[staging/FmpDevicePkg-master 0/8] Fix GenerateCapsule issues

[staging/FmpDevicePkg-master 0/8] Fix GenerateCapsule issues

[Kinney, Michael D]

https://bugzilla.tianocore.org/show_bug.cgi?id=1021
https://bugzilla.tianocore.org/show_bug.cgi?id=1022
https://bugzilla.tianocore.org/show_bug.cgi?id=1026
https://bugzilla.tianocore.org/show_bug.cgi?id=1030
https://bugzilla.tianocore.org/show_bug.cgi?id=1024
https://bugzilla.tianocore.org/show_bug.cgi?id=1025
https://bugzilla.tianocore.org/show_bug.cgi?id=1029
https://bugzilla.tianocore.org/show_bug.cgi?id=1031
https://bugzilla.tianocore.org/show_bug.cgi?id=1046
https://bugzilla.tianocore.org/show_bug.cgi?id=1048
https://bugzilla.tianocore.org/show_bug.cgi?id=1050
https://bugzilla.tianocore.org/show_bug.cgi?id=1028

Fix issues found during validation tests of the GenerateCapsule tool

Cc: Sean Brogan <sean.brogan@microsoft.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>

Kinney, Michael D (8):
  BaseTools/Capsule: Add max value checks to Capsule Generation tools
  BaseTools/Capsule: Remove support for PopulateSystemTable
  BaseTools/Capsule: Fix CertType GUID byte order
  BaseTools/Capsule: Do not support -o with --dump-info
  BaseTools/Capsule: Update help for --fw-version and --lsv
  BaseTools/Capsule: Update file header with tool limitations
  BaseTools/Capsule: Prevent traceback during signing operations
  BaseTools/Capsule: Support capsules without a payload header

 BaseTools/Source/Python/Capsule/GenerateCapsule.py | 73 ++++++++++++++++------
 .../Python/Common/Uefi/Capsule/FmpAuthHeader.py    |  2 +-
 2 files changed, 54 insertions(+), 21 deletions(-)

-- 
2.14.2.windows.3

[staging/FmpDevicePkg-master 1/8] BaseTools/Capsule: Add max value checks to Capsule Generation tools

[Kinney, Michael D]

https://bugzilla.tianocore.org/show_bug.cgi?id=1021
https://bugzilla.tianocore.org/show_bug.cgi?id=1022
https://bugzilla.tianocore.org/show_bug.cgi?id=1026

Cc: Sean Brogan <sean.brogan@microsoft.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
---
 BaseTools/Source/Python/Capsule/GenerateCapsule.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/BaseTools/Source/Python/Capsule/GenerateCapsule.py b/BaseTools/Source/Python/Capsule/GenerateCapsule.py
index 4018dc0420..5398c12a9c 100644
--- a/BaseTools/Source/Python/Capsule/GenerateCapsule.py
+++ b/BaseTools/Source/Python/Capsule/GenerateCapsule.py
@@ -298,6 +298,12 @@ if __name__ == '__main__':
                 parser.error ('--capflag PopulateSystemTable also requires --capflag PersistAcrossReset')
             if 'InitiateReset' in args.CapsuleFlag:
                 parser.error ('--capflag InitiateReset also requires --capflag PersistAcrossReset')
+        if args.CapsuleOemFlag > 0xFFFF:
+            parser.error ('--capoemflag must be an integer between 0x0000 and 0xffff')
+        if args.HardwareInstance > 0xFFFFFFFFFFFFFFFF:
+            parser.error ('--hardware-instance must be an integer in range 0x0..0xffffffffffffffff')
+        if args.MonotonicCount > 0xFFFFFFFFFFFFFFFF:
+            parser.error ('--monotonic-count must be an integer in range 0x0..0xffffffffffffffff')
 
