* [PATCH v5 00/12] UEFI + Secure Boot + qemu
@ 2017-01-27 15:30 Patrick Ohly
2017-01-27 15:30 ` [PATCH v5 01/12] acpica: move from meta-oe to OE-core Patrick Ohly
` (12 more replies)
0 siblings, 13 replies; 29+ messages in thread
From: Patrick Ohly @ 2017-01-27 15:30 UTC (permalink / raw)
To: openembedded-core
There seems to be a consensus that supporting UEFI in OE-core for qemu
would be valuable, and there have been some (stalled) attempts to add
it. For reference, see:
[OE-core] [PATCH V3 0/3] Add UEFI firmware for qemux86*
[OE-core] Add ovmf-native to make qemu-native/runqemu support boot UEFI image?
https://bugzilla.yoctoproject.org/show_bug.cgi?id=5654
https://github.com/01org/luv-yocto/issues/38
This patch set includes the necessary recipes (ovmf from meta-luv, acpica from
meta-oe), some improvements to them (in particular, enabling Secure
Boot), and changes to runqemu to make it easier to boot with UEFI. A
special image recipes builds an image which can be used to lock down a
virtual machine by enrolling the "normal" pre-installed certificates.
In contrast to the first version of this patch series, one can now use
both a single OVMF firmware file as well as set up persistent
variables for a virtual machine by using two files.
Eduardo promised to add automated testing for this once it is in OE-core.
As it stands now, ovmf-shell-image and ovmf without Secure Boot enabled
should at least be part of a world build.
As discussed on this list, Ricardo and Fathi volunteered to help with
maintaining the ovmf and acpica recipes in OE-core.
Beware that "git am --keep-cr" must be used to import the ovmf patches
correctly.
Changes since V1:
- support both combined code+vars ("ovmf") and separate code
and vars flash drives ("ovmf.code ovmf.vars")
- OVMF firmware no longer installed in the target sysroot
- slightly simpler renaming from OVMF (uppercase, underscore)
to OE naming convention (lowercase, dots): now the different
ln invocation directly create files with the final name
- DEPLOYDIR needs to be cleaned explicitly (done via cleandirs varflag)
- Secure Boot support in ovmf is controlled by a PACKAGECONFIG option,
off by default
- distros and developers can add additional Secure Boot compile flags
with OVMF_SECURE_BOOT_EXTRA_FLAGS
- explain how to get ovmf built for use with runqemu via MACHINE_ESSENTIAL_EXTRA_RDEPENDS
- IMAGE_FSTYPES_forcevariable = "wic" used in ovmf-shell-image
- remove OVMF BGRT patch
- location of "inherit deploy"
Changes since V2:
- rebased onto current master
- workaround for acpica compile issue with flex 2.6.2
Changes since V3:
- rebased onto current master (for real, this time!)
- reordered patches a bit
Changes since V4:
- revised the commit message of "ovmf: deploy firmware in image directory"
to clarify expected usage
Fathi Boudra (1):
acpica: move from meta-oe to OE-core
Patrick Ohly (10):
acpica: work around flex 2.6.2 code generation issue
ovmf: explicitly depend on nasm-native
ovmf: deploy firmware in image directory
ovmf_git.bb: enable parallel compilation
ovmf_git.bb: enable Secure Boot
runqemu: fix undefined variable reference in check_arg_path()
runqemu: also accept -image suffix for rootfs parameter
runqemu: support UEFI with OVMF firmware
ovmf: build image which enrolls standard keys
ovmf: remove BGRT patch
meta-luv (1):
ovmf: move from meta-luv to OE-core
meta/recipes-core/ovmf/ovmf-shell-image.bb | 17 +-
meta/recipes-core/ovmf/ovmf/0001-BaseTools-Force-tools-variables-to-host-toolchain.patch | 48 +++-
meta/recipes-core/ovmf/ovmf/0002-ovmf-update-path-to-native-BaseTools.patch | 32 ++-
meta/recipes-core/ovmf/ovmf/0003-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch | 39 ++-
meta/recipes-core/ovmf/ovmf/0007-OvmfPkg-EnrollDefaultKeys-application-for-enrolling-.patch | 1124 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
meta/recipes-core/ovmf/ovmf/ovmf-shell-image.wks | 4 +-
meta/recipes-core/ovmf/ovmf_git.bb | 201 +++++++++++++-
meta/recipes-extended/acpica/acpica_20150515.bb | 47 +++-
meta/recipes-extended/acpica/acpitests/aapits-linux.patch | 336 ++++++++++++++++++++++-
meta/recipes-extended/acpica/acpitests/aapits-makefile.patch | 34 ++-
meta/recipes-extended/acpica/acpitests_20140828.bb | 35 ++-
meta/recipes-extended/acpica/files/no-werror.patch | 32 ++-
meta/recipes-extended/acpica/files/rename-yy_scan_string-manually.patch | 64 ++++-
scripts/runqemu | 50 ++-
14 files changed, 2058 insertions(+), 5 deletions(-)
create mode 100644 meta/recipes-core/ovmf/ovmf-shell-image.bb
create mode 100644 meta/recipes-core/ovmf/ovmf/0001-BaseTools-Force-tools-variables-to-host-toolchain.patch
create mode 100644 meta/recipes-core/ovmf/ovmf/0002-ovmf-update-path-to-native-BaseTools.patch
create mode 100644 meta/recipes-core/ovmf/ovmf/0003-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch
create mode 100644 meta/recipes-core/ovmf/ovmf/0007-OvmfPkg-EnrollDefaultKeys-application-for-enrolling-.patch
create mode 100644 meta/recipes-core/ovmf/ovmf/ovmf-shell-image.wks
create mode 100644 meta/recipes-core/ovmf/ovmf_git.bb
create mode 100644 meta/recipes-extended/acpica/acpica_20150515.bb
create mode 100644 meta/recipes-extended/acpica/acpitests/aapits-linux.patch
create mode 100644 meta/recipes-extended/acpica/acpitests/aapits-makefile.patch
create mode 100644 meta/recipes-extended/acpica/acpitests_20140828.bb
create mode 100644 meta/recipes-extended/acpica/files/no-werror.patch
create mode 100644 meta/recipes-extended/acpica/files/rename-yy_scan_string-manually.patch
base-commit: ce5c7075d530c0950f2feed35f95fbcd9f50721f
--
git-series 0.9.1
^ permalink raw reply [flat|nested] 29+ messages in thread* [PATCH v5 01/12] acpica: move from meta-oe to OE-core 2017-01-27 15:30 [PATCH v5 00/12] UEFI + Secure Boot + qemu Patrick Ohly @ 2017-01-27 15:30 ` Patrick Ohly 2017-02-17 21:13 ` Richard Purdie 2017-01-27 15:30 ` [PATCH v5 02/12] acpica: work around flex 2.6.2 code generation issue Patrick Ohly ` (11 subsequent siblings) 12 siblings, 1 reply; 29+ messages in thread From: Patrick Ohly @ 2017-01-27 15:30 UTC (permalink / raw) To: openembedded-core From: Fathi Boudra <fathi.boudra@linaro.org> qemu support for UEFI in OE-core depends on OVMF, which needs the iasl tools provided by this recipe. There's also an iasl recipe in meta-luv, but than can and will be replaced by this one, thus reducing overall maintenance work. Copied from meta-openembedded rev fa65be9ba (current master). Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- meta/recipes-extended/acpica/acpica_20150515.bb | 46 +- meta/recipes-extended/acpica/acpitests/aapits-linux.patch | 336 +++++++- meta/recipes-extended/acpica/acpitests/aapits-makefile.patch | 34 +- meta/recipes-extended/acpica/acpitests_20140828.bb | 35 +- meta/recipes-extended/acpica/files/no-werror.patch | 32 +- 5 files changed, 483 insertions(+) create mode 100644 meta/recipes-extended/acpica/acpica_20150515.bb create mode 100644 meta/recipes-extended/acpica/acpitests/aapits-linux.patch create mode 100644 meta/recipes-extended/acpica/acpitests/aapits-makefile.patch create mode 100644 meta/recipes-extended/acpica/acpitests_20140828.bb create mode 100644 meta/recipes-extended/acpica/files/no-werror.patch diff --git a/meta/recipes-extended/acpica/acpica_20150515.bb b/meta/recipes-extended/acpica/acpica_20150515.bb new file mode 100644 index 0000000..de897e1 --- /dev/null +++ b/meta/recipes-extended/acpica/acpica_20150515.bb @@ -0,0 +1,46 @@ +SUMMARY = "ACPICA tools for the development and debug of ACPI tables" +DESCRIPTION = "The ACPI Component Architecture (ACPICA) project provides an \ +OS-independent reference implementation of the Advanced Configuration and \ +Power Interface Specification (ACPI). ACPICA code contains those portions of \ +ACPI meant to be directly integrated into the host OS as a kernel-resident \ +subsystem, and a small set of tools to assist in developing and debugging \ +ACPI tables." + +HOMEPAGE = "http://www.acpica.org/" +SECTION = "console/tools" + +LICENSE = "BSD | GPLv2" +LIC_FILES_CHKSUM = "file://generate/unix/readme.txt;md5=204407e197c1a01154a48f6c6280c3aa" + +COMPATIBLE_HOST = "(i.86|x86_64|arm|aarch64).*-linux" + +DEPENDS = "bison flex" + +SRC_URI = "https://acpica.org/sites/acpica/files/acpica-unix2-${PV}.tar.gz \ + file://no-werror.patch \ + " +SRC_URI[md5sum] = "2bc4a7ccc82de9df9fa964f784ecb29c" +SRC_URI[sha256sum] = "61204ec56d71bc9bfa2ee2ade4c66f7e8541772ac72ef8ccc20b3f339cc96374" + +S = "${WORKDIR}/acpica-unix2-${PV}" + +EXTRA_OEMAKE = "CC='${CC}' 'OPT_CFLAGS=-Wall'" + +do_install() { + install -D -p -m0755 generate/unix/bin*/iasl ${D}${bindir}/iasl + install -D -p -m0755 generate/unix/bin*/acpibin ${D}${bindir}/acpibin + install -D -p -m0755 generate/unix/bin*/acpiexec ${D}${bindir}/acpiexec + install -D -p -m0755 generate/unix/bin*/acpihelp ${D}${bindir}/acpihelp + install -D -p -m0755 generate/unix/bin*/acpinames ${D}${bindir}/acpinames + install -D -p -m0755 generate/unix/bin*/acpisrc ${D}${bindir}/acpisrc + install -D -p -m0755 generate/unix/bin*/acpixtract ${D}${bindir}/acpixtract +} + +# iasl*.bb is a subset of this recipe, so RREPLACE it +PROVIDES = "iasl" +RPROVIDES_${PN} += "iasl" +RREPLACES_${PN} += "iasl" +RCONFLIGHTS_${PN} += "iasl" + +NATIVE_INSTALL_WORKS = "1" +BBCLASSEXTEND = "native" diff --git a/meta/recipes-extended/acpica/acpitests/aapits-linux.patch b/meta/recipes-extended/acpica/acpitests/aapits-linux.patch new file mode 100644 index 0000000..7c5d6b0 --- /dev/null +++ b/meta/recipes-extended/acpica/acpitests/aapits-linux.patch @@ -0,0 +1,336 @@ +From: Al Stone <ahs3@ahs3.net> +Date: Mon, 7 Apr 2014 19:09:37 +0000 +Subject: [PATCH 1/2] Fixup aapits build + +From http://git.linaro.org/people/al.stone/acpica-tools.git +Upstream-status: Unknown + +diff -urN acpica-unix2-20130626/tests/aapits/atexec.c acpica-unix2-20130626-aapits/tests/aapits/atexec.c +--- acpica-unix2-20130626/tests/aapits/atexec.c 2013-01-17 12:48:28.000000000 -0700 ++++ acpica-unix2-20130626-aapits/tests/aapits/atexec.c 2013-07-25 13:44:23.023894441 -0600 +@@ -639,6 +639,7 @@ + } + + ++#if ACPI_MACHINE_WIDTH == 32 + /******************************************************************************* + * + * FUNCTION: AtBuildLocalRSDT +@@ -757,8 +758,9 @@ + LocalRSDT->Header.Checksum = (UINT8)~LocalRSDT->Header.Checksum; + } + } ++#endif + + + /******************************************************************************* + * + * FUNCTION: AtBuildLocalXSDT +@@ -1424,7 +1426,7 @@ + ACPI_WARNING ((AE_INFO, + "Request on [%4.4s] is beyond region limit Req-%X+%X, Base=%X, Len-%X\n", + (RegionObject->Region.Node)->Name.Ascii, (UINT32) Address, +- ByteWidth, (UINT32) BufferAddress, Length)); ++ ByteWidth, (UINT32) BufferAddress, (UINT32) Length)); + + return (AE_AML_REGION_LIMIT); + } +@@ -1792,7 +1796,9 @@ + Path, Obj.Integer.Value, Value); + #else + printf ("API Error: Value of %s is 0x%llx instead of expected 0x%llx\n", +- Path, Obj.Integer.Value, Value); ++ Path, ++ (long long unsigned int) Obj.Integer.Value, ++ (long long unsigned int) Value); + #endif + Status = AE_ERROR; + } +@@ -1871,7 +1877,7 @@ + { + TestErrors++; + printf ("Test Error: cannot allocate buffer of %d bytes\n", +- Results.Length); ++ (int) Results.Length); + return (AE_NO_MEMORY); + } + Results.Pointer = Object; +@@ -1952,7 +1956,8 @@ + { + printf ("AtCheckBuffer: unexpected length %d of Buffer vs" + " calculated %d bytes\n", +- Results.Length, ACPI_ROUND_UP_TO_NATIVE_WORD(sizeof (ACPI_OBJECT) + Length)); ++ (int)Results.Length, ++ (int)(ACPI_ROUND_UP_TO_NATIVE_WORD(sizeof (ACPI_OBJECT) + Length))); + } + + /* Initialize the return buffer structure */ +@@ -1961,7 +1968,7 @@ + { + TestErrors++; + printf ("Test Error: cannot allocate buffer of %d bytes\n", +- Results.Length); ++ (int) Results.Length); + return (AE_NO_MEMORY); + } + Results.Pointer = Object; +diff -urN acpica-unix2-20130626/tests/aapits/atinit.c acpica-unix2-20130626-aapits/tests/aapits/atinit.c +--- acpica-unix2-20130626/tests/aapits/atinit.c 2013-01-17 12:48:28.000000000 -0700 ++++ acpica-unix2-20130626-aapits/tests/aapits/atinit.c 2013-07-25 13:20:19.706705960 -0600 +@@ -3024,7 +3024,7 @@ + AapiErrors++; + printf ("API Error: AcpiGetSystemInfo() returned" + " Length %d, expected %d\n", +- OutBuffer.Length, sizeof (Info)); ++ (int) OutBuffer.Length, (int) sizeof (Info)); + return (AE_ERROR); + } + +@@ -3046,7 +3046,7 @@ + AapiErrors++; + printf ("API Error: AcpiGetSystemInfo() returned" + " Length %d, expected %d\n", +- OutBuffer.Length, sizeof (Info)); ++ (int) OutBuffer.Length, (int) sizeof (Info)); + return (AE_ERROR); + } + +@@ -3066,7 +3066,7 @@ + AapiErrors++; + printf ("API Error: AcpiGetSystemInfo() returned" + " Length %d, expected %d\n", +- OutBuffer.Length, sizeof (Info)); ++ (int) OutBuffer.Length, (int) sizeof (Info)); + return (AE_ERROR); + } + else if (OutBuffer.Pointer != &Info) +@@ -3149,7 +3149,7 @@ + AapiErrors++; + printf ("API Error: AcpiGetSystemInfo() returned" + " Length %d, expected %d\n", +- OutBuffer.Length, sizeof (Info)); ++ (int) OutBuffer.Length, (int) sizeof (Info)); + return (AE_ERROR); + } + else if (OutBuffer.Pointer != &Info) +@@ -3214,7 +3214,7 @@ + AapiErrors++; + printf ("API Error: AcpiGetSystemInfo() returned" + " Length %d, expected %d\n", +- OutBuffer.Length, sizeof (ACPI_SYSTEM_INFO)); ++ (int) OutBuffer.Length, (int) sizeof (ACPI_SYSTEM_INFO)); + return (AE_ERROR); + } + else +diff -urN acpica-unix2-20130626/tests/aapits/atmain.c acpica-unix2-20130626-aapits/tests/aapits/atmain.c +--- acpica-unix2-20130626/tests/aapits/atmain.c 2013-01-17 12:48:28.000000000 -0700 ++++ acpica-unix2-20130626-aapits/tests/aapits/atmain.c 2013-07-25 13:18:22.083323948 -0600 +@@ -315,7 +315,7 @@ + { + printf ("ACPICA API TS err: test num %ld of test case %ld" + " is not implemented\n", +- test_num, test_case); ++ (long int) test_num, (long int) test_case); + return (AtRetNotImpl); + } + +@@ -430,7 +432,7 @@ + if (test_case < 1 || test_case > AT_TEST_CASE_NUM) + { + printf ("ACPICA API TS err: test case %ld is out of range 1 - %d\n", +- test_case, AT_TEST_CASE_NUM); ++ (long int) test_case, (int) AT_TEST_CASE_NUM); + return (AtRetBadParam); + } + +@@ -438,7 +440,7 @@ + if (test_num < 0 || test_num > AtTestCase[test_case].TestsNum) + { + printf ("ACPICA API TS err: test num %ld is out of range 0 - %d\n", +- test_num, AtTestCase[test_case].TestsNum); ++ (long int) test_num, AtTestCase[test_case].TestsNum); + return (AtRetBadParam); + } + +diff -urN acpica-unix2-20130626/tests/aapits/atnamespace.c acpica-unix2-20130626-aapits/tests/aapits/atnamespace.c +--- acpica-unix2-20130626/tests/aapits/atnamespace.c 2013-01-17 12:48:28.000000000 -0700 ++++ acpica-unix2-20130626-aapits/tests/aapits/atnamespace.c 2013-07-25 13:24:15.366466707 -0600 +@@ -2535,7 +2535,8 @@ + #else + printf ("API Error: Address of %s (0x%llX) != (0x%llX)\n", + PathNames[2 * i + 1], +- Info->Address, ExpectedInfo[i].Address); ++ (long long unsigned int) Info->Address, ++ (long long unsigned int) ExpectedInfo[i].Address); + #endif + #else + printf ("API Error: Address of %s (0x%X) != (0x%X)\n", +@@ -2908,7 +2909,8 @@ + TestErrors++; + printf ("AtGetNextObjectTypeCommon: different numbers of entities" + "in TypesNames (%d) and LevelTypes0000 (%d)\n", +- TypesCount, sizeof (LevelTypes0000) / sizeof (ACPI_OBJECT_TYPE)); ++ TypesCount, ++ (int) (sizeof (LevelTypes0000) / sizeof (ACPI_OBJECT_TYPE))); + return (AE_ERROR); + } + +@@ -4192,7 +4194,9 @@ + Pathname, Obj.Integer.Value, Value); + #else + printf ("API Error: Value of %s is 0x%llx instead of expected 0x%llx\n", +- Pathname, Obj.Integer.Value, Value); ++ Pathname, ++ (long long unsigned int) Obj.Integer.Value, ++ (long long unsigned int) Value); + #endif + Status = AE_ERROR; + } +@@ -5199,7 +5203,7 @@ + { + AapiErrors++; + printf ("API Error: AcpiOsAllocate(%d) returned NULL\n", +- OutName.Length); ++ (int) OutName.Length); + return (AE_ERROR); + } + } +diff -urN acpica-unix2-20130626/tests/aapits/atosxfctrl.c acpica-unix2-20130626-aapits/tests/aapits/atosxfctrl.c +--- acpica-unix2-20130626/tests/aapits/atosxfctrl.c 2013-01-17 12:48:28.000000000 -0700 ++++ acpica-unix2-20130626-aapits/tests/aapits/atosxfctrl.c 2013-07-25 13:30:00.375492751 -0600 +@@ -737,13 +737,15 @@ + #if ACPI_MACHINE_WIDTH == 64 + #ifdef _MSC_VER + printf("OsxfCtrlFingReg: unexpected Width %d of Reg 0x%I64x\n", ++ Width, Address); + #else + printf("OsxfCtrlFingReg: unexpected Width %d of Reg 0x%llx\n", ++ Width, (long long unsigned int) Address); + #endif + #else + printf("OsxfCtrlFingReg: unexpected Width %d of Reg 0x%x\n", +-#endif + Width, Address); ++#endif + return (NULL); + } + +@@ -764,15 +766,19 @@ + #ifdef _MSC_VER + printf("OsxfCtrlFingReg: intersection Regs (0x%I64x: 0x%x)" + " and (0x%I64x: 0x%x)\n", ++ Reg->Address, Reg->Width, Address, Width); + #else + printf("OsxfCtrlFingReg: intersection Regs (0x%llx: 0x%x)" + " and (0x%llx: 0x%x)\n", ++ (long long unsigned int) Reg->Address, ++ Reg->Width, ++ (long long unsigned int) Address, Width); + #endif + #else + printf("OsxfCtrlFingReg: intersection Regs (0x%x: 0x%x)" + " and (0x%x: 0x%x)\n", +-#endif + Reg->Address, Reg->Width, Address, Width); ++#endif + return (NULL); + } + } +@@ -786,13 +792,15 @@ + #if ACPI_MACHINE_WIDTH == 64 + #ifdef _MSC_VER + printf("OsxfCtrlFingReg: no memory for Reg (0x%I64x: 0x%x)\n", ++ Reg->Address, Reg->Width); + #else + printf("OsxfCtrlFingReg: no memory for Reg (0x%llx: 0x%x)\n", ++ (long long unsigned int) Reg->Address, Reg->Width); + #endif + #else + printf("OsxfCtrlFingReg: no memory for Reg (0x%x: 0x%x)\n", +-#endif + Reg->Address, Reg->Width); ++#endif + return (NULL); + } + Reg->Type = Type; +@@ -932,14 +940,19 @@ + #if ACPI_MACHINE_WIDTH == 64 + #ifdef _MSC_VER + printf("%.2u (%s Address 0x%I64x: Width %.2u) r/w counts: %u/%u\n", ++ i, (Reg->Type == EMUL_REG_SYS)? "SYS": "IO", ++ Reg->Address, Reg->Width, Reg->ReadCount, Reg->WriteCount); + #else + printf("%.2u (%s Address 0x%llx: Width %.2u) r/w counts: %u/%u\n", ++ i, (Reg->Type == EMUL_REG_SYS)? "SYS": "IO", ++ (long long unsigned int) Reg->Address, ++ Reg->Width, Reg->ReadCount, Reg->WriteCount); + #endif + #else + printf("%.2u (%s Address 0x%.4x: Width %.2u) r/w counts: %u/%u\n", +-#endif + i, (Reg->Type == EMUL_REG_SYS)? "SYS": "IO", + Reg->Address, Reg->Width, Reg->ReadCount, Reg->WriteCount); ++#endif + Reg = Reg->Next; + i++; + } +diff -urN acpica-unix2-20130626/tests/aapits/atresource.c acpica-unix2-20130626-aapits/tests/aapits/atresource.c +--- acpica-unix2-20130626/tests/aapits/atresource.c 2013-01-17 12:48:29.000000000 -0700 ++++ acpica-unix2-20130626-aapits/tests/aapits/atresource.c 2013-07-25 13:25:49.423565947 -0600 +@@ -174,7 +174,7 @@ + AapiErrors++; + printf ("API Error: AcpiGetCurrentResources(%s) returned Length %d," + " expected %d\n", +- Pathname, OutBuffer.Length, RT0000_DEV0_CRS_LEN); ++ Pathname, (int) OutBuffer.Length, RT0000_DEV0_CRS_LEN); + return (AE_ERROR); + } + +@@ -490,7 +490,7 @@ + AapiErrors++; + printf ("API Error: AcpiGetCurrentResources(%s) returned Length %d," + " expected %d\n", +- Pathname, OutBuffer.Length, RT0000_DEV0_CRS_LEN); ++ Pathname, (int) OutBuffer.Length, RT0000_DEV0_CRS_LEN); + return (AE_ERROR); + } + +@@ -689,7 +689,7 @@ + AapiErrors++; + printf ("Api Error: Resource->Length (%d) != %d\n", + CurrentResource->Length, +- ACPI_ROUND_UP_TO_NATIVE_WORD (ACPI_RS_SIZE (ACPI_RESOURCE_IRQ))); ++ (int) (ACPI_ROUND_UP_TO_NATIVE_WORD (ACPI_RS_SIZE (ACPI_RESOURCE_IRQ)))); + } + + if (CurrentResource->Data.Irq.Triggering != 0) /* Level-Triggered */ +@@ -981,7 +981,7 @@ + AapiErrors++; + printf ("API Error: AcpiGetPossibleResources(%s) returned Length %d," + " expected %d\n", +- Pathname, OutBuffer.Length, RT0000_DEV0_CRS_LEN); ++ Pathname, (int) OutBuffer.Length, RT0000_DEV0_CRS_LEN); + return (AE_ERROR); + } + +@@ -1923,7 +1923,7 @@ + AapiErrors++; + printf ("API Error: AcpiGetIrqRoutingTable(%s) returned Length %d," + " expected %d\n", +- Pathname, OutBuffer.Length, 0xA48); ++ Pathname, (int) OutBuffer.Length, 0xA48); + return (AE_ERROR); + } + +diff -urN acpica-unix2-20130626/tests/aapits/Makefile acpica-unix2-20130626-aapits/tests/aapits/Makefile +--- acpica-unix2-20130626/tests/aapits/Makefile 2013-01-17 12:48:29.000000000 -0700 ++++ acpica-unix2-20130626-aapits/tests/aapits/Makefile 2013-07-25 15:17:09.309236422 -0600 +@@ -194,7 +194,7 @@ + CFLAGS+= -Wall -g -D_LINUX -DNDEBUG -D_CONSOLE -DACPI_APITS -DACPI_EXEC_APP -D_MULTI_THREADED -Wstrict-prototypes -I../../source/include + + +-acpiexec : $(patsubst %.c,%.o, $(SRCS)) ++$(PROG) : $(patsubst %.c,%.o, $(SRCS)) + $(CC) $(LDFLAGS) $(patsubst %.c,%.o, $(SRCS)) -o $(PROG) + + CLEANFILES= $(PROG) diff --git a/meta/recipes-extended/acpica/acpitests/aapits-makefile.patch b/meta/recipes-extended/acpica/acpitests/aapits-makefile.patch new file mode 100644 index 0000000..4d9e997 --- /dev/null +++ b/meta/recipes-extended/acpica/acpitests/aapits-makefile.patch @@ -0,0 +1,34 @@ +From: Al Stone <ahs3@ahs3.net> +Date: Mon, 7 Apr 2014 19:09:37 +0000 +Subject: [PATCH 1/2] Fixup aapits build + +From http://git.linaro.org/people/al.stone/acpica-tools.git +Upstream-status: Unknown + +diff -urN acpica-unix2-20140325/tests/aapits/Makefile acpica-unix2-20140325/tests/aapits/Makefile +--- acpica-unix2-20140325/tests/aapits/Makefile 2014-04-05 14:23:14.683636794 -0600 ++++ acpica-unix2-20140325-aapits/tests/aapits/Makefile 2014-04-05 15:10:57.879184598 -0600 +@@ -16,6 +16,7 @@ + atosxfwrap.c \ + osunixxf.c \ + ../../source/common/ahids.c \ ++ ../../source/common/ahuuids.c \ + ../../source/common/cmfsize.c \ + ../../source/common/getopt.c \ + ../../source/components/hardware/hwtimer.c \ +@@ -174,6 +175,7 @@ + ../../source/components/utilities/utexcep.c \ + ../../source/components/utilities/utfileio.c \ + ../../source/components/utilities/utglobal.c \ ++ ../../source/components/utilities/uthex.c \ + ../../source/components/utilities/utids.c \ + ../../source/components/utilities/utinit.c \ + ../../source/components/utilities/utlock.c \ +@@ -189,6 +191,7 @@ + ../../source/components/utilities/utstate.c \ + ../../source/components/utilities/utstring.c \ + ../../source/components/utilities/uttrack.c \ ++ ../../source/components/utilities/utuuid.c \ + ../../source/components/utilities/utxface.c \ + ../../source/components/utilities/utxferror.c \ + ../../source/components/utilities/utxfinit.c \ diff --git a/meta/recipes-extended/acpica/acpitests_20140828.bb b/meta/recipes-extended/acpica/acpitests_20140828.bb new file mode 100644 index 0000000..1f6f190 --- /dev/null +++ b/meta/recipes-extended/acpica/acpitests_20140828.bb @@ -0,0 +1,35 @@ +SUMMARY = "Test suite used to validate ACPICA" +HOMEPAGE = "http://www.acpica.org/" + +LICENSE = "Intel" +LIC_FILES_CHKSUM = "file://tests/aapits/atexec.c;beginline=1;endline=115;md5=e92bcdfcd01d117d1bda3e814bb2030a" + +DEPENDS = "bison flex" + +SRC_URI = "https://acpica.org/sites/acpica/files/acpitests-unix-${PV}.tar.gz;name=acpitests \ + https://acpica.org/sites/acpica/files/acpica-unix2-${PV}.tar.gz;name=acpica \ + file://aapits-linux.patch \ + file://aapits-makefile.patch \ +" +SRC_URI[acpitests.md5sum] = "db9d6fdaa8e3eb101d700ee5ba4938ed" +SRC_URI[acpitests.sha256sum] = "e576c74bf1bf1c9f7348bf9419e05c8acfece7105abcdc052e66670c7af2cf00" +SRC_URI[acpica.md5sum] = "6f05f0d10166a1b1ff6107f3d1cdf1e5" +SRC_URI[acpica.sha256sum] = "01d8867656c5ba41dec307c4383ce676196ad4281ac2c9dec9f5be5fac6d888e" + +S = "${WORKDIR}/acpitests-unix-${PV}" + +EXTRA_OEMAKE = "'CC=${TARGET_PREFIX}gcc ${HOST_CC_ARCH} ${TOOLCHAIN_OPTIONS}' 'OPT_CFLAGS=-Wall'" + +# The Makefiles expect a specific layout +do_compile() { + cp -af ${WORKDIR}/acpica-unix2-${PV}/source ${S} + cd tests/aapits + oe_runmake +} + +do_install() { + install -d ${D}${bindir} + install -m0755 tests/aapits/bin/aapits ${D}${bindir} +} + +COMPATIBLE_HOST = "(i.86|x86_64|arm|aarch64).