 22:17:33 +00:00
commit 817394f12c
6 changed files with 315 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

90
src/drivers/efi/Kconfig
View file

@ -57,3 +57,93 @@ config DRIVERS_EFI_UPDATE_CAPSULES
Adds a driver that is able to parse CapsuleUpdateData* EFI variables
to discover firmware updates and expose them for tianocore thorough
CBMEM for execution. tianocore is responsible for erasing the variables.
config DRIVERS_EFI_CAPSULE_ACCEPT_EMBEDDED_DRIVERS
bool "Allow embedded drivers in update capsules"
depends on PAYLOAD_EDK2 && DRIVERS_EFI_UPDATE_CAPSULES
help
Allow the EDK2 payload's capsule processing to load embedded drivers
from capsules (PcdCapsuleEmbeddedDriverSupport).
This is required for capsules that contain embedded drivers.
Note: if Secure Boot is enabled, the embedded driver must be signed by a
key trusted by the running firmware (or capsule processing may fail).
config DRIVERS_EFI_GENERATE_CAPSULE
bool "Generate an update capsule during the build"
depends on PAYLOAD_EDK2 && DRIVERS_EFI_UPDATE_CAPSULES
help
Generates a UEFI capsule from the final ROM image using EDK2 BaseTools.
This is intended for fwupd update workflows that use the ESRT/FMP
mechanism.
config DRIVERS_EFI_CAPSULE_EMBED_FMP_DXE
bool "Embed FmpDxe driver into generated capsules"
depends on DRIVERS_EFI_GENERATE_CAPSULE
depends on DRIVERS_EFI_CAPSULE_ACCEPT_EMBEDDED_DRIVERS
help
When generating build/coreboot.cap, embed the built FmpDxe.efi as an
embedded driver in the capsule.
config DRIVERS_EFI_CAPSULE_INITIATE_RESET
bool "Request reset after capsule is applied"
default n
depends on DRIVERS_EFI_GENERATE_CAPSULE
help
Add the InitiateReset capsule flag when generating build/coreboot.cap.
Note: Linux rejects capsules with InitiateReset when using
/dev/efi_capsule_loader.
config DRIVERS_EFI_CAPSULE_REGIONS
string "FMAP regions to include in the capsule manifest"
default "COREBOOT"
depends on DRIVERS_EFI_GENERATE_CAPSULE
help
Whitespace-separated list of FMAP regions that the update capsule is
allowed to modify. The list is embedded as a manifest inside the ROM
image prior to building the capsule.
menu "Capsule signing certificates"
depends on DRIVERS_EFI_GENERATE_CAPSULE
config DRIVERS_EFI_CAPSULE_SIGNER_PRIVATE_CERT
string "PEM file used to sign generated capsules"
default "BaseTools/Source/Python/Pkcs7Sign/TestCert.pem"
depends on DRIVERS_EFI_GENERATE_CAPSULE
help
Path to a PEM file containing the private key and leaf certificate used
when signing the capsule with EDK2 GenerateCapsule.
If the path is relative, it is interpreted relative to the configured
EDK2 repository (payloads/external/edk2 workspace).
See Documentation/drivers/efi_capsule_generation.md and
BaseTools/Source/Python/Pkcs7Sign/Readme.md in the EDK2 tree.
config DRIVERS_EFI_CAPSULE_OTHER_PUBLIC_CERT
string "Intermediate certificate for capsule signing (PEM)"
default "BaseTools/Source/Python/Pkcs7Sign/TestSub.pub.pem"
depends on DRIVERS_EFI_GENERATE_CAPSULE
help
Path to the intermediate certificate (PEM) used when generating a PKCS#7
signature for the capsule.
If the path is relative, it is interpreted relative to the configured
EDK2 repository (payloads/external/edk2 workspace).
config DRIVERS_EFI_CAPSULE_TRUSTED_PUBLIC_CERT
string "Trusted root certificate for capsule signing (PEM)"
default "BaseTools/Source/Python/Pkcs7Sign/TestRoot.pub.pem"
depends on DRIVERS_EFI_GENERATE_CAPSULE
help
Path to the trusted root certificate (PEM) used when generating a PKCS#7
signature for the capsule.
If the path is relative, it is interpreted relative to the configured
EDK2 repository (payloads/external/edk2 workspace).
endmenu