[PATCH 1/4] tools: mkeficapsule: Add support for parsing capsule params from config file

[Simon Glass]

Hi Sughosh,

On Wed, 22 Nov 2023 at 00:40, Sughosh Ganu <sughosh.ganu at linaro.org> wrote:
>
> hi Ilias,
>
> On Wed, 22 Nov 2023 at 13:06, Ilias Apalodimas
> <ilias.apalodimas at linaro.org> wrote:
> >
> > Hi all,
> >
> > On Wed, 22 Nov 2023 at 07:23, Sughosh Ganu <sughosh.ganu at linaro.org> wrote:
> > >
> > > hi Simon,
> > >
> > > On Wed, 22 Nov 2023 at 03:42, Simon Glass <sjg at chromium.org> wrote:
> > > >
> > > > Hi Sughosh,
> > > >
> > > > On Tue, 21 Nov 2023 at 00:02, Sughosh Ganu <sughosh.ganu at linaro.org> wrote:
> > > > >
> > > > > Add support for specifying the parameters needed for capsule
> > > > > generation through a config file, instead of passing them through
> > > > > command-line. Parameters for more than a single capsule file can be
> > > > > specified, resulting in generation of multiple capsules through a
> > > > > single invocation of the command.
> > > > >
> > > > > The config file can then be passed to the mkeficapsule tool in such
> > > > > manner
> > > > >
> > > > >  $ ./tools/mkeficapsule -f <path/to/the/config/file>
> > > > >
> > > > > Signed-off-by: Sughosh Ganu <sughosh.ganu at linaro.org>
> > > > > ---
> > > > >  tools/Kconfig              |  15 ++
> > > > >  tools/Makefile             |   1 +
> > > > >  tools/eficapsule.h         | 114 ++++++++++++
> > > > >  tools/mkeficapsule.c       |  87 +++++----
> > > > >  tools/mkeficapsule_parse.c | 352 +++++++++++++++++++++++++++++++++++++
> > > > >  5 files changed, 538 insertions(+), 31 deletions(-)
> > > > >  create mode 100644 tools/mkeficapsule_parse.c
> > > >
> > > > This patch keeps coming back :-)
> > > >
> > > > Can we not add multiple capsules in the binman description? Why do we
> > > > need a new file format? How can binman decode images produced in this
> > > > way?
> > >
> > > So as Tom mentions, this brings parity with respect to the other
> > > capsule generation tool in EDKII that generates capsules. IIRC, this
> > > is something which even Xilix was interested in, and Michal had kind
> > > of gone through these patches earlier. Lastly, it would be good to
> > > have support in U-Boot's mkeficapsule tool for generating a single
> > > capsule file with multiple payloads, and having support for this
> > > functionality helps in that goal.
> > >
> > > Also, you might have noticed that, since your objection to the last
> > > series, I have removed putting this in binman. So now, this aspect of
> > > the capsule generation would only be supported through the
> > > command-line invocation of the tool.
> >
> > I think that overall the approach is sane. mkeficapsule is currently
> > supported and compiled for distros, so the multiple payload support is
> > useful. If we want to add support to binman, instead of rewriting this
> > in python, we could just call that tool for parsing and creating
> > capsules
>
> Given the amount of time these patches have been under review(also
> number of iterations), I would request that this series be reviewed
> and merged first. I think there is general consensus that there is
> value to have this functionality in the mkeficapsule tool. If it is
> deemed fit to support this through binman as well, that task can be
> taken up separately. Thanks.

The point you are missing is that it is the entire goal of 'skirting
around' binman which is suspect.

If there is a need to generate an output file from the build, we
should support it in binman. If people start creating configuration
files all over the place, then they are not using binman, right?

I understand that there are pre-existing vendor-specific config files,
etc. that the EFI thing is a grey area, but I cannot imagine that this
patch would lead to a good outcome.

The goal of binman is to bring order to the chaos of firmware
packaging...we cannot do that if it is not actually used.

So let's figure out what is missing from binman's capsule generation
(multiple capsules? accept/reject capsules?) and how best to add it.

>
> -sughosh
>
> >
> > Thanks
> > /Ilias
> > >
> > > >
> > > > Also, could we get sandbox to produce one EFI capsule as part of the
> > > > normal build? I think that discussion trailed off.
> > >
> > > Yes, apologies for missing out on this. Slipped my mind. Would you
> > > want, say, all the non-signed capsules to be generated as part of the
> > > sandbox build?
> > >
> > > -sughosh

Regards,
Simon