     UseSignTool = args.SignToolPfxFile is not None
     UseOpenSsl  = (args.OpenSslSignerPrivateCertFile is not None and
@@ -319,6 +325,10 @@ if __name__ == '__main__':
         if args.Encode and (UseSignTool or UseOpenSsl):
             if args.FwVersion is None or args.LowestSupportedVersion is None:
                 parser.error ('the following options are required: --fw-version, --lsv')
+            if args.FwVersion > 0xFFFFFFFF:
+                parser.error ('--fw-version must be an integer in range 0x0..0xffffffff')
+            if args.LowestSupportedVersion > 0xFFFFFFFF:
+                parser.error ('--lsv must be an integer in range 0x0..0xffffffff')
 
         if UseSignTool:
             args.SignToolPfxFile.close()
-- 
2.14.2.windows.3

[staging/FmpDevicePkg-master 2/8] BaseTools/Capsule: Remove support for PopulateSystemTable

[Kinney, Michael D]

https://bugzilla.tianocore.org/show_bug.cgi?id=1030

Cc: Sean Brogan <sean.brogan@microsoft.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
---
 BaseTools/Source/Python/Capsule/GenerateCapsule.py | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/BaseTools/Source/Python/Capsule/GenerateCapsule.py b/BaseTools/Source/Python/Capsule/GenerateCapsule.py
index 5398c12a9c..34337b2710 100644
--- a/BaseTools/Source/Python/Capsule/GenerateCapsule.py
+++ b/BaseTools/Source/Python/Capsule/GenerateCapsule.py
@@ -239,8 +239,8 @@ if __name__ == '__main__':
     # Add optional arguments for this command
     #
     parser.add_argument ("--capflag", dest = 'CapsuleFlag', action='append', default = [],
-                         choices=['PersistAcrossReset', 'PopulateSystemTable', 'InitiateReset'],
-                         help = "Capsule flag can be PersistAcrossReset, or PopulateSystemTable or InitiateReset or not set")
+                         choices=['PersistAcrossReset', 'InitiateReset'],
+                         help = "Capsule flag can be PersistAcrossReset or InitiateReset or not set")
     parser.add_argument ("--capoemflag", dest = 'CapsuleOemFlag', type = ValidateUnsignedInteger, default = 0x0000,
                          help = "Capsule OEM Flag is an integer between 0x0000 and 0xffff.")
 
@@ -294,8 +294,6 @@ if __name__ == '__main__':
         if args.Guid is None:
             parser.error ('the following option is required: --guid')
         if 'PersistAcrossReset' not in args.CapsuleFlag:
-            if 'PopulateSystemTable' in args.CapsuleFlag:
-                parser.error ('--capflag PopulateSystemTable also requires --capflag PersistAcrossReset')
             if 'InitiateReset' in args.CapsuleFlag:
                 parser.error ('--capflag InitiateReset also requires --capflag PersistAcrossReset')
         if args.CapsuleOemFlag > 0xFFFF:
@@ -421,7 +419,7 @@ if __name__ == '__main__':
         try:
             UefiCapsuleHeader.OemFlags            = args.CapsuleOemFlag
             UefiCapsuleHeader.PersistAcrossReset  = 'PersistAcrossReset'  in args.CapsuleFlag
-            UefiCapsuleHeader.PopulateSystemTable = 'PopulateSystemTable' in args.CapsuleFlag
+            UefiCapsuleHeader.PopulateSystemTable = False
             UefiCapsuleHeader.InitiateReset       = 'InitiateReset'       in args.CapsuleFlag
             UefiCapsuleHeader.Payload             = Result
             Result = UefiCapsuleHeader.Encode ()
-- 
2.14.2.windows.3

[staging/FmpDevicePkg-master 3/8] BaseTools/Capsule: Fix CertType GUID byte order

[Kinney, Michael D]

https://bugzilla.tianocore.org/show_bug.cgi?id=1024

Cc: Sean Brogan <sean.brogan@microsoft.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
---
 BaseTools/Source/Python/Common/Uefi/Capsule/FmpAuthHeader.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/BaseTools/Source/Python/Common/Uefi/Capsule/FmpAuthHeader.py b/BaseTools/Source/Python/Common/Uefi/Capsule/FmpAuthHeader.py
index aec52bf772..ae5c1df8a4 100644
--- a/BaseTools/Source/Python/Common/Uefi/Capsule/FmpAuthHeader.py
+++ b/BaseTools/Source/Python/Common/Uefi/Capsule/FmpAuthHeader.py
@@ -166,7 +166,7 @@ class FmpAuthHeaderClass (object):
         self.dwLength         = dwLength
         self.wRevision        = wRevision
         self.wCertificateType = wCertificateType
-        self.CertType         = uuid.UUID (bytes = CertType)
+        self.CertType         = uuid.UUID (bytes_le = CertType)
         self.CertData         = Buffer[self._StructSize:self._MonotonicCountSize + self.dwLength]
         self.Payload          = Buffer[self._MonotonicCountSize + self.dwLength:]
         self._Valid           = True
-- 
2.14.2.windows.3

