[PATCH 0/5] efi: ECPT EBBR conformance profiles

[PATCH 0/5] efi: ECPT EBBR conformance profiles

[Vincent Stehlé]

The Embedded Base Boot Requirements (EBBR) specification [1] defines a
subset of UEFI, sufficient to boot an OS.

Currently, EBBR defines four UEFI conformance profiles, 2.1 to 2.4, and
U-Boot can advertise that it supports 2.1 in the EFI Conformance
Profiles Table (ECPT).

As U-Boot can in fact support up to 2.4, this patch series does the
following:

1. Refine the conditions for the 2.1 profile and prepare to add more.
2. Add the 2.2, 2.3 & 2.4 profiles.
3. Add the human readable strings to print the new GUIDs.
4. Add unit tests for the new profiles.
5. Update the documentation.

The list of supported profiles are inferred optimistically from U-Boot
configuration by default, and we rely on the system integrator to "opt
out" manually if necessary.

Link: https://github.com/ARM-software/ebbr [1]
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
---
Vincent Stehlé (5):
      efi_loader: adjust EBBR 2.1 ECPT entry
      efi_loader: add EBBR 2.2-2.4 ECPT entries
      lib: uuid: add EBBR 2.2-2.4 conformance profile GUIDs
      test/py: add 2.2-2.4 ECPT tests
      doc: uefi: EBBR conformance profiles

 doc/develop/uefi/uefi.rst        | 18 +++++---
 include/efi_api.h                | 12 ++++++
 lib/efi_loader/Kconfig           | 88 ++++++++++++++++++++++++++++++++++++----
 lib/efi_loader/efi_conformance.c |  9 ++++
 lib/uuid.c                       | 12 ++++++
 test/py/tests/test_efi_ecpt.py   | 48 ++++++++++++++++++++++
 6 files changed, 173 insertions(+), 14 deletions(-)
---
base-commit: cc557af4553382f6f50e3ed62b9577054e7bc54f
change-id: 20260902-conform-347df9362c8d

Best regards,
--  
Vincent.

[PATCH 1/5] efi_loader: adjust EBBR 2.1 ECPT entry

[Vincent Stehlé]

Adjust the EBBR 2.1 conformance profile ECPT entry configuration, and
prepare to add more:
- Introduce the HAVE_EFI_EBBR_2_1 non-visible configuration symbol to
  compute the actual system conformance status with the dependencies.
  This will make it easier to add more versions with a chain of
  dependencies, while avoiding a chain of nested submenus.
- Adjust version 2.1 dependencies to better match the specification.
  Relax the dependency on the boot manager, which was introduced in
  version 2.3, and make the list of required UEFI protocols and services
  more complete.
- Reword the EFI_EBBR_2_1_CONFORMANCE configuration entry title and help
  text, mostly to separate "EBBR" from "v2.1" and to attenuate the
  redundant "table" mention.

We do the following additional configurations dependencies
approximations:

      Configuration symbol  Used to approximate
  ------------------------  ------------------------------------
  EFI_HAVE_CAPSULE_SUPPORT  Firmware update is performed in-band
                    DM_RTC  An RTC is present

While at it, refine the ECPT help text to attenuate the redundant
"table" mention there as well.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
---
 lib/efi_loader/Kconfig | 36 +++++++++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
index 4cb13ae7c8a..40380876959 100644
--- a/lib/efi_loader/Kconfig
+++ b/lib/efi_loader/Kconfig
@@ -557,23 +557,41 @@ config EFI_ESRT
 	help
 	  Enabling this option creates the ESRT UEFI system table.
 
+config HAVE_EFI_EBBR_2_1
+	bool
+	depends on EFI_LOADER_HII
+	depends on EFI_RISCV_BOOT_PROTOCOL || !RISCV
+	depends on EFI_RNG_PROTOCOL || !DM_RNG
+	depends on EFI_UNICODE_COLLATION_PROTOCOL2
+	depends on BOOTMETH_EFILOADER
+	depends on !EFI_VARIABLE_NO_STORE
+	depends on BOOTM_EFI
+	depends on EFI_BINARY_EXEC
+	depends on EFI_DEVICE_PATH_TO_TEXT
+	depends on EFI_DEVICE_PATH_UTIL
+	depends on EFI_GET_TIME || !DM_RTC
+	depends on EFI_PARTITION
+	depends on EFI_SET_TIME || !DM_RTC
+	depends on EFI_UNICODE_CAPITALIZATION
+	depends on EFI_ESRT || !EFI_HAVE_CAPSULE_SUPPORT
+	depends on EFI_RUNTIME_UPDATE_CAPSULE || !EFI_HAVE_CAPSULE_SUPPORT
+	depends on EFI_CAPSULE_FIRMWARE || !EFI_HAVE_CAPSULE_SUPPORT
+	default y
+
 config EFI_ECPT
 	bool "Enable the UEFI ECPT generation"
 	default y
 	help
-	  Enabling this option created the ECPT UEFI table.
+	  Enabling this option creates the EFI Conformance Profiles Table
+	  (ECPT).
 
 config EFI_EBBR_2_1_CONFORMANCE
-	bool "Add the EBBRv2.1 conformance entry to the ECPT table"
-	depends on BOOTMETH_EFI_BOOTMGR
-	depends on EFI_ECPT
-	depends on EFI_LOADER_HII
-	depends on EFI_RISCV_BOOT_PROTOCOL || !RISCV
-	depends on EFI_RNG_PROTOCOL || !DM_RNG
-	depends on EFI_UNICODE_COLLATION_PROTOCOL2
+	bool "Add the EBBR v2.1 conformance entry to the ECPT"
+	depends on EFI_ECPT && HAVE_EFI_EBBR_2_1
 	default y
 	help
-	  Enabling this option adds the EBBRv2.1 conformance entry to the ECPT UEFI table.
+	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
+	  v2.1 conformance entry to the ECPT.
 
 config EFI_CONSOLE_DISABLE_ANSI
 	bool "Disable ANSI escape sequence queries for console size"

-- 
2.53.0

Re: [PATCH 1/5] efi_loader: adjust EBBR 2.1 ECPT entry

[Ilias Apalodimas]

Hi Vincent,

On Fri, 4 Sept 2026 at 17:01, Vincent Stehlé <vincent.stehle@arm.com> wrote:
>
> Adjust the EBBR 2.1 conformance profile ECPT entry configuration, and
> prepare to add more:
> - Introduce the HAVE_EFI_EBBR_2_1 non-visible configuration symbol to
>   compute the actual system conformance status with the dependencies.
>   This will make it easier to add more versions with a chain of
>   dependencies, while avoiding a chain of nested submenus.
> - Adjust version 2.1 dependencies to better match the specification.
>   Relax the dependency on the boot manager, which was introduced in
>   version 2.3, and make the list of required UEFI protocols and services
>   more complete.
> - Reword the EFI_EBBR_2_1_CONFORMANCE configuration entry title and help
>   text, mostly to separate "EBBR" from "v2.1" and to attenuate the
>   redundant "table" mention.
>
> We do the following additional configurations dependencies
> approximations:
>
>       Configuration symbol  Used to approximate
>   ------------------------  ------------------------------------
>   EFI_HAVE_CAPSULE_SUPPORT  Firmware update is performed in-band
>                     DM_RTC  An RTC is present
>
> While at it, refine the ECPT help text to attenuate the redundant
> "table" mention there as well.
>
> Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
> Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
> Cc: Tom Rini <trini@konsulko.com>
> ---
>  lib/efi_loader/Kconfig | 36 +++++++++++++++++++++++++++---------
>  1 file changed, 27 insertions(+), 9 deletions(-)
>
> diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
> index 4cb13ae7c8a..40380876959 100644
> --- a/lib/efi_loader/Kconfig
> +++ b/lib/efi_loader/Kconfig
> @@ -557,23 +557,41 @@ config EFI_ESRT
>         help
>           Enabling this option creates the ESRT UEFI system table.
>
> +config HAVE_EFI_EBBR_2_1
> +       bool
> +       depends on EFI_LOADER_HII
> +       depends on EFI_RISCV_BOOT_PROTOCOL || !RISCV
> +       depends on EFI_RNG_PROTOCOL || !DM_RNG
> +       depends on EFI_UNICODE_COLLATION_PROTOCOL2
> +       depends on BOOTMETH_EFILOADER

Similar comments here. The BOOTMETH_* shouldn't be a requirement

Cheers
/Ilias
> +       depends on !EFI_VARIABLE_NO_STORE
> +       depends on BOOTM_EFI
> +       depends on EFI_BINARY_EXEC
> +       depends on EFI_DEVICE_PATH_TO_TEXT
> +       depends on EFI_DEVICE_PATH_UTIL
> +       depends on EFI_GET_TIME || !DM_RTC
> +       depends on EFI_PARTITION
> +       depends on EFI_SET_TIME || !DM_RTC
> +       depends on EFI_UNICODE_CAPITALIZATION
> +       depends on EFI_ESRT || !EFI_HAVE_CAPSULE_SUPPORT
> +       depends on EFI_RUNTIME_UPDATE_CAPSULE || !EFI_HAVE_CAPSULE_SUPPORT
> +       depends on EFI_CAPSULE_FIRMWARE || !EFI_HAVE_CAPSULE_SUPPORT
> +       default y
> +
>  config EFI_ECPT
>         bool "Enable the UEFI ECPT generation"
>         default y
>         help
> -         Enabling this option created the ECPT UEFI table.
> +         Enabling this option creates the EFI Conformance Profiles Table
> +         (ECPT).
>
>  config EFI_EBBR_2_1_CONFORMANCE
> -       bool "Add the EBBRv2.1 conformance entry to the ECPT table"
> -       depends on BOOTMETH_EFI_BOOTMGR
> -       depends on EFI_ECPT
> -       depends on EFI_LOADER_HII
> -       depends on EFI_RISCV_BOOT_PROTOCOL || !RISCV
> -       depends on EFI_RNG_PROTOCOL || !DM_RNG
> -       depends on EFI_UNICODE_COLLATION_PROTOCOL2
> +       bool "Add the EBBR v2.1 conformance entry to the ECPT"
> +       depends on EFI_ECPT && HAVE_EFI_EBBR_2_1
>         default y
>         help
> -         Enabling this option adds the EBBRv2.1 conformance entry to the ECPT UEFI table.
> +         Enabling this option adds the Embedded Base Boot Requirements (EBBR)
> +         v2.1 conformance entry to the ECPT.
>
>  config EFI_CONSOLE_DISABLE_ANSI
>         bool "Disable ANSI escape sequence queries for console size"
>
> --
> 2.53.0
>

Re: [PATCH 1/5] efi_loader: adjust EBBR 2.1 ECPT entry

[Vincent Stehlé]

On Thu, Sep 17, 2026 at 06:04:07PM +0200, Ilias Apalodimas wrote:
> Hi Vincent,

Hi Ilias,

Thank you for reviewing; my comments below.

Best regards,
Vincent.