*-linux" diff --git a/meta/recipes-extended/acpica/files/no-werror.patch b/meta/recipes-extended/acpica/files/no-werror.patch new file mode 100644 index 0000000..5d28f47 --- /dev/null +++ b/meta/recipes-extended/acpica/files/no-werror.patch @@ -0,0 +1,32 @@ +Description: remove -Werror flag +Forwarded: not-needed +Author: Fathi Boudra <fathi.boudra@linaro.org> + +--- + generate/unix/iasl/Makefile | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/generate/unix/iasl/Makefile ++++ b/generate/unix/iasl/Makefile +@@ -266,19 +266,19 @@ $(OBJDIR)/prparser.y.h: $(OBJDIR)/prpars + # by the utilities above and they are not necessarily ANSI C, etc. + # + $(OBJDIR)/aslcompilerlex.o : $(OBJDIR)/aslcompilerlex.c +- $(CC) -c $(CFLAGS) -Wall -Werror -o$@ $< ++ $(CC) -c $(CFLAGS) -Wall -o$@ $< + + $(OBJDIR)/aslcompilerparse.o : $(OBJDIR)/aslcompilerparse.c +- $(CC) -c $(CFLAGS) -Wall -Werror -o$@ $< ++ $(CC) -c $(CFLAGS) -Wall -o$@ $< + + $(OBJDIR)/dtparserlex.o : $(OBJDIR)/dtparserlex.c +- $(CC) -c $(CFLAGS) -Wall -Werror -o$@ $< ++ $(CC) -c $(CFLAGS) -Wall -o$@ $< + + $(OBJDIR)/dtparserparse.o : $(OBJDIR)/dtparserparse.c +- $(CC) -c $(CFLAGS) -Wall -Werror -o$@ $< ++ $(CC) -c $(CFLAGS) -Wall -o$@ $< + + $(OBJDIR)/prparserlex.o : $(OBJDIR)/prparserlex.c +- $(CC) -c $(CFLAGS) -Wall -Werror -o$@ $< ++ $(CC) -c $(CFLAGS) -Wall -o$@ $< -- git-series 0.9.1 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* Re: [PATCH v5 01/12] acpica: move from meta-oe to OE-core 2017-01-27 15:30 ` [PATCH v5 01/12] acpica: move from meta-oe to OE-core Patrick Ohly @ 2017-02-17 21:13 ` Richard Purdie 2017-02-18 2:02 ` Khem Raj 2017-02-18 8:03 ` Patrick Ohly 0 siblings, 2 replies; 29+ messages in thread From: Richard Purdie @ 2017-02-17 21:13 UTC (permalink / raw) To: Patrick Ohly, openembedded-core On Fri, 2017-01-27 at 16:30 +0100, Patrick Ohly wrote: > From: Fathi Boudra <fathi.boudra@linaro.org> > > qemu support for UEFI in OE-core depends on OVMF, which needs the > iasl > tools provided by this recipe. There's also an iasl recipe in > meta-luv, but than can and will be replaced by this one, thus > reducing > overall maintenance work. > > Copied from meta-openembedded rev fa65be9ba (current master). > > Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> This fails on musl: https://autobuilder.yocto.io/builders/nightly-musl/builds/160/steps/BuildImages/logs/stdio | ^~~~~~~~~~~~~~ | i586-poky-linux-musl-gcc -m32 -march=i586 --sysroot=/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-musl/build/build/tmp/work/i586-poky-linux-musl/acpica/20150515-r0/recipe-sysroot -c -O2 -pipe -g -feliminate-unused-debug-types -fdebug-prefix-map=/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-musl/build/build/tmp/work/i586-poky-linux-musl/acpica/20150515-r0=/usr/src/debug/acpica/20150515-r0 -fdebug-prefix-map=/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-musl/build/build/tmp/work/i586-poky-linux-musl/acpica/20150515-r0/recipe-sysroot-native= -fdebug-prefix-map=/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-musl/build/build/tmp/work/i586-poky-linux-musl/acpica/20150515-r0/recipe-sysroot= -D_CYGWIN -D_GNU_SOURCE -I../../../source/include -D_CYGWIN -D_GNU_SOURCE -I../../../source/include -DACPI_ASL_COMPILER -I../../../source/compiler -Iobj -Wall -o obj/asllistsup.o ../../../source/compiler/asllistsup.c | ../../../source/compiler/aslfiles.c: In function 'FlOpenMiscOutputFiles': | ../../../source/compiler/aslfiles.c:595:45: error: invalid application of 'sizeof' to incomplete type 'FILE {aka struct _IO_FILE}' | memcpy (stderr, stdout, sizeof (FILE)); | ^~~~ | Copied obj/acpiexamples to ../bin/acpiexamples Cheers, Richard ^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: [PATCH v5 01/12] acpica: move from meta-oe to OE-core 2017-02-17 21:13 ` Richard Purdie @ 2017-02-18 2:02 ` Khem Raj 2017-02-18 8:03 ` Patrick Ohly 1 sibling, 0 replies; 29+ messages in thread From: Khem Raj @ 2017-02-18 2:02 UTC (permalink / raw) To: Richard Purdie; +Cc: openembedded-core On 17-02-17 13:13:11, Richard Purdie wrote: > On Fri, 2017-01-27 at 16:30 +0100, Patrick Ohly wrote: > > From: Fathi Boudra <fathi.boudra@linaro.org> > > > > qemu support for UEFI in OE-core depends on OVMF, which needs the > > iasl > > tools provided by this recipe. There's also an iasl recipe in > > meta-luv, but than can and will be replaced by this one, thus > > reducing > > overall maintenance work. > > > > Copied from meta-openembedded rev fa65be9ba (current master). > > > > Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> > > This fails on musl: > > https://autobuilder.yocto.io/builders/nightly-musl/builds/160/steps/BuildImages/logs/stdio > > | ^~~~~~~~~~~~~~ > | i586-poky-linux-musl-gcc -m32 -march=i586 --sysroot=/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-musl/build/build/tmp/work/i586-poky-linux-musl/acpica/20150515-r0/recipe-sysroot -c -O2 -pipe -g -feliminate-unused-debug-types -fdebug-prefix-map=/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-musl/build/build/tmp/work/i586-poky-linux-musl/acpica/20150515-r0=/usr/src/debug/acpica/20150515-r0 -fdebug-prefix-map=/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-musl/build/build/tmp/work/i586-poky-linux-musl/acpica/20150515-r0/recipe-sysroot-native= -fdebug-prefix-map=/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-musl/build/build/tmp/work/i586-poky-linux-musl/acpica/20150515-r0/recipe-sysroot= -D_CYGWIN -D_GNU_SOURCE -I../../../source/include -D_CYGWIN -D_GNU_SOURCE -I../../../source/include -DACPI_ASL_COMPILER -I../../../source/compiler -Iobj -Wall -o obj/asllistsup.o ../../../source/compiler/asllistsup.c > | ../../../source/compiler/aslfiles.c: In function 'FlOpenMiscOutputFiles': > | ../../../source/compiler/aslfiles.c:595:45: error: invalid application of 'sizeof' to incomplete type 'FILE {aka struct _IO_FILE}' > | memcpy (stderr, stdout, sizeof (FILE)); > | ^~~~ > | Copied obj/acpiexamples to ../bin/acpiexamples FILE object cannot be used in any reasonable way, only a pointer to FILE has well defined uses -Khem ^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: [PATCH v5 01/12] acpica: move from meta-oe to OE-core 2017-02-17 21:13 ` Richard Purdie 2017-02-18 2:02 ` Khem Raj @ 2017-02-18 8:03 ` Patrick Ohly 1 sibling, 0 replies; 29+ messages in thread From: Patrick Ohly @ 2017-02-18 8:03 UTC (permalink / raw) To: Richard Purdie, Neri, Ricardo; +Cc: openembedded-core Hello Ricardo, can you perhaps help? I'm traveling next week and don't have much time. Thanks, Patrick On Fri, 2017-02-17 at 13:13 -0800, Richard Purdie wrote: > On Fri, 2017-01-27 at 16:30 +0100, Patrick Ohly wrote: > > From: Fathi Boudra <fathi.boudra@linaro.org> > > > > qemu support for UEFI in OE-core depends on OVMF, which needs the > > iasl > > tools provided by this recipe. There's also an iasl recipe in > > meta-luv, but than can and will be replaced by this one, thus > > reducing > > overall maintenance work. > > > > Copied from meta-openembedded rev fa65be9ba (current master). > > > > Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> > > This fails on musl: > > https://autobuilder.yocto.io/builders/nightly-musl/builds/160/steps/BuildImages/logs/stdio > > | ^~~~~~~~~~~~~~ > | i586-poky-linux-musl-gcc -m32 -march=i586 --sysroot=/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-musl/build/build/tmp/work/i586-poky-linux-musl/acpica/20150515-r0/recipe-sysroot -c -O2 -pipe -g -feliminate-unused-debug-types -fdebug-prefix-map=/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-musl/build/build/tmp/work/i586-poky-linux-musl/acpica/20150515-r0=/usr/src/debug/acpica/20150515-r0 -fdebug-prefix-map=/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-musl/build/build/tmp/work/i586-poky-linux-musl/acpica/20150515-r0/recipe-sysroot-native= -fdebug-prefix-map=/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-musl/build/build/tmp/work/i586-poky-linux-musl/acpica/20150515-r0/recipe-sysroot= -D_CYGWIN -D_GNU_SOURCE -I../../../source/include -D_CYGWIN -D_GNU_SOURCE -I../../../source/include -DACPI_ASL_COMPILER -I../../../source/compiler -Iobj -Wall -o obj/asllistsup.o ../../../source/compiler/asllistsup.c > | ../../../source/compiler/aslfiles.c: In function 'FlOpenMiscOutputFiles': > | ../../../source/compiler/aslfiles.c:595:45: error: invalid application of 'sizeof' to incomplete type 'FILE {aka struct _IO_FILE}' > | memcpy (stderr, stdout, sizeof (FILE)); > | ^~~~ > | Copied obj/acpiexamples to ../bin/acpiexamples > > Cheers, > > Richard ^ permalink raw reply [flat|nested] 29+ messages in thread
* [PATCH v5 02/12] acpica: work around flex 2.6.2 code generation issue 2017-01-27 15:30 [PATCH v5 00/12] UEFI + Secure Boot + qemu Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 01/12] acpica: move from meta-oe to OE-core Patrick Ohly @ 2017-01-27 15:30 ` Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 03/12] ovmf: move from meta-luv to OE-core Patrick Ohly ` (10 subsequent siblings) 12 siblings, 0 replies; 29+ messages in thread From: Patrick Ohly @ 2017-01-27 15:30 UTC (permalink / raw) To: openembedded-core Without this patch, linking fails with a missing implementation of yy_scan_string. This looks like a regression in flex, because 2.6.0 generated different code that called PrParser_scan_string resp. DtParser_scan_string. Working around that in acpica until this is better understood or fixed in flex is the easiest solution for now. Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- meta/recipes-extended/acpica/acpica_20150515.bb | 1 + meta/recipes-extended/acpica/files/rename-yy_scan_string-manually.patch | 64 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 65 insertions(+) create mode 100644 meta/recipes-extended/acpica/files/rename-yy_scan_string-manually.patch diff --git a/meta/recipes-extended/acpica/acpica_20150515.bb b/meta/recipes-extended/acpica/acpica_20150515.bb index de897e1..c23b491 100644 --- a/meta/recipes-extended/acpica/acpica_20150515.bb +++ b/meta/recipes-extended/acpica/acpica_20150515.bb @@ -18,6 +18,7 @@ DEPENDS = "bison flex" SRC_URI = "https://acpica.org/sites/acpica/files/acpica-unix2-${PV}.tar.gz \ file://no-werror.patch \ + file://rename-yy_scan_string-manually.patch \ " SRC_URI[md5sum] = "2bc4a7ccc82de9df9fa964f784ecb29c" SRC_URI[sha256sum] = "61204ec56d71bc9bfa2ee2ade4c66f7e8541772ac72ef8ccc20b3f339cc96374" diff --git a/meta/recipes-extended/acpica/files/rename-yy_scan_string-manually.patch b/meta/recipes-extended/acpica/files/rename-yy_scan_string-manually.patch new file mode 100644 index 0000000..b62ca25 --- /dev/null +++ b/meta/recipes-extended/acpica/files/rename-yy_scan_string-manually.patch @@ -0,0 +1,64 @@ +From 2ab61e6ad5a9cfcde838379bc36babfaaa61afb8 Mon Sep 17 00:00:00 2001 +From: Patrick Ohly <patrick.ohly@intel.com> +Date: Fri, 20 Jan 2017 13:50:17 +0100 +Subject: [PATCH] rename yy_scan_string manually + +flex 2.6.0 used to generate code where yy_scan_string was mapped +to <custom prefix>_scan_string directly in the generated .c code. + +For example, generate/unix/iasl/obj/prparserlex.c: + +int +PrInitLexer ( + char *String) +{ + + LexBuffer = PrParser_scan_string (String); + return (LexBuffer == NULL); +} + +flex 2.6.3 no longer does that, leading to a compiler warning +and link error about yy_scan_string(). + +Both versions generate a preamble in the beginning of prparserlex.c +that maps several yy_* names, but yy_scan_string is not among those: + +... +... + +Upstream-Status: Inappropriate [workaround for https://github.com/westes/flex/issues/164] +Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> +--- + source/compiler/dtparser.l | 2 +- + source/compiler/prparser.l | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/source/compiler/dtparser.l b/source/compiler/dtparser.l +index 3f4c2f3..eaa43ff 100644 +--- a/source/compiler/dtparser.l ++++ b/source/compiler/dtparser.l +@@ -120,7 +120,7 @@ DtInitLexer ( + char *String) + { + +- LexBuffer = yy_scan_string (String); ++ LexBuffer = DtParser_scan_string (String); + return (LexBuffer == NULL); + } + +diff --git a/source/compiler/prparser.l b/source/compiler/prparser.l +index 10bd130..9cb3573 100644 +--- a/source/compiler/prparser.l ++++ b/source/compiler/prparser.l +@@ -127,7 +127,7 @@ PrInitLexer ( + char *String) + { + +- LexBuffer = yy_scan_string (String); ++ LexBuffer = PrParser_scan_string (String); + return (LexBuffer == NULL); + } + +-- +2.11.0 + -- git-series 0.9.1 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* [PATCH v5 03/12] ovmf: move from meta-luv to OE-core 2017-01-27 15:30 [PATCH v5 00/12] UEFI + Secure Boot + qemu Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 01/12] acpica: move from meta-oe to OE-core Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 02/12] acpica: work around flex 2.6.2 code generation issue Patrick Ohly @ 2017-01-27 15:30 ` Patrick Ohly 2017-02-17 21:10 ` Richard Purdie 2017-01-27 15:30 ` [PATCH v5 04/12] ovmf: explicitly depend on nasm-native Patrick Ohly ` (9 subsequent siblings) 12 siblings, 1 reply; 29+ messages in thread From: Patrick Ohly @ 2017-01-27 15:30 UTC (permalink / raw) To: openembedded-core From: meta-luv <luv@lists.01.org> This is an unmodified copy of github.com/01org/luv-yocto/meta-luv/recipes-core/ovmf revision 4be4329. Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- meta/recipes-core/ovmf/ovmf/0001-BaseTools-Force-tools-variables-to-host-toolchain.patch | 48 +++++++++++++++++++++++++++++- meta/recipes-core/ovmf/ovmf/0001-OvmfPkg-Enable-BGRT-in-OVMF.patch | 110 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++- meta/recipes-core/ovmf/ovmf/0002-ovmf-update-path-to-native-BaseTools.patch | 32 +++++++++++++++++++- meta/recipes-core/ovmf/ovmf/0003-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch | 39 +++++++++++++++++++++++- meta/recipes-core/ovmf/ovmf_git.bb | 121 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++- 5 files changed, 350 insertions(+) create mode 100644 meta/recipes-core/ovmf/ovmf/0001-BaseTools-Force-tools-variables-to-host-toolchain.patch create mode 100644 meta/recipes-core/ovmf/ovmf/0001-OvmfPkg-Enable-BGRT-in-OVMF.patch create mode 100644 meta/recipes-core/ovmf/ovmf/0002-ovmf-update-path-to-native-BaseTools.patch create mode 100644 meta/recipes-core/ovmf/ovmf/0003-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch create mode 100644 meta/recipes-core/ovmf/ovmf_git.bb diff --git a/meta/recipes-core/ovmf/ovmf/0001-BaseTools-Force-tools-variables-to-host-toolchain.patch b/meta/recipes-core/ovmf/ovmf/0001-BaseTools-Force-tools-variables-to-host-toolchain.patch new file mode 100644 index 0000000..644b99d --- /dev/null +++ b/meta/recipes-core/ovmf/ovmf/0001-BaseTools-Force-tools-variables-to-host-toolchain.patch @@ -0,0 +1,48 @@ +From 6e24bde1979c2d7149b37d142fb882dfde0e9770 Mon Sep 17 00:00:00 2001 +From: Matt Fleming <matt.fleming@intel.com> +Date: Fri, 27 Jun 2014 11:12:18 +0100 +Subject: [PATCH] BaseTools: Force tools variables to host toolchain + +Signed-off-by: Matt Fleming <matt.fleming@intel.com> +--- + BaseTools/Source/C/Makefiles/app.makefile | 7 +++++++ + BaseTools/Source/C/VfrCompile/GNUmakefile | 5 +++++ + 2 files changed, 12 insertions(+) + +diff --git a/BaseTools/Source/C/Makefiles/app.makefile b/BaseTools/Source/C/Makefiles/app.makefile +index 19269a1..62aad0f 100644 +--- a/BaseTools/Source/C/Makefiles/app.makefile ++++ b/BaseTools/Source/C/Makefiles/app.makefile +@@ -16,6 +16,13 @@ include $(MAKEROOT)/Makefiles/header.makefile + + APPLICATION = $(MAKEROOT)/bin/$(APPNAME) + ++CC = gcc ++CXX = g++ ++AS = gcc ++AR = ar ++LD = ld ++LINKER = $(CC) ++ + .PHONY:all + all: $(MAKEROOT)/bin $(APPLICATION) + +diff --git a/BaseTools/Source/C/VfrCompile/GNUmakefile b/BaseTools/Source/C/VfrCompile/GNUmakefile +index 82005e1..5ac5f7e 100644 +--- a/BaseTools/Source/C/VfrCompile/GNUmakefile ++++ b/BaseTools/Source/C/VfrCompile/GNUmakefile +@@ -26,6 +26,11 @@ OBJECTS = AParser.o DLexerBase.o ATokenBuffer.o EfiVfrParser.o VfrLexer.o VfrSyn + + VFR_CPPFLAGS = -DPCCTS_USE_NAMESPACE_STD $(CPPFLAGS) + ++CC = gcc ++CXX = g++ ++AS = gcc ++AR = ar ++LD = ld + LINKER = $(BUILD_CXX) + + EXTRA_CLEAN_OBJECTS = EfiVfrParser.cpp EfiVfrParser.h VfrParser.dlg VfrTokens.h VfrLexer.cpp VfrLexer.h VfrSyntax.cpp tokens.h +-- +1.9.0 + diff --git a/meta/recipes-core/ovmf/ovmf/0001-OvmfPkg-Enable-BGRT-in-OVMF.patch b/meta/recipes-core/ovmf/ovmf/0001-OvmfPkg-Enable-BGRT-in-OVMF.patch new file mode 100644 index 0000000..4531a6d --- /dev/null +++ b/meta/recipes-core/ovmf/ovmf/0001-OvmfPkg-Enable-BGRT-in-OVMF.patch @@ -0,0 +1,110 @@ +From 66a4020c3c2163aeffc9757851f33c346ecfd870 Mon Sep 17 00:00:00 2001 +From: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com> +Date: Mon, 4 Apr 2016 12:15:12 -0700 +Subject: [PATCH] OvmfPkg: Enable BGRT in OVMF + +By default, firmware (OVMF - Open source Virtual Machine Firmware) +never publishes BGRT (Boot Graphics Resource Table) and in the boot +process Linux kernel checks for this table and if it fails to find BGRT +table then corresponding code in Linux kernel is not executed. EDK II +(EFI Development Kit, thus OVMF) already has BGRT source code packaged +into it but it is excluded from the build process of OVMF. These changes +to build system of OVMF enables BGRT in 32-bit and 64-bit OVMF. + +There are only two files that need to be modified in order to do this. +The first one being OvmfPkg*.dsc (this file describes the platform) and +the second one being OvmfPkg*.fdf (this file describes firmware descriptor +volume). A *.inf file (here "BootGraphicsResourceTableDxe.inf") +describes a module (here BGRT). So, include +"BootGraphicsResourceTableDxe.inf" file in "OvmfPkg*.dsc" so that BGRT +source code will be compiled and "BootGraphicsResourceTableDxe.efi" file +is generated and we should also include +"BootGraphicsResourceTableDxe.inf" file in "OvmfPkg*.fdf" file so that +"BootGraphicsResourceTableDxe.efi" will be placed in a firmware volume +and thus gets published. + +Signed-off-by: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com> +--- + OvmfPkg/OvmfPkgIa32.dsc | 1 + + OvmfPkg/OvmfPkgIa32.fdf | 1 + + OvmfPkg/OvmfPkgIa32X64.dsc | 1 + + OvmfPkg/OvmfPkgIa32X64.fdf | 1 + + OvmfPkg/OvmfPkgX64.dsc | 1 + + OvmfPkg/OvmfPkgX64.fdf | 1 + + 6 files changed, 6 insertions(+) + +diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc +index 9e5b477..0582219 100644 +--- a/OvmfPkg/OvmfPkgIa32.dsc ++++ b/OvmfPkg/OvmfPkgIa32.dsc +@@ -647,6 +647,7 @@ + OvmfPkg/AcpiS3SaveDxe/AcpiS3SaveDxe.inf + MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf + MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf ++ MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf + + # + # Network Support +diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf +index fc203f2..f968cb7 100644 +--- a/OvmfPkg/OvmfPkgIa32.fdf ++++ b/OvmfPkg/OvmfPkgIa32.fdf +@@ -274,6 +274,7 @@ INF RuleOverride=ACPITABLE OvmfPkg/AcpiTables/AcpiTables.inf + INF OvmfPkg/AcpiS3SaveDxe/AcpiS3SaveDxe.inf + INF MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf + INF MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf ++INF MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf + + INF RuleOverride = BINARY FatBinPkg/EnhancedFatDxe/Fat.inf + +diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc +index 6e4da4f..8289385 100644 +--- a/OvmfPkg/OvmfPkgIa32X64.dsc ++++ b/OvmfPkg/OvmfPkgIa32X64.dsc +@@ -656,6 +656,7 @@ + OvmfPkg/AcpiS3SaveDxe/AcpiS3SaveDxe.inf + MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf + MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf ++ MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf + + # + # Network Support +diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf +index d3f46f3..282d40b 100644 +--- a/OvmfPkg/OvmfPkgIa32X64.fdf ++++ b/OvmfPkg/OvmfPkgIa32X64.fdf +@@ -274,6 +274,7 @@ INF RuleOverride=ACPITABLE OvmfPkg/AcpiTables/AcpiTables.inf + INF OvmfPkg/AcpiS3SaveDxe/AcpiS3SaveDxe.inf + INF MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf + INF MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf ++INF MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf + + INF RuleOverride = BINARY USE = X64 FatBinPkg/EnhancedFatDxe/Fat.inf + +diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc +index 3d6d43e..0f956a7 100644 +--- a/OvmfPkg/OvmfPkgX64.dsc ++++ b/OvmfPkg/OvmfPkgX64.dsc +@@ -654,6 +654,7 @@ + OvmfPkg/AcpiS3SaveDxe/AcpiS3SaveDxe.inf + MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf + MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf ++ MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf + + # + # Network Support +diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf +index 15ef13a..9708fd5 100644 +--- a/OvmfPkg/OvmfPkgX64.fdf ++++ b/OvmfPkg/OvmfPkgX64.fdf +@@ -274,6 +274,7 @@ INF RuleOverride=ACPITABLE OvmfPkg/AcpiTables/AcpiTables.inf + INF OvmfPkg/AcpiS3SaveDxe/AcpiS3SaveDxe.inf + INF MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf + INF MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf ++INF MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf + + INF RuleOverride = BINARY FatBinPkg/EnhancedFatDxe/Fat.inf + +-- +2.7.4 + diff --git a/meta/recipes-core/ovmf/ovmf/0002-ovmf-update-path-to-native-BaseTools.patch b/meta/recipes-core/ovmf/ovmf/0002-ovmf-update-path-to-native-BaseTools.patch new file mode 100644 index 0000000..94029a5 --- /dev/null +++ b/meta/recipes-core/ovmf/ovmf/0002-ovmf-update-path-to-native-BaseTools.patch @@ -0,0 +1,32 @@ +From 9e632e3f9edd09632cc877dff6ea57608f979aab Mon Sep 17 00:00:00 2001 +From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> +Date: Thu, 9 Jun 2016 02:23:01 -0700 +Subject: [PATCH] ovmf: update path to native BaseTools + +BaseTools is a set of utilities to build EDK-based firmware. These utilities +are used during the build process. Thus, they need to be built natively. +When cross-compiling, we need to provide a path to the location of these +tools. The BBAKE_EDK_TOOLS_PATH string is used as a pattern to be replaced +with the appropriate location before building. + +Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> +--- + OvmfPkg/build.