[staging/FmpDevicePkg-master 4/8] BaseTools/Capsule: Do not support -o with --dump-info

[Kinney, Michael D]

https://bugzilla.tianocore.org/show_bug.cgi?id=1025

Cc: Sean Brogan <sean.brogan@microsoft.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
---
 BaseTools/Source/Python/Capsule/GenerateCapsule.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/BaseTools/Source/Python/Capsule/GenerateCapsule.py b/BaseTools/Source/Python/Capsule/GenerateCapsule.py
index 34337b2710..3c641bdca7 100644
--- a/BaseTools/Source/Python/Capsule/GenerateCapsule.py
+++ b/BaseTools/Source/Python/Capsule/GenerateCapsule.py
@@ -339,6 +339,10 @@ if __name__ == '__main__':
             args.OpenSslOtherPublicCertFile   = args.OpenSslOtherPublicCertFile.name
             args.OpenSslTrustedPublicCertFile = args.OpenSslTrustedPublicCertFile.name
 
+    if args.DumpInfo:
+        if args.OutputFile is not None:
+            parser.error ('the following option is not supported for dumpinfo operations: --output')
+
     #
     # Read binary input file
     #
-- 
2.14.2.windows.3

[staging/FmpDevicePkg-master 5/8] BaseTools/Capsule: Update help for --fw-version and --lsv

[Kinney, Michael D]

Update help to state that --fw-version and -=-lsv are required
for encode operations that sign a payload.

https://bugzilla.tianocore.org/show_bug.cgi?id=1029

Cc: Sean Brogan <sean.brogan@microsoft.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
---
 BaseTools/Source/Python/Capsule/GenerateCapsule.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/BaseTools/Source/Python/Capsule/GenerateCapsule.py b/BaseTools/Source/Python/Capsule/GenerateCapsule.py
index 3c641bdca7..76426dcf66 100644
--- a/BaseTools/Source/Python/Capsule/GenerateCapsule.py
+++ b/BaseTools/Source/Python/Capsule/GenerateCapsule.py
@@ -254,9 +254,9 @@ if __name__ == '__main__':
                          help = "64-bit monotonic count value in header.  Default is 0x0000000000000000.")
 
     parser.add_argument ("--fw-version", dest = 'FwVersion', type = ValidateUnsignedInteger,
-                         help = "The 32-bit version of the binary payload (e.g. 0x11223344 or 5678).")
+                         help = "The 32-bit version of the binary payload (e.g. 0x11223344 or 5678).  Required for encode operations that sign a payload.")
     parser.add_argument ("--lsv", dest = 'LowestSupportedVersion', type = ValidateUnsignedInteger,
-                         help = "The 32-bit lowest supported version of the binary payload (e.g. 0x11223344 or 5678).")
+                         help = "The 32-bit lowest supported version of the binary payload (e.g. 0x11223344 or 5678).  Required for encode operations that sign a payload.")
 
     parser.add_argument ("--pfx-file", dest='SignToolPfxFile', type=argparse.FileType('rb'),
                          help="signtool PFX certificate filename.")
-- 
2.14.2.windows.3

[staging/FmpDevicePkg-master 6/8] BaseTools/Capsule: Update file header with tool limitations

[Kinney, Michael D]