> 
> On Fri, 4 Sept 2026 at 17:01, Vincent Stehlé <vincent.stehle@arm.com> wrote:
> >
> > Adjust the EBBR 2.1 conformance profile ECPT entry configuration, and
> > prepare to add more:
> > - Introduce the HAVE_EFI_EBBR_2_1 non-visible configuration symbol to
> >   compute the actual system conformance status with the dependencies.
> >   This will make it easier to add more versions with a chain of
> >   dependencies, while avoiding a chain of nested submenus.
> > - Adjust version 2.1 dependencies to better match the specification.
> >   Relax the dependency on the boot manager, which was introduced in
> >   version 2.3, and make the list of required UEFI protocols and services
> >   more complete.
> > - Reword the EFI_EBBR_2_1_CONFORMANCE configuration entry title and help
> >   text, mostly to separate "EBBR" from "v2.1" and to attenuate the
> >   redundant "table" mention.
> >
> > We do the following additional configurations dependencies
> > approximations:
> >
> >       Configuration symbol  Used to approximate
> >   ------------------------  ------------------------------------
> >   EFI_HAVE_CAPSULE_SUPPORT  Firmware update is performed in-band
> >                     DM_RTC  An RTC is present
> >
> > While at it, refine the ECPT help text to attenuate the redundant
> > "table" mention there as well.
> >
> > Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
> > Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
> > Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
> > Cc: Tom Rini <trini@konsulko.com>
> > ---
> >  lib/efi_loader/Kconfig | 36 +++++++++++++++++++++++++++---------
> >  1 file changed, 27 insertions(+), 9 deletions(-)
> >
> > diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
> > index 4cb13ae7c8a..40380876959 100644
> > --- a/lib/efi_loader/Kconfig
> > +++ b/lib/efi_loader/Kconfig
> > @@ -557,23 +557,41 @@ config EFI_ESRT
> >         help
> >           Enabling this option creates the ESRT UEFI system table.
> >
> > +config HAVE_EFI_EBBR_2_1
> > +       bool
> > +       depends on EFI_LOADER_HII
> > +       depends on EFI_RISCV_BOOT_PROTOCOL || !RISCV
> > +       depends on EFI_RNG_PROTOCOL || !DM_RNG
> > +       depends on EFI_UNICODE_COLLATION_PROTOCOL2
> > +       depends on BOOTMETH_EFILOADER
> 
> Similar comments here. The BOOTMETH_* shouldn't be a requirement

I think you are right: depending on the boot method is a bit too
specific.

The original intention was to advertise a system as compliant only if we
could guarantee that it would boot automatically with UEFI (in this
patch with the default filename, and in previous patch with the boot
manager).
There did not seem to be an easy way to guarantee that with the
configurations dependencies.

What you see here is a second attempt, trying to -at least- avoid
advertising as compliant a system, which we know cannot boot
automatically with UEFI.
Even for that depending on the BOOTMETH_* configurations is probably not
good enough after all.

I think you mentioned that you or Heinrich could amend the patches
before merging; do not hesitate to let me know if you prefer that I send
a v2 series with the dependency here and in the previous patch removed.

> 
> Cheers
> /Ilias
> > +       depends on !EFI_VARIABLE_NO_STORE
> > +       depends on BOOTM_EFI
> > +       depends on EFI_BINARY_EXEC
> > +       depends on EFI_DEVICE_PATH_TO_TEXT
> > +       depends on EFI_DEVICE_PATH_UTIL
> > +       depends on EFI_GET_TIME || !DM_RTC
> > +       depends on EFI_PARTITION
> > +       depends on EFI_SET_TIME || !DM_RTC
> > +       depends on EFI_UNICODE_CAPITALIZATION
> > +       depends on EFI_ESRT || !EFI_HAVE_CAPSULE_SUPPORT
> > +       depends on EFI_RUNTIME_UPDATE_CAPSULE || !EFI_HAVE_CAPSULE_SUPPORT
> > +       depends on EFI_CAPSULE_FIRMWARE || !EFI_HAVE_CAPSULE_SUPPORT
> > +       default y
> > +
> >  config EFI_ECPT
> >         bool "Enable the UEFI ECPT generation"
> >         default y
> >         help
> > -         Enabling this option created the ECPT UEFI table.
> > +         Enabling this option creates the EFI Conformance Profiles Table
> > +         (ECPT).
> >
> >  config EFI_EBBR_2_1_CONFORMANCE
> > -       bool "Add the EBBRv2.1 conformance entry to the ECPT table"
> > -       depends on BOOTMETH_EFI_BOOTMGR
> > -       depends on EFI_ECPT
> > -       depends on EFI_LOADER_HII
> > -       depends on EFI_RISCV_BOOT_PROTOCOL || !RISCV
> > -       depends on EFI_RNG_PROTOCOL || !DM_RNG
> > -       depends on EFI_UNICODE_COLLATION_PROTOCOL2
> > +       bool "Add the EBBR v2.1 conformance entry to the ECPT"
> > +       depends on EFI_ECPT && HAVE_EFI_EBBR_2_1
> >         default y
> >         help
> > -         Enabling this option adds the EBBRv2.1 conformance entry to the ECPT UEFI table.
> > +         Enabling this option adds the Embedded Base Boot Requirements (EBBR)
> > +         v2.1 conformance entry to the ECPT.
> >
> >  config EFI_CONSOLE_DISABLE_ANSI
> >         bool "Disable ANSI escape sequence queries for console size"
> >
> > --
> > 2.53.0
> >

Re: [PATCH 1/5] efi_loader: adjust EBBR 2.1 ECPT entry

[Ilias Apalodimas]

Hi Vincent,

On Fri, 18 Sept 2026 at 15:35, Vincent Stehlé <vincent.stehle@arm.com> wrote:
>
> On Thu, Sep 17, 2026 at 06:04:07PM +0200, Ilias Apalodimas wrote:
> > Hi Vincent,
>
> Hi Ilias,
>
> Thank you for reviewing; my comments below.
>
> Best regards,
> Vincent.
>
> >
> > On Fri, 4 Sept 2026 at 17:01, Vincent Stehlé <vincent.stehle@arm.com> wrote:
> > >
> > > Adjust the EBBR 2.1 conformance profile ECPT entry configuration, and
> > > prepare to add more:
> > > - Introduce the HAVE_EFI_EBBR_2_1 non-visible configuration symbol to
> > >   compute the actual system conformance status with the dependencies.
> > >   This will make it easier to add more versions with a chain of
> > >   dependencies, while avoiding a chain of nested submenus.
> > > - Adjust version 2.1 dependencies to better match the specification.
> > >   Relax the dependency on the boot manager, which was introduced in
> > >   version 2.3, and make the list of required UEFI protocols and services
> > >   more complete.
> > > - Reword the EFI_EBBR_2_1_CONFORMANCE configuration entry title and help
> > >   text, mostly to separate "EBBR" from "v2.1" and to attenuate the
> > >   redundant "table" mention.
> > >
> > > We do the following additional configurations dependencies
> > > approximations:
> > >
> > >       Configuration symbol  Used to approximate
> > >   ------------------------  ------------------------------------
> > >   EFI_HAVE_CAPSULE_SUPPORT  Firmware update is performed in-band
> > >                     DM_RTC  An RTC is present
> > >
> > > While at it, refine the ECPT help text to attenuate the redundant
> > > "table" mention there as well.
> > >
> > > Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
> > > Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
> > > Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
> > > Cc: Tom Rini <trini@konsulko.com>
> > > ---
> > >  lib/efi_loader/Kconfig | 36 +++++++++++++++++++++++++++---------
> > >  1 file changed, 27 insertions(+), 9 deletions(-)
> > >
> > > diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
> > > index 4cb13ae7c8a..40380876959 100644
> > > --- a/lib/efi_loader/Kconfig
> > > +++ b/lib/efi_loader/Kconfig
> > > @@ -557,23 +557,41 @@ config EFI_ESRT
> > >         help
> > >           Enabling this option creates the ESRT UEFI system table.
> > >
> > > +config HAVE_EFI_EBBR_2_1
> > > +       bool
> > > +       depends on EFI_LOADER_HII
> > > +       depends on EFI_RISCV_BOOT_PROTOCOL || !RISCV
> > > +       depends on EFI_RNG_PROTOCOL || !DM_RNG
> > > +       depends on EFI_UNICODE_COLLATION_PROTOCOL2
> > > +       depends on BOOTMETH_EFILOADER
> >
> > Similar comments here. The BOOTMETH_* shouldn't be a requirement
>
> I think you are right: depending on the boot method is a bit too
> specific.
>
> The original intention was to advertise a system as compliant only if we
> could guarantee that it would boot automatically with UEFI (in this
> patch with the default filename, and in previous patch with the boot
> manager).
> There did not seem to be an easy way to guarantee that with the
> configurations dependencies.
>
> What you see here is a second attempt, trying to -at least- avoid
> advertising as compliant a system, which we know cannot boot
> automatically with UEFI.
> Even for that depending on the BOOTMETH_* configurations is probably not
> good enough after all.

Fair enough but that's a bit of a chicken-and-egg situation, tbh...
and it's not straightforward.
For example, you *can* boot directly without bootmeth* if your default
command is 'bootefi bootmgr'. And I think it's better to document that
somewhere, rather than not exposing the ECPT entry for people that opt
out of bootmeth*

>
> I think you mentioned that you or Heinrich could amend the patches
> before merging; do not hesitate to let me know if you prefer that I send
> a v2 series with the dependency here and in the previous patch removed.
>

I found another place with the same dependancy, so please send a v2 if
it's not too much trouble.

Cheers
/Ilias
> >
> > Cheers
> > /Ilias
> > > +       depends on !EFI_VARIABLE_NO_STORE
> > > +       depends on BOOTM_EFI
> > > +       depends on EFI_BINARY_EXEC
> > > +       depends on EFI_DEVICE_PATH_TO_TEXT
> > > +       depends on EFI_DEVICE_PATH_UTIL
> > > +       depends on EFI_GET_TIME || !DM_RTC
> > > +       depends on EFI_PARTITION
> > > +       depends on EFI_SET_TIME || !DM_RTC
> > > +       depends on EFI_UNICODE_CAPITALIZATION
> > > +       depends on EFI_ESRT || !EFI_HAVE_CAPSULE_SUPPORT
> > > +       depends on EFI_RUNTIME_UPDATE_CAPSULE || !EFI_HAVE_CAPSULE_SUPPORT
> > > +       depends on EFI_CAPSULE_FIRMWARE || !EFI_HAVE_CAPSULE_SUPPORT
> > > +       default y
> > > +
> > >  config EFI_ECPT
> > >         bool "Enable the UEFI ECPT generation"
> > >         default y
> > >         help
> > > -         Enabling this option created the ECPT UEFI table.
> > > +         Enabling this option creates the EFI Conformance Profiles Table
> > > +         (ECPT).
> > >
> > >  config EFI_EBBR_2_1_CONFORMANCE
> > > -       bool "Add the EBBRv2.1 conformance entry to the ECPT table"
> > > -       depends on BOOTMETH_EFI_BOOTMGR
> > > -       depends on EFI_ECPT
> > > -       depends on EFI_LOADER_HII
> > > -       depends on EFI_RISCV_BOOT_PROTOCOL || !RISCV
> > > -       depends on EFI_RNG_PROTOCOL || !DM_RNG
> > > -       depends on EFI_UNICODE_COLLATION_PROTOCOL2
> > > +       bool "Add the EBBR v2.1 conformance entry to the ECPT"
> > > +       depends on EFI_ECPT && HAVE_EFI_EBBR_2_1
> > >         default y
> > >         help
> > > -         Enabling this option adds the EBBRv2.1 conformance entry to the ECPT UEFI table.
> > > +         Enabling this option adds the Embedded Base Boot Requirements (EBBR)
> > > +         v2.1 conformance entry to the ECPT.
> > >
> > >  config EFI_CONSOLE_DISABLE_ANSI
> > >         bool "Disable ANSI escape sequence queries for console size"
> > >
> > > --
> > > 2.53.0
> > >

[PATCH 2/5] efi_loader: add EBBR 2.2-2.4 ECPT entries

[Vincent Stehlé]

Add three ECPT entries for the EBBR versions 2.2, 2.3 and 2.4
conformance profiles:
- Define the three EFI_CONFORMANCE_PROFILE_EBBR_2_[234]_GUIDs.
- Introduce the three HAVE_EFI_EBBR_2_[234] non-visible configuration
  symbols to compute the actual system conformance status with the
  dependencies.
- Add the three EFI_EBBR_2_[234]_CONFORMANCE configuration menu entries
  to control the addition of the corresponding GUIDs in the ECPT.