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/OvmfPkg/build.sh b/OvmfPkg/build.sh +index eb5eb73..9058fca 100755 +--- a/OvmfPkg/build.sh ++++ b/OvmfPkg/build.sh +@@ -30,7 +30,7 @@ then + # this assumes svn pulls have the same root dir + # export EDK_TOOLS_PATH=`pwd`/../BaseTools + # This version is for the tools source in edk2 +- export EDK_TOOLS_PATH=`pwd`/BaseTools ++ export EDK_TOOLS_PATH=BBAKE_EDK_TOOLS_PATH/BaseTools + echo $EDK_TOOLS_PATH + source edksetup.sh BaseTools + else +-- +2.8.1 + diff --git a/meta/recipes-core/ovmf/ovmf/0003-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch b/meta/recipes-core/ovmf/ovmf/0003-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch new file mode 100644 index 0000000..0fdc278 --- /dev/null +++ b/meta/recipes-core/ovmf/ovmf/0003-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch @@ -0,0 +1,39 @@ +From 2320650c6d381b914fe91b2dedaa5870279a8bcf Mon Sep 17 00:00:00 2001 +From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com> +Date: Sun, 27 Nov 2016 18:42:55 -0800 +Subject: [PATCH] BaseTools: makefile: adjust to build in under bitbake + +Prepend the build flags with those of bitbake. This is to build +using the bitbake native sysroot include and library directories. + +Signed-off-by: Ricardo Neri <ricardo.neri@linux.intel.com> +--- + BaseTools/Source/C/Makefiles/header.makefile | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/BaseTools/Source/C/Makefiles/header.makefile b/BaseTools/Source/C/Makefiles/header.makefile +index 821d114..fe0f08b 100644 +--- a/BaseTools/Source/C/Makefiles/header.makefile ++++ b/BaseTools/Source/C/Makefiles/header.makefile +@@ -44,14 +44,14 @@ ARCH_INCLUDE = -I $(MAKEROOT)/Include/AArch64/ + endif + + INCLUDE = $(TOOL_INCLUDE) -I $(MAKEROOT) -I $(MAKEROOT)/Include/Common -I $(MAKEROOT)/Include/ -I $(MAKEROOT)/Include/IndustryStandard -I $(MAKEROOT)/Common/ -I .. -I . $(ARCH_INCLUDE) +-BUILD_CPPFLAGS = $(INCLUDE) -O2 ++BUILD_CPPFLAGS := $(BUILD_CPPFLAGS) $(INCLUDE) -O2 + ifeq ($(DARWIN),Darwin) + # assume clang or clang compatible flags on OS X +-BUILD_CFLAGS = -MD -fshort-wchar -fno-strict-aliasing -Wall -Werror -Wno-deprecated-declarations -Wno-self-assign -Wno-unused-result -nostdlib -c -g ++BUILD_CFLAGS := $(BUILD_CFLAGS) -MD -fshort-wchar -fno-strict-aliasing -Wall -Werror -Wno-deprecated-declarations -Wno-self-assign -Wno-unused-result -nostdlib -c -g + else +-BUILD_CFLAGS = -MD -fshort-wchar -fno-strict-aliasing -Wall -Werror -Wno-deprecated-declarations -Wno-unused-result -nostdlib -c -g ++BUILD_CFLAGS := $(BUILD_CFLAGS) -MD -fshort-wchar -fno-strict-aliasing -Wall -Werror -Wno-deprecated-declarations -Wno-unused-result -nostdlib -c -g + endif +-BUILD_LFLAGS = ++BUILD_LFLAGS := $(LDFLAGS) + BUILD_CXXFLAGS = + + ifeq ($(ARCH), IA32) +-- +2.9.3 + diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb new file mode 100644 index 0000000..e722db5 --- /dev/null +++ b/meta/recipes-core/ovmf/ovmf_git.bb @@ -0,0 +1,121 @@ +DESCRIPTION = "OVMF - UEFI firmware for Qemu and KVM" +HOMEPAGE = "http://sourceforge.net/apps/mediawiki/tianocore/index.php?title=OVMF" +LICENSE = "BSD" +LIC_FILES_CHKSUM = "file://OvmfPkg/License.txt;md5=343dc88e82ff33d042074f62050c3496" + +SRC_URI = "git://github.com/tianocore/edk2.git;branch=master \ + file://0001-BaseTools-Force-tools-variables-to-host-toolchain.patch \ + file://0001-OvmfPkg-Enable-BGRT-in-OVMF.patch \ + file://0002-ovmf-update-path-to-native-BaseTools.patch \ + file://0003-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch \ + " + +SRCREV="4575a602ca6072ee9d04150b38bfb143cbff8588" + +PARALLEL_MAKE = "" + +S = "${WORKDIR}/git" + +DEPENDS_class-native="util-linux-native iasl-native ossp-uuid-native" + +DEPENDS_class-target="ovmf-native" + +EDK_TOOLS_DIR="edk2_basetools" + +# OVMF has trouble building with the default optimization of -O2. +BUILD_OPTIMIZATION="-pipe" + +# OVMF supports IA only, although it could conceivably support ARM someday. +COMPATIBLE_HOST='(i.86|x86_64).*' + +do_patch_append_class-native() { + bb.build.exec_func('do_fix_iasl', d) + bb.build.exec_func('do_fix_toolchain', d) +} + +do_fix_basetools_location() { + sed -i -e 's#BBAKE_EDK_TOOLS_PATH#${STAGING_BINDIR_NATIVE}/${EDK_TOOLS_DIR}#' ${S}/OvmfPkg/build.sh +} + +do_patch_append_class-target() { + bb.build.exec_func('do_fix_basetools_location', d) +} + + +do_fix_iasl() { + sed -i -e 's#/usr/bin/iasl#${STAGING_BINDIR_NATIVE}/iasl#' ${S}/BaseTools/Conf/tools_def.template +} + +do_fix_toolchain(){ + sed -i -e 's#DEF(ELFGCC_BIN)/#${TARGET_PREFIX}#' ${S}/BaseTools/Conf/tools_def.template + sed -i -e 's#DEF(GCC.*PREFIX)#${TARGET_PREFIX}#' ${S}/BaseTools/Conf/tools_def.template + sed -i -e "s#^LINKER\(.*\)#LINKER\1\nLFLAGS += ${BUILD_LDFLAGS}#" ${S}/BaseTools/Source/C/Makefiles/app.makefile + sed -i -e "s#^LINKER\(.*\)#LINKER\1\nCFLAGS += ${BUILD_CFLAGS}#" ${S}/BaseTools/Source/C/Makefiles/app.makefile + sed -i -e "s#^LINKER\(.*\)#LINKER\1\nLFLAGS += ${BUILD_LDFLAGS}#" ${S}/BaseTools/Source/C/VfrCompile/GNUmakefile + sed -i -e "s#^LINKER\(.*\)#LINKER\1\nCFLAGS += ${BUILD_CFLAGS}#" ${S}/BaseTools/Source/C/VfrCompile/GNUmakefile +} + +GCC_VER="$(${CC} -v 2>&1 | tail -n1 | awk '{print $3}')" + +fixup_target_tools() { + case ${1} in + 4.4.*) + FIXED_GCCVER=GCC44 + ;; + 4.5.*) + FIXED_GCCVER=GCC45 + ;; + 4.6.*) + FIXED_GCCVER=GCC46 + ;; + 4.7.*) + FIXED_GCCVER=GCC47 + ;; + 4.8.*) + FIXED_GCCVER=GCC48 + ;; + 4.9.*) + FIXED_GCCVER=GCC49 + ;; + *) + FIXED_GCCVER=GCC5 + ;; + esac + echo ${FIXED_GCCVER} +} + +do_compile_class-native() { + oe_runmake -C ${S}/BaseTools +} + +do_compile_class-target() { + export LFLAGS="${LDFLAGS}" + OVMF_ARCH="X64" + if [ "${TARGET_ARCH}" != "x86_64" ] ; then + OVMF_ARCH="IA32" + fi + + FIXED_GCCVER=$(fixup_target_tools ${GCC_VER}) + echo FIXED_GCCVER is ${FIXED_GCCVER} + ${S}/OvmfPkg/build.sh -a $OVMF_ARCH -b RELEASE -t ${FIXED_GCCVER} +} + +do_install_class-native() { + install -d ${D}/${bindir}/edk2_basetools + cp -r ${S}/BaseTools ${D}/${bindir}/${EDK_TOOLS_DIR} +} + +do_install_class-target() { + OVMF_DIR_SUFFIX="X64" + if [ "${TARGET_ARCH}" != "x86_64" ] ; then + OVMF_DIR_SUFFIX="Ia32" # Note the different capitalization + fi + install -d ${D}${datadir}/ovmf + + FIXED_GCCVER=$(fixup_target_tools ${GCC_VER}) + build_dir="${S}/Build/Ovmf$OVMF_DIR_SUFFIX/RELEASE_${FIXED_GCCVER}" + install -m 0755 ${build_dir}/FV/OVMF.fd \ + ${D}${datadir}/ovmf/bios.bin +} + +BBCLASSEXTEND = "native" -- git-series 0.9.1 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* Re: [PATCH v5 03/12] ovmf: move from meta-luv to OE-core 2017-01-27 15:30 ` [PATCH v5 03/12] ovmf: move from meta-luv to OE-core Patrick Ohly @ 2017-02-17 21:10 ` Richard Purdie 2017-02-18 2:04 ` Khem Raj 2017-02-18 8:05 ` [PATCH v5 03/12] ovmf: move from meta-luv to OE-core Patrick Ohly 0 siblings, 2 replies; 29+ messages in thread From: Richard Purdie @ 2017-02-17 21:10 UTC (permalink / raw) To: Patrick Ohly, openembedded-core On Fri, 2017-01-27 at 16:30 +0100, Patrick Ohly wrote: > From: meta-luv <luv@lists.01.org> > > This is an unmodified copy of > github.com/01org/luv-yocto/meta-luv/recipes-core/ovmf revision > 4be4329. https://autobuilder.yocto.io/builders/nightly-world/builds/156 which boils down to: | "gcc-ar" cr /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootLogoLib/BootLogoLib/OUTPUT/BootLogoLib.lib @/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootLogoLib/BootLogoLib/OUTPUT/object_files.lst | make: *** [/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootMaintenanceManagerUiLib/DEBUG/BootMaintenanceManager.c] Error 2 | VfrCompile: ERROR 1003: Invalid option value | VFR file name /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootMaintenanceManagerUiLib/OUTPUT/BootMaintenanceManager.i is too long. | "gcc-ar" cr /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib/OUTPUT/NvVarsFileLib.lib @/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib/OUTPUT/object_files.lst i.e. path length issues. We saw this on multiple builds :(. Cheers, Richard ^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: [PATCH v5 03/12] ovmf: move from meta-luv to OE-core 2017-02-17 21:10 ` Richard Purdie @ 2017-02-18 2:04 ` Khem Raj 2017-02-23 17:47 ` Patrick Ohly 2017-02-18 8:05 ` [PATCH v5 03/12] ovmf: move from meta-luv to OE-core Patrick Ohly 1 sibling, 1 reply; 29+ messages in thread From: Khem Raj @ 2017-02-18 2:04 UTC (permalink / raw) To: Richard Purdie; +Cc: openembedded-core On 17-02-17 13:10:56, Richard Purdie wrote: > On Fri, 2017-01-27 at 16:30 +0100, Patrick Ohly wrote: > > From: meta-luv <luv@lists.01.org> > > > > This is an unmodified copy of > > github.com/01org/luv-yocto/meta-luv/recipes-core/ovmf revision > > 4be4329. > > https://autobuilder.yocto.io/builders/nightly-world/builds/156 > > which boils down to: > > | "gcc-ar" cr /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootLogoLib/BootLogoLib/OUTPUT/BootLogoLib.lib @/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootLogoLib/BootLogoLib/OUTPUT/object_files.lst > | make: *** [/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootMaintenanceManagerUiLib/DEBUG/BootMaintenanceManager.c] Error 2 > | VfrCompile: ERROR 1003: Invalid option value > | VFR file name /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootMaintenanceManagerUiLib/OUTPUT/BootMaintenanceManager.i is too long. > | "gcc-ar" cr /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib/OUTPUT/NvVarsFileLib.lib @/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib/OUTPUT/object_files.lst > > i.e. path length issues. > > We saw this on multiple builds :(. I wonder why its using gcc-ar that should actually be <cross>-gcc-ar so probably we need to set AR to point to <cross>-gcc-ar, but I would like to see if we can use normal ar since gcc-ar would fail with clang ^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: [PATCH v5 03/12] ovmf: move from meta-luv to OE-core 2017-02-18 2:04 ` Khem Raj @ 2017-02-23 17:47 ` Patrick Ohly 2017-02-23 17:48 ` [PATCH 1/2] acpica: fix compilation with musl Patrick Ohly 0 siblings, 1 reply; 29+ messages in thread From: Patrick Ohly @ 2017-02-23 17:47 UTC (permalink / raw) To: Khem Raj, Neri, Ricardo; +Cc: openembedded-core On Fri, 2017-02-17 at 18:04 -0800, Khem Raj wrote: > On 17-02-17 13:10:56, Richard Purdie wrote: > > On Fri, 2017-01-27 at 16:30 +0100, Patrick Ohly wrote: > > > From: meta-luv <luv@lists.01.org> > > > > > > This is an unmodified copy of > > > github.com/01org/luv-yocto/meta-luv/recipes-core/ovmf revision > > > 4be4329. > > > > https://autobuilder.yocto.io/builders/nightly-world/builds/156 > > > > which boils down to: > > > > | "gcc-ar" cr /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootLogoLib/BootLogoLib/OUTPUT/BootLogoLib.lib @/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootLogoLib/BootLogoLib/OUTPUT/object_files.lst > > | make: *** [/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootMaintenanceManagerUiLib/DEBUG/BootMaintenanceManager.c] Error 2 > > | VfrCompile: ERROR 1003: Invalid option value > > | VFR file name /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootMaintenanceManagerUiLib/OUTPUT/BootMaintenanceManager.i is too long. > > | "gcc-ar" cr /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib/OUTPUT/NvVarsFileLib.lib @/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib/OUTPUT/object_files.lst > > > > i.e. path length issues. > > > > We saw this on multiple builds :(. > > I wonder why its using gcc-ar that should actually be <cross>-gcc-ar > so probably we need to set AR to point to <cross>-gcc-ar, but I would > like to see if we can use normal ar since gcc-ar would fail with clang The actual error wasn't in the gcc-ar invocation but rather the VfrCompile tool, so for now I haven't done anything about gcc-ar vs. ar. I have patches for the VfrCompile path length and the acpica+musl issue which I will send momentarily. Richard, Ross, they apply on top of the patches that I had sent earlier. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on the issue, nor am I authorized to speak on behalf of Intel on this matter. ^ permalink raw reply [flat|nested] 29+ messages in thread
* [PATCH 1/2] acpica: fix compilation with musl 2017-02-23 17:47 ` Patrick Ohly @ 2017-02-23 17:48 ` Patrick Ohly 2017-02-23 17:48 ` [PATCH 2/2] ovmf: increase path length limit Patrick Ohly 0 siblings, 1 reply; 29+ messages in thread From: Patrick Ohly @ 2017-02-23 17:48 UTC (permalink / raw) To: openembedded-core Manipulating stderr after freopen() fails as done by upstream does not work with musl. The replacement is Unix specific and uses open()/dup2(). Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- meta/recipes-extended/acpica/acpica_20150515.bb | 1 + .../files/manipulate-fds-instead-of-FILE.patch | 71 ++++++++++++++++++++++ 2 files changed, 72 insertions(+) create mode 100644 meta/recipes-extended/acpica/files/manipulate-fds-instead-of-FILE.patch diff --git a/meta/recipes-extended/acpica/acpica_20150515.bb b/meta/recipes-extended/acpica/acpica_20150515.bb index c23b491..b55f353 100644 --- a/meta/recipes-extended/acpica/acpica_20150515.bb +++ b/meta/recipes-extended/acpica/acpica_20150515.bb @@ -19,6 +19,7 @@ DEPENDS = "bison flex" SRC_URI = "https://acpica.org/sites/acpica/files/acpica-unix2-${PV}.tar.gz \ file://no-werror.patch \ file://rename-yy_scan_string-manually.patch \ + file://manipulate-fds-instead-of-FILE.patch \ " SRC_URI[md5sum] = "2bc4a7ccc82de9df9fa964f784ecb29c" SRC_URI[sha256sum] = "61204ec56d71bc9bfa2ee2ade4c66f7e8541772ac72ef8ccc20b3f339cc96374" diff --git a/meta/recipes-extended/acpica/files/manipulate-fds-instead-of-FILE.patch b/meta/recipes-extended/acpica/files/manipulate-fds-instead-of-FILE.patch new file mode 100644 index 0000000..6944bb7 --- /dev/null +++ b/meta/recipes-extended/acpica/files/manipulate-fds-instead-of-FILE.patch @@ -0,0 +1,71 @@ +From 33a57979738e5ab13950ec1c0e7298e41ef50929 Mon Sep 17 00:00:00 2001 +From: Patrick Ohly <patrick.ohly@intel.com> +Date: Thu, 23 Feb 2017 18:10:47 +0100 +Subject: [PATCH] aslfiles.c: manipulate fds instead of FILE + +Copying what stdout/stderr point to is not portable and fails with +musl because FILE is an undefined struct. + +Instead, use lower-level Unix functions to modify the file that stderr +writes into. This works on the platforms that Yocto targets. + +Upstream-Status: Inappropriate [embedded specific] + +Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> +--- + source/compiler/aslfiles.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/source/compiler/aslfiles.c b/source/compiler/aslfiles.c +index 947e465..7a352b4 100644 +--- a/source/compiler/aslfiles.c ++++ b/source/compiler/aslfiles.c +@@ -44,6 +44,11 @@ + #include "aslcompiler.h" + #include "acapps.h" + ++#include <sys/types.h> ++#include <sys/stat.h> ++#include <fcntl.h> ++#include <unistd.h> ++ + #define _COMPONENT ACPI_COMPILER + ACPI_MODULE_NAME ("aslfiles") + +@@ -569,6 +574,8 @@ FlOpenMiscOutputFiles ( + + if (Gbl_DebugFlag) + { ++ int fd; ++ + Filename = FlGenerateFilename (FilenamePrefix, FILE_SUFFIX_DEBUG); + if (!Filename) + { +@@ -582,20 +589,15 @@ FlOpenMiscOutputFiles ( + /* TBD: hide this behind a FlReopenFile function */ + + Gbl_Files[ASL_FILE_DEBUG_OUTPUT].Filename = Filename; +- Gbl_Files[ASL_FILE_DEBUG_OUTPUT].Handle = +- freopen (Filename, "w+t", stderr); +- +- if (!Gbl_Files[ASL_FILE_DEBUG_OUTPUT].Handle) ++ fd = open(Filename, O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH); ++ if (fd < 0 || ++ dup2(fd, fileno(stderr))) + { +- /* +- * A problem with freopen is that on error, +- * we no longer have stderr. +- */ + Gbl_DebugFlag = FALSE; +- memcpy (stderr, stdout, sizeof (FILE)); + FlFileError (ASL_FILE_DEBUG_OUTPUT, ASL_MSG_DEBUG_FILENAME); + AslAbort (); + } ++ Gbl_Files[ASL_FILE_DEBUG_OUTPUT].Handle = stderr; + + AslCompilerSignon (ASL_FILE_DEBUG_OUTPUT); + AslCompilerFileHeader (ASL_FILE_DEBUG_OUTPUT); +-- +2.1.4 + -- 2.1.4 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* [PATCH 2/2] ovmf: increase path length limit 2017-02-23 17:48 ` [PATCH 1/2] acpica: fix compilation with musl Patrick Ohly @ 2017-02-23 17:48 ` Patrick Ohly 2017-02-24 0:57 ` Patrick Ohly 0 siblings, 1 reply; 29+ messages in thread From: Patrick Ohly @ 2017-02-23 17:48 UTC (permalink / raw) To: openembedded-core The VfrCompile tool has a hard-coded maximum length for path names which turned out to be too small by around 20 characters in the Yocto autobuilder setup. Increasing the maximum by a factor of 4 is relatively easy and makes the problem less likely. Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- meta/recipes-core/ovmf/ovmf_git.bb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb index 6b3a597..76e836a 100644 --- a/meta/recipes-core/ovmf/ovmf_git.bb +++ b/meta/recipes-core/ovmf/ovmf_git.bb @@ -50,6 +50,11 @@ COMPATIBLE_HOST='(i.86|x86_64).*' OVMF_SECURE_BOOT_EXTRA_FLAGS ??= "" OVMF_SECURE_BOOT_FLAGS = "-DSECURE_BOOT_ENABLE=TRUE ${OVMF_SECURE_BOOT_EXTRA_FLAGS}" +do_patch[postfuncs] += "fix_path_len" +fix_path_len () { + sed -i -e 's/^#define MAX_PATH.*255/#define MAX_PATH 1023/' ${S}/BaseTools/Source/C/VfrCompile/EfiVfr.h +} + do_patch_append_class-native() { bb.build.exec_func('do_fix_iasl', d) bb.build.exec_func('do_fix_toolchain', d) -- 2.1.4 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* Re: [PATCH 2/2] ovmf: increase path length limit 2017-02-23 17:48 ` [PATCH 2/2] ovmf: increase path length limit Patrick Ohly @ 2017-02-24 0:57 ` Patrick Ohly 2017-02-24 0:58 ` [PATCH v2] " Patrick Ohly 0 siblings, 1 reply; 29+ messages in thread From: Patrick Ohly @ 2017-02-24 0:57 UTC (permalink / raw) To: openembedded-core On Thu, 2017-02-23 at 18:48 +0100, Patrick Ohly wrote: > The VfrCompile tool has a hard-coded maximum length for path names > which turned out to be too small by around 20 characters in the > Yocto autobuilder setup. Increasing the maximum by a factor of 4 > is relatively easy and makes the problem less likely. > > Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> > --- > meta/recipes-core/ovmf/ovmf_git.bb | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb > index 6b3a597..76e836a 100644 > --- a/meta/recipes-core/ovmf/ovmf_git.bb > +++ b/meta/recipes-core/ovmf/ovmf_git.bb > @@ -50,6 +50,11 @@ COMPATIBLE_HOST='(i.86|x86_64).*' > OVMF_SECURE_BOOT_EXTRA_FLAGS ??= "" > OVMF_SECURE_BOOT_FLAGS = "-DSECURE_BOOT_ENABLE=TRUE ${OVMF_SECURE_BOOT_EXTRA_FLAGS}" > > +do_patch[postfuncs] += "fix_path_len" > +fix_path_len () { > + sed -i -e 's/^#define MAX_PATH.*255/#define MAX_PATH 1023/' ${S}/BaseTools/Source/C/VfrCompile/EfiVfr.h > +} I've used sed here because it was easy. I'll also send a version which uses a proper patch. Just beware of the line encoding issues. The patch really must have CR line ends, otherwise it won't apply to the source. It might be safer to pull V2 of the ovmf patch from: https://github.com/pohly/openembedded-core/commits/ovmf -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on the issue, nor am I authorized to speak on behalf of Intel on this matter. ^ permalink raw reply [flat|nested] 29+ messages in thread