Update file header to state that the tool does not support:
* Multiple payloads
* Drivers
* Vendor code bytes

https://bugzilla.tianocore.org/show_bug.cgi?id=1031

Cc: Sean Brogan <sean.brogan@microsoft.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
---
 BaseTools/Source/Python/Capsule/GenerateCapsule.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/BaseTools/Source/Python/Capsule/GenerateCapsule.py b/BaseTools/Source/Python/Capsule/GenerateCapsule.py
index 76426dcf66..d829000849 100644
--- a/BaseTools/Source/Python/Capsule/GenerateCapsule.py
+++ b/BaseTools/Source/Python/Capsule/GenerateCapsule.py
@@ -1,6 +1,17 @@
 ## @file
 # Generate a capsule.
 #
+# This tool generates a UEFI Capsule around an FMP Capsule.  The capsule payload
+# be signed using signtool or OpenSSL and if it is signed the signed content
+# includes an FMP Payload Header.
+#
+# This tool is intended to be used to generate UEFI Capsules to update the
+# system firmware or device firmware for integrated devices.  In order to
+# keep the tool as simple as possible, it has the following limitations:
+#   * Do not support multiple payloads in a capsule.
+#   * Do not support optional drivers in a capsule.
+#   * Do not support vendor code bytes in a capsule.
+#
 # Copyright (c) 2018, Intel Corporation. All rights reserved.<BR>
 # This program and the accompanying materials
 # are licensed and made available under the terms and conditions of the BSD License
-- 
2.14.2.windows.3

[staging/FmpDevicePkg-master 7/8] BaseTools/Capsule: Prevent traceback during signing operations

[Kinney, Michael D]

https://bugzilla.tianocore.org/show_bug.cgi?id=1046
https://bugzilla.tianocore.org/show_bug.cgi?id=1048
https://bugzilla.tianocore.org/show_bug.cgi?id=1050

Remove raise statements that generate Tracebacks that were only
intended for development/debug.  With the raise statements removed
proper error messages are shown.

Cc: Sean Brogan <sean.brogan@microsoft.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
---
 BaseTools/Source/Python/Capsule/GenerateCapsule.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/BaseTools/Source/Python/Capsule/GenerateCapsule.py b/BaseTools/Source/Python/Capsule/GenerateCapsule.py
index d829000849..42cd1fb8ba 100644
--- a/BaseTools/Source/Python/Capsule/GenerateCapsule.py
+++ b/BaseTools/Source/Python/Capsule/GenerateCapsule.py
@@ -408,7 +408,6 @@ if __name__ == '__main__':
                                  )
             except:
                 print ('GenerateCapsule: error: can not sign payload')
-                raise
                 sys.exit (1)
 
             try:
@@ -496,7 +495,6 @@ if __name__ == '__main__':
                 print ('========')
         except:
             print ('GenerateCapsule: error: can not decode capsule')
-            raise
             sys.exit (1)
 
     elif args.DumpInfo:
-- 
2.14.2.windows.3

[staging/FmpDevicePkg-master 8/8] BaseTools/Capsule: Support capsules without a payload header

[Kinney, Michael D]

https://bugzilla.tianocore.org/show_bug.cgi?id=1028

Update --dump-info and --decode to show auth header infomation
even if a payload header is not present.  The --decode operation
still fails if a payload header is not present.

Cc: Sean Brogan <sean.brogan@microsoft.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
---
 BaseTools/Source/Python/Capsule/GenerateCapsule.py | 34 +++++++++++++++-------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/BaseTools/Source/Python/Capsule/GenerateCapsule.py b/BaseTools/Source/Python/Capsule/GenerateCapsule.py
index 42cd1fb8ba..7b08918857 100644
--- a/BaseTools/Source/Python/Capsule/GenerateCapsule.py
+++ b/BaseTools/Source/Python/Capsule/GenerateCapsule.py
@@ -455,6 +455,9 @@ if __name__ == '__main__':
                 FmpCapsuleHeader.DumpInfo ()
             if UseSignTool or UseOpenSsl:
                 Result = FmpAuthHeader.Decode (Result)
+                if args.Verbose:
+                    print ('--------')
+                    FmpAuthHeader.DumpInfo ()
 
                 #
                 # Verify Image with 64-bit MonotonicCount appended to end of image
@@ -479,20 +482,25 @@ if __name__ == '__main__':
                 except ValueError:
                     print ('GenerateCapsule: warning: can not verify payload.')
 