Following what was done for version 2.1, as many entries as possible are
added optimistically by default in the ECPT, and this can be overridden
manually by the system integrator after inspection if necessary.

Conformance cheat sheet:

  EBBR  Additional requirements
  ----  ---------------------------------------------------
   2.2  TCG2 & capsule "on disk"
   2.3  Authenticated capsules in FMP format & boot manager
   2.4  Non-UEFI (privileged firmware)

We do the following configurations dependencies approximations:

      Configuration symbol  Used to approximate
  ------------------------  ------------------------------------
  EFI_HAVE_CAPSULE_SUPPORT  Firmware update is performed in-band
                    TPM_V2  A TPM is present

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
---
 include/efi_api.h                | 12 ++++++++++
 lib/efi_loader/Kconfig           | 52 ++++++++++++++++++++++++++++++++++++++++
 lib/efi_loader/efi_conformance.c |  9 +++++++
 3 files changed, 73 insertions(+)

diff --git a/include/efi_api.h b/include/efi_api.h
index d4fdd50c49e..17e55118cda 100644
--- a/include/efi_api.h
+++ b/include/efi_api.h
@@ -238,6 +238,18 @@ enum efi_reset_type {
 	EFI_GUID(0xcce33c35, 0x74ac, 0x4087, 0xbc, 0xe7, \
 		 0x8b, 0x29, 0xb0, 0x2e, 0xeb, 0x27)
 
+#define EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID \
+	EFI_GUID(0x9073eed4, 0xe50d, 0x11ee, 0xb8, 0xb0, \
+		 0x8b, 0x68, 0xda, 0x62, 0xfc, 0x80)
+
+#define EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID \
+	EFI_GUID(0x7721fc77, 0xa724, 0x11ef, 0x8e, 0xaa, \
+		 0xf7, 0xc9, 0xb1, 0x94, 0xba, 0x75)
+
+#define EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID \
+	EFI_GUID(0xf2bb0422, 0xda8e, 0x11f0, 0xa6, 0x7b, \
+		 0x1b, 0xe2, 0x20, 0x85, 0x40, 0x98)
+
 #define EFI_DEBUG_IMAGE_INFO_TABLE_GUID \
 	EFI_GUID(0x49152e77, 0x1ada, 0x4764, 0xb7, 0xa2, \
 		 0x7a, 0xfe, 0xfe, 0xd9, 0x5e, 0x8b)
diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
index 40380876959..8ac4165b996 100644
--- a/lib/efi_loader/Kconfig
+++ b/lib/efi_loader/Kconfig
@@ -578,6 +578,27 @@ config HAVE_EFI_EBBR_2_1
 	depends on EFI_CAPSULE_FIRMWARE || !EFI_HAVE_CAPSULE_SUPPORT
 	default y
 
+config HAVE_EFI_EBBR_2_2
+	bool
+	depends on HAVE_EFI_EBBR_2_1
+	depends on EFI_TCG2_PROTOCOL || !TPM_V2
+	depends on EFI_CAPSULE_ON_DISK || !EFI_HAVE_CAPSULE_SUPPORT
+	default y
+
+config HAVE_EFI_EBBR_2_3
+	bool
+	depends on HAVE_EFI_EBBR_2_2
+	depends on EFI_CAPSULE_AUTHENTICATE || !EFI_HAVE_CAPSULE_SUPPORT
+	depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT || !EFI_HAVE_CAPSULE_SUPPORT
+	depends on EFI_BOOTMGR
+	depends on BOOTMETH_EFI_BOOTMGR
+	default y
+
+config HAVE_EFI_EBBR_2_4
+	bool
+	depends on HAVE_EFI_EBBR_2_3
+	default y
+
 config EFI_ECPT
 	bool "Enable the UEFI ECPT generation"
 	default y
@@ -593,6 +614,37 @@ config EFI_EBBR_2_1_CONFORMANCE
 	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
 	  v2.1 conformance entry to the ECPT.
 
+config EFI_EBBR_2_2_CONFORMANCE
+	bool "Add the EBBR v2.2 conformance entry to the ECPT"
+	depends on EFI_ECPT && HAVE_EFI_EBBR_2_2
+	default y
+	help
+	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
+	  v2.2 conformance entry to the ECPT.
+
+	  Version 2.2 adds requirements around TCG2 and capsule "on disk".
+
+config EFI_EBBR_2_3_CONFORMANCE
+	bool "Add the EBBR v2.3 conformance entry to the ECPT"
+	depends on EFI_ECPT && HAVE_EFI_EBBR_2_3
+	default y
+	help
+	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
+	  v2.3 conformance entry to the ECPT.
+
+	  Version 2.3 adds requirements around authenticated capsules in FMP
+	  format and the boot manager.
+
+config EFI_EBBR_2_4_CONFORMANCE
+	bool "Add the EBBR v2.4 conformance entry to the ECPT"
+	depends on EFI_ECPT && HAVE_EFI_EBBR_2_4
+	default y
+	help
+	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
+	  v2.4 conformance entry to the ECPT.
+
+	  Version 2.4 adds non-UEFI requirements.
+
 config EFI_CONSOLE_DISABLE_ANSI
 	bool "Disable ANSI escape sequence queries for console size"
 	help
diff --git a/lib/efi_loader/efi_conformance.c b/lib/efi_loader/efi_conformance.c
index 470141af483..c1234681bb6 100644
--- a/lib/efi_loader/efi_conformance.c
+++ b/lib/efi_loader/efi_conformance.c
@@ -29,6 +29,15 @@ efi_status_t efi_ecpt_register(void)
 	#if CONFIG_IS_ENABLED(EFI_EBBR_2_1_CONFORMANCE)
 		EFI_CONFORMANCE_PROFILE_EBBR_2_1_GUID,
 	#endif
+	#if CONFIG_IS_ENABLED(EFI_EBBR_2_2_CONFORMANCE)
+		EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID,
+	#endif
+	#if CONFIG_IS_ENABLED(EFI_EBBR_2_3_CONFORMANCE)
+		EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID,
+	#endif
+	#if CONFIG_IS_ENABLED(EFI_EBBR_2_4_CONFORMANCE)
+		EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID,
+	#endif
 	};
 
 	ecpt_size = sizeof(profiles)

-- 
2.53.0

Re: [PATCH 2/5] efi_loader: add EBBR 2.2-2.4 ECPT entries

[Ilias Apalodimas]

Hi Vincent

Thanks fo fixing this and apologies for the delayed response.

[...]

> ---
>  include/efi_api.h                | 12 ++++++++++
>  lib/efi_loader/Kconfig           | 52 ++++++++++++++++++++++++++++++++++++++++
>  lib/efi_loader/efi_conformance.c |  9 +++++++
>  3 files changed, 73 insertions(+)
>
> diff --git a/include/efi_api.h b/include/efi_api.h

[...]

>
> +config HAVE_EFI_EBBR_2_2
> +       bool
> +       depends on HAVE_EFI_EBBR_2_1
> +       depends on EFI_TCG2_PROTOCOL || !TPM_V2
> +       depends on EFI_CAPSULE_ON_DISK || !EFI_HAVE_CAPSULE_SUPPORT
> +       default y
> +
> +config HAVE_EFI_EBBR_2_3
> +       bool
> +       depends on HAVE_EFI_EBBR_2_2
> +       depends on EFI_CAPSULE_AUTHENTICATE || !EFI_HAVE_CAPSULE_SUPPORT
> +       depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT || !EFI_HAVE_CAPSULE_SUPPORT
> +       depends on EFI_BOOTMGR
> +       depends on BOOTMETH_EFI_BOOTMGR

I don't think we need this. The EFI_BOOTMGR should be enough, this is
the additional bootflow and bootmethods.

Other than that it looks correct to me.
Heinrich, do you want me to fix this up on merge and send a PR ?

Cheers
/Ilias


> +       default y
> +
> +config HAVE_EFI_EBBR_2_4
> +       bool
> +       depends on HAVE_EFI_EBBR_2_3
> +       default y
> +
>  config EFI_ECPT
>         bool "Enable the UEFI ECPT generation"
>         default y
> @@ -593,6 +614,37 @@ config EFI_EBBR_2_1_CONFORMANCE
>           Enabling this option adds the Embedded Base Boot Requirements (EBBR)
>           v2.1 conformance entry to the ECPT.
>
> +config EFI_EBBR_2_2_CONFORMANCE
> +       bool "Add the EBBR v2.2 conformance entry to the ECPT"
> +       depends on EFI_ECPT && HAVE_EFI_EBBR_2_2
> +       default y
> +       help
> +         Enabling this option adds the Embedded Base Boot Requirements (EBBR)
> +         v2.2 conformance entry to the ECPT.
> +
> +         Version 2.2 adds requirements around TCG2 and capsule "on disk".
> +
> +config EFI_EBBR_2_3_CONFORMANCE
> +       bool "Add the EBBR v2.3 conformance entry to the ECPT"
> +       depends on EFI_ECPT && HAVE_EFI_EBBR_2_3
> +       default y
> +       help
> +         Enabling this option adds the Embedded Base Boot Requirements (EBBR)
> +         v2.3 conformance entry to the ECPT.
> +
> +         Version 2.3 adds requirements around authenticated capsules in FMP
> +         format and the boot manager.
> +
> +config EFI_EBBR_2_4_CONFORMANCE
> +       bool "Add the EBBR v2.4 conformance entry to the ECPT"
> +       depends on EFI_ECPT && HAVE_EFI_EBBR_2_4
> +       default y
> +       help
> +         Enabling this option adds the Embedded Base Boot Requirements (EBBR)
> +         v2.4 conformance entry to the ECPT.
> +
> +         Version 2.4 adds non-UEFI requirements.
> +
>  config EFI_CONSOLE_DISABLE_ANSI
>         bool "Disable ANSI escape sequence queries for console size"
>         help
> diff --git a/lib/efi_loader/efi_conformance.c b/lib/efi_loader/efi_conformance.c
> index 470141af483..c1234681bb6 100644
> --- a/lib/efi_loader/efi_conformance.c
> +++ b/lib/efi_loader/efi_conformance.c
> @@ -29,6 +29,15 @@ efi_status_t efi_ecpt_register(void)
>         #if CONFIG_IS_ENABLED(EFI_EBBR_2_1_CONFORMANCE)
>                 EFI_CONFORMANCE_PROFILE_EBBR_2_1_GUID,
>         #endif
> +       #if CONFIG_IS_ENABLED(EFI_EBBR_2_2_CONFORMANCE)
> +               EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID,
> +       #endif
> +       #if CONFIG_IS_ENABLED(EFI_EBBR_2_3_CONFORMANCE)
> +               EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID,
> +       #endif
> +       #if CONFIG_IS_ENABLED(EFI_EBBR_2_4_CONFORMANCE)
> +               EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID,
> +       #endif
>         };
>
>         ecpt_size = sizeof(profiles)
>
> --
> 2.53.0
>