* [PATCH v2] ovmf: increase path length limit 2017-02-24 0:57 ` Patrick Ohly @ 2017-02-24 0:58 ` Patrick Ohly 0 siblings, 0 replies; 29+ messages in thread From: Patrick Ohly @ 2017-02-24 0:58 UTC (permalink / raw) To: openembedded-core The VfrCompile tool has a hard-coded maximum length for path names which turned out to be too small by around 20 characters in the Yocto autobuilder setup. Increasing the maximum by a factor of 4 is relatively easy and makes the problem less likely. Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- .../VfrCompile-increase-path-length-limit.patch | 33 ++++++++++++++++++++++ meta/recipes-core/ovmf/ovmf_git.bb | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta/recipes-core/ovmf/ovmf/VfrCompile-increase-path-length-limit.patch diff --git a/meta/recipes-core/ovmf/ovmf/VfrCompile-increase-path-length-limit.patch b/meta/recipes-core/ovmf/ovmf/VfrCompile-increase-path-length-limit.patch new file mode 100644 index 0000000..bb12d8b --- /dev/null +++ b/meta/recipes-core/ovmf/ovmf/VfrCompile-increase-path-length-limit.patch @@ -0,0 +1,33 @@ +From c7722d10c7bcf6be0adcf54abb1d406599dd7914 Mon Sep 17 00:00:00 2001 +From: Patrick Ohly <patrick.ohly@intel.com> +Date: Fri, 24 Feb 2017 01:40:02 +0100 +Subject: [PATCH] VfrCompile: increase path length limit + +The VfrCompile tool has a hard-coded maximum length for path names +which turned out to be too small by around 20 characters in the Yocto +autobuilder setup. Increasing the maximum by a factor of 4 is +relatively easy and makes the problem less likely. + +Upstream-Status: Inappropriate [configuration] + +Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> +--- + BaseTools/Source/C/VfrCompile/EfiVfr.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/BaseTools/Source/C/VfrCompile/EfiVfr.h b/BaseTools/Source/C/VfrCompile/EfiVfr.h +index d187902..9ad4a7b 100644 +--- a/BaseTools/Source/C/VfrCompile/EfiVfr.h ++++ b/BaseTools/Source/C/VfrCompile/EfiVfr.h +@@ -19,7 +19,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. + #include "Common/UefiInternalFormRepresentation.h" + #include "Common/MdeModuleHii.h" + +-#define MAX_PATH 255 ++#define MAX_PATH 1023 + #define MAX_VFR_LINE_LEN 4096 + + #define EFI_IFR_MAX_LENGTH 0xFF +-- +2.1.4 + diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb index 6b3a597..a658c9d 100644 --- a/meta/recipes-core/ovmf/ovmf_git.bb +++ b/meta/recipes-core/ovmf/ovmf_git.bb @@ -14,6 +14,7 @@ SRC_URI = "git://github.com/tianocore/edk2.git;branch=master \ file://0001-BaseTools-Force-tools-variables-to-host-toolchain.patch \ file://0002-ovmf-update-path-to-native-BaseTools.patch \ file://0003-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch \ + file://VfrCompile-increase-path-length-limit.patch \ " SRC_URI_append_class-target = " \ -- 2.1.4 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* Re: [PATCH v5 03/12] ovmf: move from meta-luv to OE-core 2017-02-17 21:10 ` Richard Purdie 2017-02-18 2:04 ` Khem Raj @ 2017-02-18 8:05 ` Patrick Ohly 1 sibling, 0 replies; 29+ messages in thread From: Patrick Ohly @ 2017-02-18 8:05 UTC (permalink / raw) To: Richard Purdie, Neri, Ricardo; +Cc: openembedded-core [-- Attachment #1: Type: text/plain, Size: 2188 bytes --] Hello Ricardo, another issue with the UEFI recipes. See also Khem's comment (attached). Bye, Patrick On Fri, 2017-02-17 at 13:10 -0800, Richard Purdie wrote: > On Fri, 2017-01-27 at 16:30 +0100, Patrick Ohly wrote: > > From: meta-luv <luv@lists.01.org> > > > > This is an unmodified copy of > > github.com/01org/luv-yocto/meta-luv/recipes-core/ovmf revision > > 4be4329. > > https://autobuilder.yocto.io/builders/nightly-world/builds/156 > > which boils down to: > > | "gcc-ar" cr /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootLogoLib/BootLogoLib/OUTPUT/BootLogoLib.lib @/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootLogoLib/BootLogoLib/OUTPUT/object_files.lst > | make: *** [/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootMaintenanceManagerUiLib/DEBUG/BootMaintenanceManager.c] Error 2 > | VfrCompile: ERROR 1003: Invalid option value > | VFR file name /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootMaintenanceManagerUiLib/OUTPUT/BootMaintenanceManager.i is too long. > | "gcc-ar" cr /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib/OUTPUT/NvVarsFileLib.lib @/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib/OUTPUT/object_files.lst > > i.e. path length issues. > > We saw this on multiple builds :(. > > Cheers, > > Richard [-- Attachment #2: Attached message - Re: [OE-core] [PATCH v5 03/12] ovmf: move from meta-luv to OE-core --] [-- Type: message/rfc822, Size: 9808 bytes --] From: Khem Raj <raj.khem@gmail.com> To: Richard Purdie <richard.purdie@linuxfoundation.org> Cc: Patrick Ohly <patrick.ohly@intel.com>, <openembedded-core@lists.openembedded.org> Subject: Re: [OE-core] [PATCH v5 03/12] ovmf: move from meta-luv to OE-core Date: Fri, 17 Feb 2017 18:04:40 -0800 Message-ID: <20170218020440.GB30443@haswell> On 17-02-17 13:10:56, Richard Purdie wrote: > On Fri, 2017-01-27 at 16:30 +0100, Patrick Ohly wrote: > > From: meta-luv <luv@lists.01.org> > > > > This is an unmodified copy of > > github.com/01org/luv-yocto/meta-luv/recipes-core/ovmf revision > > 4be4329. > > https://autobuilder.yocto.io/builders/nightly-world/builds/156 > > which boils down to: > > | "gcc-ar" cr /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootLogoLib/BootLogoLib/OUTPUT/BootLogoLib.lib @/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootLogoLib/BootLogoLib/OUTPUT/object_files.lst > | make: *** [/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootMaintenanceManagerUiLib/DEBUG/BootMaintenanceManager.c] Error 2 > | VfrCompile: ERROR 1003: Invalid option value > | VFR file name /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/MdeModulePkg/Library/BootMaintenanceManagerUiLib/BootMaintenanceManagerUiLib/OUTPUT/BootMaintenanceManager.i is too long. > | "gcc-ar" cr /home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib/OUTPUT/NvVarsFileLib.lib @/home/pokybuild/yocto-autobuilder/yocto-worker/nightly-world/build/build/tmp/work/x86-pokymllib32-linux/lib32-ovmf/git-r0/git/Build/OvmfIa32/RELEASE_GCC5/IA32/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib/OUTPUT/object_files.lst > > i.e. path length issues. > > We saw this on multiple builds :(. I wonder why its using gcc-ar that should actually be <cross>-gcc-ar so probably we need to set AR to point to <cross>-gcc-ar, but I would like to see if we can use normal ar since gcc-ar would fail with clang ^ permalink raw reply [flat|nested] 29+ messages in thread
* [PATCH v5 04/12] ovmf: explicitly depend on nasm-native 2017-01-27 15:30 [PATCH v5 00/12] UEFI + Secure Boot + qemu Patrick Ohly ` (2 preceding siblings ...) 2017-01-27 15:30 ` [PATCH v5 03/12] ovmf: move from meta-luv to OE-core Patrick Ohly @ 2017-01-27 15:30 ` Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 05/12] ovmf: deploy firmware in image directory Patrick Ohly ` (8 subsequent siblings) 12 siblings, 0 replies; 29+ messages in thread From: Patrick Ohly @ 2017-01-27 15:30 UTC (permalink / raw) To: openembedded-core Fixes a build issue when nasm was not build already because of something else. Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- meta/recipes-core/ovmf/ovmf_git.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb index e722db5..13b583b 100644 --- a/meta/recipes-core/ovmf/ovmf_git.bb +++ b/meta/recipes-core/ovmf/ovmf_git.bb @@ -20,6 +20,8 @@ DEPENDS_class-native="util-linux-native iasl-native ossp-uuid-native" DEPENDS_class-target="ovmf-native" +DEPENDS_append = " nasm-native" + EDK_TOOLS_DIR="edk2_basetools" # OVMF has trouble building with the default optimization of -O2. -- git-series 0.9.1 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* [PATCH v5 05/12] ovmf: deploy firmware in image directory 2017-01-27 15:30 [PATCH v5 00/12] UEFI + Secure Boot + qemu Patrick Ohly ` (3 preceding siblings ...) 2017-01-27 15:30 ` [PATCH v5 04/12] ovmf: explicitly depend on nasm-native Patrick Ohly @ 2017-01-27 15:30 ` Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 06/12] ovmf_git.bb: enable parallel compilation Patrick Ohly ` (7 subsequent siblings) 12 siblings, 0 replies; 29+ messages in thread From: Patrick Ohly @ 2017-01-27 15:30 UTC (permalink / raw) To: openembedded-core When used with '-drive if=pflash', qemu will store UEFI variables inside the firmware image file. That is unexpected for a file located in the sysroot, which should be read-only, while it is normal for image files in the deploy/images directory. Therefore that directory is a better place for use with runqemu. The name was chose so that "runqemu ovmf" can be used as shorthand for "runqemu <full path>/ovmf.qcow2" by treating "ovmf" as the base name of the firmware file. "ovmf.secboot.qcow2" is meant to be used for the Secure Boot enabled firmware. qcow2 is used because it is needed for "savevm" snapshots of a virtual machine. With code and variables stored in the same ovmf.qcow2 it is not possible to update the firmware code without also overwriting the variables. For users who care about persistent variables, the code and variables are also provided as separate files, in ovmf.code.qcow2 and ovmf.vars.qcow2. The traditional usage of OVMF via the qemu bios parameter ("biosdir" and/or "biosfilename" in runqemu) is no longer recommended, and therefore this recipe no longer provides the bios.bin file. Instead, OVMF is meant to be used as flash drive in qemu. See the "runqemu: support UEFI with OVMF firmware" patch for details on how to use OVMF that way. Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- meta/recipes-core/ovmf/ovmf_git.bb | 42 ++++++++++++++++++++++--------- 1 file changed, 31 insertions(+), 11 deletions(-) diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb index 13b583b..895ed6c 100644 --- a/meta/recipes-core/ovmf/ovmf_git.bb +++ b/meta/recipes-core/ovmf/ovmf_git.bb @@ -12,11 +12,13 @@ SRC_URI = "git://github.com/tianocore/edk2.git;branch=master \ SRCREV="4575a602ca6072ee9d04150b38bfb143cbff8588" +inherit deploy + PARALLEL_MAKE = "" S = "${WORKDIR}/git" -DEPENDS_class-native="util-linux-native iasl-native ossp-uuid-native" +DEPENDS_class-native="util-linux-native iasl-native ossp-uuid-native qemu-native" DEPENDS_class-target="ovmf-native" @@ -97,9 +99,22 @@ do_compile_class-target() { OVMF_ARCH="IA32" fi + # ${WORKDIR}/ovmf is a well-known location where do_install and + # do_deploy will be able to find the files. + rm -rf ${WORKDIR}/ovmf + mkdir ${WORKDIR}/ovmf + OVMF_DIR_SUFFIX="X64" + if [ "${TARGET_ARCH}" != "x86_64" ] ; then + OVMF_DIR_SUFFIX="Ia32" # Note the different capitalization + fi FIXED_GCCVER=$(fixup_target_tools ${GCC_VER}) - echo FIXED_GCCVER is ${FIXED_GCCVER} + bbnote FIXED_GCCVER is ${FIXED_GCCVER} + build_dir="${S}/Build/Ovmf$OVMF_DIR_SUFFIX/RELEASE_${FIXED_GCCVER}" + ${S}/OvmfPkg/build.sh -a $OVMF_ARCH -b RELEASE -t ${FIXED_GCCVER} + ln ${build_dir}/FV/OVMF.fd ${WORKDIR}/ovmf/ovmf.fd + ln ${build_dir}/FV/OVMF_CODE.fd ${WORKDIR}/ovmf/ovmf.code.fd + ln ${build_dir}/FV/OVMF_VARS.fd ${WORKDIR}/ovmf/ovmf.vars.fd } do_install_class-native() { @@ -108,16 +123,21 @@ do_install_class-native() { } do_install_class-target() { - OVMF_DIR_SUFFIX="X64" - if [ "${TARGET_ARCH}" != "x86_64" ] ; then - OVMF_DIR_SUFFIX="Ia32" # Note the different capitalization - fi - install -d ${D}${datadir}/ovmf +} - FIXED_GCCVER=$(fixup_target_tools ${GCC_VER}) - build_dir="${S}/Build/Ovmf$OVMF_DIR_SUFFIX/RELEASE_${FIXED_GCCVER}" - install -m 0755 ${build_dir}/FV/OVMF.fd \ - ${D}${datadir}/ovmf/bios.bin +do_deploy() { +} +do_deploy[cleandirs] = "${DEPLOYDIR}" +do_deploy_class-target() { + # For use with "runqemu ovmf". + for i in \ + ovmf \ + ovmf.code \ + ovmf.vars \ + ; do + qemu-img convert -f raw -O qcow2 ${WORKDIR}/ovmf/$i.fd ${DEPLOYDIR}/$i.qcow2 + done } +addtask do_deploy after do_compile before do_build BBCLASSEXTEND = "native" -- git-series 0.9.1 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* [PATCH v5 06/12] ovmf_git.bb: enable parallel compilation 2017-01-27 15:30 [PATCH v5 00/12] UEFI + Secure Boot + qemu Patrick Ohly ` (4 preceding siblings ...) 2017-01-27 15:30 ` [PATCH v5 05/12] ovmf: deploy firmware in image directory Patrick Ohly @ 2017-01-27 15:30 ` Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 07/12] ovmf_git.bb: enable Secure Boot Patrick Ohly ` (6 subsequent siblings) 12 siblings, 0 replies; 29+ messages in thread From: Patrick Ohly @ 2017-01-27 15:30 UTC (permalink / raw) To: openembedded-core The Fedora srpm [1] seems to have no problems with parallel compilation, so let's also use that for the target. The native tools however indeed have dependency problems: | test_Ecc_CParser (CheckPythonSyntax.Tests) ... gcc -o ../bin/EfiRom -L/fast/build/ostro/x86/tmp-glibc/sysroots/x86_64-linux/usr/lib -L/fast/build/ostro/x86/tmp-glibc/sysroots/x86_64-linux/lib -Wl,-rpath-link,/fast/build/ostro/x86/tmp-glibc/sysroots/x86_64-linux/usr/lib -Wl,-rpath-link,/fast/build/ostro/x86/tmp-glibc/sysroots/x86_64-linux/lib -Wl,-rpath,/fast/build/ostro/x86/tmp-glibc/sysroots/x86_64-linux/usr/lib -Wl,-rpath,/fast/build/ostro/x86/tmp-glibc/sysroots/x86_64-linux/lib -Wl,-O1 EfiRom.o -L../libs -lCommon | /usr/bin/ld: cannot find -lCommon | collect2: error: ld returned 1 exit status ERROR: Task (virtual:native:.../meta/recipes-core/ovmf/ovmf_git.bb:do_compile) failed with exit code '1' [1] https://src.fedoraproject.org/cgit/rpms/edk2.git/tree/edk2.spec Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- meta/recipes-core/ovmf/ovmf_git.bb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb index 895ed6c..9989025 100644 --- a/meta/recipes-core/ovmf/ovmf_git.bb +++ b/meta/recipes-core/ovmf/ovmf_git.bb @@ -14,7 +14,7 @@ SRCREV="4575a602ca6072ee9d04150b38bfb143cbff8588" inherit deploy -PARALLEL_MAKE = "" +PARALLEL_MAKE_class-native = "" S = "${WORKDIR}/git" @@ -94,6 +94,7 @@ do_compile_class-native() { do_compile_class-target() { export LFLAGS="${LDFLAGS}" + PARALLEL_JOBS="${@ '${PARALLEL_MAKE}'.replace('-j', '-n')}" OVMF_ARCH="X64" if [ "${TARGET_ARCH}" != "x86_64" ] ; then OVMF_ARCH="IA32" @@ -111,7 +112,7 @@ do_compile_class-target() { bbnote FIXED_GCCVER is ${FIXED_GCCVER} build_dir="${S}/Build/Ovmf$OVMF_DIR_SUFFIX/RELEASE_${FIXED_GCCVER}" - ${S}/OvmfPkg/build.sh -a $OVMF_ARCH -b RELEASE -t ${FIXED_GCCVER} + ${S}/OvmfPkg/build.sh $PARALLEL_JOBS -a $OVMF_ARCH -b RELEASE -t ${FIXED_GCCVER} ln ${build_dir}/FV/OVMF.fd ${WORKDIR}/ovmf/ovmf.fd ln ${build_dir}/FV/OVMF_CODE.fd ${WORKDIR}/ovmf/ovmf.code.fd ln ${build_dir}/FV/OVMF_VARS.fd ${WORKDIR}/ovmf/ovmf.vars.fd -- git-series 0.9.1 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* [PATCH v5 07/12] ovmf_git.bb: enable Secure Boot 2017-01-27 15:30 [PATCH v5 00/12] UEFI + Secure Boot + qemu Patrick Ohly ` (5 preceding siblings ...) 2017-01-27 15:30 ` [PATCH v5 06/12] ovmf_git.bb: enable parallel compilation Patrick Ohly @ 2017-01-27 15:30 ` Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 08/12] runqemu: fix undefined variable reference in check_arg_path() Patrick Ohly ` (5 subsequent siblings) 12 siblings, 0 replies; 29+ messages in thread From: Patrick Ohly @ 2017-01-27 15:30 UTC (permalink / raw) To: openembedded-core When enabled via PACCKAGECONFIG = "secureboot" (off by default because of the extra work and license change), the recipe compiles OVMF twice, once without Secure Boot, once with. This is the same approach as in https://src.fedoraproject.org/cgit/rpms/edk2.git/tree/edk2.spec The results are "ovmf.qcow2" and "ovmf.secboot.qcow2" in the image deploy directory, so runqemu <machine> <image> ovmf.secboot will boot with Secure Boot enabled. ovmf.secboot.code.qcow2 is provided for those who want separate code and variable flash drives. The normal ovmf.vars.qcow2 can be used with it. In contrast to Fedora, no attempt is made to strip potentially patent encumbered algorithms out of the OpenSSL archive. OVMF does not use the ones considered problematic for Fedora, so this shouldn't be a problem. Fixes: luv-yocto/#38 Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- meta/recipes-core/ovmf/ovmf_git.bb | 36 +++++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+) diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb index 9989025..bdec6aa 100644 --- a/meta/recipes-core/ovmf/ovmf_git.bb +++ b/meta/recipes-core/ovmf/ovmf_git.bb @@ -1,8 +1,15 @@ DESCRIPTION = "OVMF - UEFI firmware for Qemu and KVM" HOMEPAGE = "http://sourceforge.net/apps/mediawiki/tianocore/index.php?title=OVMF" LICENSE = "BSD" +LICENSE_class-target = "${@bb.utils.contains('PACKAGECONFIG', 'secureboot', 'BSD & OpenSSL', 'BSD', d)}" LIC_FILES_CHKSUM = "file://OvmfPkg/License.txt;md5=343dc88e82ff33d042074f62050c3496" +# Enabling Secure Boot adds a dependency on OpenSSL and implies +# compiling OVMF twice, so it is disabled by default. Distros +# may change that default. +PACKAGECONFIG ??= "" +PACKAGECONFIG[secureboot] = ",,," + SRC_URI = "git://github.com/tianocore/edk2.git;branch=master \ file://0001-BaseTools-Force-tools-variables-to-host-toolchain.patch \ file://0001-OvmfPkg-Enable-BGRT-in-OVMF.patch \ @@ -10,7 +17,13 @@ SRC_URI = "git://github.com/tianocore/edk2.git;branch=master \ file://0003-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch \ " +SRC_URI_append_class-target = " \ + ${@bb.utils.contains('PACKAGECONFIG', 'secureboot', 'http://www.openssl.org/source/openssl-1.0.2j.tar.gz;name=openssl;subdir=${S}/CryptoPkg/Library/OpensslLib', '', d)} \ +" + SRCREV="4575a602ca6072ee9d04150b38bfb143cbff8588" +SRC_URI[openssl.md5sum] = "96322138f0b69e61b7212bc53d5e912b" +SRC_URI[openssl.sha256sum] = "e7aff292be21c259c6af26469c7a9b3ba26e9abaaffd325e3dccc9785256c431" inherit deploy @@ -32,6 +45,11 @@ BUILD_OPTIMIZATION="-pipe" # OVMF supports IA only, although it could conceivably support ARM someday. COMPATIBLE_HOST='(i.86|x86_64).*' +# Additional build flags for OVMF with Secure Boot. +# Fedora also uses "-D SMM_REQUIRE -D EXCLUDE_SHELL_FROM_FD". +OVMF_SECURE_BOOT_EXTRA_FLAGS ??= "" +OVMF_SECURE_BOOT_FLAGS = "-DSECURE_BOOT_ENABLE=TRUE ${OVMF_SECURE_BOOT_EXTRA_FLAGS}" + do_patch_append_class-native() { bb.build.exec_func('do_fix_iasl', d) bb.build.exec_func('do_fix_toolchain', d) @@ -112,10 +130,27 @@ do_compile_class-target() { bbnote FIXED_GCCVER is ${FIXED_GCCVER} build_dir="${S}/Build/Ovmf$OVMF_DIR_SUFFIX/RELEASE_${FIXED_GCCVER}" + bbnote "Building without Secure Boot." + rm -rf ${S}/Build/Ovmf$OVMF_DIR_SUFFIX ${S}/OvmfPkg/build.sh $PARALLEL_JOBS -a $OVMF_ARCH -b RELEASE -t ${FIXED_GCCVER} ln ${build_dir}/FV/OVMF.fd ${WORKDIR}/ovmf/ovmf.fd ln ${build_dir}/FV/OVMF_CODE.fd ${WORKDIR}/ovmf/ovmf.code.fd ln ${build_dir}/FV/OVMF_VARS.fd ${WORKDIR}/ovmf/ovmf.vars.fd + + if ${@bb.utils.contains('PACKAGECONFIG', 'secureboot', 'true', 'false', d)}; then + # See CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt and + # https://src.fedoraproject.org/cgit/rpms/edk2.git/tree/ for + # building with Secure Boot enabled. + bbnote "Building with Secure Boot." + rm -rf ${S}/Build/Ovmf$OVMF_DIR_SUFFIX + if ! [ -f ${S}/CryptoPkg/Library/OpensslLib/openssl-*/edk2-patch-applied ]; then + ( cd ${S}/CryptoPkg/Library/OpensslLib/openssl-* && patch -p1 <$(echo ../EDKII_openssl-*.patch) && touch edk2-patch-applied ) + fi + ( cd ${S}/CryptoPkg/Library/OpensslLib/ && ./Install.sh ) + ${S}/OvmfPkg/build.sh $PARALLEL_JOBS -a $OVMF_ARCH -b RELEASE -t ${FIXED_GCCVER} ${OVMF_SECURE_BOOT_FLAGS} + ln ${build_dir}/FV/OVMF.fd ${WORKDIR}/ovmf/ovmf.secboot.fd + ln ${build_dir}/FV/OVMF_CODE.fd ${WORKDIR}/ovmf/ovmf.secboot.code.fd + fi } do_install_class-native() { @@ -135,6 +170,7 @@ do_deploy_class-target() { ovmf \ ovmf.code \ ovmf.vars \ + ${@bb.utils.contains('PACKAGECONFIG', 'secureboot', 'ovmf.secboot ovmf.secboot.code', '', d)} \ ; do qemu-img convert -f raw -O qcow2 ${WORKDIR}/ovmf/$i.fd ${DEPLOYDIR}/$i.qcow2 done -- git-series 0.9.1 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* [PATCH v5 08/12] runqemu: fix undefined variable reference in check_arg_path() 2017-01-27 15:30 [PATCH v5 00/12] UEFI + Secure Boot + qemu Patrick Ohly ` (6 preceding siblings ...) 2017-01-27 15:30 ` [PATCH v5 07/12] ovmf_git.bb: enable Secure Boot Patrick Ohly @ 2017-01-27 15:30 ` Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 09/12] runqemu: also accept -image suffix for rootfs parameter Patrick Ohly ` (4 subsequent siblings) 12 siblings, 0 replies; 29+ messages in thread From: Patrick Ohly @ 2017-01-27 15:30 UTC (permalink / raw) To: openembedded-core 'arg' isn't defined, the right name there is 'p'. This fixes a rather obscure error message when that code path ends up being taken: $ runqemu some/existing-file-name runqemu - ERROR - name 'arg' is not defined runqemu - ERROR - Try 'runqemu help' on how to use it Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- scripts/runqemu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/runqemu b/scripts/runqemu index 434b1c2..17d79e9 100755 --- a/scripts/runqemu +++ b/scripts/runqemu @@ -292,7 +292,7 @@ class BaseConfig(object): else: raise Exception("Can't find FSTYPE from: %s" % p) - elif os.path.isdir(p) or re.search(':', arg) and re.search('/', arg): + elif os.path.isdir(p) or re.search(':', p) and re.search('/', p): if self.is_deploy_dir_image(p): logger.info('DEPLOY_DIR_IMAGE: %s' % p) self.set("DEPLOY_DIR_IMAGE", p) -- git-series 0.9.1 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* [PATCH v5 09/12] runqemu: also accept -image suffix for rootfs parameter 2017-01-27 15:30 [PATCH v5 00/12] UEFI + Secure Boot + qemu Patrick Ohly ` (7 preceding siblings ...) 2017-01-27 15:30 ` [PATCH v5 08/12] runqemu: fix undefined variable reference in check_arg_path() Patrick Ohly @ 2017-01-27 15:30 ` Patrick Ohly 2017-01-27 16:54 ` Bystricky, Juro 2017-01-27 15:30 ` [PATCH v5 10/12] runqemu: support UEFI with OVMF firmware Patrick Ohly ` (3 subsequent siblings) 12 siblings, 1 reply; 29+ messages in thread From: Patrick Ohly @ 2017-01-27 15:30 UTC (permalink / raw) To: openembedded-core The magic detection of the rootfs parameter only worked for image recipes which embedd the "image" string in the middle, as in "core-image-minimal". Sometimes it is more natural to call an image "something-image". To get such an image detected by runqemu, "-image" at the end of a parameter must also cause that parameter to be treated as the rootfs parameter. Inside the image directory, "something-image" has an -<arch> suffix and thus no change is needed for those usages of re.search('-image-'). However, while at it also enhance those string searches a bit (no need for re; any()+map() a bit closer to the intended logic). Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- scripts/runqemu | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/runqemu b/scripts/runqemu index 17d79e9..4d7168c 100755 --- a/scripts/runqemu +++ b/scripts/runqemu @@ -218,7 +218,7 @@ class BaseConfig(object): if not re.search('.qemuboot.conf$', '\n'.join(os.listdir(p)), re.M): logger.info("Can't find required *.qemuboot.conf in %s" % p) return False - if not re.search('-image-', '\n'.join(os.listdir(p))): + if not any(map(lambda name: '-image-' in name, os.listdir(p))): logger.info("Can't find *-image-* in %s" % p) return False return True @@ -267,7 +267,7 @@ class BaseConfig(object): re.search('zImage', p) or re.search('vmlinux', p) or \ re.search('fitImage', p) or re.search('uImage', p): self.kernel = p - elif os.path.exists(p) and (not os.path.isdir(p)) and re.search('-image-', os.path.basename(p)): + elif os.path.exists(p) and (not os.path.isdir(p)) and '-image-' in os.path.basename(p): self.rootfs = p # Check filename against self.fstypes can hanlde <file>.cpio.gz, # otherwise, its type would be "gz", which is incorrect. @@ -381,7 +381,7 @@ class BaseConfig(object): self.kernel_cmdline_script += ' %s' % arg[len('bootparams='):] elif os.path.exists(arg) or (re.search(':', arg) and re.search('/', arg)): self.check_arg_path(os.path.abspath(arg)) - elif re.search('-image-', arg): + elif re.search(r'-image-|-image$', arg): # Lazy rootfs self.rootfs = arg else: -- git-series 0.9.1 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* Re: [PATCH v5 09/12] runqemu: also accept -image suffix for rootfs parameter 2017-01-27 15:30 ` [PATCH v5 09/12] runqemu: also accept -image suffix for rootfs parameter Patrick Ohly @ 2017-01-27 16:54 ` Bystricky, Juro 2017-01-27 19:22 ` Patrick Ohly 0 siblings, 1 reply; 29+ messages in thread From: Bystricky, Juro @ 2017-01-27 16:54 UTC (permalink / raw) To: Ohly, Patrick, openembedded-core Just curious: is this test for "image" in file name really necessary? With qemuboot.conf the relevant files are already spelled out. I don't see a need to force "compulsory" names for images. If I comment out this test, everything works just fine. Am I missing something? Juro ________________________________________ From: openembedded-core-bounces@lists.openembedded.org [openembedded-core-bounces@lists.openembedded.org] on behalf of Patrick Ohly [patrick.ohly@intel.com] Sent: Friday, January 27, 2017 7:30 AM To: openembedded-core@lists.openembedded.org Subject: [OE-core] [PATCH v5 09/12] runqemu: also accept -image suffix for rootfs parameter The magic detection of the rootfs parameter only worked for image recipes which embedd the "image" string in the middle, as in "core-image-minimal". Sometimes it is more natural to call an image "something-image". To get such an image detected by runqemu, "-image" at the end of a parameter must also cause that parameter to be treated as the rootfs parameter. Inside the image directory, "something-image" has an -<arch> suffix and thus no change is needed for those usages of re.search('-image-'). However, while at it also enhance those string searches a bit (no need for re; any()+map() a bit closer to the intended logic). Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- scripts/runqemu | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/runqemu b/scripts/runqemu index 17d79e9..4d7168c 100755 --- a/scripts/runqemu +++ b/scripts/runqemu @@ -218,7 +218,7 @@ class BaseConfig(object): if not re.search('.qemuboot.conf$', '\n'.join(os.listdir(p)), re.M): logger.info("Can't find required *.qemuboot.conf in %s" % p) return False - if not re.search('-image-', '\n'.join(os.listdir(p))): + if not any(map(lambda name: '-image-' in name, os.listdir(p))): logger.info("Can't find *-image-* in %s" % p) return False return True @@ -267,7 +267,7 @@ class BaseConfig(object): re.search('zImage', p) or re.search('vmlinux', p) or \ re.search('fitImage', p) or re.search('uImage', p): self.kernel = p - elif os.path.exists(p) and (not os.path.isdir(p)) and re.search('-image-', os.path.basename(p)): + elif os.path.exists(p) and (not os.path.isdir(p)) and '-image-' in os.path.basename(p): self.rootfs = p # Check filename against self.fstypes can hanlde <file>.cpio.gz, # otherwise, its type would be "gz", which is incorrect. @@ -381,7 +381,7 @@ class BaseConfig(object): self.kernel_cmdline_script += ' %s' % arg[len('bootparams='):] elif os.path.exists(arg) or (re.search(':', arg) and re.search('/', arg)): self.check_arg_path(os.path.abspath(arg)) - elif re.search('-image-', arg): + elif re.search(r'-image-|-image$', arg): # Lazy rootfs self.rootfs = arg else: -- git-series 0.9.1 -- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core ^ permalink raw reply related [flat|nested] 29+ messages in thread
