Stanley Chang f61bb6c116 FWU: support OEM key revocation together with BIOS/CSME update ...

The steps of OEM key revocation are:
  1. Replace OEM KM (signed with key2) by updating CSME
  2. Replace BIOS region (signed with key2)
  3. Reboot with new BIOS region (to make key1 inactive)
  4. Revoke key1

Before this patch, it requires 2 firmware updates and 2 capsules for
step 1~2 and step 4 respectively. The patch combines them into a single
update/capsule.

To implement the feature, the patch:
  1. Double max # of payloads to allow CSME/CSMD/BIOS/CMDI update
     in one capsule image.
  2. Prevent from failing update of a critical component.
     e.g., if step 1(CSME) fails, step 2(BIOS) should be skipped

Verified cases:

 Case 1: Capsule having CSMD/CSMD/BIOS/CMDI.
         Expectation: successful

    $ python BootloaderCorePkg/Tools/GenCapsuleFirmware.py \
      -p CSME FWUpdate.bin \
      -p CSMD CsmeUpdateDriver.efi \
      -p BIOS new_BiosRegion.bin \
      -p CMDI cmdi.txt \
      ...(skip)

 Case 2: Capsule having CSME/BIOS/CMDI but no CSMD.
         Expectation: no update

 Case 3: Inject fault flow (no partition switch after first flash),
         Capsule having CSME/CSMD/BIOS/CMDI.
         Expectation: no CMDI update

Verification: EHL CRB

Signed-off-by: Stanley Chang <stanley.chang@intel.com>

2022-07-19 15:31:23 -07:00

..

Include

FWU: support OEM key revocation together with BIOS/CSME update

2022-07-19 15:31:23 -07:00

Library

Fix build error caused by non-ASCII characters

2022-07-13 16:43:19 -07:00

BootloaderCommonPkg.dec

Add support for getting csme boot time perf data

2022-05-11 09:02:52 -07:00