[PATCH 3/5] lib: uuid: add EBBR 2.2-2.4 conformance profile GUIDs

[Vincent Stehlé]

Add support for printing the EFI_CONFORMANCE_PROFILE_EBBR_2_[234]_GUIDs
as human readable text.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Tom Rini <trini@konsulko.com>
---
 lib/uuid.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/uuid.c b/lib/uuid.c
index 16ca8f37751..18fe2a8a8f3 100644
--- a/lib/uuid.c
+++ b/lib/uuid.c
@@ -261,6 +261,18 @@ static const struct {
 		NULL, "EFI EBBR 2.1 Conformance Profile",
 		EFI_CONFORMANCE_PROFILE_EBBR_2_1_GUID,
 	},
+	{
+		NULL, "EFI EBBR 2.2 Conformance Profile",
+		EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID,
+	},
+	{
+		NULL, "EFI EBBR 2.3 Conformance Profile",
+		EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID,
+	},
+	{
+		NULL, "EFI EBBR 2.4 Conformance Profile",
+		EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID,
+	},
 #endif
 #ifdef CONFIG_EFI_RISCV_BOOT_PROTOCOL
 	{

-- 
2.53.0

[PATCH 4/5] test/py: add 2.2-2.4 ECPT tests

[Vincent Stehlé]

Add three more ECPT tests to verify the EBBR 2.[234] conformance
profiles entries with the "efidebug ecpt" command.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
---
 test/py/tests/test_efi_ecpt.py | 48 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/test/py/tests/test_efi_ecpt.py b/test/py/tests/test_efi_ecpt.py
index 632a6b90bad..5f6dc2b74dc 100644
--- a/test/py/tests/test_efi_ecpt.py
+++ b/test/py/tests/test_efi_ecpt.py
@@ -40,3 +40,51 @@ def test_efi_ecpt_ebbr_2_1(ubman) -> None:
     response = ubman.run_command('efidebug ecpt')
     assert ('cce33c35-74ac-4087-bce7-8b29b02eeb27  '
             'EFI EBBR 2.1 Conformance Profile') in response
+
+
+@pytest.mark.buildconfigspec('cmd_efidebug')
+@pytest.mark.buildconfigspec('efi_ecpt')
+@pytest.mark.buildconfigspec('efi_ebbr_2_2_conformance')
+def test_efi_ecpt_ebbr_2_2(ubman) -> None:
+    """ Unit test for the ECPT, with EBBR 2.2 profile
+    This test uses the efidebug ecpt command to dump the ECPT and check that
+    the EBBR 2.2 conformance profile is there.
+
+    Args:
+        ubman -- U-Boot console
+    """
+    response = ubman.run_command('efidebug ecpt')
+    assert ('9073eed4-e50d-11ee-b8b0-8b68da62fc80  '
+            'EFI EBBR 2.2 Conformance Profile') in response
+
+
+@pytest.mark.buildconfigspec('cmd_efidebug')
+@pytest.mark.buildconfigspec('efi_ecpt')
+@pytest.mark.buildconfigspec('efi_ebbr_2_3_conformance')
+def test_efi_ecpt_ebbr_2_3(ubman) -> None:
+    """ Unit test for the ECPT, with EBBR 2.3 profile
+    This test uses the efidebug ecpt command to dump the ECPT and check that
+    the EBBR 2.3 conformance profile is there.
+
+    Args:
+        ubman -- U-Boot console
+    """
+    response = ubman.run_command('efidebug ecpt')
+    assert ('7721fc77-a724-11ef-8eaa-f7c9b194ba75  '
+            'EFI EBBR 2.3 Conformance Profile') in response
+
+
+@pytest.mark.buildconfigspec('cmd_efidebug')
+@pytest.mark.buildconfigspec('efi_ecpt')
+@pytest.mark.buildconfigspec('efi_ebbr_2_4_conformance')
+def test_efi_ecpt_ebbr_2_4(ubman) -> None:
+    """ Unit test for the ECPT, with EBBR 2.4 profile
+    This test uses the efidebug ecpt command to dump the ECPT and check that
+    the EBBR 2.4 conformance profile is there.
+
+    Args:
+        ubman -- U-Boot console
+    """
+    response = ubman.run_command('efidebug ecpt')
+    assert ('f2bb0422-da8e-11f0-a67b-1be220854098  '
+            'EFI EBBR 2.4 Conformance Profile') in response

-- 
2.53.0

Re: [PATCH 4/5] test/py: add 2.2-2.4 ECPT tests

[Ilias Apalodimas]

On Fri, 4 Sept 2026 at 17:01, Vincent Stehlé <vincent.stehle@arm.com> wrote:
>
> Add three more ECPT tests to verify the EBBR 2.[234] conformance
> profiles entries with the "efidebug ecpt" command.
>
> Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
> Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
> Cc: Tom Rini <trini@konsulko.com>
> ---

Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
>  test/py/tests/test_efi_ecpt.py | 48 ++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 48 insertions(+)
>
> diff --git a/test/py/tests/test_efi_ecpt.py b/test/py/tests/test_efi_ecpt.py
> index 632a6b90bad..5f6dc2b74dc 100644
> --- a/test/py/tests/test_efi_ecpt.py
> +++ b/test/py/tests/test_efi_ecpt.py
> @@ -40,3 +40,51 @@ def test_efi_ecpt_ebbr_2_1(ubman) -> None:
>      response = ubman.run_command('efidebug ecpt')
>      assert ('cce33c35-74ac-4087-bce7-8b29b02eeb27  '
>              'EFI EBBR 2.1 Conformance Profile') in response
> +
> +
> +@pytest.mark.buildconfigspec('cmd_efidebug')
> +@pytest.mark.buildconfigspec('efi_ecpt')
> +@pytest.mark.buildconfigspec('efi_ebbr_2_2_conformance')
> +def test_efi_ecpt_ebbr_2_2(ubman) -> None:
> +    """ Unit test for the ECPT, with EBBR 2.2 profile
> +    This test uses the efidebug ecpt command to dump the ECPT and check that
> +    the EBBR 2.2 conformance profile is there.
> +
> +    Args:
> +        ubman -- U-Boot console
> +    """
> +    response = ubman.run_command('efidebug ecpt')
> +    assert ('9073eed4-e50d-11ee-b8b0-8b68da62fc80  '
> +            'EFI EBBR 2.2 Conformance Profile') in response
> +
> +
> +@pytest.mark.buildconfigspec('cmd_efidebug')
> +@pytest.mark.buildconfigspec('efi_ecpt')
> +@pytest.mark.buildconfigspec('efi_ebbr_2_3_conformance')
> +def test_efi_ecpt_ebbr_2_3(ubman) -> None:
> +    """ Unit test for the ECPT, with EBBR 2.3 profile
> +    This test uses the efidebug ecpt command to dump the ECPT and check that
> +    the EBBR 2.3 conformance profile is there.
> +
> +    Args:
> +        ubman -- U-Boot console
> +    """
> +    response = ubman.run_command('efidebug ecpt')
> +    assert ('7721fc77-a724-11ef-8eaa-f7c9b194ba75  '
> +            'EFI EBBR 2.3 Conformance Profile') in response
> +
> +
> +@pytest.mark.buildconfigspec('cmd_efidebug')
> +@pytest.mark.buildconfigspec('efi_ecpt')
> +@pytest.mark.buildconfigspec('efi_ebbr_2_4_conformance')
> +def test_efi_ecpt_ebbr_2_4(ubman) -> None:
> +    """ Unit test for the ECPT, with EBBR 2.4 profile
> +    This test uses the efidebug ecpt command to dump the ECPT and check that
> +    the EBBR 2.4 conformance profile is there.
> +
> +    Args:
> +        ubman -- U-Boot console
> +    """
> +    response = ubman.run_command('efidebug ecpt')
> +    assert ('f2bb0422-da8e-11f0-a67b-1be220854098  '
> +            'EFI EBBR 2.4 Conformance Profile') in response
>
> --
> 2.53.0
>

[PATCH 5/5] doc: uefi: EBBR conformance profiles

[Vincent Stehlé]

U-Boot can support multiple EBBR conformance profiles, and it can advertise
them in the ECPT; therefore, remove the EBBR fixed version 2.1 mention from
the documentation and add a word about the ECPT profiles.

While at it, fix one typo.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
---
 doc/develop/uefi/uefi.rst | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/doc/develop/uefi/uefi.rst b/doc/develop/uefi/uefi.rst
index 94ddf690440..9dc34495f66 100644
--- a/doc/develop/uefi/uefi.rst
+++ b/doc/develop/uefi/uefi.rst
@@ -14,14 +14,23 @@ Development target
 ------------------
 
 The implementation of UEFI in U-Boot strives to reach the requirements described
-in the "Embedded Base Boot Requirements (EBBR) Specification - Release v2.1.0"
-[2]. The "Server Base Boot Requirements System Software on ARM Platforms" [3]
+in the "Embedded Base Boot Requirements (EBBR) Specification" [2].
+The "Server Base Boot Requirements System Software on ARM Platforms" [3]
 describes a superset of the EBBR specification and may be used as further
 reference.
 
 A full blown UEFI implementation would contradict the U-Boot design principle
 "keep it small".
 
