summaryrefslogtreecommitdiffstats
path: root/BaseTools/Source/Python/Capsule
Commit message (Collapse)AuthorAgeFilesLines
* BaseTools/Capsule: Support Different Hash Algorithm for Payload DigestJason1 Lin2024-08-051-14/+103
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4821 - The capsule payload digest got hardcoded inside the GenerateCapsule script as "sha256". - It would be hard for the caller to change the supported hash algorithm which supported on OpenSSL or Windows signtool program and platform. - Capsule payload digest signed data is followed by the PKCS#7 standard, in EDK-II CryptoPkg "Pkcs7Verify ()" is supported to validate with several hash algorithms naturally. (md5, sha1, sha256, sha384, and sha512) - Deliver below changes within this patch, (1) Introduce an optional argument "--hash-algorithm" to assign the caller expected one and leave the default value "sha256" to support the backward compatibility. (2) Add the double quotes to put the string of certificate's subject name inside it. (3) Set "Open" argument of "SignToolSubjectName" into "False". (4) Set "Convert" argument of "SignToolSubjectName: into "str". (5) Correct the actual name of the "--subject-name" flag. (6) Add back correct number of arguments for PayloadDescriptor class object initializing. Note: - Platform needs to support the correspond hash algorithm to validate the digital signature or the failure would be observed. - Set the md5 and sha1 algorithm as EOL based on the CryptoPkg supported table and reject the capsule creation. Signed-off-by: Jason1 Lin <jason1.lin@intel.com>
* BaseTools/GenerateCapsule.py: Fix checking for DepExp presenceSergii Dmytruk2024-07-051-2/+2
| | | | | | | | | | | struct.unpack() returns a tuple even for a single-element pack, resulting in signature verification being evaluated to false even when the signature is there. This fixes --decode and --dump-info actions incorrectly reporting issues with parsing capsule dependencies when there are none. Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
* BaseTools/GenerateCapsule.py: Fix inconsistent error formattingSergii Dmytruk2024-07-051-2/+2
| | | | | | | Just add a space between colon and a more detailed error message in two places. Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
* BaseTools/GenerateCapsule.py: Require --output for --decodeSergii Dmytruk2024-07-051-0/+4
| | | | | | | | | | | --decode unconditionally uses args.OutputFile.name as a prefix for output files that it creates and fails in a non-pretty way without --output option. This doesn't address creation/truncation of the file specified via --output, but at least you're able to decode a capsule. Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
* BaseTools/GenerateCapsule.py: Better error message on --decode failureSergii Dmytruk2024-07-051-2/+2
| | | | | | Print error text from the exception. Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
* BaseTools/GenerateCapsule.py: Disallow UpdateImageIndex == 0 on --encodeSergii Dmytruk2024-07-051-3/+3
| | | | | | | | | This field seems to be one-based according UEFI specification, default value is 1 and --decode of GenerateCapsule.py errors upon seeing UpdateImageIndex less than 1. So align --encode behaviour to enforce a value within the 1..255 range. Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
* BaseTools/GenerateCapsule.py: Fix --decode operationSergii Dmytruk2024-07-051-1/+1
| | | | | | | | | | | Commit b68d566439683d0ebe60d52c85ff0e90331db740 added support for input subject name with signtool and broke --decode operation by using incorrect identifier in one place (could be an incomplete rename during review). It's `args.SignToolSubjectName`, not `args.SignSubjectName`. Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
* BaseTools/Capsule: Support signtool input subject name to sign capsule fileJason1 Lin2022-07-271-9/+34
| | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3928 Windows-based system using signtool.exe to sign the capsule. Add the support to using "--subject-name" argument to assign the subject name used to sign the capsule file. This argument would pass to signtool.exe as a part of input argument with "/n" flag. NOTE: If using signtool.exe to sign capsule at least need to choose one of "--pfx-file" and "--subject-name" argument to input the value. Signed-off-by: Jason1 Lin <jason1.lin@intel.com> Cc: Bob Feng <bob.c.feng@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Yuwei Chen <yuwei.chen@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Dakota Chiang <dakota.chiang@intel.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn> Reviewed-by: Bob Feng <bob.c.feng@intel.com>
* BaseTools: Add support for version 3 of FMP Image Header structureSughosh Ganu2021-05-121-1/+4
| | | | | | | | | | | Add support for the ImageCapsuleSupport field, introduced in version 3 of the EFI_FIRMWARE_MANAGEMENT_CAPSULE_IMAGE_HEADER structure. This structure member is used to indicate if the corresponding payload has support for authentication and dependency. Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Bob Feng <bob.c.feng@intel.com>
* BaseTools/Capsule: Add capsule dependency supportLi, Aaron2020-01-151-7/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2412 Capsule generate tool support encode capsule dependencies through '-j' command with a JSON file. To enable dependency feature, "Dependencies" field for each payload in JSON file is required. The value of "Dependencies" field is C style infix notation expression. For example: "Dependencies":"72E2945A-00DA-448E-9AA7-075AD840F9D4 > 0x00000001" The relation of Dependency Expression Opcode in UEFI2.8 chap 23.2 and infix notation expression value is as follows: +-----------------------------+--------------------------+ | OPCODE | INFIX EXPRESSION VALUE | +-----------------------------+--------------------------+ | 0x00 (PUSH_GUID) | {GUID} | | 0x01 (PUSH_VERSION) | {UINT32} | | 0x02 (DECLEAR_VERSION_NAME} | DECLEAR "{VERSION_NAME}" | | 0x03 (AND) | && | | 0x04 (OR) | || | | 0x05 (NOT) | ~ | | 0x06 (TRUE) | TRUE | | 0x07 (FALSE) | FALSE | | 0x08 (EQ) | == | | 0x09 (GT) | > | | 0x0A (GTE) | >= | | 0x0B (LT) | < | | 0x0C (LTE) | <= | +-----------------------------+--------------------------+ Cc: Bob Feng <bob.c.feng@intel.com> Cc: Liming Gao <liming.gao@intel.com> Signed-off-by: Aaron Li <aaron.li@intel.com> Reviewed-by: Bob Feng <bob.c.feng@intel.com>
* BaseTools/Capsule: Tool to generate Windows Firmware Update DriverJin, Eric2019-08-152-7/+129
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1837 The tool is designed to generate Windows Firmware Update Drivers, the input is one drivername.cap with related parameters, the output Windows Driver package are composed by drivername.cap, drivername.inf and drivername.cat to update the single payload in device. usage: GenerateWindowsDriver [-h] [--output-folder OUTPUTFOLDER] [--product-fmp-guid PRODUCTFMPGUID] [--capsuleversion-dotstring CAPSULEVERSION_DOTSTRING] [--capsuleversion-hexstring CAPSULEVERSION_HEXSTRING] [--product-fw-provider PRODUCTFWPROVIDER] [--product-fw-mfg-name PRODUCTFWMFGNAME] [--product-fw-desc PRODUCTFWDESC] [--capsule-file-name CAPSULEFILENAME] [--pfx-file PFXFILE] [--arch ARCH] [--operating-system-string OPERATINGSYSTEMSTRING] Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Cc: Bob Feng <bob.c.feng@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Kinney Michael D <michael.d.kinney@intel.com> Signed-off-by: Eric Jin <eric.jin@intel.com> Reviewed-by: Bob Feng <bob.c.feng@intel.com>
* BaseTools/Capsule: Add WindowsCapsuleSupportHelperSean Brogan2019-08-151-0/+62
| | | | | | | | | | | | | | | | Add initial version WindowsCapsuleSupportHelper.py original source comes from https://github.com/microsoft/mu_basecore/blob/dev/201905/BaseTools/Plugin/WindowsCapsuleSupportHelper/WindowsCapsuleSupportHelper.py commit ebd9aad90dee3a3094b575928670cf81b8c685b5 Convert EOL to CRLF Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Bob Feng <bob.c.feng@intel.com> Signed-off-by: Eric Jin <eric.jin@intel.com> Reviewed-by: Bob Feng <bob.c.feng@intel.com>
* BaseTools/Capsule: Supports multiple payloads and drivers in capsuleJin, Eric2019-06-281-260/+711
| | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1834 1)Add arguments "--embedded-driver" to support embedded driver in command line. 2)Add arguments "--update-image-index" to identify ImageIndex within the device in command line. 3)Add arguments "-j JSONFILE" to support multiple payloads and embedded drivers with JSON file. The update is in a backwards compatible manner, so all command line options to support single payload are still supported. But all the options associated with multiple payloads should be provided in a JSON file. Cc: Bob Feng <bob.c.feng@intel.com> Signed-off-by: Eric Jin <eric.jin@intel.com> Reviewed-by: Bob Feng <bob.c.feng@intel.com>
* BaseTools:Coding problems cause can not encode FMP Auth HeaderFan, ZhijuX2019-04-161-1/+1
| | | | | | | | | | | GenerateCapsule: error: can not encode FMP Auth Header The system cannot find the file specified. Cc: Bob Feng <bob.c.feng@intel.com> Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Zhiju.Fan <zhijux.fan@intel.com> Reviewed-by: Bob Feng <bob.c.feng@intel.com>
* BaseTools: Replace BSD License with BSD+Patent LicenseMichael D Kinney2019-04-091-7/+1
| | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1373 Replace BSD 2-Clause License with BSD+Patent License. This change is based on the following emails: https://lists.01.org/pipermail/edk2-devel/2019-February/036260.html https://lists.01.org/pipermail/edk2-devel/2018-October/030385.html RFCs with detailed process for the license change: V3: https://lists.01.org/pipermail/edk2-devel/2019-March/038116.html V2: https://lists.01.org/pipermail/edk2-devel/2019-March/037669.html V1: https://lists.01.org/pipermail/edk2-devel/2019-March/037500.html Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Bob Feng <bob.c.feng@intel.com>
* BaseTools:Coding problems caused by special charactersFan, ZhijuX2019-04-011-4/+4
| | | | | | | | | | | | | | | BZ:https://bugzilla.tianocore.org/show_bug.cgi?id=1670 During BaseTools compiling under Chinese or Japanese language Windows, python exception occurring. UnicodeDecodeError: 'ascii' codec can't decode byte 0xbd in position 3528: ordinal not in range(128) Cc: Bob Feng <bob.c.feng@intel.com> Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Zhiju.Fan <zhijux.fan@intel.com> Reviewed-by: Bob Feng <bob.c.feng@intel.com>
* BaseTools/Capsule: Support capsules without a payload headerKinney, Michael D2018-08-021-11/+23
| | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1028 Update --dump-info and --decode to show auth header information even if a payload header is not present. The --decode operation still fails if a payload header is not present. Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yonghong Zhu <yonghong.zhu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
* BaseTools/Capsule: Prevent traceback during signing operationsKinney, Michael D2018-08-021-2/+0
| | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1046 https://bugzilla.tianocore.org/show_bug.cgi?id=1048 https://bugzilla.tianocore.org/show_bug.cgi?id=1050 Remove raise statements that generate Tracebacks that were only intended for development/debug. With the raise statements removed proper error messages are shown. Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yonghong Zhu <yonghong.zhu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
* BaseTools/Capsule: Update file header with tool limitationsKinney, Michael D2018-08-021-0/+11
| | | | | | | | | | | | | | | | | Update file header to state that the tool does not support: * Multiple payloads * Drivers * Vendor code bytes https://bugzilla.tianocore.org/show_bug.cgi?id=1031 Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yonghong Zhu <yonghong.zhu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
* BaseTools/Capsule: Update help for --fw-version and --lsvKinney, Michael D2018-08-021-2/+2
| | | | | | | | | | | | | | | Update help to state that --fw-version and -=-lsv are required for encode operations that sign a payload. https://bugzilla.tianocore.org/show_bug.cgi?id=1029 Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yonghong Zhu <yonghong.zhu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