* Re: [PATCH v5 09/12] runqemu: also accept -image suffix for rootfs parameter 2017-01-27 16:54 ` Bystricky, Juro @ 2017-01-27 19:22 ` Patrick Ohly 2017-01-30 17:12 ` Bystricky, Juro 0 siblings, 1 reply; 29+ messages in thread From: Patrick Ohly @ 2017-01-27 19:22 UTC (permalink / raw) To: Bystricky, Juro; +Cc: openembedded-core On Fri, 2017-01-27 at 16:54 +0000, Bystricky, Juro wrote: > Just curious: is this test for "image" in file name really necessary? > With qemuboot.conf the relevant files are already spelled out. > I don't see a need to force "compulsory" names for images. > If I comment out this test, everything works just fine. Am I missing something? Some of the usages when checking for paths might have become obsolete, but at least for distinguishing between machine and image base name parameters it is still relevant: def check_args(self): ... elif re.search(r'-image-|-image$', arg): # Lazy rootfs self.rootfs = arg elif arg.startswith('ovmf'): self.ovmf_bios.append(arg) else: # At last, assume is it the MACHINE if (not unknown_arg) or unknown_arg == arg: unknown_arg = arg else: raise Exception("Can't handle two unknown args: %s % s" % (unknown_arg, arg)) When removing the "if re.search(r'-image-|-image$', arg)" clause one gets an error for: $ runqemu core-image-minimal ext4 qemux86 runqemu - ERROR - Can't handle two unknown args: core-image-minimal qemux86 runqemu - ERROR - Try 'runqemu help' on how to use it -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on the issue, nor am I authorized to speak on behalf of Intel on this matter. ^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: [PATCH v5 09/12] runqemu: also accept -image suffix for rootfs parameter 2017-01-27 19:22 ` Patrick Ohly @ 2017-01-30 17:12 ` Bystricky, Juro 2017-01-30 19:10 ` Patrick Ohly 0 siblings, 1 reply; 29+ messages in thread From: Bystricky, Juro @ 2017-01-30 17:12 UTC (permalink / raw) To: Ohly, Patrick; +Cc: openembedded-core > -----Original Message----- > From: Patrick Ohly [mailto:patrick.ohly@intel.com] > Sent: Friday, January 27, 2017 11:22 AM > To: Bystricky, Juro <juro.bystricky@intel.com> > Cc: openembedded-core@lists.openembedded.org > Subject: Re: [OE-core] [PATCH v5 09/12] runqemu: also accept -image suffix > for rootfs parameter > > On Fri, 2017-01-27 at 16:54 +0000, Bystricky, Juro wrote: > > Just curious: is this test for "image" in file name really necessary? > > With qemuboot.conf the relevant files are already spelled out. > > I don't see a need to force "compulsory" names for images. > > If I comment out this test, everything works just fine. Am I missing > something? > > Some of the usages when checking for paths might have become obsolete, > but at least for distinguishing between machine and image base name > parameters it is still relevant: > > def check_args(self): > ... > elif re.search(r'-image-|-image$', arg): > # Lazy rootfs > self.rootfs = arg > elif arg.startswith('ovmf'): > self.ovmf_bios.append(arg) > else: > # At last, assume is it the MACHINE > if (not unknown_arg) or unknown_arg == arg: > unknown_arg = arg > else: > raise Exception("Can't handle two unknown args: %s % > s" % (unknown_arg, arg)) > > When removing the "if re.search(r'-image-|-image$', arg)" clause one > gets an error for: > > $ runqemu core-image-minimal ext4 qemux86 > runqemu - ERROR - Can't handle two unknown args: core-image-minimal qemux86 > runqemu - ERROR - Try 'runqemu help' on how to use it > I see, the purpose of this test is determine which argument is which, as they can be in any order. IMHO to differentiate between MACHINE and image it would make more sense to search for "qemu" instead of "-image-" or "-image" . (BTW do we need both -image- and -image$?) There is also ANOTHER test for '-image-', in "is_deploy_dir_image". This is the one I considered redundant (or not needed in case we have qemuboot.conf). > -- > Best Regards, Patrick Ohly > > The content of this message is my personal opinion only and although > I am an employee of Intel, the statements I make here in no way > represent Intel's position on the issue, nor am I authorized to speak > on behalf of Intel on this matter. > > ^ permalink raw reply [flat|nested] 29+ messages in thread
* Re: [PATCH v5 09/12] runqemu: also accept -image suffix for rootfs parameter 2017-01-30 17:12 ` Bystricky, Juro @ 2017-01-30 19:10 ` Patrick Ohly 0 siblings, 0 replies; 29+ messages in thread From: Patrick Ohly @ 2017-01-30 19:10 UTC (permalink / raw) To: Bystricky, Juro; +Cc: openembedded-core On Mon, 2017-01-30 at 17:12 +0000, Bystricky, Juro wrote: > > > -----Original Message----- > > From: Patrick Ohly [mailto:patrick.ohly@intel.com] > > Sent: Friday, January 27, 2017 11:22 AM > > To: Bystricky, Juro <juro.bystricky@intel.com> > > Cc: openembedded-core@lists.openembedded.org > > Subject: Re: [OE-core] [PATCH v5 09/12] runqemu: also accept -image suffix > > for rootfs parameter > > > > On Fri, 2017-01-27 at 16:54 +0000, Bystricky, Juro wrote: > > > Just curious: is this test for "image" in file name really necessary? > > > With qemuboot.conf the relevant files are already spelled out. > > > I don't see a need to force "compulsory" names for images. > > > If I comment out this test, everything works just fine. Am I missing > > something? > > > > Some of the usages when checking for paths might have become obsolete, > > but at least for distinguishing between machine and image base name > > parameters it is still relevant: > > > > def check_args(self): > > ... > > elif re.search(r'-image-|-image$', arg): > > # Lazy rootfs > > self.rootfs = arg > > elif arg.startswith('ovmf'): > > self.ovmf_bios.append(arg) > > else: > > # At last, assume is it the MACHINE > > if (not unknown_arg) or unknown_arg == arg: > > unknown_arg = arg > > else: > > raise Exception("Can't handle two unknown args: %s % > > s" % (unknown_arg, arg)) > > > > When removing the "if re.search(r'-image-|-image$', arg)" clause one > > gets an error for: > > > > $ runqemu core-image-minimal ext4 qemux86 > > runqemu - ERROR - Can't handle two unknown args: core-image-minimal qemux86 > > runqemu - ERROR - Try 'runqemu help' on how to use it > > > > I see, the purpose of this test is determine which argument is which, > as they can be in any order. IMHO to differentiate between MACHINE and image it would > make more sense to search for "qemu" instead of "-image-" or "-image" . The machine is not guaranteed to contain "qemu". I sent a patch to meta-intel which enables "runqemu core-image-minimal ext4 intel-corei7-64", and other BSPs might want to do the same. > (BTW do we need both -image- and -image$?) Yes, for "core-image-minimal" and "foobar-installer-image" (something that I am currently working on). > There is also ANOTHER test for '-image-', in "is_deploy_dir_image". > This is the one I considered redundant (or not needed in case we have qemuboot.conf). That might be true. I was trying to be conservative with this patch and thus extended all existing checks instead of trying to to figure out which one had become redundant. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on the issue, nor am I authorized to speak on behalf of Intel on this matter. ^ permalink raw reply [flat|nested] 29+ messages in thread
* [PATCH v5 10/12] runqemu: support UEFI with OVMF firmware 2017-01-27 15:30 [PATCH v5 00/12] UEFI + Secure Boot + qemu Patrick Ohly ` (8 preceding siblings ...) 2017-01-27 15:30 ` [PATCH v5 09/12] runqemu: also accept -image suffix for rootfs parameter Patrick Ohly @ 2017-01-27 15:30 ` Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 11/12] ovmf: build image which enrolls standard keys Patrick Ohly ` (2 subsequent siblings) 12 siblings, 0 replies; 29+ messages in thread From: Patrick Ohly @ 2017-01-27 15:30 UTC (permalink / raw) To: openembedded-core In the simplest case, "runqemu qemux86 <some-image> qcow2 ovmf" for an EFI-enabled image in the qcow2 format will locate the ovmf.qcow2 firmware file deployed by the ovmf recipe in the image deploy directory, override the graphics hardware with "-vga std" because that is all that OVMF supports, and boot with UEFI enabled. ovmf is not built by default. Either do it explicitly ("bitbake ovmf") or make it a part of the normal build ("MACHINE_ESSENTIAL_EXTRA_RDEPENDS_append = ' ovmf'"). The firmware file is activated as a flash drive instead of using the qemu BIOS parameters, because that is the recommended method (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=764918#47) as it allows storing UEFI variables in the file. Instead of just "ovmf", a full path to an existing file can also be used, just as with the rootfs. That may be useful when making a permanent copy of the virtual machine data files. It is possible to specify "ovmf*" parameters more than once, then each parameter creates a separate flash drive. This way it is possible to use separate flash drives for firmware code and variables: $ runqemu qemux86 <some-image> qcow2 ovmf.code ovmf.vars" Note that rebuilding ovmf will overwrite the ovmf.vars.qcow2 file in the image deploy directory. So when the goal is to update the firmware while keeping variables, make a copy of the variable file and use that: $ mkdir my-machine $ cp tmp/deploy/images/qemux86/ovmf.vars.qcow2 my-machine/ $ runqemu qemux86 <some-image> qcow2 ovmf.code my-machine/ovmf.vars.qcow2 When Secure Boot was enabled in ovmf, one can pick that instead of the non-Secure-Boot enabled ovmf.code: $ runqemu qemux86 <some-image> qcow2 ovmf.secboot.code my-machine/ovmf.vars.qcow2 Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- scripts/runqemu | 42 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/scripts/runqemu b/scripts/runqemu index 4d7168c..10947bb 100755 --- a/scripts/runqemu +++ b/scripts/runqemu @@ -74,6 +74,7 @@ of the following environment variables (in any order): kvm-vhost - enable KVM with vhost when running x86/x86_64 (VT-capable CPU required) publicvnc - enable a VNC server open to all hosts audio - enable audio + [*/]ovmf* - OVMF firmware file or base name for booting with UEFI tcpserial=<port> - specify tcp serial port number biosdir=<dir> - specify custom bios dir biosfilename=<filename> - specify bios filename @@ -162,6 +163,13 @@ class BaseConfig(object): self.clean_nfs_dir = False self.nfs_server = '' self.rootfs = '' + # File name(s) of a OVMF firmware file or variable store, + # to be added with -drive if=pflash. + # Found in the same places as the rootfs, with or without one of + # these suffices: qcow2, bin. + # Setting one also adds "-vga std" because that is all that + # OVMF supports. + self.ovmf_bios = [] self.qemuboot = '' self.qbconfload = False self.kernel = '' @@ -259,6 +267,7 @@ class BaseConfig(object): - Check whether is a kernel file - Check whether is a image file - Check whether it is a nfs dir + - Check whether it is a OVMF flash file """ if p.endswith('.qemuboot.conf'): self.qemuboot = p @@ -299,6 +308,8 @@ class BaseConfig(object): else: logger.info("Assuming %s is an nfs rootfs" % p) self.check_arg_nfs(p) + elif os.path.basename(p).startswith('ovmf'): + self.ovmf_bios.append(p) else: raise Exception("Unknown path arg %s" % p) @@ -384,6 +395,8 @@ class BaseConfig(object): elif re.search(r'-image-|-image$', arg): # Lazy rootfs self.rootfs = arg + elif arg.startswith('ovmf'): + self.ovmf_bios.append(arg) else: # At last, assume is it the MACHINE if (not unknown_arg) or unknown_arg == arg: @@ -482,6 +495,20 @@ class BaseConfig(object): if not os.path.exists(self.rootfs): raise Exception("Can't find rootfs: %s" % self.rootfs) + def check_ovmf(self): + """Check and set full path for OVMF firmware and variable file(s).""" + + for index, ovmf in enumerate(self.ovmf_bios): + if os.path.exists(ovmf): + continue + for suffix in ('qcow2', 'bin'): + path = '%s/%s.%s' % (self.get('DEPLOY_DIR_IMAGE'), ovmf, suffix) + if os.path.exists(path): + self.ovmf_bios[index] = path + break + else: + raise Exception("Can't find OVMF firmware: %s" % ovmf) + def check_kernel(self): """Check and set kernel, dtb""" # The vm image doesn't need a kernel @@ -576,6 +603,7 @@ class BaseConfig(object): self.check_kvm() self.check_fstype() self.check_rootfs() + self.check_ovmf() self.check_kernel() self.check_biosdir() self.check_mem() @@ -684,6 +712,8 @@ class BaseConfig(object): print('NFS_DIR: [%s]' % self.nfs_dir) else: print('ROOTFS: [%s]' % self.rootfs) + if self.ovmf_bios: + print('OVMF: %s' % self.ovmf_bios) print('CONFFILE: [%s]' % self.qemuboot) print('') @@ -943,7 +973,17 @@ class BaseConfig(object): check_libgl(qemu_bin) - self.qemu_opt = "%s %s %s %s %s" % (qemu_bin, self.get('NETWORK_CMD'), self.get('ROOTFS_OPTIONS'), self.get('QB_OPT_APPEND'), self.qemu_opt_script) + self.qemu_opt = "%s %s %s %s" % (qemu_bin, self.get('NETWORK_CMD'), self.get('ROOTFS_OPTIONS'), self.get('QB_OPT_APPEND')) + + for ovmf in self.ovmf_bios: + format = ovmf.rsplit('.', 1)[-1] + self.qemu_opt += ' -drive if=pflash,format=%s,file=%s' % (format, ovmf) + if self.ovmf_bios: + # OVMF only supports normal VGA, i.e. we need to override a -vga vmware + # that gets added for example for normal qemux86. + self.qemu_opt += ' -vga std' + + self.qemu_opt += ' ' + self.qemu_opt_script if self.snapshot: self.qemu_opt += " -snapshot" -- git-series 0.9.1 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* [PATCH v5 11/12] ovmf: build image which enrolls standard keys 2017-01-27 15:30 [PATCH v5 00/12] UEFI + Secure Boot + qemu Patrick Ohly ` (9 preceding siblings ...) 2017-01-27 15:30 ` [PATCH v5 10/12] runqemu: support UEFI with OVMF firmware Patrick Ohly @ 2017-01-27 15:30 ` Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 12/12] ovmf: remove BGRT patch Patrick Ohly 2017-01-27 15:53 ` ✗ patchtest: failure for UEFI + Secure Boot + qemu (rev6) Patchwork 12 siblings, 0 replies; 29+ messages in thread From: Patrick Ohly @ 2017-01-27 15:30 UTC (permalink / raw) To: openembedded-core When booting a qemu virtual machine with ovmf.secboot, it comes up with no keys installed and thus Secure Boot disabled. To lock down the machine like a typical PC, one has to enroll the same keys that PC vendors normally install, i.e. the ones from Microsoft. This can be done manually (see https://wiki.ubuntu.com/SecurityTeam/SecureBoot and https://github.com/tianocore-docs/Docs/raw/master/White_Papers/A_Tour_Beyond_BIOS_into_UEFI_Secure_Boot_White_Paper.pdf) or automatically with the EnrollDefaultKeys.efi helper from the Fedora ovmf rpm. To use this with qemu: $ bitbake ovmf-shell-image ... $ runqemu serial nographic qemux86 ovmf-shell-image wic ovmf.secboot ... UEFI Interactive Shell v2.1 EDK II UEFI v2.60 (EDK II, 0x00010000) Mapping table FS0: Alias(s):HD2b:;BLK4: PciRoot(0x0)/Pci(0x5,0x0)/HD(1,GPT,06AEF759-3982-4AF6-B517-70BA6304FC1C,0x800,0x566C) BLK0: Alias(s): PciRoot(0x0)/Pci(0x1,0x0)/Floppy(0x0) BLK1: Alias(s): PciRoot(0x0)/Pci(0x1,0x0)/Floppy(0x1) BLK2: Alias(s): PciRoot(0x0)/Pci(0x1,0x1)/Ata(0x0) BLK3: Alias(s): PciRoot(0x0)/Pci(0x5,0x0) Press ESC in 1 seconds to skip startup.nsh or any other key to continue. Shell> fs0:EnrollDefaultKeys.efi info: SetupMode=1 SecureBoot=0 SecureBootEnable=0 CustomMode=0 VendorKeys=1 info: SetupMode=0 SecureBoot=1 SecureBootEnable=1 CustomMode=0 VendorKeys=0 info: success Shell> reset Remember that this will modify deploy/images/qemux86/ovmf.secboot.qcow2, so make a copy and use the full path of that copy instead of the "ovmf" argument if needed. The ovmf-shell-image contains an EFI shell, which is what got started here directly. After enrolling the keys, Secure Boot is active and the same image cannot be booted anymore, so the BIOS goes through the normal boot targets (including network boot, which can take a while to time out), and ends up in the internal EFI shell. Trying to invoke bootia32.efi (the shell from the image) or EnrollDefaultKeys.efi then fails: Shell> bootia32.efi Command Error Status: Security Violation The main purpose at the moment is to test that Secure Boot enforcement really works. If we had a way to sign generated images, that part could also be tested by booting in a locked down qemu instance. 0007-OvmfPkg-EnrollDefaultKeys-application-for-enrolling-.patch is from https://src.fedoraproject.org/cgit/rpms/edk2.git/tree/0007-OvmfPkg-EnrollDefaultKeys-application-for-enrolling-.patch?id=b1781931894bf2057464e634beed68b1e3218c9e with one line changed to fix https://bugzilla.redhat.com/show_bug.cgi?id=132502: "EFI_STATUS Status = EFI_SUCCESS;" in EnrollListOfX509Certs() lacked the initializer. Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- meta/recipes-core/ovmf/ovmf-shell-image.bb | 17 +- meta/recipes-core/ovmf/ovmf/0007-OvmfPkg-EnrollDefaultKeys-application-for-enrolling-.patch | 1124 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++- meta/recipes-core/ovmf/ovmf/ovmf-shell-image.wks | 4 +- meta/recipes-core/ovmf/ovmf_git.bb | 22 +- 4 files changed, 1167 insertions(+) create mode 100644 meta/recipes-core/ovmf/ovmf-shell-image.bb create mode 100644 meta/recipes-core/ovmf/ovmf/0007-OvmfPkg-EnrollDefaultKeys-application-for-enrolling-.patch create mode 100644 meta/recipes-core/ovmf/ovmf/ovmf-shell-image.wks diff --git a/meta/recipes-core/ovmf/ovmf-shell-image.bb b/meta/recipes-core/ovmf/ovmf-shell-image.bb new file mode 100644 index 0000000..029547b --- /dev/null +++ b/meta/recipes-core/ovmf/ovmf-shell-image.bb @@ -0,0 +1,17 @@ +DESCRIPTION = "boot image with UEFI shell and tools" + +# For this image recipe, only the wic format with a +# single vfat partition makes sense. +IMAGE_FSTYPES_forcevariable = 'wic' + +WKS_FILE = "ovmf/ovmf-shell-image.wks" +inherit image + +# We want a minimal image with just ovmf-shell-efi unpacked in it. We +# avoid installing unnecessary stuff as much as possible, but some +# things still get through and need to be removed. +PACKAGE_INSTALL = "ovmf-shell-efi" +LINGUAS_INSTALL = "" +do_image () { + rm -rf `ls -d ${IMAGE_ROOTFS}/* | grep -v efi` +} diff --git a/meta/recipes-core/ovmf/ovmf/0007-OvmfPkg-EnrollDefaultKeys-application-for-enrolling-.patch b/meta/recipes-core/ovmf/ovmf/0007-OvmfPkg-EnrollDefaultKeys-application-for-enrolling-.patch new file mode 100644 index 0000000..3aa6cc4 --- /dev/null +++ b/meta/recipes-core/ovmf/ovmf/0007-OvmfPkg-EnrollDefaultKeys-application-for-enrolling-.patch @@ -0,0 +1,1124 @@ +From: Laszlo Ersek <lersek@redhat.com> +Date: Mon, 6 Jul 2015 20:22:02 +0200 +Subject: [PATCH] OvmfPkg: EnrollDefaultKeys: application for enrolling default + keys + +(A port of the <https://bugzilla.redhat.com/show_bug.cgi?id=1148296> patch +to Gerd's public RPMs.) + +This application is meant to be invoked by the management layer, after +booting the UEFI shell and getting a shell prompt on the serial console. +The app enrolls a number of certificates (see below), and then reports +status to the serial console as well. The expected output is "info: +success": + +> Shell> EnrollDefaultKeys.efi +> info: SetupMode=1 SecureBoot=0 SecureBootEnable=0 CustomMode=0 VendorKeys=1 +> info: SetupMode=0 SecureBoot=1 SecureBootEnable=1 CustomMode=0 VendorKeys=0 +> info: success +> Shell> + +In case of success, the management layer can force off or reboot the VM +(for example with the "reset -s" or "reset -c" UEFI shell commands, +respectively), and start the guest installation with SecureBoot enabled. + +PK: +- A unique, static, ad-hoc certificate whose private half has been + destroyed (more precisely, never saved) and is therefore unusable for + signing. (The command for creating this certificate is saved in the + source code.) + +KEK: +- same ad-hoc certificate as used for the PK, +- "Microsoft Corporation KEK CA 2011" -- the dbx data in Fedora's dbxtool + package is signed (indirectly, through a chain) with this; enrolling + such a KEK should allow guests to install those updates. + +DB: +- "Microsoft Windows Production PCA 2011" -- to load Windows 8 and Windows + Server 2012 R2, +- "Microsoft Corporation UEFI CA 2011" -- to load Linux and signed PCI + oproms. + +Contributed-under: TianoCore Contribution Agreement 1.0 +Signed-off-by: Laszlo Ersek <lersek@redhat.com> +Upstream-Status: Inappropriate [not author] +Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> +--- + OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c | 960 ++++++++++++++++++++++++ + OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf | 51 ++ + OvmfPkg/OvmfPkgIa32.dsc | 4 + + OvmfPkg/OvmfPkgIa32X64.dsc | 4 + + OvmfPkg/OvmfPkgX64.dsc | 4 + + 5 files changed, 1023 insertions(+) + create mode 100644 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c + create mode 100644 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf + +diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c +new file mode 100644 +index 0000000..081212b +--- /dev/null ++++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c +@@ -0,0 +1,960 @@ ++/** @file ++ Enroll default PK, KEK, DB. ++ ++ Copyright (C) 2014, Red Hat, Inc. ++ ++ This program and the accompanying materials are licensed and made available ++ under the terms and conditions of the BSD License which accompanies this ++ distribution. The full text of the license may be found at ++ http://opensource.org/licenses/bsd-license. ++ ++ THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, WITHOUT ++ WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. ++**/ ++#include <Guid/AuthenticatedVariableFormat.h> // gEfiCustomModeEnableGuid ++#include <Guid/GlobalVariable.h> // EFI_SETUP_MODE_NAME ++#include <Guid/ImageAuthentication.h> // EFI_IMAGE_SECURITY_DATABASE ++#include <Library/BaseMemoryLib.h> // CopyGuid() ++#include <Library/DebugLib.h> // ASSERT() ++#include <Library/MemoryAllocationLib.h> // FreePool() ++#include <Library/ShellCEntryLib.h> // ShellAppMain() ++#include <Library/UefiLib.h> // AsciiPrint() ++#include <Library/UefiRuntimeServicesTableLib.h> // gRT ++ ++// ++// The example self-signed certificate below, which we'll use for both Platform ++// Key, and first Key Exchange Key, has been generated with the following ++// non-interactive openssl command. The passphrase is read from /dev/urandom, ++// and not saved, and the private key is written to /dev/null. In other words, ++// we can't sign anything else against this certificate, which is our purpose. ++// ++/* ++ openssl req \ ++ -passout file:<(head -c 16 /dev/urandom) \ ++ -x509 \ ++ -newkey rsa:2048 \ ++ -keyout /dev/null \ ++ -outform DER \ ++ -subj $( ++ printf /C=US ++ printf /ST=TestStateOrProvince ++ printf /L=TestLocality ++ printf /O=TestOrganization ++ printf /OU=TestOrganizationalUnit ++ printf /CN=TestCommonName ++ printf /emailAddress=test@example.com ++ ) \ ++ 2>/dev/null \ ++ | xxd -i ++*/ ++STATIC CONST UINT8 ExampleCert[] = { ++ 0x30, 0x82, 0x04, 0x45, 0x30, 0x82, 0x03, 0x2d, 0xa0, 0x03, 0x02, 0x01, 0x02, ++ 0x02, 0x09, 0x00, 0xcf, 0x9f, 0x51, 0xa3, 0x07, 0xdb, 0x54, 0xa1, 0x30, 0x0d, ++ 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, ++ 0x30, 0x81, 0xb8, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, ++ 0x02, 0x55, 0x53, 0x31, 0x1c, 0x30, 0x1a, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, ++ 0x13, 0x54, 0x65, 0x73, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x4f, 0x72, 0x50, ++ 0x72, 0x6f, 0x76, 0x69, 0x6e, 0x63, 0x65, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, ++ 0x55, 0x04, 0x07, 0x0c, 0x0c, 0x54, 0x65, 0x73, 0x74, 0x4c, 0x6f, 0x63, 0x61, ++ 0x6c, 0x69, 0x74, 0x79, 0x31, 0x19, 0x30, 0x17, 0x06, 0x03, 0x55, 0x04, 0x0a, ++ 0x0c, 0x10, 0x54, 0x65, 0x73, 0x74, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, ++ 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x31, 0x1f, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x04, ++ 0x0b, 0x0c, 0x16, 0x54, 0x65, 0x73, 0x74, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, ++ 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x55, 0x6e, 0x69, 0x74, 0x31, ++ 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0e, 0x54, 0x65, 0x73, ++ 0x74, 0x43, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x31, 0x1f, ++ 0x30, 0x1d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01, ++ 0x16, 0x10, 0x74, 0x65, 0x73, 0x74, 0x40, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, ++ 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x34, 0x31, 0x30, ++ 0x30, 0x39, 0x31, 0x33, 0x32, 0x38, 0x32, 0x32, 0x5a, 0x17, 0x0d, 0x31, 0x34, ++ 0x31, 0x31, 0x30, 0x38, 0x31, 0x33, 0x32, 0x38, 0x32, 0x32, 0x5a, 0x30, 0x81, ++ 0xb8, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, ++ 0x53, 0x31, 0x1c, 0x30, 0x1a, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, 0x13, 0x54, ++ 0x65, 0x73, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x4f, 0x72, 0x50, 0x72, 0x6f, ++ 0x76, 0x69, 0x6e, 0x63, 0x65, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04, ++ 0x07, 0x0c, 0x0c, 0x54, 0x65, 0x73, 0x74, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x69, ++ 0x74, 0x79, 0x31, 0x19, 0x30, 0x17, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x10, ++ 0x54, 0x65, 0x73, 0x74, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, ++ 0x69, 0x6f, 0x6e, 0x31, 0x1f, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x0c, ++ 0x16, 0x54, 0x65, 0x73, 0x74, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, ++ 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x55, 0x6e, 0x69, 0x74, 0x31, 0x17, 0x30, ++ 0x15, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x0e, 0x54, 0x65, 0x73, 0x74, 0x43, ++ 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x31, 0x1f, 0x30, 0x1d, ++ 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x01, 0x16, 0x10, ++ 0x74, 0x65, 0x73, 0x74, 0x40, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2e, ++ 0x63, 0x6f, 0x6d, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, ++ 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, ++ 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xbf, 0xf1, 0xce, ++ 0x17, 0x32, 0xac, 0xc4, 0x4b, 0xb2, 0xed, 0x84, 0x76, 0xe5, 0xd0, 0xf8, 0x21, ++ 0xac, 0x10, 0xf8, 0x18, 0x09, 0x0e, 0x07, 0x13, 0x76, 0x21, 0x5c, 0xc4, 0xcc, ++ 0xd5, 0xe6, 0x25, 0xa7, 0x26, 0x53, 0x79, 0x2f, 0x16, 0x4b, 0x85, 0xbd, 0xae, ++ 0x42, 0x64, 0x58, 0xcb, 0x5e, 0xe8, 0x6e, 0x5a, 0xd0, 0xc4, 0x0f, 0x38, 0x16, ++ 0xbe, 0xd3, 0x22, 0xa7, 0x3c, 0x9b, 0x8b, 0x5e, 0xcb, 0x62, 0x35, 0xc5, 0x9b, ++ 0xe2, 0x8e, 0x4c, 0x65, 0x57, 0x4f, 0xcb, 0x27, 0xad, 0xe7, 0x63, 0xa7, 0x77, ++ 0x2b, 0xd5, 0x02, 0x42, 0x70, 0x46, 0xac, 0xba, 0xb6, 0x60, 0x57, 0xd9, 0xce, ++ 0x31, 0xc5, 0x12, 0x03, 0x4a, 0xf7, 0x2a, 0x2b, 0x40, 0x06, 0xb4, 0xdb, 0x31, ++ 0xb7, 0x83, 0x6c, 0x67, 0x87, 0x98, 0x8b, 0xce, 0x1b, 0x30, 0x7a, 0xfa, 0x35, ++ 0x6c, 0x86, 0x20, 0x74, 0xc5, 0x7d, 0x32, 0x31, 0x18, 0xeb, 0x69, 0xf7, 0x2d, ++ 0x20, 0xc4, 0xf0, 0xd2, 0xfa, 0x67, 0x81, 0xc1, 0xbb, 0x23, 0xbb, 0x75, 0x1a, ++ 0xe4, 0xb4, 0x49, 0x99, 0xdf, 0x12, 0x4c, 0xe3, 0x6d, 0x76, 0x24, 0x85, 0x24, ++ 0xae, 0x5a, 0x9e, 0xbd, 0x54, 0x1c, 0xf9, 0x0e, 0xed, 0x96, 0xb5, 0xd8, 0xa2, ++ 0x0d, 0x2a, 0x38, 0x5d, 0x12, 0x97, 0xb0, 0x4d, 0x75, 0x85, 0x1e, 0x47, 0x6d, ++ 0xe1, 0x25, 0x59, 0xcb, 0xe9, 0x33, 0x86, 0x6a, 0xef, 0x98, 0x24, 0xa0, 0x2b, ++ 0x02, 0x7b, 0xc0, 0x9f, 0x88, 0x03, 0xb0, 0xbe, 0x22, 0x65, 0x83, 0x77, 0xb3, ++ 0x30, 0xba, 0xe0, 0x3b, 0x54, 0x31, 0x3a, 0x45, 0x81, 0x9c, 0x48, 0xaf, 0xc1, ++ 0x11, 0x5b, 0xf2, 0x3a, 0x1e, 0x33, 0x1b, 0x8f, 0x0e, 0x04, 0xa4, 0x16, 0xd4, ++ 0x6b, 0x57, 0xee, 0xe7, 0xba, 0xf5, 0xee, 0xaf, 0xe2, 0x4c, 0x50, 0xf8, 0x68, ++ 0x57, 0x88, 0xfb, 0x7f, 0xa3, 0xcf, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x50, ++ 0x30, 0x4e, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, ++ 0x1e, 0x44, 0xe5, 0xef, 0xcd, 0x6e, 0x1f, 0xdb, 0xcb, 0x4f, 0x94, 0x8f, 0xe3, ++ 0x3b, 0x1a, 0x8c, 0xe6, 0x95, 0x29, 0x61, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, ++ 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x1e, 0x44, 0xe5, 0xef, 0xcd, 0x6e, ++ 0x1f, 0xdb, 0xcb, 0x4f, 0x94, 0x8f, 0xe3, 0x3b, 0x1a, 0x8c, 0xe6, 0x95, 0x29, ++ 0x61, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x04, 0x05, 0x30, 0x03, 0x01, ++ 0x01, 0xff, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, ++ 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x12, 0x9c, 0x3e, 0x38, ++ 0xfc, 0x26, 0xea, 0x6d, 0xb7, 0x5c, 0x29, 0x3c, 0x76, 0x20, 0x0c, 0xb2, 0xa9, ++ 0x0f, 0xdf, 0xc0, 0x85, 0xfe, 0xeb, 0xec, 0x1d, 0x5d, 0x73, 0x84, 0xac, 0x8a, ++ 0xb4, 0x2a, 0x86, 0x38, 0x30, 0xaf, 0xd2, 0x2d, 0x2a, 0xde, 0x54, 0xc8, 0x5c, ++ 0x29, 0x90, 0x24, 0xf2, 0x39, 0xc1, 0xa5, 0x00, 0xb4, 0xb7, 0xd8, 0xdc, 0x59, ++ 0x64, 0x50, 0x62, 0x5f, 0x54, 0xf1, 0x73, 0x02, 0x4d, 0x43, 0xc5, 0xc3, 0xc4, ++ 0x0e, 0x62, 0x60, 0x8c, 0x53, 0x66, 0x57, 0x77, 0xb5, 0x81, 0xda, 0x1f, 0x81, ++ 0xda, 0xe9, 0xd6, 0x5e, 0x82, 0xce, 0xa7, 0x5c, 0xc0, 0xa6, 0xbe, 0x9c, 0x5c, ++ 0x7b, 0xa5, 0x15, 0xc8, 0xd7, 0x14, 0x53, 0xd3, 0x5c, 0x1c, 0x9f, 0x8a, 0x9f, ++ 0x66, 0x15, 0xd5, 0xd3, 0x2a, 0x27, 0x0c, 0xee, 0x9f, 0x80, 0x39, 0x88, 0x7b, ++ 0x24, 0xde, 0x0c, 0x61, 0xa3, 0x44, 0xd8, 0x8d, 0x2e, 0x79, 0xf8, 0x1e, 0x04, ++ 0x5a, 0xcb, 0xd6, 0x9c, 0xa3, 0x22, 0x8f, 0x09, 0x32, 0x1e, 0xe1, 0x65, 0x8f, ++ 0x10, 0x5f, 0xd8, 0x52, 0x56, 0xd5, 0x77, 0xac, 0x58, 0x46, 0x60, 0xba, 0x2e, ++ 0xe2, 0x3f, 0x58, 0x7d, 0x60, 0xfc, 0x31, 0x4a, 0x3a, 0xaf, 0x61, 0x55, 0x5f, ++ 0xfb, 0x68, 0x14, 0x74, 0xda, 0xdc, 0x42, 0x78, 0xcc, 0xee, 0xff, 0x5c, 0x03, ++ 0x24, 0x26, 0x2c, 0xb8, 0x3a, 0x81, 0xad, 0xdb, 0xe7, 0xed, 0xe1, 0x62, 0x84, ++ 0x07, 0x1a, 0xc8, 0xa4, 0x4e, 0xb0, 0x87, 0xf7, 0x96, 0xd8, 0x33, 0x9b, 0x0d, ++ 0xa7, 0x77, 0xae, 0x5b, 0xaf, 0xad, 0xe6, 0x5a, 0xc9, 0xfa, 0xa4, 0xe4, 0xe5, ++ 0x57, 0xbb, 0x97, 0xdd, 0x92, 0x85, 0xd8, 0x03, 0x45, 0xfe, 0xd8, 0x6b, 0xb1, ++ 0xdb, 0x85, 0x36, 0xb9, 0xd9, 0x28, 0xbf, 0x17, 0xae, 0x11, 0xde, 0x10, 0x19, ++ 0x26, 0x5b, 0xc0, 0x3d, 0xc7 ++}; ++ ++// ++// Second KEK: "Microsoft Corporation KEK CA 2011". ++// SHA1: 31:59:0b:fd:89:c9:d7:4e:d0:87:df:ac:66:33:4b:39:31:25:4b:30 ++// ++// "dbx" updates in "dbxtool" are signed with a key derived from this KEK. ++// ++STATIC CONST UINT8 MicrosoftKEK[] = { ++ 0x30, 0x82, 0x05, 0xe8, 0x30, 0x82, 0x03, 0xd0, 0xa0, 0x03, 0x02, 0x01, 0x02, ++ 0x02, 0x0a, 0x61, 0x0a, 0xd1, 0x88, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x30, ++ 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, ++ 0x00, 0x30, 0x81, 0x91, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, ++ 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, ++ 0x13, 0x0a, 0x57, 0x61, 0x73, 0x68, 0x69, 0x6e, 0x67, 0x74, 0x6f, 0x6e, 0x31, ++ 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x07, 0x52, 0x65, 0x64, ++ 0x6d, 0x6f, 0x6e, 0x64, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, ++ 0x13, 0x15, 0x4d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, 0x20, 0x43, ++ 0x6f, 0x72, 0x70, 0x6f, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x31, 0x3b, 0x30, ++ 0x39, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x32, 0x4d, 0x69, 0x63, 0x72, 0x6f, ++ 0x73, 0x6f, 0x66, 0x74, 0x20, 0x43, 0x6f, 0x72, 0x70, 0x6f, 0x72, 0x61, 0x74, ++ 0x69, 0x6f, 0x6e, 0x20, 0x54, 0x68, 0x69, 0x72, 0x64, 0x20, 0x50, 0x61, 0x72, ++ 0x74, 0x79, 0x20, 0x4d, 0x61, 0x72, 0x6b, 0x65, 0x74, 0x70, 0x6c, 0x61, 0x63, ++ 0x65, 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x31, 0x30, ++ 0x36, 0x32, 0x34, 0x32, 0x30, 0x34, 0x31, 0x32, 0x39, 0x5a, 0x17, 0x0d, 0x32, ++ 0x36, 0x30, 0x36, 0x32, 0x34, 0x32, 0x30, 0x35, 0x31, 0x32, 0x39, 0x5a, 0x30, ++ 0x81, 0x80, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, ++ 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x0a, ++ 0x57, 0x61, 0x73, 0x68, 0x69, 0x6e, 0x67, 0x74, 0x6f, 0x6e, 0x31, 0x10, 0x30, ++ 0x0e, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x07, 0x52, 0x65, 0x64, 0x6d, 0x6f, ++ 0x6e, 0x64, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x15, ++ 0x4d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, 0x20, 0x43, 0x6f, 0x72, ++ 0x70, 0x6f, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x31, 0x2a, 0x30, 0x28, 0x06, ++ 0x03, 0x55, 0x04, 0x03, 0x13, 0x21, 0x4d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, ++ 0x66, 0x74, 0x20, 0x43, 0x6f, 0x72, 0x70, 0x6f, 0x72, 0x61, 0x74, 0x69, 0x6f, ++ 0x6e, 0x20, 0x4b, 0x45, 0x4b, 0x20, 0x43, 0x41, 0x20, 0x32, 0x30, 0x31, 0x31, ++ 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, ++ 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, ++ 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xc4, 0xe8, 0xb5, 0x8a, 0xbf, 0xad, ++ 0x57, 0x26, 0xb0, 0x26, 0xc3, 0xea, 0xe7, 0xfb, 0x57, 0x7a, 0x44, 0x02, 0x5d, ++ 0x07, 0x0d, 0xda, 0x4a, 0xe5, 0x74, 0x2a, 0xe6, 0xb0, 0x0f, 0xec, 0x6d, 0xeb, ++ 0xec, 0x7f, 0xb9, 0xe3, 0x5a, 0x63, 0x32, 0x7c, 0x11, 0x17, 0x4f, 0x0e, 0xe3, ++ 0x0b, 0xa7, 0x38, 0x15, 0x93, 0x8e, 0xc6, 0xf5, 0xe0, 0x84, 0xb1, 0x9a, 0x9b, ++ 0x2c, 0xe7, 0xf5, 0xb7, 0x91, 0xd6, 0x09, 0xe1, 0xe2, 0xc0, 0x04, 0xa8, 0xac, ++ 0x30, 0x1c, 0xdf, 0x48, 0xf3, 0x06, 0x50, 0x9a, 0x64, 0xa7, 0x51, 0x7f, 0xc8, ++ 0x85, 0x4f, 0x8f, 0x20, 0x86, 0xce, 0xfe, 0x2f, 0xe1, 0x9f, 0xff, 0x82, 0xc0, ++ 0xed, 0xe9, 0xcd, 0xce, 0xf4, 0x53, 0x6a, 0x62, 0x3a, 0x0b, 0x43, 0xb9, 0xe2, ++ 0x25, 0xfd, 0xfe, 0x05, 0xf9, 0xd4, 0xc4, 0x14, 0xab, 0x11, 0xe2, 0x23, 0x89, ++ 0x8d, 0x70, 0xb7, 0xa4, 0x1d, 0x4d, 0xec, 0xae, 0xe5, 0x9c, 0xfa, 0x16, 0xc2, ++ 0xd7, 0xc1, 0xcb, 0xd4, 0xe8, 0xc4, 0x2f, 0xe5, 0x99, 0xee, 0x24, 0x8b, 0x03, ++ 0xec, 0x8d, 0xf2, 0x8b, 0xea, 0xc3, 0x4a, 0xfb, 0x43, 0x11, 0x12, 0x0b, 0x7e, ++ 0xb5, 0x47, 0x92, 0x6c, 0xdc, 0xe6, 0x04, 0x89, 0xeb, 0xf5, 0x33, 0x04, 0xeb, ++ 0x10, 0x01, 0x2a, 0x71, 0xe5, 0xf9, 0x83, 0x13, 0x3c, 0xff, 0x25, 0x09, 0x2f, ++ 0x68, 0x76, 0x46, 0xff, 0xba, 0x4f, 0xbe, 0xdc, 0xad, 0x71, 0x2a, 0x58, 0xaa, ++ 0xfb, 0x0e, 0xd2, 0x79, 0x3d, 0xe4, 0x9b, 0x65, 0x3b, 0xcc, 0x29, 0x2a, 0x9f, ++ 0xfc, 0x72, 0x59, 0xa2, 0xeb, 0xae, 0x92, 0xef, 0xf6, 0x35, 0x13, 0x80, 0xc6, ++ 0x02, 0xec, 0xe4, 0x5f, 0xcc, 0x9d, 0x76, 0xcd, 0xef, 0x63, 0x92, 0xc1, 0xaf, ++ 0x79, 0x40, 0x84, 0x79, 0x87, 0x7f, 0xe3, 0x52, 0xa8, 0xe8, 0x9d, 0x7b, 0x07, ++ 0x69, 0x8f, 0x15, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01, 0x4f, 0x30, ++ 0x82, 0x01, 0x4b, 0x30, 0x10, 0x06, 0x09, 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, ++ 0x37, 0x15, 0x01, 0x04, 0x03, 0x02, 0x01, 0x00, 0x30, 0x1d, 0x06, 0x03, 0x55, ++ 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0x62, 0xfc, 0x43, 0xcd, 0xa0, 0x3e, 0xa4, ++ 0xcb, 0x67, 0x12, 0xd2, 0x5b, 0xd9, 0x55, 0xac, 0x7b, 0xcc, 0xb6, 0x8a, 0x5f, ++ 0x30, 0x19, 0x06, 0x09, 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x14, 0x02, ++ 0x04, 0x0c, 0x1e, 0x0a, 0x00, 0x53, 0x00, 0x75, 0x00, 0x62, 0x00, 0x43, 0x00, ++ 0x41, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x04, 0x04, 0x03, 0x02, 0x01, ++ 0x86, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x05, ++ 0x30, 0x03, 0x01, 0x01, 0xff, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, ++ 0x18, 0x30, 0x16, 0x80, 0x14, 0x45, 0x66, 0x52, 0x43, 0xe1, 0x7e, 0x58, 0x11, ++ 0xbf, 0xd6, 0x4e, 0x9e, 0x23, 0x55, 0x08, 0x3b, 0x3a, 0x22, 0x6a, 0xa8, 0x30, ++ 0x5c, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x55, 0x30, 0x53, 0x30, 0x51, 0xa0, ++ 0x4f, 0xa0, 0x4d, 0x86, 0x4b, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, ++ 0x72, 0x6c, 0x2e, 0x6d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, 0x2e, ++ 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x6b, 0x69, 0x2f, 0x63, 0x72, 0x6c, 0x2f, 0x70, ++ 0x72, 0x6f, 0x64, 0x75, 0x63, 0x74, 0x73, 0x2f, 0x4d, 0x69, 0x63, 0x43, 0x6f, ++ 0x72, 0x54, 0x68, 0x69, 0x50, 0x61, 0x72, 0x4d, 0x61, 0x72, 0x52, 0x6f, 0x6f, ++ 0x5f, 0x32, 0x30, 0x31, 0x30, 0x2d, 0x31, 0x30, 0x2d, 0x30, 0x35, 0x2e, 0x63, ++ 0x72, 0x6c, 0x30, 0x60, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, ++ 0x01, 0x04, 0x54, 0x30, 0x52, 0x30, 0x50, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, ++ 0x05, 0x07, 0x30, 0x02, 0x86, 0x44, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, ++ 0x77, 0x77, 0x77, 0x2e, 0x6d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, ++ 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x6b, 0x69, 0x2f, 0x63, 0x65, 0x72, 0x74, ++ 0x73, 0x2f, 0x4d, 0x69, 0x63, 0x43, 0x6f, 0x72, 0x54, 0x68, 0x69, 0x50, 0x61, ++ 0x72, 0x4d, 0x61, 0x72, 0x52, 0x6f, 0x6f, 0x5f, 0x32, 0x30, 0x31, 0x30, 0x2d, ++ 0x31, 0x30, 0x2d, 0x30, 0x35, 0x2e, 0x63, 0x72, 0x74, 0x30, 0x0d, 0x06, 0x09, ++ 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, ++ 0x02, 0x01, 0x00, 0xd4, 0x84, 0x88, 0xf5, 0x14, 0x94, 0x18, 0x02, 0xca, 0x2a, ++ 0x3c, 0xfb, 0x2a, 0x92, 0x1c, 0x0c, 0xd7, 0xa0, 0xd1, 0xf1, 0xe8, 0x52, 0x66, ++ 0xa8, 0xee, 0xa2, 0xb5, 0x75, 0x7a, 0x90, 0x00, 0xaa, 0x2d, 0xa4, 0x76, 0x5a, ++ 0xea, 0x79, 0xb7, 0xb9, 0x37, 0x6a, 0x51, 0x7b, 0x10, 0x64, 0xf6, 0xe1, 0x64, ++ 0xf2, 0x02, 0x67, 0xbe, 0xf7, 0xa8, 0x1b, 0x78, 0xbd, 0xba, 0xce, 0x88, 0x58, ++ 0x64, 0x0c, 0xd6, 0x57, 0xc8, 0x19, 0xa3, 0x5f, 0x05, 0xd6, 0xdb, 0xc6, 0xd0, ++ 0x69, 0xce, 0x48, 0x4b, 0x32, 0xb7, 0xeb, 0x5d, 0xd2, 0x30, 0xf5, 0xc0, 0xf5, ++ 0xb8, 0xba, 0x78, 0x07, 0xa3, 0x2b, 0xfe, 0x9b, 0xdb, 0x34, 0x56, 0x84, 0xec, ++ 0x82, 0xca, 0xae, 0x41, 0x25, 0x70, 0x9c, 0x6b, 0xe9, 0xfe, 0x90, 0x0f, 0xd7, ++ 0x96, 0x1f, 0xe5, 0xe7, 0x94, 0x1f, 0xb2, 0x2a, 0x0c, 0x8d, 0x4b, 0xff, 0x28, ++ 0x29, 0x10, 0x7b, 0xf7, 0xd7, 0x7c, 0xa5, 0xd1, 0x76, 0xb9, 0x05, 0xc8, 0x79, ++ 0xed, 0x0f, 0x90, 0x92, 0x9c, 0xc2, 0xfe, 0xdf, 0x6f, 0x7e, 0x6c, 0x0f, 0x7b, ++ 0xd4, 0xc1, 0x45, 0xdd, 0x34, 0x51, 0x96, 0x39, 0x0f, 0xe5, 0x5e, 0x56, 0xd8, ++ 0x18, 0x05, 0x96, 0xf4, 0x07, 0xa6, 0x42, 0xb3, 0xa0, 0x77, 0xfd, 0x08, 0x19, ++ 0xf2, 0x71, 0x56, 0xcc, 0x9f, 0x86, 0x23, 0xa4, 0x87, 0xcb, 0xa6, 0xfd, 0x58, ++ 0x7e, 0xd4, 0x69, 0x67, 0x15, 0x91, 0x7e, 0x81, 0xf2, 0x7f, 0x13, 0xe5, 0x0d, ++ 0x8b, 0x8a, 0x3c, 0x87, 0x84, 0xeb, 0xe3, 0xce, 0xbd, 0x43, 0xe5, 0xad, 0x2d, ++ 0x84, 0x93, 0x8e, 0x6a, 0x2b, 0x5a, 0x7c, 0x44, 0xfa, 0x52, 0xaa, 0x81, 0xc8, ++ 0x2d, 0x1c, 0xbb, 0xe0, 0x52, 0xdf, 0x00, 0x11, 0xf8, 0x9a, 0x3d, 0xc1, 0x60, ++ 0xb0, 0xe1, 0x33, 0xb5, 0xa3, 0x88, 0xd1, 0x65, 0x19, 0x0a, 0x1a, 0xe7, 0xac, ++ 0x7c, 0xa4, 0xc1, 0x82, 0x87, 0x4e, 0x38, 0xb1, 0x2f, 0x0d, 0xc5, 0x14, 0x87, ++ 0x6f, 0xfd, 0x8d, 0x2e, 0xbc, 0x39, 0xb6, 0xe7, 0xe6, 0xc3, 0xe0, 0xe4, 0xcd, ++ 0x27, 0x84, 0xef, 0x94, 0x42, 0xef, 0x29, 0x8b, 0x90, 0x46, 0x41, 0x3b, 0x81, ++ 0x1b, 0x67, 0xd8, 0xf9, 0x43, 0x59, 0x65, 0xcb, 0x0d, 0xbc, 0xfd, 0x00, 0x92, ++ 0x4f, 0xf4, 0x75, 0x3b, 0xa7, 0xa9, 0x24, 0xfc, 0x50, 0x41, 0x40, 0x79, 0xe0, ++ 0x2d, 0x4f, 0x0a, 0x6a, 0x27, 0x76, 0x6e, 0x52, 0xed, 0x96, 0x69, 0x7b, 0xaf, ++ 0x0f, 0xf7, 0x87, 0x05, 0xd0, 0x45, 0xc2, 0xad, 0x53, 0x14, 0x81, 0x1f, 0xfb, ++ 0x30, 0x04, 0xaa, 0x37, 0x36, 0x61, 0xda, 0x4a, 0x69, 0x1b, 0x34, 0xd8, 0x68, ++ 0xed, 0xd6, 0x02, 0xcf, 0x6c, 0x94, 0x0c, 0xd3, 0xcf, 0x6c, 0x22, 0x79, 0xad, ++ 0xb1, 0xf0, 0xbc, 0x03, 0xa2, 0x46, 0x60, 0xa9, 0xc4, 0x07, 0xc2, 0x21, 0x82, ++ 0xf1, 0xfd, 0xf2, 0xe8, 0x79, 0x32, 0x60, 0xbf, 0xd8, 0xac, 0xa5, 0x22, 0x14, ++ 0x4b, 0xca, 0xc1, 0xd8, 0x4b, 0xeb, 0x7d, 0x3f, 0x57, 0x35, 0xb2, 0xe6, 0x4f, ++ 0x75, 0xb4, 0xb0, 0x60, 0x03, 0x22, 0x53, 0xae, 0x91, 0x79, 0x1d, 0xd6, 0x9b, ++ 0x41, 0x1f, 0x15, 0x86, 0x54, 0x70, 0xb2, 0xde, 0x0d, 0x35, 0x0f, 0x7c, 0xb0, ++ 0x34, 0x72, 0xba, 0x97, 0x60, 0x3b, 0xf0, 0x79, 0xeb, 0xa2, 0xb2, 0x1c, 0x5d, ++ 0xa2, 0x16, 0xb8, 0x87, 0xc5, 0xe9, 0x1b, 0xf6, 0xb5, 0x97, 0x25, 0x6f, 0x38, ++ 0x9f, 0xe3, 0x91, 0xfa, 0x8a, 0x79, 0x98, 0xc3, 0x69, 0x0e, 0xb7, 0xa3, 0x1c, ++ 0x20, 0x05, 0x97, 0xf8, 0xca, 0x14, 0xae, 0x00, 0xd7, 0xc4, 0xf3, 0xc0, 0x14, ++ 0x10, 0x75, 0x6b, 0x34, 0xa0, 0x1b, 0xb5, 0x99, 0x60, 0xf3, 0x5c, 0xb0, 0xc5, ++ 0x57, 0x4e, 0x36, 0xd2, 0x32, 0x84, 0xbf, 0x9e ++}; ++ ++// ++// First DB entry: "Microsoft Windows Production PCA 2011" ++// SHA1: 58:0a:6f:4c:c4:e4:b6:69:b9:eb:dc:1b:2b:3e:08:7b:80:d0:67:8d ++// ++// Windows 8 and Windows Server 2012 R2 boot loaders are signed with a chain ++// rooted in this certificate. ++// ++STATIC CONST UINT8 MicrosoftPCA[] = { ++ 0x30, 0x82, 0x05, 0xd7, 0x30, 0x82, 0x03, 0xbf, 0xa0, 0x03, 0x02, 0x01, 0x02, ++ 0x02, 0x0a, 0x61, 0x07, 0x76, 0x56, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x30, ++ 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, ++ 0x00, 0x30, 0x81, 0x88, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, ++ 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, ++ 0x13, 0x0a, 0x57, 0x61, 0x73, 0x68, 0x69, 0x6e, 0x67, 0x74, 0x6f, 0x6e, 0x31, ++ 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x07, 0x52, 0x65, 0x64, ++ 0x6d, 0x6f, 0x6e, 0x64, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, ++ 0x13, 0x15, 0x4d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, 0x20, 0x43, ++ 0x6f, 0x72, 0x70, 0x6f, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x31, 0x32, 0x30, ++ 0x30, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x29, 0x4d, 0x69, 0x63, 0x72, 0x6f, ++ 0x73, 0x6f, 0x66, 0x74, 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x65, 0x72, ++ 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x41, 0x75, 0x74, 0x68, ++ 0x6f, 0x72, 0x69, 0x74, 0x79, 0x20, 0x32, 0x30, 0x31, 0x30, 0x30, 0x1e, 0x17, ++ 0x0d, 0x31, 0x31, 0x31, 0x30, 0x31, 0x39, 0x31, 0x38, 0x34, 0x31, 0x34, 0x32, ++ 0x5a, 0x17, 0x0d, 0x32, 0x36, 0x31, 0x30, 0x31, 0x39, 0x31, 0x38, 0x35, 0x31, ++ 0x34, 0x32, 0x5a, 0x30, 0x81, 0x84, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, ++ 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, ++ 0x04, 0x08, 0x13, 0x0a, 0x57, 0x61, 0x73, 0x68, 0x69, 0x6e, 0x67, 0x74, 0x6f, ++ 0x6e, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x07, 0x52, ++ 0x65, 0x64, 0x6d, 0x6f, 0x6e, 0x64, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, ++ 0x04, 0x0a, 0x13, 0x15, 0x4d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, ++ 0x20, 0x43, 0x6f, 0x72, 0x70, 0x6f, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x31, ++ 0x2e, 0x30, 0x2c, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x25, 0x4d, 0x69, 0x63, ++ 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, 0x20, 0x57, 0x69, 0x6e, 0x64, 0x6f, 0x77, ++ 0x73, 0x20, 0x50, 0x72, 0x6f, 0x64, 0x75, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, ++ 0x50, 0x43, 0x41, 0x20, 0x32, 0x30, 0x31, 0x31, 0x30, 0x82, 0x01, 0x22, 0x30, ++ 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, ++ 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, ++ 0x01, 0x00, 0xdd, 0x0c, 0xbb, 0xa2, 0xe4, 0x2e, 0x09, 0xe3, 0xe7, 0xc5, 0xf7, ++ 0x96, 0x69, 0xbc, 0x00, 0x21, 0xbd, 0x69, 0x33, 0x33, 0xef, 0xad, 0x04, 0xcb, ++ 0x54, 0x80, 0xee, 0x06, 0x83, 0xbb, 0xc5, 0x20, 0x84, 0xd9, 0xf7, 0xd2, 0x8b, ++ 0xf3, 0x38, 0xb0, 0xab, 0xa4, 0xad, 0x2d, 0x7c, 0x62, 0x79, 0x05, 0xff, 0xe3, ++ 0x4a, 0x3f, 0x04, 0x35, 0x20, 0x70, 0xe3, 0xc4, 0xe7, 0x6b, 0xe0, 0x9c, 0xc0, ++ 0x36, 0x75, 0xe9, 0x8a, 