+Conformance profiles
+~~~~~~~~~~~~~~~~~~~~
+
+The EBBR conformance profiles supported by U-Boot are inferred optimistically
+from its configuration and the corresponding GUIDs are advertised in the EFI
+Conformance Profiles Table (ECPT) automatically by default.
+System integrators should review the advertised profiles and override manually
+if necessary.
+
 Building U-Boot for UEFI
 ------------------------
 
@@ -323,7 +332,7 @@ Capsule with firmware version
 
 The UEFI specification does not define the firmware versioning mechanism.
 EDK II reference implementation inserts the FMP Payload Header right before
-the payload. It coutains the fw_version and lowest supported version,
+the payload. It contains the fw_version and lowest supported version,
 EDK II reference implementation uses these information to implement the
 firmware versioning and anti-rollback protection, the firmware version and
 lowest supported version is stored into EFI non-volatile variable.
@@ -1019,8 +1028,7 @@ Links
 -----
 
 * [1] http://uefi.org/specifications - UEFI specifications
-* [2] https://github.com/ARM-software/ebbr/releases/download/v2.1.0/ebbr-v2.1.0.pdf -
-  Embedded Base Boot Requirements (EBBR) Specification - Release v2.1.0
+* [2] https://github.com/ARM-software/ebbr - Embedded Base Boot Requirements (EBBR) Specification
 * [3] https://developer.arm.com/docs/den0044/latest/server-base-boot-requirements-system-software-on-arm-platforms-version-11 -
   Server Base Boot Requirements System Software on ARM Platforms - Version 1.1
 * [4] :doc:`iscsi`

-- 
2.53.0

Re: [PATCH 5/5] doc: uefi: EBBR conformance profiles

[Ilias Apalodimas]

On Fri, 4 Sept 2026 at 17:02, Vincent Stehlé <vincent.stehle@arm.com> wrote:
>
> U-Boot can support multiple EBBR conformance profiles, and it can advertise
> them in the ECPT; therefore, remove the EBBR fixed version 2.1 mention from
> the documentation and add a word about the ECPT profiles.
>
> While at it, fix one typo.
>
> Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
> Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
> Cc: Tom Rini <trini@konsulko.com>
> ---

Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

>  doc/develop/uefi/uefi.rst | 18 +++++++++++++-----
>  1 file changed, 13 insertions(+), 5 deletions(-)
>
> diff --git a/doc/develop/uefi/uefi.rst b/doc/develop/uefi/uefi.rst
> index 94ddf690440..9dc34495f66 100644
> --- a/doc/develop/uefi/uefi.rst
> +++ b/doc/develop/uefi/uefi.rst
> @@ -14,14 +14,23 @@ Development target
>  ------------------
>
>  The implementation of UEFI in U-Boot strives to reach the requirements described
> -in the "Embedded Base Boot Requirements (EBBR) Specification - Release v2.1.0"
> -[2]. The "Server Base Boot Requirements System Software on ARM Platforms" [3]
> +in the "Embedded Base Boot Requirements (EBBR) Specification" [2].
> +The "Server Base Boot Requirements System Software on ARM Platforms" [3]
>  describes a superset of the EBBR specification and may be used as further
>  reference.
>
>  A full blown UEFI implementation would contradict the U-Boot design principle
>  "keep it small".
>
> +Conformance profiles
> +~~~~~~~~~~~~~~~~~~~~
> +
> +The EBBR conformance profiles supported by U-Boot are inferred optimistically
> +from its configuration and the corresponding GUIDs are advertised in the EFI
> +Conformance Profiles Table (ECPT) automatically by default.
> +System integrators should review the advertised profiles and override manually
> +if necessary.
> +
>  Building U-Boot for UEFI
>  ------------------------
>
> @@ -323,7 +332,7 @@ Capsule with firmware version
>
>  The UEFI specification does not define the firmware versioning mechanism.
>  EDK II reference implementation inserts the FMP Payload Header right before
> -the payload. It coutains the fw_version and lowest supported version,
> +the payload. It contains the fw_version and lowest supported version,
>  EDK II reference implementation uses these information to implement the
>  firmware versioning and anti-rollback protection, the firmware version and
>  lowest supported version is stored into EFI non-volatile variable.
> @@ -1019,8 +1028,7 @@ Links
>  -----
>
>  * [1] http://uefi.org/specifications - UEFI specifications
> -* [2] https://github.com/ARM-software/ebbr/releases/download/v2.1.0/ebbr-v2.1.0.pdf -
> -  Embedded Base Boot Requirements (EBBR) Specification - Release v2.1.0
> +* [2] https://github.com/ARM-software/ebbr - Embedded Base Boot Requirements (EBBR) Specification
>  * [3] https://developer.arm.com/docs/den0044/latest/server-base-boot-requirements-system-software-on-arm-platforms-version-11 -
>    Server Base Boot Requirements System Software on ARM Platforms - Version 1.1
>  * [4] :doc:`iscsi`
>
> --
> 2.53.0
>

[PATCH v2 0/5] efi: ECPT EBBR conformance profiles

[Vincent Stehlé]

The Embedded Base Boot Requirements (EBBR) specification [1] defines a
subset of UEFI, sufficient to boot an OS.

Currently, EBBR defines four UEFI conformance profiles, 2.1 to 2.4, and
U-Boot can advertise that it supports 2.1 in the EFI Conformance
Profiles Table (ECPT).

As U-Boot can in fact support up to 2.4, this patch series does the
following:

1. Refine the conditions for the 2.1 profile and prepare to add more.
2. Add the 2.2, 2.3 & 2.4 profiles.
3. Add the human readable strings to print the new GUIDs.
4. Add unit tests for the new profiles.
5. Update the documentation.

The list of supported profiles are inferred optimistically from U-Boot
configuration by default, and we rely on the system integrator to "opt
out" manually if necessary.

Link: https://github.com/ARM-software/ebbr [1]
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
---
Changes in v2:
- Remove HAVE_EFI_EBBR_2_1 dependency on BOOTMETH_EFILOADER,
  and HAVE_EFI_EBBR_2_3 dependency on BOOTMETH_EFI_BOOTMGR
  (suggested by Ilias)
- Link to v1: https://patch.msgid.link/20260904-conform-v1-0-475b2947631a@arm.com

---
Vincent Stehlé (5):
      efi_loader: adjust EBBR 2.1 ECPT entry
      efi_loader: add EBBR 2.2-2.4 ECPT entries
      lib: uuid: add EBBR 2.2-2.4 conformance profile GUIDs
      test/py: add 2.2-2.4 ECPT tests
      doc: uefi: EBBR conformance profiles

 doc/develop/uefi/uefi.rst        | 18 ++++++---
 include/efi_api.h                | 12 ++++++
 lib/efi_loader/Kconfig           | 86 +++++++++++++++++++++++++++++++++++-----
 lib/efi_loader/efi_conformance.c |  9 +++++
 lib/uuid.c                       | 12 ++++++
 test/py/tests/test_efi_ecpt.py   | 48 ++++++++++++++++++++++
 6 files changed, 171 insertions(+), 14 deletions(-)
---
base-commit: 211de43d0f954a00a490220c1aac9db298287c40
change-id: 20260902-conform-347df9362c8d

Best regards,
--  
Vincent.

[PATCH v2 1/5] efi_loader: adjust EBBR 2.1 ECPT entry

[Vincent Stehlé]

Adjust the EBBR 2.1 conformance profile ECPT entry configuration, and
prepare to add more:
- Introduce the HAVE_EFI_EBBR_2_1 non-visible configuration symbol to
  compute the actual system conformance status with the dependencies.
  This will make it easier to add more versions with a chain of
  dependencies, while avoiding a chain of nested submenus.
- Adjust version 2.1 dependencies to better match the specification.
  Relax the dependency on the boot manager, which was introduced in
  version 2.3, and make the list of required UEFI protocols and services
  more complete.
- Reword the EFI_EBBR_2_1_CONFORMANCE configuration entry title and help
  text, mostly to separate "EBBR" from "v2.1" and to attenuate the
  redundant "table" mention.

We do the following additional configurations dependencies
approximations:

      Configuration symbol  Used to approximate
  ------------------------  ------------------------------------
  EFI_HAVE_CAPSULE_SUPPORT  Firmware update is performed in-band
                    DM_RTC  An RTC is present

While at it, refine the ECPT help text to attenuate the redundant
"table" mention there as well.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
---
 lib/efi_loader/Kconfig | 35 ++++++++++++++++++++++++++---------
 1 file changed, 26 insertions(+), 9 deletions(-)

diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
index 4cb13ae7c8a..aad8f860868 100644
--- a/lib/efi_loader/Kconfig
+++ b/lib/efi_loader/Kconfig
@@ -557,23 +557,40 @@ config EFI_ESRT
 	help
 	  Enabling this option creates the ESRT UEFI system table.
 
+config HAVE_EFI_EBBR_2_1
+	bool
+	depends on EFI_LOADER_HII
+	depends on EFI_RISCV_BOOT_PROTOCOL || !RISCV
+	depends on EFI_RNG_PROTOCOL || !DM_RNG
+	depends on EFI_UNICODE_COLLATION_PROTOCOL2
+	depends on !EFI_VARIABLE_NO_STORE
+	depends on BOOTM_EFI
+	depends on EFI_BINARY_EXEC
+	depends on EFI_DEVICE_PATH_TO_TEXT
+	depends on EFI_DEVICE_PATH_UTIL
+	depends on EFI_GET_TIME || !DM_RTC
+	depends on EFI_PARTITION
+	depends on EFI_SET_TIME || !DM_RTC
+	depends on EFI_UNICODE_CAPITALIZATION
+	depends on EFI_ESRT || !EFI_HAVE_CAPSULE_SUPPORT
+	depends on EFI_RUNTIME_UPDATE_CAPSULE || !EFI_HAVE_CAPSULE_SUPPORT
+	depends on EFI_CAPSULE_FIRMWARE || !EFI_HAVE_CAPSULE_SUPPORT
+	default y
+
 config EFI_ECPT
 	bool "Enable the UEFI ECPT generation"
 	default y
 	help
-	  Enabling this option created the ECPT UEFI table.
+	  Enabling this option creates the EFI Conformance Profiles Table
+	  (ECPT).
 
 config EFI_EBBR_2_1_CONFORMANCE
-	bool "Add the EBBRv2.1 conformance entry to the ECPT table"
-	depends on BOOTMETH_EFI_BOOTMGR
-	depends on EFI_ECPT
-	depends on EFI_LOADER_HII
-	depends on EFI_RISCV_BOOT_PROTOCOL || !RISCV
-	depends on EFI_RNG_PROTOCOL || !DM_RNG
-	depends on EFI_UNICODE_COLLATION_PROTOCOL2
+	bool "Add the EBBR v2.1 conformance entry to the ECPT"
+	depends on EFI_ECPT && HAVE_EFI_EBBR_2_1
 	default y
 	help
-	  Enabling this option adds the EBBRv2.1 conformance entry to the ECPT UEFI table.
+	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
+	  v2.1 conformance entry to the ECPT.
 
 config EFI_CONSOLE_DISABLE_ANSI
 	bool "Disable ANSI escape sequence queries for console size"

-- 
2.53.0

Re: [PATCH v2 1/5] efi_loader: adjust EBBR 2.1 ECPT entry

[Ilias Apalodimas]