* BaseTools/Capsule: Do not support -o with --dump-infoKinney, Michael D2018-08-021-0/+4
| | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1025 Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yonghong Zhu <yonghong.zhu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
* BaseTools/Capsule: Remove support for PopulateSystemTableKinney, Michael D2018-08-021-5/+3
| | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1030 Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yonghong Zhu <yonghong.zhu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
* BaseTools/Capsule: Add max value checks to Capsule Generation toolsKinney, Michael D2018-08-021-0/+10
| | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=1021 https://bugzilla.tianocore.org/show_bug.cgi?id=1022 https://bugzilla.tianocore.org/show_bug.cgi?id=1026 Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yonghong Zhu <yonghong.zhu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
* BaseTools/Capsule: Add Capsule Generation ToolsKinney, Michael D2018-08-021-0/+522
https://bugzilla.tianocore.org/show_bug.cgi?id=945 Based on content from the following branch https://github.com/Microsoft/MS_UEFI/tree/share/beta/CapsuleTools * Convert C tools to Python * Add common python modules to: BaseTools/Source/Python/Common/Uefi/Capsule BaseTools/Source/Python/Common/Edk2/Capsule * Add GenerateCapsule.py to BaseTools/Source/Python/Capsule * Add Windows and Posix wrappers for GenerateCapsule.py usage: GenerateCapsule [-h] [-o OUTPUTFILE] (-e | -d | --dump-info) [--capflag {PersistAcrossReset,PopulateSystemTable,InitiateReset}] [--capoemflag CAPSULEOEMFLAG] [--guid GUID] [--hardware-instance HARDWAREINSTANCE] [--monotonic-count MONOTONICCOUNT] [--fw-version FWVERSION] [--lsv LOWESTSUPPORTEDVERSION] [--pfx-file SIGNTOOLPFXFILE] [--signer-private-cert OPENSSLSIGNERPRIVATECERTFILE] [--other-public-cert OPENSSLOTHERPUBLICCERTFILE] [--trusted-public-cert OPENSSLTRUSTEDPUBLICCERTFILE] [--signing-tool-path SIGNINGTOOLPATH] [--version] [-v] [-q] [--debug [0-9]] InputFile Generate a capsule. Copyright (c) 2018, Intel Corporation. All rights reserved. positional arguments: InputFile Input binary payload filename. optional arguments: -h, --help show this help message and exit -o OUTPUTFILE, --output OUTPUTFILE Output filename. -e, --encode Encode file -d, --decode Decode file --dump-info Display FMP Payload Header information --capflag {PersistAcrossReset,PopulateSystemTable,InitiateReset} Capsule flag can be PersistAcrossReset, or PopulateSystemTable or InitiateReset or not set --capoemflag CAPSULEOEMFLAG Capsule OEM Flag is an integer between 0x0000 and 0xffff. --guid GUID The FMP/ESRT GUID in registry format. Required for encode operations. --hardware-instance HARDWAREINSTANCE The 64-bit hardware instance. The default is 0x0000000000000000 --monotonic-count MONOTONICCOUNT 64-bit monotonic count value in header. Default is 0x0000000000000000. --fw-version FWVERSION The 32-bit version of the binary payload (e.g. 0x11223344 or 5678). --lsv LOWESTSUPPORTEDVERSION The 32-bit lowest supported version of the binary payload (e.g. 0x11223344 or 5678). --pfx-file SIGNTOOLPFXFILE signtool PFX certificate filename. --signer-private-cert OPENSSLSIGNERPRIVATECERTFILE OpenSSL signer private certificate filename. --other-public-cert OPENSSLOTHERPUBLICCERTFILE OpenSSL other public certificate filename. --trusted-public-cert OPENSSLTRUSTEDPUBLICCERTFILE OpenSSL trusted public certificate filename. --signing-tool-path SIGNINGTOOLPATH Path to signtool or OpenSSL tool. Optional if path to tools are already in PATH. --version show program's version number and exit -v, --verbose Turn on verbose output with informational messages printed, including capsule headers and warning messages. -q, --quiet Disable all messages except fatal errors. --debug [0-9] Set debug level Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Yonghong Zhu <yonghong.zhu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
generated by cgit v1.2.3 (git 2.46.0) at 2025-04-29 17:55:57 +0000