0x31, 0xdd, 0x8d, 0x70, 0xe5, 0xdc, 0x37, 0xb5, 0x74, ++ 0x46, 0x96, 0x28, 0x5b, 0x87, 0x60, 0x23, 0x2c, 0xbf, 0xdc, 0x47, 0xa5, 0x67, ++ 0xf7, 0x51, 0x27, 0x9e, 0x72, 0xeb, 0x07, 0xa6, 0xc9, 0xb9, 0x1e, 0x3b, 0x53, ++ 0x35, 0x7c, 0xe5, 0xd3, 0xec, 0x27, 0xb9, 0x87, 0x1c, 0xfe, 0xb9, 0xc9, 0x23, ++ 0x09, 0x6f, 0xa8, 0x46, 0x91, 0xc1, 0x6e, 0x96, 0x3c, 0x41, 0xd3, 0xcb, 0xa3, ++ 0x3f, 0x5d, 0x02, 0x6a, 0x4d, 0xec, 0x69, 0x1f, 0x25, 0x28, 0x5c, 0x36, 0xff, ++ 0xfd, 0x43, 0x15, 0x0a, 0x94, 0xe0, 0x19, 0xb4, 0xcf, 0xdf, 0xc2, 0x12, 0xe2, ++ 0xc2, 0x5b, 0x27, 0xee, 0x27, 0x78, 0x30, 0x8b, 0x5b, 0x2a, 0x09, 0x6b, 0x22, ++ 0x89, 0x53, 0x60, 0x16, 0x2c, 0xc0, 0x68, 0x1d, 0x53, 0xba, 0xec, 0x49, 0xf3, ++ 0x9d, 0x61, 0x8c, 0x85, 0x68, 0x09, 0x73, 0x44, 0x5d, 0x7d, 0xa2, 0x54, 0x2b, ++ 0xdd, 0x79, 0xf7, 0x15, 0xcf, 0x35, 0x5d, 0x6c, 0x1c, 0x2b, 0x5c, 0xce, 0xbc, ++ 0x9c, 0x23, 0x8b, 0x6f, 0x6e, 0xb5, 0x26, 0xd9, 0x36, 0x13, 0xc3, 0x4f, 0xd6, ++ 0x27, 0xae, 0xb9, 0x32, 0x3b, 0x41, 0x92, 0x2c, 0xe1, 0xc7, 0xcd, 0x77, 0xe8, ++ 0xaa, 0x54, 0x4e, 0xf7, 0x5c, 0x0b, 0x04, 0x87, 0x65, 0xb4, 0x43, 0x18, 0xa8, ++ 0xb2, 0xe0, 0x6d, 0x19, 0x77, 0xec, 0x5a, 0x24, 0xfa, 0x48, 0x03, 0x02, 0x03, ++ 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01, 0x43, 0x30, 0x82, 0x01, 0x3f, 0x30, 0x10, ++ 0x06, 0x09, 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x15, 0x01, 0x04, 0x03, ++ 0x02, 0x01, 0x00, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, ++ 0x14, 0xa9, 0x29, 0x02, 0x39, 0x8e, 0x16, 0xc4, 0x97, 0x78, 0xcd, 0x90, 0xf9, ++ 0x9e, 0x4f, 0x9a, 0xe1, 0x7c, 0x55, 0xaf, 0x53, 0x30, 0x19, 0x06, 0x09, 0x2b, ++ 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x14, 0x02, 0x04, 0x0c, 0x1e, 0x0a, 0x00, ++ 0x53, 0x00, 0x75, 0x00, 0x62, 0x00, 0x43, 0x00, 0x41, 0x30, 0x0b, 0x06, 0x03, ++ 0x55, 0x1d, 0x0f, 0x04, 0x04, 0x03, 0x02, 0x01, 0x86, 0x30, 0x0f, 0x06, 0x03, ++ 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0xff, ++ 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, ++ 0xd5, 0xf6, 0x56, 0xcb, 0x8f, 0xe8, 0xa2, 0x5c, 0x62, 0x68, 0xd1, 0x3d, 0x94, ++ 0x90, 0x5b, 0xd7, 0xce, 0x9a, 0x18, 0xc4, 0x30, 0x56, 0x06, 0x03, 0x55, 0x1d, ++ 0x1f, 0x04, 0x4f, 0x30, 0x4d, 0x30, 0x4b, 0xa0, 0x49, 0xa0, 0x47, 0x86, 0x45, ++ 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x72, 0x6c, 0x2e, 0x6d, 0x69, ++ 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, ++ 0x6b, 0x69, 0x2f, 0x63, 0x72, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x64, 0x75, 0x63, ++ 0x74, 0x73, 0x2f, 0x4d, 0x69, 0x63, 0x52, 0x6f, 0x6f, 0x43, 0x65, 0x72, 0x41, ++ 0x75, 0x74, 0x5f, 0x32, 0x30, 0x31, 0x30, 0x2d, 0x30, 0x36, 0x2d, 0x32, 0x33, ++ 0x2e, 0x63, 0x72, 0x6c, 0x30, 0x5a, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, ++ 0x07, 0x01, 0x01, 0x04, 0x4e, 0x30, 0x4c, 0x30, 0x4a, 0x06, 0x08, 0x2b, 0x06, ++ 0x01, 0x05, 0x05, 0x07, 0x30, 0x02, 0x86, 0x3e, 0x68, 0x74, 0x74, 0x70, 0x3a, ++ 0x2f, 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x6d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, ++ 0x66, 0x74, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x6b, 0x69, 0x2f, 0x63, 0x65, ++ 0x72, 0x74, 0x73, 0x2f, 0x4d, 0x69, 0x63, 0x52, 0x6f, 0x6f, 0x43, 0x65, 0x72, ++ 0x41, 0x75, 0x74, 0x5f, 0x32, 0x30, 0x31, 0x30, 0x2d, 0x30, 0x36, 0x2d, 0x32, ++ 0x33, 0x2e, 0x63, 0x72, 0x74, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, ++ 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x02, 0x01, 0x00, 0x14, ++ 0xfc, 0x7c, 0x71, 0x51, 0xa5, 0x79, 0xc2, 0x6e, 0xb2, 0xef, 0x39, 0x3e, 0xbc, ++ 0x3c, 0x52, 0x0f, 0x6e, 0x2b, 0x3f, 0x10, 0x13, 0x73, 0xfe, 0xa8, 0x68, 0xd0, ++ 0x48, 0xa6, 0x34, 0x4d, 0x8a, 0x96, 0x05, 0x26, 0xee, 0x31, 0x46, 0x90, 0x61, ++ 0x79, 0xd6, 0xff, 0x38, 0x2e, 0x45, 0x6b, 0xf4, 0xc0, 0xe5, 0x28, 0xb8, 0xda, ++ 0x1d, 0x8f, 0x8a, 0xdb, 0x09, 0xd7, 0x1a, 0xc7, 0x4c, 0x0a, 0x36, 0x66, 0x6a, ++ 0x8c, 0xec, 0x1b, 0xd7, 0x04, 0x90, 0xa8, 0x18, 0x17, 0xa4, 0x9b, 0xb9, 0xe2, ++ 0x40, 0x32, 0x36, 0x76, 0xc4, 0xc1, 0x5a, 0xc6, 0xbf, 0xe4, 0x04, 0xc0, 0xea, ++ 0x16, 0xd3, 0xac, 0xc3, 0x68, 0xef, 0x62, 0xac, 0xdd, 0x54, 0x6c, 0x50, 0x30, ++ 0x58, 0xa6, 0xeb, 0x7c, 0xfe, 0x94, 0xa7, 0x4e, 0x8e, 0xf4, 0xec, 0x7c, 0x86, ++ 0x73, 0x57, 0xc2, 0x52, 0x21, 0x73, 0x34, 0x5a, 0xf3, 0xa3, 0x8a, 0x56, 0xc8, ++ 0x04, 0xda, 0x07, 0x09, 0xed, 0xf8, 0x8b, 0xe3, 0xce, 0xf4, 0x7e, 0x8e, 0xae, ++ 0xf0, 0xf6, 0x0b, 0x8a, 0x08, 0xfb, 0x3f, 0xc9, 0x1d, 0x72, 0x7f, 0x53, 0xb8, ++ 0xeb, 0xbe, 0x63, 0xe0, 0xe3, 0x3d, 0x31, 0x65, 0xb0, 0x81, 0xe5, 0xf2, 0xac, ++ 0xcd, 0x16, 0xa4, 0x9f, 0x3d, 0xa8, 0xb1, 0x9b, 0xc2, 0x42, 0xd0, 0x90, 0x84, ++ 0x5f, 0x54, 0x1d, 0xff, 0x89, 0xea, 0xba, 0x1d, 0x47, 0x90, 0x6f, 0xb0, 0x73, ++ 0x4e, 0x41, 0x9f, 0x40, 0x9f, 0x5f, 0xe5, 0xa1, 0x2a, 0xb2, 0x11, 0x91, 0x73, ++ 0x8a, 0x21, 0x28, 0xf0, 0xce, 0xde, 0x73, 0x39, 0x5f, 0x3e, 0xab, 0x5c, 0x60, ++ 0xec, 0xdf, 0x03, 0x10, 0xa8, 0xd3, 0x09, 0xe9, 0xf4, 0xf6, 0x96, 0x85, 0xb6, ++ 0x7f, 0x51, 0x88, 0x66, 0x47, 0x19, 0x8d, 0xa2, 0xb0, 0x12, 0x3d, 0x81, 0x2a, ++ 0x68, 0x05, 0x77, 0xbb, 0x91, 0x4c, 0x62, 0x7b, 0xb6, 0xc1, 0x07, 0xc7, 0xba, ++ 0x7a, 0x87, 0x34, 0x03, 0x0e, 0x4b, 0x62, 0x7a, 0x99, 0xe9, 0xca, 0xfc, 0xce, ++ 0x4a, 0x37, 0xc9, 0x2d, 0xa4, 0x57, 0x7c, 0x1c, 0xfe, 0x3d, 0xdc, 0xb8, 0x0f, ++ 0x5a, 0xfa, 0xd6, 0xc4, 0xb3, 0x02, 0x85, 0x02, 0x3a, 0xea, 0xb3, 0xd9, 0x6e, ++ 0xe4, 0x69, 0x21, 0x37, 0xde, 0x81, 0xd1, 0xf6, 0x75, 0x19, 0x05, 0x67, 0xd3, ++ 0x93, 0x57, 0x5e, 0x29, 0x1b, 0x39, 0xc8, 0xee, 0x2d, 0xe1, 0xcd, 0xe4, 0x45, ++ 0x73, 0x5b, 0xd0, 0xd2, 0xce, 0x7a, 0xab, 0x16, 0x19, 0x82, 0x46, 0x58, 0xd0, ++ 0x5e, 0x9d, 0x81, 0xb3, 0x67, 0xaf, 0x6c, 0x35, 0xf2, 0xbc, 0xe5, 0x3f, 0x24, ++ 0xe2, 0x35, 0xa2, 0x0a, 0x75, 0x06, 0xf6, 0x18, 0x56, 0x99, 0xd4, 0x78, 0x2c, ++ 0xd1, 0x05, 0x1b, 0xeb, 0xd0, 0x88, 0x01, 0x9d, 0xaa, 0x10, 0xf1, 0x05, 0xdf, ++ 0xba, 0x7e, 0x2c, 0x63, 0xb7, 0x06, 0x9b, 0x23, 0x21, 0xc4, 0xf9, 0x78, 0x6c, ++ 0xe2, 0x58, 0x17, 0x06, 0x36, 0x2b, 0x91, 0x12, 0x03, 0xcc, 0xa4, 0xd9, 0xf2, ++ 0x2d, 0xba, 0xf9, 0x94, 0x9d, 0x40, 0xed, 0x18, 0x45, 0xf1, 0xce, 0x8a, 0x5c, ++ 0x6b, 0x3e, 0xab, 0x03, 0xd3, 0x70, 0x18, 0x2a, 0x0a, 0x6a, 0xe0, 0x5f, 0x47, ++ 0xd1, 0xd5, 0x63, 0x0a, 0x32, 0xf2, 0xaf, 0xd7, 0x36, 0x1f, 0x2a, 0x70, 0x5a, ++ 0xe5, 0x42, 0x59, 0x08, 0x71, 0x4b, 0x57, 0xba, 0x7e, 0x83, 0x81, 0xf0, 0x21, ++ 0x3c, 0xf4, 0x1c, 0xc1, 0xc5, 0xb9, 0x90, 0x93, 0x0e, 0x88, 0x45, 0x93, 0x86, ++ 0xe9, 0xb1, 0x20, 0x99, 0xbe, 0x98, 0xcb, 0xc5, 0x95, 0xa4, 0x5d, 0x62, 0xd6, ++ 0xa0, 0x63, 0x08, 0x20, 0xbd, 0x75, 0x10, 0x77, 0x7d, 0x3d, 0xf3, 0x45, 0xb9, ++ 0x9f, 0x97, 0x9f, 0xcb, 0x57, 0x80, 0x6f, 0x33, 0xa9, 0x04, 0xcf, 0x77, 0xa4, ++ 0x62, 0x1c, 0x59, 0x7e ++}; ++ ++// ++// Second DB entry: "Microsoft Corporation UEFI CA 2011" ++// SHA1: 46:de:f6:3b:5c:e6:1c:f8:ba:0d:e2:e6:63:9c:10:19:d0:ed:14:f3 ++// ++// To verify the "shim" binary and PCI expansion ROMs with. ++// ++STATIC CONST UINT8 MicrosoftUefiCA[] = { ++ 0x30, 0x82, 0x06, 0x10, 0x30, 0x82, 0x03, 0xf8, 0xa0, 0x03, 0x02, 0x01, 0x02, ++ 0x02, 0x0a, 0x61, 0x08, 0xd3, 0xc4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x30, ++ 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, ++ 0x00, 0x30, 0x81, 0x91, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, ++ 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, ++ 0x13, 0x0a, 0x57, 0x61, 0x73, 0x68, 0x69, 0x6e, 0x67, 0x74, 0x6f, 0x6e, 0x31, ++ 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x07, 0x52, 0x65, 0x64, ++ 0x6d, 0x6f, 0x6e, 0x64, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, ++ 0x13, 0x15, 0x4d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, 0x20, 0x43, ++ 0x6f, 0x72, 0x70, 0x6f, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x31, 0x3b, 0x30, ++ 0x39, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x32, 0x4d, 0x69, 0x63, 0x72, 0x6f, ++ 0x73, 0x6f, 0x66, 0x74, 0x20, 0x43, 0x6f, 0x72, 0x70, 0x6f, 0x72, 0x61, 0x74, ++ 0x69, 0x6f, 0x6e, 0x20, 0x54, 0x68, 0x69, 0x72, 0x64, 0x20, 0x50, 0x61, 0x72, ++ 0x74, 0x79, 0x20, 0x4d, 0x61, 0x72, 0x6b, 0x65, 0x74, 0x70, 0x6c, 0x61, 0x63, ++ 0x65, 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x31, 0x30, ++ 0x36, 0x32, 0x37, 0x32, 0x31, 0x32, 0x32, 0x34, 0x35, 0x5a, 0x17, 0x0d, 0x32, ++ 0x36, 0x30, 0x36, 0x32, 0x37, 0x32, 0x31, 0x33, 0x32, 0x34, 0x35, 0x5a, 0x30, ++ 0x81, 0x81, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, ++ 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x0a, ++ 0x57, 0x61, 0x73, 0x68, 0x69, 0x6e, 0x67, 0x74, 0x6f, 0x6e, 0x31, 0x10, 0x30, ++ 0x0e, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x07, 0x52, 0x65, 0x64, 0x6d, 0x6f, ++ 0x6e, 0x64, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x15, ++ 0x4d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, 0x20, 0x43, 0x6f, 0x72, ++ 0x70, 0x6f, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x31, 0x2b, 0x30, 0x29, 0x06, ++ 0x03, 0x55, 0x04, 0x03, 0x13, 0x22, 0x4d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, ++ 0x66, 0x74, 0x20, 0x43, 0x6f, 0x72, 0x70, 0x6f, 0x72, 0x61, 0x74, 0x69, 0x6f, ++ 0x6e, 0x20, 0x55, 0x45, 0x46, 0x49, 0x20, 0x43, 0x41, 0x20, 0x32, 0x30, 0x31, ++ 0x31, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, ++ 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, ++ 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xa5, 0x08, 0x6c, 0x4c, 0xc7, ++ 0x45, 0x09, 0x6a, 0x4b, 0x0c, 0xa4, 0xc0, 0x87, 0x7f, 0x06, 0x75, 0x0c, 0x43, ++ 0x01, 0x54, 0x64, 0xe0, 0x16, 0x7f, 0x07, 0xed, 0x92, 0x7d, 0x0b, 0xb2, 0x73, ++ 0xbf, 0x0c, 0x0a, 0xc6, 0x4a, 0x45, 0x61, 0xa0, 0xc5, 0x16, 0x2d, 0x96, 0xd3, ++ 0xf5, 0x2b, 0xa0, 0xfb, 0x4d, 0x49, 0x9b, 0x41, 0x80, 0x90, 0x3c, 0xb9, 0x54, ++ 0xfd, 0xe6, 0xbc, 0xd1, 0x9d, 0xc4, 0xa4, 0x18, 0x8a, 0x7f, 0x41, 0x8a, 0x5c, ++ 0x59, 0x83, 0x68, 0x32, 0xbb, 0x8c, 0x47, 0xc9, 0xee, 0x71, 0xbc, 0x21, 0x4f, ++ 0x9a, 0x8a, 0x7c, 0xff, 0x44, 0x3f, 0x8d, 0x8f, 0x32, 0xb2, 0x26, 0x48, 0xae, ++ 0x75, 0xb5, 0xee, 0xc9, 0x4c, 0x1e, 0x4a, 0x19, 0x7e, 0xe4, 0x82, 0x9a, 0x1d, ++ 0x78, 0x77, 0x4d, 0x0c, 0xb0, 0xbd, 0xf6, 0x0f, 0xd3, 0x16, 0xd3, 0xbc, 0xfa, ++ 0x2b, 0xa5, 0x51, 0x38, 0x5d, 0xf5, 0xfb, 0xba, 0xdb, 0x78, 0x02, 0xdb, 0xff, ++ 0xec, 0x0a, 0x1b, 0x96, 0xd5, 0x83, 0xb8, 0x19, 0x13, 0xe9, 0xb6, 0xc0, 0x7b, ++ 0x40, 0x7b, 0xe1, 0x1f, 0x28, 0x27, 0xc9, 0xfa, 0xef, 0x56, 0x5e, 0x1c, 0xe6, ++ 0x7e, 0x94, 0x7e, 0xc0, 0xf0, 0x44, 0xb2, 0x79, 0x39, 0xe5, 0xda, 0xb2, 0x62, ++ 0x8b, 0x4d, 0xbf, 0x38, 0x70, 0xe2, 0x68, 0x24, 0x14, 0xc9, 0x33, 0xa4, 0x08, ++ 0x37, 0xd5, 0x58, 0x69, 0x5e, 0xd3, 0x7c, 0xed, 0xc1, 0x04, 0x53, 0x08, 0xe7, ++ 0x4e, 0xb0, 0x2a, 0x87, 0x63, 0x08, 0x61, 0x6f, 0x63, 0x15, 0x59, 0xea, 0xb2, ++ 0x2b, 0x79, 0xd7, 0x0c, 0x61, 0x67, 0x8a, 0x5b, 0xfd, 0x5e, 0xad, 0x87, 0x7f, ++ 0xba, 0x86, 0x67, 0x4f, 0x71, 0x58, 0x12, 0x22, 0x04, 0x22, 0x22, 0xce, 0x8b, ++ 0xef, 0x54, 0x71, 0x00, 0xce, 0x50, 0x35, 0x58, 0x76, 0x95, 0x08, 0xee, 0x6a, ++ 0xb1, 0xa2, 0x01, 0xd5, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x01, 0x76, ++ 0x30, 0x82, 0x01, 0x72, 0x30, 0x12, 0x06, 0x09, 0x2b, 0x06, 0x01, 0x04, 0x01, ++ 0x82, 0x37, 0x15, 0x01, 0x04, 0x05, 0x02, 0x03, 0x01, 0x00, 0x01, 0x30, 0x23, ++ 0x06, 0x09, 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x15, 0x02, 0x04, 0x16, ++ 0x04, 0x14, 0xf8, 0xc1, 0x6b, 0xb7, 0x7f, 0x77, 0x53, 0x4a, 0xf3, 0x25, 0x37, ++ 0x1d, 0x4e, 0xa1, 0x26, 0x7b, 0x0f, 0x20, 0x70, 0x80, 0x30, 0x1d, 0x06, 0x03, ++ 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0x13, 0xad, 0xbf, 0x43, 0x09, 0xbd, ++ 0x82, 0x70, 0x9c, 0x8c, 0xd5, 0x4f, 0x31, 0x6e, 0xd5, 0x22, 0x98, 0x8a, 0x1b, ++ 0xd4, 0x30, 0x19, 0x06, 0x09, 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x14, ++ 0x02, 0x04, 0x0c, 0x1e, 0x0a, 0x00, 0x53, 0x00, 0x75, 0x00, 0x62, 0x00, 0x43, ++ 0x00, 0x41, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x04, 0x04, 0x03, 0x02, ++ 0x01, 0x86, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, ++ 0x05, 0x30, 0x03, 0x01, 0x01, 0xff, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, ++ 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x45, 0x66, 0x52, 0x43, 0xe1, 0x7e, 0x58, ++ 0x11, 0xbf, 0xd6, 0x4e, 0x9e, 0x23, 0x55, 0x08, 0x3b, 0x3a, 0x22, 0x6a, 0xa8, ++ 0x30, 0x5c, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04, 0x55, 0x30, 0x53, 0x30, 0x51, ++ 0xa0, 0x4f, 0xa0, 0x4d, 0x86, 0x4b, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, ++ 0x63, 0x72, 0x6c, 0x2e, 0x6d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, 0x74, ++ 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x6b, 0x69, 0x2f, 0x63, 0x72, 0x6c, 0x2f, ++ 0x70, 0x72, 0x6f, 0x64, 0x75, 0x63, 0x74, 0x73, 0x2f, 0x4d, 0x69, 0x63, 0x43, ++ 0x6f, 0x72, 0x54, 0x68, 0x69, 0x50, 0x61, 0x72, 0x4d, 0x61, 0x72, 0x52, 0x6f, ++ 0x6f, 0x5f, 0x32, 0x30, 0x31, 0x30, 0x2d, 0x31, 0x30, 0x2d, 0x30, 0x35, 0x2e, ++ 0x63, 0x72, 0x6c, 0x30, 0x60, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, ++ 0x01, 0x01, 0x04, 0x54, 0x30, 0x52, 0x30, 0x50, 0x06, 0x08, 0x2b, 0x06, 0x01, ++ 0x05, 0x05, 0x07, 0x30, 0x02, 0x86, 0x44, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, ++ 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x6d, 0x69, 0x63, 0x72, 0x6f, 0x73, 0x6f, 0x66, ++ 0x74, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x6b, 0x69, 0x2f, 0x63, 0x65, 0x72, ++ 0x74, 0x73, 0x2f, 0x4d, 0x69, 0x63, 0x43, 0x6f, 0x72, 0x54, 0x68, 0x69, 0x50, ++ 0x61, 0x72, 0x4d, 0x61, 0x72, 0x52, 0x6f, 0x6f, 0x5f, 0x32, 0x30, 0x31, 0x30, ++ 0x2d, 0x31, 0x30, 0x2d, 0x30, 0x35, 0x2e, 0x63, 0x72, 0x74, 0x30, 0x0d, 0x06, ++ 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, ++ 0x82, 0x02, 0x01, 0x00, 0x35, 0x08, 0x42, 0xff, 0x30, 0xcc, 0xce, 0xf7, 0x76, ++ 0x0c, 0xad, 0x10, 0x68, 0x58, 0x35, 0x29, 0x46, 0x32, 0x76, 0x27, 0x7c, 0xef, ++ 0x12, 0x41, 0x27, 0x42, 0x1b, 0x4a, 0xaa, 0x6d, 0x81, 0x38, 0x48, 0x59, 0x13, ++ 0x55, 0xf3, 0xe9, 0x58, 0x34, 0xa6, 0x16, 0x0b, 0x82, 0xaa, 0x5d, 0xad, 0x82, ++ 0xda, 0x80, 0x83, 0x41, 0x06, 0x8f, 0xb4, 0x1d, 0xf2, 0x03, 0xb9, 0xf3, 0x1a, ++ 0x5d, 0x1b, 0xf1, 0x50, 0x90, 0xf9, 0xb3, 0x55, 0x84, 0x42, 0x28, 0x1c, 0x20, ++ 0xbd, 0xb2, 0xae, 0x51, 0x14, 0xc5, 0xc0, 0xac, 0x97, 0x95, 0x21, 0x1c, 0x90, ++ 0xdb, 0x0f, 0xfc, 0x77, 0x9e, 0x95, 0x73, 0x91, 0x88, 0xca, 0xbd, 0xbd, 0x52, ++ 0xb9, 0x05, 0x50, 0x0d, 0xdf, 0x57, 0x9e, 0xa0, 0x61, 0xed, 0x0d, 0xe5, 0x6d, ++ 0x25, 0xd9, 0x40, 0x0f, 0x17, 0x40, 0xc8, 0xce, 0xa3, 0x4a, 0xc2, 0x4d, 0xaf, ++ 0x9a, 0x12, 0x1d, 0x08, 0x54, 0x8f, 0xbd, 0xc7, 0xbc, 0xb9, 0x2b, 0x3d, 0x49, ++ 0x2b, 0x1f, 0x32, 0xfc, 0x6a, 0x21, 0x69, 0x4f, 0x9b, 0xc8, 0x7e, 0x42, 0x34, ++ 0xfc, 0x36, 0x06, 0x17, 0x8b, 0x8f, 0x20, 0x40, 0xc0, 0xb3, 0x9a, 0x25, 0x75, ++ 0x27, 0xcd, 0xc9, 0x03, 0xa3, 0xf6, 0x5d, 0xd1, 0xe7, 0x36, 0x54, 0x7a, 0xb9, ++ 0x50, 0xb5, 0xd3, 0x12, 0xd1, 0x07, 0xbf, 0xbb, 0x74, 0xdf, 0xdc, 0x1e, 0x8f, ++ 0x80, 0xd5, 0xed, 0x18, 0xf4, 0x2f, 0x14, 0x16, 0x6b, 0x2f, 0xde, 0x66, 0x8c, ++ 0xb0, 0x23, 0xe5, 0xc7, 0x84, 0xd8, 0xed, 0xea, 0xc1, 0x33, 0x82, 0xad, 0x56, ++ 0x4b, 0x18, 0x2d, 0xf1, 0x68, 0x95, 0x07, 0xcd, 0xcf, 0xf0, 0x72, 0xf0, 0xae, ++ 0xbb, 0xdd, 0x86, 0x85, 0x98, 0x2c, 0x21, 0x4c, 0x33, 0x2b, 0xf0, 0x0f, 0x4a, ++ 0xf0, 0x68, 0x87, 0xb5, 0x92, 0x55, 0x32, 0x75, 0xa1, 0x6a, 0x82, 0x6a, 0x3c, ++ 0xa3, 0x25, 0x11, 0xa4, 0xed, 0xad, 0xd7, 0x04, 0xae, 0xcb, 0xd8, 0x40, 0x59, ++ 0xa0, 0x84, 0xd1, 0x95, 0x4c, 0x62, 0x91, 0x22, 0x1a, 0x74, 0x1d, 0x8c, 0x3d, ++ 0x47, 0x0e, 0x44, 0xa6, 0xe4, 0xb0, 0x9b, 0x34, 0x35, 0xb1, 0xfa, 0xb6, 0x53, ++ 0xa8, 0x2c, 0x81, 0xec, 0xa4, 0x05, 0x71, 0xc8, 0x9d, 0xb8, 0xba, 0xe8, 0x1b, ++ 0x44, 0x66, 0xe4, 0x47, 0x54, 0x0e, 0x8e, 0x56, 0x7f, 0xb3, 0x9f, 0x16, 0x98, ++ 0xb2, 0x86, 0xd0, 0x68, 0x3e, 0x90, 0x23, 0xb5, 0x2f, 0x5e, 0x8f, 0x50, 0x85, ++ 0x8d, 0xc6, 0x8d, 0x82, 0x5f, 0x41, 0xa1, 0xf4, 0x2e, 0x0d, 0xe0, 0x99, 0xd2, ++ 0x6c, 0x75, 0xe4, 0xb6, 0x69, 0xb5, 0x21, 0x86, 0xfa, 0x07, 0xd1, 0xf6, 0xe2, ++ 0x4d, 0xd1, 0xda, 0xad, 0x2c, 0x77, 0x53, 0x1e, 0x25, 0x32, 0x37, 0xc7, 0x6c, ++ 0x52, 0x72, 0x95, 0x86, 0xb0, 0xf1, 0x35, 0x61, 0x6a, 0x19, 0xf5, 0xb2, 0x3b, ++ 0x81, 0x50, 0x56, 0xa6, 0x32, 0x2d, 0xfe, 0xa2, 0x89, 0xf9, 0x42, 0x86, 0x27, ++ 0x18, 0x55, 0xa1, 0x82, 0xca, 0x5a, 0x9b, 0xf8, 0x30, 0x98, 0x54, 0x14, 0xa6, ++ 0x47, 0x96, 0x25, 0x2f, 0xc8, 0x26, 0xe4, 0x41, 0x94, 0x1a, 0x5c, 0x02, 0x3f, ++ 0xe5, 0x96, 0xe3, 0x85, 0x5b, 0x3c, 0x3e, 0x3f, 0xbb, 0x47, 0x16, 0x72, 0x55, ++ 0xe2, 0x25, 0x22, 0xb1, 0xd9, 0x7b, 0xe7, 0x03, 0x06, 0x2a, 0xa3, 0xf7, 0x1e, ++ 0x90, 0x46, 0xc3, 0x00, 0x0d, 0xd6, 0x19, 0x89, 0xe3, 0x0e, 0x35, 0x27, 0x62, ++ 0x03, 0x71, 0x15, 0xa6, 0xef, 0xd0, 0x27, 0xa0, 0xa0, 0x59, 0x37, 0x60, 0xf8, ++ 0x38, 0x94, 0xb8, 0xe0, 0x78, 0x70, 0xf8, 0xba, 0x4c, 0x86, 0x87, 0x94, 0xf6, ++ 0xe0, 0xae, 0x02, 0x45, 0xee, 0x65, 0xc2, 0xb6, 0xa3, 0x7e, 0x69, 0x16, 0x75, ++ 0x07, 0x92, 0x9b, 0xf5, 0xa6, 0xbc, 0x59, 0x83, 0x58 ++}; ++ ++// ++// The most important thing about the variable payload is that it is a list of ++// lists, where the element size of any given *inner* list is constant. ++// ++// Since X509 certificates vary in size, each of our *inner* lists will contain ++// one element only (one X.509 certificate). This is explicitly mentioned in ++// the UEFI specification, in "28.4.1 Signature Database", in a Note. ++// ++// The list structure looks as follows: ++// ++// struct EFI_VARIABLE_AUTHENTICATION_2 { | ++// struct EFI_TIME { | ++// UINT16 Year; | ++// UINT8 Month; | ++// UINT8 Day; | ++// UINT8 Hour; | ++// UINT8 Minute; | ++// UINT8 Second; | ++// UINT8 Pad1; | ++// UINT32 Nanosecond; | ++// INT16 TimeZone; | ++// UINT8 Daylight; | ++// UINT8 Pad2; | ++// } TimeStamp; | ++// | ++// struct WIN_CERTIFICATE_UEFI_GUID { | | ++// struct WIN_CERTIFICATE { | | ++// UINT32 dwLength; ----------------------------------------+ | ++// UINT16 wRevision; | | ++// UINT16 wCertificateType; | | ++// } Hdr; | +- DataSize ++// | | ++// EFI_GUID CertType; | | ++// UINT8 CertData[1] = { <--- "struct hack" | | ++// struct EFI_SIGNATURE_LIST { | | | ++// EFI_GUID SignatureType; | | | ++// UINT32 SignatureListSize; -------------------------+ | | ++// UINT32 SignatureHeaderSize; | | | ++// UINT32 SignatureSize; ---------------------------+ | | | ++// UINT8 SignatureHeader[SignatureHeaderSize]; | | | | ++// v | | | ++// struct EFI_SIGNATURE_DATA { | | | | ++// EFI_GUID SignatureOwner; | | | | ++// UINT8 SignatureData[1] = { <--- "struct hack" | | | | ++// X.509 payload | | | | ++// } | | | | ++// } Signatures[]; | | | ++// } SigLists[]; | | ++// }; | | ++// } AuthInfo; | | ++// }; | ++// ++// Given that the "struct hack" invokes undefined behavior (which is why C99 ++// introduced the flexible array member), and because subtracting those pesky ++// sizes of 1 is annoying, and because the format is fully specified in the ++// UEFI specification, we'll introduce two matching convenience structures that ++// are customized for our X.509 purposes. ++// ++#pragma pack(1) ++typedef struct { ++ EFI_TIME TimeStamp; ++ ++ // ++ // dwLength covers data below ++ // ++ UINT32 dwLength; ++ UINT16 wRevision; ++ UINT16 wCertificateType; ++ EFI_GUID CertType; ++} SINGLE_HEADER; ++ ++typedef struct { ++ // ++ // SignatureListSize covers data below ++ // ++ EFI_GUID SignatureType; ++ UINT32 SignatureListSize; ++ UINT32 SignatureHeaderSize; // constant 0 ++ UINT32 SignatureSize; ++ ++ // ++ // SignatureSize covers data below ++ // ++ EFI_GUID SignatureOwner; ++ ++ // ++ // X.509 certificate follows ++ // ++} REPEATING_HEADER; ++#pragma pack() ++ ++/** ++ Enroll a set of DER-formatted X.509 certificates in a global variable, ++ overwriting it. ++ ++ The variable will be rewritten with NV+BS+RT+AT attributes. ++ ++ @param[in] VariableName The name of the variable to overwrite. ++ ++ @param[in] VendorGuid The namespace (ie. vendor GUID) of the variable to ++ overwrite. ++ ++ @param[in] ... A list of ++ ++ IN CONST UINT8 *Cert, ++ IN UINTN CertSize, ++ IN CONST EFI_GUID *OwnerGuid ++ ++ triplets. If the first component of a triplet is ++ NULL, then the other two components are not ++ accessed, and processing is terminated. The list of ++ X.509 certificates is enrolled in the variable ++ specified, overwriting it. The OwnerGuid component ++ identifies the agent installing the certificate. ++ ++ @retval EFI_INVALID_PARAMETER The triplet list is empty (ie. the first Cert ++ value is NULL), or one of the CertSize values ++ is 0, or one of the CertSize values would ++ overflow the accumulated UINT32 data size. ++ ++ @retval EFI_OUT_OF_RESOURCES Out of memory while formatting variable ++ payload. ++ ++ @retval EFI_SUCCESS Enrollment successful; the variable has been ++ overwritten (or created). ++ ++ @return Error codes from gRT->GetTime() and ++ gRT->SetVariable(). ++**/ ++STATIC ++EFI_STATUS ++EFIAPI ++EnrollListOfX509Certs ( ++ IN CHAR16 *VariableName, ++ IN EFI_GUID *VendorGuid, ++ ... ++ ) ++{ ++ UINTN DataSize; ++ SINGLE_HEADER *SingleHeader; ++ REPEATING_HEADER *RepeatingHeader; ++ VA_LIST Marker; ++ CONST UINT8 *Cert; ++ EFI_STATUS Status = EFI_SUCCESS; ++ UINT8 *Data; ++ UINT8 *Position; ++ ++ // ++ // compute total size first, for UINT32 range check, and allocation ++ // ++ DataSize = sizeof *SingleHeader; ++ VA_START (Marker, VendorGuid); ++ for (Cert = VA_ARG (Marker, CONST UINT8 *); ++ Cert != NULL; ++ Cert = VA_ARG (Marker, CONST UINT8 *)) { ++ UINTN CertSize; ++ ++ CertSize = VA_ARG (Marker, UINTN); ++ (VOID)VA_ARG (Marker, CONST EFI_GUID *); ++ ++ if (CertSize == 0 || ++ CertSize > MAX_UINT32 - sizeof *RepeatingHeader || ++ DataSize > MAX_UINT32 - sizeof *RepeatingHeader - CertSize) { ++ Status = EFI_INVALID_PARAMETER; ++ break; ++ } ++ DataSize += sizeof *RepeatingHeader + CertSize; ++ } ++ VA_END (Marker); ++ ++ if (DataSize == sizeof *SingleHeader) { ++ Status = EFI_INVALID_PARAMETER; ++ } ++ if (EFI_ERROR (Status)) { ++ goto Out; ++ } ++ ++ Data = AllocatePool (DataSize); ++ if (Data == NULL) { ++ Status = EFI_OUT_OF_RESOURCES; ++ goto Out; ++ } ++ ++ Position = Data; ++ ++ SingleHeader = (SINGLE_HEADER *)Position; ++ Status = gRT->GetTime (&SingleHeader->TimeStamp, NULL); ++ if (EFI_ERROR (Status)) { ++ goto FreeData; ++ } ++ SingleHeader->TimeStamp.Pad1 = 0; ++ SingleHeader->TimeStamp.Nanosecond = 0; ++ SingleHeader->TimeStamp.TimeZone = 0; ++ SingleHeader->TimeStamp.Daylight = 0; ++ SingleHeader->TimeStamp.Pad2 = 0; ++#if 0 ++ SingleHeader->dwLength = DataSize - sizeof SingleHeader->TimeStamp; ++#else ++ // ++ // This looks like a bug in edk2. According to the UEFI specification, ++ // dwLength is "The length of the entire certificate, including the length of ++ // the header, in bytes". That shouldn't stop right after CertType -- it ++ // should include