Hi Vincent,


On Mon, 21 Sept 2026 at 16:12, Vincent Stehlé <vincent.stehle@arm.com> wrote:
>
> Adjust the EBBR 2.1 conformance profile ECPT entry configuration, and
> prepare to add more:
> - Introduce the HAVE_EFI_EBBR_2_1 non-visible configuration symbol to
>   compute the actual system conformance status with the dependencies.
>   This will make it easier to add more versions with a chain of
>   dependencies, while avoiding a chain of nested submenus.
> - Adjust version 2.1 dependencies to better match the specification.
>   Relax the dependency on the boot manager, which was introduced in
>   version 2.3, and make the list of required UEFI protocols and services
>   more complete.
> - Reword the EFI_EBBR_2_1_CONFORMANCE configuration entry title and help
>   text, mostly to separate "EBBR" from "v2.1" and to attenuate the
>   redundant "table" mention.
>
> We do the following additional configurations dependencies
> approximations:
>
>       Configuration symbol  Used to approximate
>   ------------------------  ------------------------------------
>   EFI_HAVE_CAPSULE_SUPPORT  Firmware update is performed in-band
>                     DM_RTC  An RTC is present
>
> While at it, refine the ECPT help text to attenuate the redundant
> "table" mention there as well.
>
> Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
> Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
> Cc: Tom Rini <trini@konsulko.com>
> ---
>  lib/efi_loader/Kconfig | 35 ++++++++++++++++++++++++++---------
>  1 file changed, 26 insertions(+), 9 deletions(-)
>
> diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
> index 4cb13ae7c8a..aad8f860868 100644
> --- a/lib/efi_loader/Kconfig
> +++ b/lib/efi_loader/Kconfig
> @@ -557,23 +557,40 @@ config EFI_ESRT
>         help
>           Enabling this option creates the ESRT UEFI system table.
>
> +config HAVE_EFI_EBBR_2_1
> +       bool
> +       depends on EFI_LOADER_HII
> +       depends on EFI_RISCV_BOOT_PROTOCOL || !RISCV
> +       depends on EFI_RNG_PROTOCOL || !DM_RNG
> +       depends on EFI_UNICODE_COLLATION_PROTOCOL2
> +       depends on !EFI_VARIABLE_NO_STORE
> +       depends on BOOTM_EFI

This is for booting EFI images that are ina  FIT image. Is this needed
for conformance?


[...]

Thanks
/Ilias

[PATCH v2 2/5] efi_loader: add EBBR 2.2-2.4 ECPT entries

[Vincent Stehlé]

Add three ECPT entries for the EBBR versions 2.2, 2.3 and 2.4
conformance profiles:
- Define the three EFI_CONFORMANCE_PROFILE_EBBR_2_[234]_GUIDs.
- Introduce the three HAVE_EFI_EBBR_2_[234] non-visible configuration
  symbols to compute the actual system conformance status with the
  dependencies.
- Add the three EFI_EBBR_2_[234]_CONFORMANCE configuration menu entries
  to control the addition of the corresponding GUIDs in the ECPT.

Following what was done for version 2.1, as many entries as possible are
added optimistically by default in the ECPT, and this can be overridden
manually by the system integrator after inspection if necessary.

Conformance cheat sheet:

  EBBR  Additional requirements
  ----  ---------------------------------------------------
   2.2  TCG2 & capsule "on disk"
   2.3  Authenticated capsules in FMP format & boot manager
   2.4  Non-UEFI (privileged firmware)

We do the following configurations dependencies approximations:

      Configuration symbol  Used to approximate
  ------------------------  ------------------------------------
  EFI_HAVE_CAPSULE_SUPPORT  Firmware update is performed in-band
                    TPM_V2  A TPM is present

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
---
 include/efi_api.h                | 12 ++++++++++
 lib/efi_loader/Kconfig           | 51 ++++++++++++++++++++++++++++++++++++++++
 lib/efi_loader/efi_conformance.c |  9 +++++++
 3 files changed, 72 insertions(+)

diff --git a/include/efi_api.h b/include/efi_api.h
index d4fdd50c49e..17e55118cda 100644
--- a/include/efi_api.h
+++ b/include/efi_api.h
@@ -238,6 +238,18 @@ enum efi_reset_type {
 	EFI_GUID(0xcce33c35, 0x74ac, 0x4087, 0xbc, 0xe7, \
 		 0x8b, 0x29, 0xb0, 0x2e, 0xeb, 0x27)
 
+#define EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID \
+	EFI_GUID(0x9073eed4, 0xe50d, 0x11ee, 0xb8, 0xb0, \
+		 0x8b, 0x68, 0xda, 0x62, 0xfc, 0x80)
+
+#define EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID \
+	EFI_GUID(0x7721fc77, 0xa724, 0x11ef, 0x8e, 0xaa, \
+		 0xf7, 0xc9, 0xb1, 0x94, 0xba, 0x75)
+
+#define EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID \
+	EFI_GUID(0xf2bb0422, 0xda8e, 0x11f0, 0xa6, 0x7b, \
+		 0x1b, 0xe2, 0x20, 0x85, 0x40, 0x98)
+
 #define EFI_DEBUG_IMAGE_INFO_TABLE_GUID \
 	EFI_GUID(0x49152e77, 0x1ada, 0x4764, 0xb7, 0xa2, \
 		 0x7a, 0xfe, 0xfe, 0xd9, 0x5e, 0x8b)
diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
index aad8f860868..81231533946 100644
--- a/lib/efi_loader/Kconfig
+++ b/lib/efi_loader/Kconfig
@@ -577,6 +577,26 @@ config HAVE_EFI_EBBR_2_1
 	depends on EFI_CAPSULE_FIRMWARE || !EFI_HAVE_CAPSULE_SUPPORT
 	default y
 
+config HAVE_EFI_EBBR_2_2
+	bool
+	depends on HAVE_EFI_EBBR_2_1
+	depends on EFI_TCG2_PROTOCOL || !TPM_V2
+	depends on EFI_CAPSULE_ON_DISK || !EFI_HAVE_CAPSULE_SUPPORT
+	default y
+
+config HAVE_EFI_EBBR_2_3
+	bool
+	depends on HAVE_EFI_EBBR_2_2
+	depends on EFI_CAPSULE_AUTHENTICATE || !EFI_HAVE_CAPSULE_SUPPORT
+	depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT || !EFI_HAVE_CAPSULE_SUPPORT
+	depends on EFI_BOOTMGR
+	default y
+
+config HAVE_EFI_EBBR_2_4
+	bool
+	depends on HAVE_EFI_EBBR_2_3
+	default y
+
 config EFI_ECPT
 	bool "Enable the UEFI ECPT generation"
 	default y
@@ -592,6 +612,37 @@ config EFI_EBBR_2_1_CONFORMANCE
 	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
 	  v2.1 conformance entry to the ECPT.
 
+config EFI_EBBR_2_2_CONFORMANCE
+	bool "Add the EBBR v2.2 conformance entry to the ECPT"
+	depends on EFI_ECPT && HAVE_EFI_EBBR_2_2
+	default y
+	help
+	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
+	  v2.2 conformance entry to the ECPT.
+
+	  Version 2.2 adds requirements around TCG2 and capsule "on disk".
+
+config EFI_EBBR_2_3_CONFORMANCE
+	bool "Add the EBBR v2.3 conformance entry to the ECPT"
+	depends on EFI_ECPT && HAVE_EFI_EBBR_2_3
+	default y
+	help
+	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
+	  v2.3 conformance entry to the ECPT.
+
+	  Version 2.3 adds requirements around authenticated capsules in FMP
+	  format and the boot manager.
+
+config EFI_EBBR_2_4_CONFORMANCE
+	bool "Add the EBBR v2.4 conformance entry to the ECPT"
+	depends on EFI_ECPT && HAVE_EFI_EBBR_2_4
+	default y
+	help
+	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
+	  v2.4 conformance entry to the ECPT.
+
+	  Version 2.4 adds non-UEFI requirements.
+
 config EFI_CONSOLE_DISABLE_ANSI
 	bool "Disable ANSI escape sequence queries for console size"
 	help
diff --git a/lib/efi_loader/efi_conformance.c b/lib/efi_loader/efi_conformance.c
index 470141af483..c1234681bb6 100644
--- a/lib/efi_loader/efi_conformance.c
+++ b/lib/efi_loader/efi_conformance.c
@@ -29,6 +29,15 @@ efi_status_t efi_ecpt_register(void)
 	#if CONFIG_IS_ENABLED(EFI_EBBR_2_1_CONFORMANCE)
 		EFI_CONFORMANCE_PROFILE_EBBR_2_1_GUID,
 	#endif
+	#if CONFIG_IS_ENABLED(EFI_EBBR_2_2_CONFORMANCE)
+		EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID,
+	#endif
+	#if CONFIG_IS_ENABLED(EFI_EBBR_2_3_CONFORMANCE)
+		EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID,
+	#endif
+	#if CONFIG_IS_ENABLED(EFI_EBBR_2_4_CONFORMANCE)
+		EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID,
+	#endif
 	};
 
 	ecpt_size = sizeof(profiles)

-- 
2.53.0

Re: [PATCH v2 2/5] efi_loader: add EBBR 2.2-2.4 ECPT entries

[Ilias Apalodimas]

On Mon, 21 Sept 2026 at 16:12, Vincent Stehlé <vincent.stehle@arm.com> wrote:
>
> Add three ECPT entries for the EBBR versions 2.2, 2.3 and 2.4
> conformance profiles:
> - Define the three EFI_CONFORMANCE_PROFILE_EBBR_2_[234]_GUIDs.
> - Introduce the three HAVE_EFI_EBBR_2_[234] non-visible configuration
>   symbols to compute the actual system conformance status with the
>   dependencies.
> - Add the three EFI_EBBR_2_[234]_CONFORMANCE configuration menu entries
>   to control the addition of the corresponding GUIDs in the ECPT.
>
> Following what was done for version 2.1, as many entries as possible are
> added optimistically by default in the ECPT, and this can be overridden
> manually by the system integrator after inspection if necessary.
>
> Conformance cheat sheet:
>
>   EBBR  Additional requirements
>   ----  ---------------------------------------------------
>    2.2  TCG2 & capsule "on disk"
>    2.3  Authenticated capsules in FMP format & boot manager
>    2.4  Non-UEFI (privileged firmware)
>
> We do the following configurations dependencies approximations:
>
>       Configuration symbol  Used to approximate
>   ------------------------  ------------------------------------
>   EFI_HAVE_CAPSULE_SUPPORT  Firmware update is performed in-band
>                     TPM_V2  A TPM is present
>
> Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
> Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
> Cc: Tom Rini <trini@konsulko.com>
> ---

Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
>  include/efi_api.h                | 12 ++++++++++
>  lib/efi_loader/Kconfig           | 51 ++++++++++++++++++++++++++++++++++++++++
>  lib/efi_loader/efi_conformance.c |  9 +++++++
>  3 files changed, 72 insertions(+)
>
> diff --git a/include/efi_api.h b/include/efi_api.h
> index d4fdd50c49e..17e55118cda 100644
> --- a/include/efi_api.h
> +++ b/include/efi_api.h
> @@ -238,6 +238,18 @@ enum efi_reset_type {
>         EFI_GUID(0xcce33c35, 0x74ac, 0x4087, 0xbc, 0xe7, \
>                  0x8b, 0x29, 0xb0, 0x2e, 0xeb, 0x27)
>
> +#define EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID \
> +       EFI_GUID(0x9073eed4, 0xe50d, 0x11ee, 0xb8, 0xb0, \
> +                0x8b, 0x68, 0xda, 0x62, 0xfc, 0x80)
> +
> +#define EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID \
> +       EFI_GUID(0x7721fc77, 0xa724, 0x11ef, 0x8e, 0xaa, \
> +                0xf7, 0xc9, 0xb1, 0x94, 0xba, 0x75)
> +
> +#define EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID \
> +       EFI_GUID(0xf2bb0422, 0xda8e, 0x11f0, 0xa6, 0x7b, \
> +                0x1b, 0xe2, 0x20, 0x85, 0x40, 0x98)
> +
>  #define EFI_DEBUG_IMAGE_INFO_TABLE_GUID \
>         EFI_GUID(0x49152e77, 0x1ada, 0x4764, 0xb7, 0xa2, \
>                  0x7a, 0xfe, 0xfe, 0xd9, 0x5e, 0x8b)
> diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
> index aad8f860868..81231533946 100644
> --- a/lib/efi_loader/Kconfig
> +++ b/lib/efi_loader/Kconfig
> @@ -577,6 +577,26 @@ config HAVE_EFI_EBBR_2_1
>         depends on EFI_CAPSULE_FIRMWARE || !EFI_HAVE_CAPSULE_SUPPORT
>         default y
>
> +config HAVE_EFI_EBBR_2_2
> +       bool
> +       depends on HAVE_EFI_EBBR_2_1
> +       depends on EFI_TCG2_PROTOCOL || !TPM_V2
> +       depends on EFI_CAPSULE_ON_DISK || !EFI_HAVE_CAPSULE_SUPPORT
> +       default y
> +
> +config HAVE_EFI_EBBR_2_3
> +       bool
> +       depends on HAVE_EFI_EBBR_2_2
> +       depends on EFI_CAPSULE_AUTHENTICATE || !EFI_HAVE_CAPSULE_SUPPORT
> +       depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT || !EFI_HAVE_CAPSULE_SUPPORT
> +       depends on EFI_BOOTMGR
> +       default y
> +
> +config HAVE_EFI_EBBR_2_4
> +       bool
> +       depends on HAVE_EFI_EBBR_2_3
> +       default y
> +
>  config EFI_ECPT
>         bool "Enable the UEFI ECPT generation"
>         default y
> @@ -592,6 +612,37 @@ config EFI_EBBR_2_1_CONFORMANCE
>           Enabling this option adds the Embedded Base Boot Requirements (EBBR)
>           v2.1 conformance entry to the ECPT.
>
> +config EFI_EBBR_2_2_CONFORMANCE
> +       bool "Add the EBBR v2.2 conformance entry to the ECPT"
> +       depends on EFI_ECPT && HAVE_EFI_EBBR_2_2
> +       default y
> +       help
> +         Enabling this option adds the Embedded Base Boot Requirements (EBBR)
> +         v2.2 conformance entry to the ECPT.
> +
> +         Version 2.2 adds requirements around TCG2 and capsule "on disk".
> +
> +config EFI_EBBR_2_3_CONFORMANCE
> +       bool "Add the EBBR v2.3 conformance entry to the ECPT"
> +       depends on EFI_ECPT && HAVE_EFI_EBBR_2_3
> +       default y
> +       help
> +         Enabling this option adds the Embedded Base Boot Requirements (EBBR)
> +         v2.3 conformance entry to the ECPT.
> +
> +         Version 2.3 adds requirements around authenticated capsules in FMP
> +         format and the boot manager.
> +
> +config EFI_EBBR_2_4_CONFORMANCE
> +       bool "Add the EBBR v2.4 conformance entry to the ECPT"
> +       depends on EFI_ECPT && HAVE_EFI_EBBR_2_4
> +       default y
> +       help
> +         Enabling this option adds the Embedded Base Boot Requirements (EBBR)
> +         v2.4 conformance entry to the ECPT.
> +
> +         Version 2.4 adds non-UEFI requirements.
> +
>  config EFI_CONSOLE_DISABLE_ANSI
>         bool "Disable ANSI escape sequence queries for console size"
>         help
> diff --git a/lib/efi_loader/efi_conformance.c b/lib/efi_loader/efi_conformance.c
> index 470141af483..c1234681bb6 100644
> --- a/lib/efi_loader/efi_conformance.c
> +++ b/lib/efi_loader/efi_conformance.c
> @@ -29,6 +29,15 @@ efi_status_t efi_ecpt_register(void)
>         #if CONFIG_IS_ENABLED(EFI_EBBR_2_1_CONFORMANCE)
>                 EFI_CONFORMANCE_PROFILE_EBBR_2_1_GUID,
>         #endif
> +       #if CONFIG_IS_ENABLED(EFI_EBBR_2_2_CONFORMANCE)
> +               EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID,
> +       #endif
> +       #if CONFIG_IS_ENABLED(EFI_EBBR_2_3_CONFORMANCE)
> +               EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID,
> +       #endif
> +       #if CONFIG_IS_ENABLED(EFI_EBBR_2_4_CONFORMANCE)
> +               EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID,
> +       #endif
>         };
>
>         ecpt_size = sizeof(profiles)
>
> --
> 2.53.0
>

Re: [PATCH v2 2/5] efi_loader: add EBBR 2.2-2.4 ECPT entries

[Heinrich Schuchardt]

On 9/21/26 15:12, Vincent Stehlé wrote:
> Add three ECPT entries for the EBBR versions 2.2, 2.3 and 2.4
> conformance profiles:
> - Define the three EFI_CONFORMANCE_PROFILE_EBBR_2_[234]_GUIDs.
> - Introduce the three HAVE_EFI_EBBR_2_[234] non-visible configuration
>    symbols to compute the actual system conformance status with the
>    dependencies.
> - Add the three EFI_EBBR_2_[234]_CONFORMANCE configuration menu entries
>    to control the addition of the corresponding GUIDs in the ECPT.
> 
> Following what was done for version 2.1, as many entries as possible are
> added optimistically by default in the ECPT, and this can be overridden
> manually by the system integrator after inspection if necessary.

Hello Vincent,

This patch causes a CI failure:

lib/efi_selftest/efi_selftest_ecpt.c(63):
ERROR: Expected 1 entries, found 4

Please, update the current patch to set the correct number in the test 
based on the number of enabled GUIDS.

You can follow the existing pattern:

         if (CONFIG_IS_ENABLED(EFI_EBBR_2_1_CONFORMANCE)) {
                 ++expected_entries;
                 if (ecpt_find_guid(ecpt, &guid_ebbr_2_1))
                         return EFI_ST_FAILURE;
         }

Best regards

Heinrich

> 
> Conformance cheat sheet:
> 
>    EBBR  Additional requirements
>    ----  ---------------------------------------------------
>     2.2  TCG2 & capsule "on disk"
>     2.3  Authenticated capsules in FMP format & boot manager
>     2.4  Non-UEFI (privileged firmware)
> 
> We do the following configurations dependencies approximations:
> 
>        Configuration symbol  Used to approximate
>    ------------------------  ------------------------------------
>    EFI_HAVE_CAPSULE_SUPPORT  Firmware update is performed in-band
>                      TPM_V2  A TPM is present
> 
> Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
> Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
> Cc: Tom Rini <trini@konsulko.com>
> ---
>   include/efi_api.h                | 12 ++++++++++
>   lib/efi_loader/Kconfig           | 51 ++++++++++++++++++++++++++++++++++++++++
>   lib/efi_loader/efi_conformance.c |  9 +++++++
>   3 files changed, 72 insertions(+)
> 
> diff --git a/include/efi_api.h b/include/efi_api.h
> index d4fdd50c49e..17e55118cda 100644
> --- a/include/efi_api.h
> +++ b/include/efi_api.h
> @@ -238,6 +238,18 @@ enum efi_reset_type {
>   	EFI_GUID(0xcce33c35, 0x74ac, 0x4087, 0xbc, 0xe7, \
>   		 0x8b, 0x29, 0xb0, 0x2e, 0xeb, 0x27)
>   
> +#define EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID \
> +	EFI_GUID(0x9073eed4, 0xe50d, 0x11ee, 0xb8, 0xb0, \
> +		 0x8b, 0x68, 0xda, 0x62, 0xfc, 0x80)
> +
> +#define EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID \
> +	EFI_GUID(0x7721fc77, 0xa724, 0x11ef, 0x8e, 0xaa, \
> +		 0xf7, 0xc9, 0xb1, 0x94, 0xba, 0x75)
> +
> +#define EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID \
> +	EFI_GUID(0xf2bb0422, 0xda8e, 0x11f0, 0xa6, 0x7b, \
> +		 0x1b, 0xe2, 0x20, 0x85, 0x40, 0x98)
> +
>   #define EFI_DEBUG_IMAGE_INFO_TABLE_GUID \
>   	EFI_GUID(0x49152e77, 0x1ada, 0x4764, 0xb7, 0xa2, \
>   		 0x7a, 0xfe, 0xfe, 0xd9, 0x5e, 0x8b)
> diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
> index aad8f860868..81231533946 100644
> --- a/lib/efi_loader/Kconfig
> +++ b/lib/efi_loader/Kconfig
> @@ -577,6 +577,26 @@ config HAVE_EFI_EBBR_2_1
>   	depends on EFI_CAPSULE_FIRMWARE || !EFI_HAVE_CAPSULE_SUPPORT
>   	default y
>   
> +config HAVE_EFI_EBBR_2_2
> +	bool
> +	depends on HAVE_EFI_EBBR_2_1
> +	depends on EFI_TCG2_PROTOCOL || !TPM_V2
> +	depends on EFI_CAPSULE_ON_DISK || !EFI_HAVE_CAPSULE_SUPPORT
> +	default y
> +
> +config HAVE_EFI_EBBR_2_3
> +	bool
> +	depends on HAVE_EFI_EBBR_2_2
> +	depends on EFI_CAPSULE_AUTHENTICATE || !EFI_HAVE_CAPSULE_SUPPORT
> +	depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT || !EFI_HAVE_CAPSULE_SUPPORT
> +	depends on EFI_BOOTMGR
> +	default y
> +
> +config HAVE_EFI_EBBR_2_4
> +	bool
> +	depends on HAVE_EFI_EBBR_2_3
> +	default y
> +
>   config EFI_ECPT
>   	bool "Enable the UEFI ECPT generation"
>   	default y
> @@ -592,6 +612,37 @@ config EFI_EBBR_2_1_CONFORMANCE
>   	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
>   	  v2.1 conformance entry to the ECPT.
>   
> +config EFI_EBBR_2_2_CONFORMANCE
> +	bool "Add the EBBR v2.2 conformance entry to the ECPT"
> +	depends on EFI_ECPT && HAVE_EFI_EBBR_2_2
> +	default y
> +	help
> +	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
> +	  v2.2 conformance entry to the ECPT.
> +
> +	  Version 2.2 adds requirements around TCG2 and capsule "on disk".
> +
> +config EFI_EBBR_2_3_CONFORMANCE
> +	bool "Add the EBBR v2.3 conformance entry to the ECPT"
> +	depends on EFI_ECPT && HAVE_EFI_EBBR_2_3
> +	default y
> +	help
> +	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
> +	  v2.3 conformance entry to the ECPT.
> +
> +	  Version 2.3 adds requirements around authenticated capsules in FMP
> +	  format and the boot manager.
> +
> +config EFI_EBBR_2_4_CONFORMANCE
> +	bool "Add the EBBR v2.4 conformance entry to the ECPT"
> +	depends on EFI_ECPT && HAVE_EFI_EBBR_2_4
> +	default y
> +	help
> +	  Enabling this option adds the Embedded Base Boot Requirements (EBBR)
> +	  v2.4 conformance entry to the ECPT.
> +
> +	  Version 2.4 adds non-UEFI requirements.
> +
>   config EFI_CONSOLE_DISABLE_ANSI
>   	bool "Disable ANSI escape sequence queries for console size"
>   	help
> diff --git a/lib/efi_loader/efi_conformance.c b/lib/efi_loader/efi_conformance.c
> index 470141af483..c1234681bb6 100644
> --- a/lib/efi_loader/efi_conformance.c
> +++ b/lib/efi_loader/efi_conformance.c
> @@ -29,6 +29,15 @@ efi_status_t efi_ecpt_register(void)
>   	#if CONFIG_IS_ENABLED(EFI_EBBR_2_1_CONFORMANCE)
>   		EFI_CONFORMANCE_PROFILE_EBBR_2_1_GUID,
>   	#endif
> +	#if CONFIG_IS_ENABLED(EFI_EBBR_2_2_CONFORMANCE)
> +		EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID,
> +	#endif
> +	#if CONFIG_IS_ENABLED(EFI_EBBR_2_3_CONFORMANCE)
> +		EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID,
> +	#endif
> +	#if CONFIG_IS_ENABLED(EFI_EBBR_2_4_CONFORMANCE)
> +		EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID,
> +	#endif
>   	};
>   
>   	ecpt_size = sizeof(profiles)
> 

