[PATCH v2 2/5] efi_loader: add EBBR 2.2-2.4 ECPT entries

["Vincent Stehlé" <vincent.stehle@arm.com>]

Add three ECPT entries for the EBBR versions 2.2, 2.3 and 2.4
conformance profiles:
- Define the three EFI_CONFORMANCE_PROFILE_EBBR_2_[234]_GUIDs.
- Introduce the three HAVE_EFI_EBBR_2_[234] non-visible configuration
  symbols to compute the actual system conformance status with the
  dependencies.
- Add the three EFI_EBBR_2_[234]_CONFORMANCE configuration menu entries
  to control the addition of the corresponding GUIDs in the ECPT.

Following what was done for version 2.1, as many entries as possible are
added optimistically by default in the ECPT, and this can be overridden
manually by the system integrator after inspection if necessary.

Conformance cheat sheet:

  EBBR  Additional requirements
  ----  ---------------------------------------------------
   2.2  TCG2 & capsule "on disk"
   2.3  Authenticated capsules in FMP format & boot manager
   2.4  Non-UEFI (privileged firmware)

We do the following configurations dependencies approximations:

      Configuration symbol  Used to approximate
  ------------------------  ------------------------------------
  EFI_HAVE_CAPSULE_SUPPORT  Firmware update is performed in-band
                    TPM_V2  A TPM is present

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
---
 include/efi_api.h                | 12 ++++++++++
 lib/efi_loader/Kconfig           | 51 ++++++++++++++++++++++++++++++++++++++++
 lib/efi_loader/efi_conformance.c |  9 +++++++
 3 files changed, 72 insertions(+)

diff --git a/include/efi_api.h b/include/efi_api.h
index d4fdd50c49e..17e55118cda 100644
--- a/include/efi_api.h
+++ b/include/efi_api.h
@@ -238,6 +238,18 @@ enum efi_reset_type {
 	EFI_GUID(0xcce33c35, 0x74ac, 0x4087, 0xbc, 0xe7, \
 		 0x8b, 0x29, 0xb0, 0x2e, 0xeb, 0x27)
 
+#define EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID \
+	EFI_GUID(0x9073eed4, 0xe50d, 0x11ee, 0xb8, 0xb0, \
+		 0x8b, 0x68, 0xda, 0x62, 0xfc, 0x80)
+
+#define EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID \
+	EFI_GUID(0x7721fc77, 0xa724, 0x11ef, 0x8e, 0xaa, \
+		 0xf7, 0xc9, 0xb1, 0x94, 0xba, 0x75)
+
+#define EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID \
+	EFI_GUID(0xf2bb0422, 0xda8e, 0x11f0, 0xa6, 0x7b, \
+		 0x1b, 0xe2, 0x20, 0x85, 0x40, 0x98)
+
 #define EFI_DEBUG_IMAGE_INFO_TABLE_GUID \
 	EFI_GUID(0x49152e77, 0x1ada, 0x4764, 0xb7, 0xa2, \
 		 0x7a, 0xfe, 0xfe, 0xd9, 0x5e, 0x8b)
diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
index aad8f860868..81231533946 100644
--- a/lib/efi_loader/Kconfig
+++ b/lib/efi_loader/Kconfig
@@ -577,6 +577,26 @@ config HAVE_EFI_EBBR_2_1
 	depends on EFI_CAPSULE_FIRMWARE || !EFI_HAVE_CAPSULE_SUPPORT
 	default y
 
+config HAVE_EFI_EBBR_2_2
+	bool
+	depends on HAVE_EFI_EBBR_2_1
+	depends on EFI_TCG2_PROTOCOL || !TPM_V2
+	depends on EFI_CAPSULE_ON_DISK || !EFI_HAVE_CAPSULE_SUPPORT
+	default y
+
+config HAVE_EFI_EBBR_2_3
+	bool
+	depends on HAVE_EFI_EBBR_2_2
+	depends on EFI_CAPSULE_AUTHENTICATE || !EFI_HAVE_CAPSULE_SUPPORT
+	depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT || !EFI_HAVE_CAPSULE_SUPPORT
+	depends on EFI_BOOTMGR
+	default y
+
+config HAVE_EFI_EBBR_2_4
+	bool
+	depends on HAVE_EFI_EBBR_2_3
+	default y
+
 config EFI_ECPT
 	bool "Enable the UEFI ECPT generation"
 	default y
@@ -592,6 +612,37 @@ config EFI_EBBR_2_1_CONFORMANCE
 	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
 	  v2.1 conformance entry to the ECPT.
 
+config EFI_EBBR_2_2_CONFORMANCE
+	bool "Add the EBBR v2.2 conformance entry to the ECPT"
+	depends on EFI_ECPT && HAVE_EFI_EBBR_2_2
+	default y
+	help
+	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
+	  v2.2 conformance entry to the ECPT.
+
+	  Version 2.2 adds requirements around TCG2 and capsule "on disk".
+
+config EFI_EBBR_2_3_CONFORMANCE
+	bool "Add the EBBR v2.3 conformance entry to the ECPT"
+	depends on EFI_ECPT && HAVE_EFI_EBBR_2_3
+	default y
+	help
+	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
+	  v2.3 conformance entry to the ECPT.
+
+	  Version 2.3 adds requirements around authenticated capsules in FMP
+	  format and the boot manager.
+
+config EFI_EBBR_2_4_CONFORMANCE
+	bool "Add the EBBR v2.4 conformance entry to the ECPT"
+	depends on EFI_ECPT && HAVE_EFI_EBBR_2_4
+	default y
+	help
+	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
+	  v2.4 conformance entry to the ECPT.
+
+	  Version 2.4 adds non-UEFI requirements.
+
 config EFI_CONSOLE_DISABLE_ANSI
 	bool "Disable ANSI escape sequence queries for console size"
 	help
diff --git a/lib/efi_loader/efi_conformance.c b/lib/efi_loader/efi_conformance.c
index 470141af483..c1234681bb6 100644
--- a/lib/efi_loader/efi_conformance.c
+++ b/lib/efi_loader/efi_conformance.c
@@ -29,6 +29,15 @@ efi_status_t efi_ecpt_register(void)
 	#if CONFIG_IS_ENABLED(EFI_EBBR_2_1_CONFORMANCE)
 		EFI_CONFORMANCE_PROFILE_EBBR_2_1_GUID,
 	#endif
+	#if CONFIG_IS_ENABLED(EFI_EBBR_2_2_CONFORMANCE)
+		EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID,
+	#endif
+	#if CONFIG_IS_ENABLED(EFI_EBBR_2_3_CONFORMANCE)
+		EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID,
+	#endif
+	#if CONFIG_IS_ENABLED(EFI_EBBR_2_4_CONFORMANCE)
+		EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID,
+	#endif
 	};
 
 	ecpt_size = sizeof(profiles)

-- 
2.53.0