everything below it. ++ // ++ SingleHeader->dwLength = sizeof *SingleHeader ++ - sizeof SingleHeader->TimeStamp; ++#endif ++ SingleHeader->wRevision = 0x0200; ++ SingleHeader->wCertificateType = WIN_CERT_TYPE_EFI_GUID; ++ CopyGuid (&SingleHeader->CertType, &gEfiCertPkcs7Guid); ++ Position += sizeof *SingleHeader; ++ ++ VA_START (Marker, VendorGuid); ++ for (Cert = VA_ARG (Marker, CONST UINT8 *); ++ Cert != NULL; ++ Cert = VA_ARG (Marker, CONST UINT8 *)) { ++ UINTN CertSize; ++ CONST EFI_GUID *OwnerGuid; ++ ++ CertSize = VA_ARG (Marker, UINTN); ++ OwnerGuid = VA_ARG (Marker, CONST EFI_GUID *); ++ ++ RepeatingHeader = (REPEATING_HEADER *)Position; ++ CopyGuid (&RepeatingHeader->SignatureType, &gEfiCertX509Guid); ++ RepeatingHeader->SignatureListSize = sizeof *RepeatingHeader + CertSize; ++ RepeatingHeader->SignatureHeaderSize = 0; ++ RepeatingHeader->SignatureSize = ++ sizeof RepeatingHeader->SignatureOwner + CertSize; ++ CopyGuid (&RepeatingHeader->SignatureOwner, OwnerGuid); ++ Position += sizeof *RepeatingHeader; ++ ++ CopyMem (Position, Cert, CertSize); ++ Position += CertSize; ++ } ++ VA_END (Marker); ++ ++ ASSERT (Data + DataSize == Position); ++ ++ Status = gRT->SetVariable (VariableName, VendorGuid, ++ (EFI_VARIABLE_NON_VOLATILE | ++ EFI_VARIABLE_BOOTSERVICE_ACCESS | ++ EFI_VARIABLE_RUNTIME_ACCESS | ++ EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS), ++ DataSize, Data); ++ ++FreeData: ++ FreePool (Data); ++ ++Out: ++ if (EFI_ERROR (Status)) { ++ AsciiPrint ("error: %a(\"%s\", %g): %r\n", __FUNCTION__, VariableName, ++ VendorGuid, Status); ++ } ++ return Status; ++} ++ ++ ++STATIC ++EFI_STATUS ++EFIAPI ++GetExact ( ++ IN CHAR16 *VariableName, ++ IN EFI_GUID *VendorGuid, ++ OUT VOID *Data, ++ IN UINTN DataSize, ++ IN BOOLEAN AllowMissing ++ ) ++{ ++ UINTN Size; ++ EFI_STATUS Status; ++ ++ Size = DataSize; ++ Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &Size, Data); ++ if (EFI_ERROR (Status)) { ++ if (Status == EFI_NOT_FOUND && AllowMissing) { ++ ZeroMem (Data, DataSize); ++ return EFI_SUCCESS; ++ } ++ ++ AsciiPrint ("error: GetVariable(\"%s\", %g): %r\n", VariableName, ++ VendorGuid, Status); ++ return Status; ++ } ++ ++ if (Size != DataSize) { ++ AsciiPrint ("error: GetVariable(\"%s\", %g): expected size 0x%Lx, " ++ "got 0x%Lx\n", VariableName, VendorGuid, (UINT64)DataSize, (UINT64)Size); ++ return EFI_PROTOCOL_ERROR; ++ } ++ ++ return EFI_SUCCESS; ++} ++ ++typedef struct { ++ UINT8 SetupMode; ++ UINT8 SecureBoot; ++ UINT8 SecureBootEnable; ++ UINT8 CustomMode; ++ UINT8 VendorKeys; ++} SETTINGS; ++ ++STATIC ++EFI_STATUS ++EFIAPI ++GetSettings ( ++ OUT SETTINGS *Settings ++ ) ++{ ++ EFI_STATUS Status; ++ ++ Status = GetExact (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, ++ &Settings->SetupMode, sizeof Settings->SetupMode, FALSE); ++ if (EFI_ERROR (Status)) { ++ return Status; ++ } ++ ++ Status = GetExact (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, ++ &Settings->SecureBoot, sizeof Settings->SecureBoot, FALSE); ++ if (EFI_ERROR (Status)) { ++ return Status; ++ } ++ ++ Status = GetExact (EFI_SECURE_BOOT_ENABLE_NAME, ++ &gEfiSecureBootEnableDisableGuid, &Settings->SecureBootEnable, ++ sizeof Settings->SecureBootEnable, TRUE); ++ if (EFI_ERROR (Status)) { ++ return Status; ++ } ++ ++ Status = GetExact (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, ++ &Settings->CustomMode, sizeof Settings->CustomMode, FALSE); ++ if (EFI_ERROR (Status)) { ++ return Status; ++ } ++ ++ Status = GetExact (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, ++ &Settings->VendorKeys, sizeof Settings->VendorKeys, FALSE); ++ return Status; ++} ++ ++STATIC ++VOID ++EFIAPI ++PrintSettings ( ++ IN CONST SETTINGS *Settings ++ ) ++{ ++ AsciiPrint ("info: SetupMode=%d SecureBoot=%d SecureBootEnable=%d " ++ "CustomMode=%d VendorKeys=%d\n", Settings->SetupMode, Settings->SecureBoot, ++ Settings->SecureBootEnable, Settings->CustomMode, Settings->VendorKeys); ++} ++ ++ ++INTN ++EFIAPI ++ShellAppMain ( ++ IN UINTN Argc, ++ IN CHAR16 **Argv ++ ) ++{ ++ EFI_STATUS Status; ++ SETTINGS Settings; ++ ++ Status = GetSettings (&Settings); ++ if (EFI_ERROR (Status)) { ++ return 1; ++ } ++ PrintSettings (&Settings); ++ ++ if (Settings.SetupMode != 1) { ++ AsciiPrint ("error: already in User Mode\n"); ++ return 1; ++ } ++ ++ if (Settings.CustomMode != CUSTOM_SECURE_BOOT_MODE) { ++ Settings.CustomMode = CUSTOM_SECURE_BOOT_MODE; ++ Status = gRT->SetVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, ++ (EFI_VARIABLE_NON_VOLATILE | ++ EFI_VARIABLE_BOOTSERVICE_ACCESS), ++ sizeof Settings.CustomMode, &Settings.CustomMode); ++ if (EFI_ERROR (Status)) { ++ AsciiPrint ("error: SetVariable(\"%s\", %g): %r\n", EFI_CUSTOM_MODE_NAME, ++ &gEfiCustomModeEnableGuid, Status); ++ return 1; ++ } ++ } ++ ++ Status = EnrollListOfX509Certs ( ++ EFI_IMAGE_SECURITY_DATABASE, ++ &gEfiImageSecurityDatabaseGuid, ++ MicrosoftPCA, sizeof MicrosoftPCA, &gEfiCallerIdGuid, ++ MicrosoftUefiCA, sizeof MicrosoftUefiCA, &gEfiCallerIdGuid, ++ NULL); ++ if (EFI_ERROR (Status)) { ++ return 1; ++ } ++ ++ Status = EnrollListOfX509Certs ( ++ EFI_KEY_EXCHANGE_KEY_NAME, ++ &gEfiGlobalVariableGuid, ++ ExampleCert, sizeof ExampleCert, &gEfiCallerIdGuid, ++ MicrosoftKEK, sizeof MicrosoftKEK, &gEfiCallerIdGuid, ++ NULL); ++ if (EFI_ERROR (Status)) { ++ return 1; ++ } ++ ++ Status = EnrollListOfX509Certs ( ++ EFI_PLATFORM_KEY_NAME, ++ &gEfiGlobalVariableGuid, ++ ExampleCert, sizeof ExampleCert, &gEfiGlobalVariableGuid, ++ NULL); ++ if (EFI_ERROR (Status)) { ++ return 1; ++ } ++ ++ Settings.CustomMode = STANDARD_SECURE_BOOT_MODE; ++ Status = gRT->SetVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, ++ EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS, ++ sizeof Settings.CustomMode, &Settings.CustomMode); ++ if (EFI_ERROR (Status)) { ++ AsciiPrint ("error: SetVariable(\"%s\", %g): %r\n", EFI_CUSTOM_MODE_NAME, ++ &gEfiCustomModeEnableGuid, Status); ++ return 1; ++ } ++ ++ Status = GetSettings (&Settings); ++ if (EFI_ERROR (Status)) { ++ return 1; ++ } ++ PrintSettings (&Settings); ++ ++ if (Settings.SetupMode != 0 || Settings.SecureBoot != 1 || ++ Settings.SecureBootEnable != 1 || Settings.CustomMode != 0 || ++ Settings.VendorKeys != 0) { ++ AsciiPrint ("error: unexpected\n"); ++ return 1; ++ } ++ ++ AsciiPrint ("info: success\n"); ++ return 0; ++} +diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf +new file mode 100644 +index 0000000..ac919bb +--- /dev/null ++++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf +@@ -0,0 +1,51 @@ ++## @file ++# Enroll default PK, KEK, DB. ++# ++# Copyright (C) 2014, Red Hat, Inc. ++# ++# This program and the accompanying materials are licensed and made available ++# under the terms and conditions of the BSD License which accompanies this ++# distribution. The full text of the license may be found at ++# http://opensource.org/licenses/bsd-license. ++# ++# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS, ++# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR ++# IMPLIED. ++## ++ ++[Defines] ++ INF_VERSION = 0x00010006 ++ BASE_NAME = EnrollDefaultKeys ++ FILE_GUID = D5C1DF0B-1BAC-4EDF-BA48-08834009CA5A ++ MODULE_TYPE = UEFI_APPLICATION ++ VERSION_STRING = 0.1 ++ ENTRY_POINT = ShellCEntryLib ++ ++# ++# VALID_ARCHITECTURES = IA32 X64 ++# ++ ++[Sources] ++ EnrollDefaultKeys.c ++ ++[Packages] ++ MdePkg/MdePkg.dec ++ MdeModulePkg/MdeModulePkg.dec ++ SecurityPkg/SecurityPkg.dec ++ ShellPkg/ShellPkg.dec ++ ++[Guids] ++ gEfiCertPkcs7Guid ++ gEfiCertX509Guid ++ gEfiCustomModeEnableGuid ++ gEfiGlobalVariableGuid ++ gEfiImageSecurityDatabaseGuid ++ gEfiSecureBootEnableDisableGuid ++ ++[LibraryClasses] ++ BaseMemoryLib ++ DebugLib ++ MemoryAllocationLib ++ ShellCEntryLib ++ UefiLib ++ UefiRuntimeServicesTableLib +diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc +index fa9661c..e2e6ba3 100644 +--- a/OvmfPkg/OvmfPkgIa32.dsc ++++ b/OvmfPkg/OvmfPkgIa32.dsc +@@ -764,6 +764,10 @@ + + !if $(SECURE_BOOT_ENABLE) == TRUE + SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf ++ OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf { ++ <LibraryClasses> ++ ShellCEntryLib|ShellPkg/Library/UefiShellCEntryLib/UefiShellCEntryLib.inf ++ } + !endif + + OvmfPkg/PlatformDxe/Platform.inf +diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc +index 667584a..a0ae1aa 100644 +--- a/OvmfPkg/OvmfPkgIa32X64.dsc ++++ b/OvmfPkg/OvmfPkgIa32X64.dsc +@@ -773,6 +773,10 @@ + + !if $(SECURE_BOOT_ENABLE) == TRUE + SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf ++ OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf { ++ <LibraryClasses> ++ ShellCEntryLib|ShellPkg/Library/UefiShellCEntryLib/UefiShellCEntryLib.inf ++ } + !endif + + OvmfPkg/PlatformDxe/Platform.inf +diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc +index 5ae8469..87cee52 100644 +--- a/OvmfPkg/OvmfPkgX64.dsc ++++ b/OvmfPkg/OvmfPkgX64.dsc +@@ -771,6 +771,10 @@ + + !if $(SECURE_BOOT_ENABLE) == TRUE + SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf ++ OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf { ++ <LibraryClasses> ++ ShellCEntryLib|ShellPkg/Library/UefiShellCEntryLib/UefiShellCEntryLib.inf ++ } + !endif + + OvmfPkg/PlatformDxe/Platform.inf diff --git a/meta/recipes-core/ovmf/ovmf/ovmf-shell-image.wks b/meta/recipes-core/ovmf/ovmf/ovmf-shell-image.wks new file mode 100644 index 0000000..1d2f16b --- /dev/null +++ b/meta/recipes-core/ovmf/ovmf/ovmf-shell-image.wks @@ -0,0 +1,4 @@ +# short-description: Create an EFI disk image with just the EFI system partition + +part / --source rootfs --ondisk sda --fstype=vfat --align 1024 +bootloader --ptable gpt --timeout=5 diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb index bdec6aa..436b2f0 100644 --- a/meta/recipes-core/ovmf/ovmf_git.bb +++ b/meta/recipes-core/ovmf/ovmf_git.bb @@ -19,6 +19,7 @@ SRC_URI = "git://github.com/tianocore/edk2.git;branch=master \ SRC_URI_append_class-target = " \ ${@bb.utils.contains('PACKAGECONFIG', 'secureboot', 'http://www.openssl.org/source/openssl-1.0.2j.tar.gz;name=openssl;subdir=${S}/CryptoPkg/Library/OpensslLib', '', d)} \ + file://0007-OvmfPkg-EnrollDefaultKeys-application-for-enrolling-.patch \ " SRCREV="4575a602ca6072ee9d04150b38bfb143cbff8588" @@ -136,6 +137,7 @@ do_compile_class-target() { ln ${build_dir}/FV/OVMF.fd ${WORKDIR}/ovmf/ovmf.fd ln ${build_dir}/FV/OVMF_CODE.fd ${WORKDIR}/ovmf/ovmf.code.fd ln ${build_dir}/FV/OVMF_VARS.fd ${WORKDIR}/ovmf/ovmf.vars.fd + ln ${build_dir}/${OVMF_ARCH}/Shell.efi ${WORKDIR}/ovmf/ if ${@bb.utils.contains('PACKAGECONFIG', 'secureboot', 'true', 'false', d)}; then # See CryptoPkg/Library/OpensslLib/Patch-HOWTO.txt and @@ -150,6 +152,7 @@ do_compile_class-target() { ${S}/OvmfPkg/build.sh $PARALLEL_JOBS -a $OVMF_ARCH -b RELEASE -t ${FIXED_GCCVER} ${OVMF_SECURE_BOOT_FLAGS} ln ${build_dir}/FV/OVMF.fd ${WORKDIR}/ovmf/ovmf.secboot.fd ln ${build_dir}/FV/OVMF_CODE.fd ${WORKDIR}/ovmf/ovmf.secboot.code.fd + ln ${build_dir}/${OVMF_ARCH}/EnrollDefaultKeys.efi ${WORKDIR}/ovmf/ fi } @@ -159,8 +162,27 @@ do_install_class-native() { } do_install_class-target() { + # Content for UEFI shell iso. We install the EFI shell as + # bootx64/ia32.efi because then it can be started even when the + # firmware itself does not contain it. + install -d ${D}/efi/boot + install ${WORKDIR}/ovmf/Shell.efi ${D}/efi/boot/boot${@ "ia32" if "${TARGET_ARCH}" != "x86_64" else "x64"}.efi + if ${@bb.utils.contains('PACKAGECONFIG', 'secureboot', 'true', 'false', d)}; then + install ${WORKDIR}/ovmf/EnrollDefaultKeys.efi ${D} + fi } +# This always gets packaged because ovmf-shell-image depends on it. +# This allows testing that recipe in all configurations because it +# can always be part of a world build. +# +# However, EnrollDefaultKeys.efi is only included when Secure Boot is enabled. +PACKAGES =+ "ovmf-shell-efi" +FILES_ovmf-shell-efi = " \ + EnrollDefaultKeys.efi \ + efi/ \ +" + do_deploy() { } do_deploy[cleandirs] = "${DEPLOYDIR}" -- git-series 0.9.1 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* [PATCH v5 12/12] ovmf: remove BGRT patch 2017-01-27 15:30 [PATCH v5 00/12] UEFI + Secure Boot + qemu Patrick Ohly ` (10 preceding siblings ...) 2017-01-27 15:30 ` [PATCH v5 11/12] ovmf: build image which enrolls standard keys Patrick Ohly @ 2017-01-27 15:30 ` Patrick Ohly 2017-01-27 15:53 ` ✗ patchtest: failure for UEFI + Secure Boot + qemu (rev6) Patchwork 12 siblings, 0 replies; 29+ messages in thread From: Patrick Ohly @ 2017-01-27 15:30 UTC (permalink / raw) To: openembedded-core This patch was added to meta-luv for kernel testing purposes and probably is not relevant for OE-core. Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- meta/recipes-core/ovmf/ovmf/0001-OvmfPkg-Enable-BGRT-in-OVMF.patch | 110 +------------------------------------------------------------------------ meta/recipes-core/ovmf/ovmf_git.bb | 1 +- 2 files changed, 111 deletions(-) delete mode 100644 meta/recipes-core/ovmf/ovmf/0001-OvmfPkg-Enable-BGRT-in-OVMF.patch diff --git a/meta/recipes-core/ovmf/ovmf/0001-OvmfPkg-Enable-BGRT-in-OVMF.patch b/meta/recipes-core/ovmf/ovmf/0001-OvmfPkg-Enable-BGRT-in-OVMF.patch deleted file mode 100644 index 4531a6d..0000000 --- a/meta/recipes-core/ovmf/ovmf/0001-OvmfPkg-Enable-BGRT-in-OVMF.patch +++ /dev/null @@ -1,110 +0,0 @@ -From 66a4020c3c2163aeffc9757851f33c346ecfd870 Mon Sep 17 00:00:00 2001 -From: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com> -Date: Mon, 4 Apr 2016 12:15:12 -0700 -Subject: [PATCH] OvmfPkg: Enable BGRT in OVMF - -By default, firmware (OVMF - Open source Virtual Machine Firmware) -never publishes BGRT (Boot Graphics Resource Table) and in the boot -process Linux kernel checks for this table and if it fails to find BGRT -table then corresponding code in Linux kernel is not executed. EDK II -(EFI Development Kit, thus OVMF) already has BGRT source code packaged -into it but it is excluded from the build process of OVMF. These changes -to build system of OVMF enables BGRT in 32-bit and 64-bit OVMF. - -There are only two files that need to be modified in order to do this. -The first one being OvmfPkg*.dsc (this file describes the platform) and -the second one being OvmfPkg*.fdf (this file describes firmware descriptor -volume). A *.inf file (here "BootGraphicsResourceTableDxe.inf") -describes a module (here BGRT). So, include -"BootGraphicsResourceTableDxe.inf" file in "OvmfPkg*.dsc" so that BGRT -source code will be compiled and "BootGraphicsResourceTableDxe.efi" file -is generated and we should also include -"BootGraphicsResourceTableDxe.inf" file in "OvmfPkg*.fdf" file so that -"BootGraphicsResourceTableDxe.efi" will be placed in a firmware volume -and thus gets published. - -Signed-off-by: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com> ---- - OvmfPkg/OvmfPkgIa32.dsc | 1 + - OvmfPkg/OvmfPkgIa32.fdf | 1 + - OvmfPkg/OvmfPkgIa32X64.dsc | 1 + - OvmfPkg/OvmfPkgIa32X64.fdf | 1 + - OvmfPkg/OvmfPkgX64.dsc | 1 + - OvmfPkg/OvmfPkgX64.fdf | 1 + - 6 files changed, 6 insertions(+) - -diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc -index 9e5b477..0582219 100644 ---- a/OvmfPkg/OvmfPkgIa32.dsc -+++ b/OvmfPkg/OvmfPkgIa32.dsc -@@ -647,6 +647,7 @@ - OvmfPkg/AcpiS3SaveDxe/AcpiS3SaveDxe.inf - MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf - MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf -+ MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf - - # - # Network Support -diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf -index fc203f2..f968cb7 100644 ---- a/OvmfPkg/OvmfPkgIa32.fdf -+++ b/OvmfPkg/OvmfPkgIa32.fdf -@@ -274,6 +274,7 @@ INF RuleOverride=ACPITABLE OvmfPkg/AcpiTables/AcpiTables.inf - INF OvmfPkg/AcpiS3SaveDxe/AcpiS3SaveDxe.inf - INF MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf - INF MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf -+INF MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf - - INF RuleOverride = BINARY FatBinPkg/EnhancedFatDxe/Fat.inf - -diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc -index 6e4da4f..8289385 100644 ---- a/OvmfPkg/OvmfPkgIa32X64.dsc -+++ b/OvmfPkg/OvmfPkgIa32X64.dsc -@@ -656,6 +656,7 @@ - OvmfPkg/AcpiS3SaveDxe/AcpiS3SaveDxe.inf - MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf - MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf -+ MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf - - # - # Network Support -diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf -index d3f46f3..282d40b 100644 ---- a/OvmfPkg/OvmfPkgIa32X64.fdf -+++ b/OvmfPkg/OvmfPkgIa32X64.fdf -@@ -274,6 +274,7 @@ INF RuleOverride=ACPITABLE OvmfPkg/AcpiTables/AcpiTables.inf - INF OvmfPkg/AcpiS3SaveDxe/AcpiS3SaveDxe.inf - INF MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf - INF MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf -+INF MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf - - INF RuleOverride = BINARY USE = X64 FatBinPkg/EnhancedFatDxe/Fat.inf - -diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc -index 3d6d43e..0f956a7 100644 ---- a/OvmfPkg/OvmfPkgX64.dsc -+++ b/OvmfPkg/OvmfPkgX64.dsc -@@ -654,6 +654,7 @@ - OvmfPkg/AcpiS3SaveDxe/AcpiS3SaveDxe.inf - MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf - MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf -+ MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf - - # - # Network Support -diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf -index 15ef13a..9708fd5 100644 ---- a/OvmfPkg/OvmfPkgX64.fdf -+++ b/OvmfPkg/OvmfPkgX64.fdf -@@ -274,6 +274,7 @@ INF RuleOverride=ACPITABLE OvmfPkg/AcpiTables/AcpiTables.inf - INF OvmfPkg/AcpiS3SaveDxe/AcpiS3SaveDxe.inf - INF MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf - INF MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf -+INF MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf - - INF RuleOverride = BINARY FatBinPkg/EnhancedFatDxe/Fat.inf - --- -2.7.4 - diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb index 436b2f0..6b3a597 100644 --- a/meta/recipes-core/ovmf/ovmf_git.bb +++ b/meta/recipes-core/ovmf/ovmf_git.bb @@ -12,7 +12,6 @@ PACKAGECONFIG[secureboot] = ",,," SRC_URI = "git://github.com/tianocore/edk2.git;branch=master \ file://0001-BaseTools-Force-tools-variables-to-host-toolchain.patch \ - file://0001-OvmfPkg-Enable-BGRT-in-OVMF.patch \ file://0002-ovmf-update-path-to-native-BaseTools.patch \ file://0003-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch \ " -- git-series 0.9.1 ^ permalink raw reply related [flat|nested] 29+ messages in thread
* ✗ patchtest: failure for UEFI + Secure Boot + qemu (rev6) 2017-01-27 15:30 [PATCH v5 00/12] UEFI + Secure Boot + qemu Patrick Ohly ` (11 preceding siblings ...) 2017-01-27 15:30 ` [PATCH v5 12/12] ovmf: remove BGRT patch Patrick Ohly @ 2017-01-27 15:53 ` Patchwork 12 siblings, 0 replies; 29+ messages in thread From: Patchwork @ 2017-01-27 15:53 UTC (permalink / raw) To: Patrick Ohly; +Cc: openembedded-core == Series Details == Series: UEFI + Secure Boot + qemu (rev6) Revision: 6 URL : https://patchwork.openembedded.org/series/4506/ State : failure == Summary == Thank you for submitting this patch series to OpenEmbedded Core. This is an automated response. Several tests have been executed on the proposed series by patchtest resulting in the following failures: * Issue A patch file has been added, but does not have a Signed-off-by tag [test_signed_off_by_presence] Suggested fix Sign off the added patch file (meta/recipes-extended/acpica/acpitests/aapits-linux.patch) * Issue Added patch file is missing Upstream-Status in the header [test_upstream_status_presence] Suggested fix Add Upstream-Status: <status> to the header of meta/recipes-extended/acpica/acpitests/aapits-linux.patch (possible values: Pending, Submitted, Accepted, Backport, Denied, Inappropriate) If you believe any of these test results are incorrect, please reply to the mailing list (openembedded-core@lists.openembedded.org) raising your concerns. Otherwise we would appreciate you correcting the issues and submitting a new version of the patchset if applicable. Please ensure you add/increment the version number when sending the new version (i.e. [PATCH] -> [PATCH v2] -> [PATCH v3] -> ...). --- Test framework: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest Test suite: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest-oe ^ permalink raw reply [flat|nested] 29+ messages in thread
end of thread, other threads:[~2017-02-24 0:58 UTC | newest] Thread overview: 29+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2017-01-27 15:30 [PATCH v5 00/12] UEFI + Secure Boot + qemu Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 01/12] acpica: move from meta-oe to OE-core Patrick Ohly 2017-02-17 21:13 ` Richard Purdie 2017-02-18 2:02 ` Khem Raj 2017-02-18 8:03 ` Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 02/12] acpica: work around flex 2.6.2 code generation issue Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 03/12] ovmf: move from meta-luv to OE-core Patrick Ohly 2017-02-17 21:10 ` Richard Purdie 2017-02-18 2:04 ` Khem Raj 2017-02-23 17:47 ` Patrick Ohly 2017-02-23 17:48 ` [PATCH 1/2] acpica: fix compilation with musl Patrick Ohly 2017-02-23 17:48 ` [PATCH 2/2] ovmf: increase path length limit Patrick Ohly 2017-02-24 0:57 ` Patrick Ohly 2017-02-24 0:58 ` [PATCH v2] " Patrick Ohly 2017-02-18 8:05 ` [PATCH v5 03/12] ovmf: move from meta-luv to OE-core Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 04/12] ovmf: explicitly depend on nasm-native Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 05/12] ovmf: deploy firmware in image directory Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 06/12] ovmf_git.bb: enable parallel compilation Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 07/12] ovmf_git.bb: enable Secure Boot Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 08/12] runqemu: fix undefined variable reference in check_arg_path() Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 09/12] runqemu: also accept -image suffix for rootfs parameter Patrick Ohly 2017-01-27 16:54 ` Bystricky, Juro 2017-01-27 19:22 ` Patrick Ohly 2017-01-30 17:12 ` Bystricky, Juro 2017-01-30 19:10 ` Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 10/12] runqemu: support UEFI with OVMF firmware Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 11/12] ovmf: build image which enrolls standard keys Patrick Ohly 2017-01-27 15:30 ` [PATCH v5 12/12] ovmf: remove BGRT patch Patrick Ohly 2017-01-27 15:53 ` ✗ patchtest: failure for UEFI + Secure Boot + qemu (rev6) Patchwork
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.