[PATCH v2 3/5] lib: uuid: add EBBR 2.2-2.4 conformance profile GUIDs

[Vincent Stehlé]

Add support for printing the EFI_CONFORMANCE_PROFILE_EBBR_2_[234]_GUIDs
as human readable text.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Tom Rini <trini@konsulko.com>
---
 lib/uuid.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/uuid.c b/lib/uuid.c
index 16ca8f37751..18fe2a8a8f3 100644
--- a/lib/uuid.c
+++ b/lib/uuid.c
@@ -261,6 +261,18 @@ static const struct {
 		NULL, "EFI EBBR 2.1 Conformance Profile",
 		EFI_CONFORMANCE_PROFILE_EBBR_2_1_GUID,
 	},
+	{
+		NULL, "EFI EBBR 2.2 Conformance Profile",
+		EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID,
+	},
+	{
+		NULL, "EFI EBBR 2.3 Conformance Profile",
+		EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID,
+	},
+	{
+		NULL, "EFI EBBR 2.4 Conformance Profile",
+		EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID,
+	},
 #endif
 #ifdef CONFIG_EFI_RISCV_BOOT_PROTOCOL
 	{

-- 
2.53.0

Re: [PATCH v2 3/5] lib: uuid: add EBBR 2.2-2.4 conformance profile GUIDs

[Ilias Apalodimas]

On Mon, 21 Sept 2026 at 16:12, Vincent Stehlé <vincent.stehle@arm.com> wrote:
>
> Add support for printing the EFI_CONFORMANCE_PROFILE_EBBR_2_[234]_GUIDs
> as human readable text.
>
> Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
> Cc: Tom Rini <trini@konsulko.com>
> ---

Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

>  lib/uuid.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
>
> diff --git a/lib/uuid.c b/lib/uuid.c
> index 16ca8f37751..18fe2a8a8f3 100644
> --- a/lib/uuid.c
> +++ b/lib/uuid.c
> @@ -261,6 +261,18 @@ static const struct {
>                 NULL, "EFI EBBR 2.1 Conformance Profile",
>                 EFI_CONFORMANCE_PROFILE_EBBR_2_1_GUID,
>         },
> +       {
> +               NULL, "EFI EBBR 2.2 Conformance Profile",
> +               EFI_CONFORMANCE_PROFILE_EBBR_2_2_GUID,
> +       },
> +       {
> +               NULL, "EFI EBBR 2.3 Conformance Profile",
> +               EFI_CONFORMANCE_PROFILE_EBBR_2_3_GUID,
> +       },
> +       {
> +               NULL, "EFI EBBR 2.4 Conformance Profile",
> +               EFI_CONFORMANCE_PROFILE_EBBR_2_4_GUID,
> +       },
>  #endif
>  #ifdef CONFIG_EFI_RISCV_BOOT_PROTOCOL
>         {
>
> --
> 2.53.0
>

[PATCH v2 4/5] test/py: add 2.2-2.4 ECPT tests

[Vincent Stehlé]

Add three more ECPT tests to verify the EBBR 2.[234] conformance
profiles entries with the "efidebug ecpt" command.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
---
 test/py/tests/test_efi_ecpt.py | 48 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/test/py/tests/test_efi_ecpt.py b/test/py/tests/test_efi_ecpt.py
index 632a6b90bad..5f6dc2b74dc 100644
--- a/test/py/tests/test_efi_ecpt.py
+++ b/test/py/tests/test_efi_ecpt.py
@@ -40,3 +40,51 @@ def test_efi_ecpt_ebbr_2_1(ubman) -> None:
     response = ubman.run_command('efidebug ecpt')
     assert ('cce33c35-74ac-4087-bce7-8b29b02eeb27  '
             'EFI EBBR 2.1 Conformance Profile') in response
+
+
+@pytest.mark.buildconfigspec('cmd_efidebug')
+@pytest.mark.buildconfigspec('efi_ecpt')
+@pytest.mark.buildconfigspec('efi_ebbr_2_2_conformance')
+def test_efi_ecpt_ebbr_2_2(ubman) -> None:
+    """ Unit test for the ECPT, with EBBR 2.2 profile
+    This test uses the efidebug ecpt command to dump the ECPT and check that
+    the EBBR 2.2 conformance profile is there.
+
+    Args:
+        ubman -- U-Boot console
+    """
+    response = ubman.run_command('efidebug ecpt')
+    assert ('9073eed4-e50d-11ee-b8b0-8b68da62fc80  '
+            'EFI EBBR 2.2 Conformance Profile') in response
+
+
+@pytest.mark.buildconfigspec('cmd_efidebug')
+@pytest.mark.buildconfigspec('efi_ecpt')
+@pytest.mark.buildconfigspec('efi_ebbr_2_3_conformance')
+def test_efi_ecpt_ebbr_2_3(ubman) -> None:
+    """ Unit test for the ECPT, with EBBR 2.3 profile
+    This test uses the efidebug ecpt command to dump the ECPT and check that
+    the EBBR 2.3 conformance profile is there.
+
+    Args:
+        ubman -- U-Boot console
+    """
+    response = ubman.run_command('efidebug ecpt')
+    assert ('7721fc77-a724-11ef-8eaa-f7c9b194ba75  '
+            'EFI EBBR 2.3 Conformance Profile') in response
+
+
+@pytest.mark.buildconfigspec('cmd_efidebug')
+@pytest.mark.buildconfigspec('efi_ecpt')
+@pytest.mark.buildconfigspec('efi_ebbr_2_4_conformance')
+def test_efi_ecpt_ebbr_2_4(ubman) -> None:
+    """ Unit test for the ECPT, with EBBR 2.4 profile
+    This test uses the efidebug ecpt command to dump the ECPT and check that
+    the EBBR 2.4 conformance profile is there.
+
+    Args:
+        ubman -- U-Boot console
+    """
+    response = ubman.run_command('efidebug ecpt')
+    assert ('f2bb0422-da8e-11f0-a67b-1be220854098  '
+            'EFI EBBR 2.4 Conformance Profile') in response

-- 
2.53.0

[PATCH v2 5/5] doc: uefi: EBBR conformance profiles

[Vincent Stehlé]

U-Boot can support multiple EBBR conformance profiles, and it can advertise
them in the ECPT; therefore, remove the EBBR fixed version 2.1 mention from
the documentation and add a word about the ECPT profiles.

While at it, fix one typo.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
---
 doc/develop/uefi/uefi.rst | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/doc/develop/uefi/uefi.rst b/doc/develop/uefi/uefi.rst
index 94ddf690440..9dc34495f66 100644
--- a/doc/develop/uefi/uefi.rst
+++ b/doc/develop/uefi/uefi.rst
@@ -14,14 +14,23 @@ Development target
 ------------------
 
 The implementation of UEFI in U-Boot strives to reach the requirements described
-in the "Embedded Base Boot Requirements (EBBR) Specification - Release v2.1.0"
-[2]. The "Server Base Boot Requirements System Software on ARM Platforms" [3]
+in the "Embedded Base Boot Requirements (EBBR) Specification" [2].
+The "Server Base Boot Requirements System Software on ARM Platforms" [3]
 describes a superset of the EBBR specification and may be used as further
 reference.
 
 A full blown UEFI implementation would contradict the U-Boot design principle
 "keep it small".
 
+Conformance profiles
+~~~~~~~~~~~~~~~~~~~~
+
+The EBBR conformance profiles supported by U-Boot are inferred optimistically
+from its configuration and the corresponding GUIDs are advertised in the EFI
+Conformance Profiles Table (ECPT) automatically by default.
+System integrators should review the advertised profiles and override manually
+if necessary.
+
 Building U-Boot for UEFI
 ------------------------
 
@@ -323,7 +332,7 @@ Capsule with firmware version
 
 The UEFI specification does not define the firmware versioning mechanism.
 EDK II reference implementation inserts the FMP Payload Header right before
-the payload. It coutains the fw_version and lowest supported version,
+the payload. It contains the fw_version and lowest supported version,
 EDK II reference implementation uses these information to implement the
 firmware versioning and anti-rollback protection, the firmware version and
 lowest supported version is stored into EFI non-volatile variable.
@@ -1019,8 +1028,7 @@ Links
 -----
 
 * [1] http://uefi.org/specifications - UEFI specifications
-* [2] https://github.com/ARM-software/ebbr/releases/download/v2.1.0/ebbr-v2.1.0.pdf -
-  Embedded Base Boot Requirements (EBBR) Specification - Release v2.1.0
+* [2] https://github.com/ARM-software/ebbr - Embedded Base Boot Requirements (EBBR) Specification
 * [3] https://developer.arm.com/docs/den0044/latest/server-base-boot-requirements-system-software-on-arm-platforms-version-11 -
   Server Base Boot Requirements System Software on ARM Platforms - Version 1.1
 * [4] :doc:`iscsi`

-- 
2.53.0