-                Result = FmpPayloadHeader.Decode (Result)
-                if args.Verbose:
-                    print ('--------')
-                    FmpAuthHeader.DumpInfo ()
-                    print ('--------')
-                    FmpPayloadHeader.DumpInfo ()
+                try:
+                    Result = FmpPayloadHeader.Decode (Result)
+                    if args.Verbose:
+                        print ('--------')
+                        FmpPayloadHeader.DumpInfo ()
+                        print ('========')
+                except:
+                    if args.Verbose:
+                        print ('--------')
+                        print ('No FMP_PAYLOAD_HEADER')
+                        print ('========')
+                    raise
             else:
                 if args.Verbose:
                     print ('--------')
                     print ('No EFI_FIRMWARE_IMAGE_AUTHENTICATION')
                     print ('--------')
                     print ('No FMP_PAYLOAD_HEADER')
-            if args.Verbose:
-                print ('========')
+                    print ('========')
         except:
             print ('GenerateCapsule: error: can not decode capsule')
             sys.exit (1)
@@ -508,11 +516,15 @@ if __name__ == '__main__':
             FmpCapsuleHeader.DumpInfo ()
             try:
                 Result = FmpAuthHeader.Decode (Result)
-                Result = FmpPayloadHeader.Decode (Result)
                 print ('--------')
                 FmpAuthHeader.DumpInfo ()
-                print ('--------')
-                FmpPayloadHeader.DumpInfo ()
+                try:
+                    Result = FmpPayloadHeader.Decode (Result)
+                    print ('--------')
+                    FmpPayloadHeader.DumpInfo ()
+                except:
+                    print ('--------')
+                    print ('No FMP_PAYLOAD_HEADER')
             except:
                 print ('--------')
                 print ('No EFI_FIRMWARE_IMAGE_AUTHENTICATION')
-- 
2.14.2.windows.3

Re: [staging/FmpDevicePkg-master 0/8] Fix GenerateCapsule issues

[Zhu, Yonghong]

Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com> 

Best Regards,
Zhu Yonghong


-----Original Message-----
From: Kinney, Michael D 
Sent: Monday, July 30, 2018 2:08 AM
To: edk2-devel@lists.01.org
Cc: Sean Brogan <sean.brogan@microsoft.com>; Yao, Jiewen <jiewen.yao@intel.com>; Zhu, Yonghong <yonghong.zhu@intel.com>; Gao, Liming <liming.gao@intel.com>; Kinney, Michael D <michael.d.kinney@intel.com>
Subject: [staging/FmpDevicePkg-master 0/8] Fix GenerateCapsule issues

https://bugzilla.tianocore.org/show_bug.cgi?id=1021
https://bugzilla.tianocore.org/show_bug.cgi?id=1022
https://bugzilla.tianocore.org/show_bug.cgi?id=1026
https://bugzilla.tianocore.org/show_bug.cgi?id=1030
https://bugzilla.tianocore.org/show_bug.cgi?id=1024
https://bugzilla.tianocore.org/show_bug.cgi?id=1025
https://bugzilla.tianocore.org/show_bug.cgi?id=1029
https://bugzilla.tianocore.org/show_bug.cgi?id=1031
https://bugzilla.tianocore.org/show_bug.cgi?id=1046
https://bugzilla.tianocore.org/show_bug.cgi?id=1048
https://bugzilla.tianocore.org/show_bug.cgi?id=1050
https://bugzilla.tianocore.org/show_bug.cgi?id=1028

Fix issues found during validation tests of the GenerateCapsule tool

Cc: Sean Brogan <sean.brogan@microsoft.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>

Kinney, Michael D (8):
  BaseTools/Capsule: Add max value checks to Capsule Generation tools
  BaseTools/Capsule: Remove support for PopulateSystemTable
  BaseTools/Capsule: Fix CertType GUID byte order
  BaseTools/Capsule: Do not support -o with --dump-info
  BaseTools/Capsule: Update help for --fw-version and --lsv
  BaseTools/Capsule: Update file header with tool limitations
  BaseTools/Capsule: Prevent traceback during signing operations
  BaseTools/Capsule: Support capsules without a payload header

 BaseTools/Source/Python/Capsule/GenerateCapsule.py | 73 ++++++++++++++++------
 .../Python/Common/Uefi/Capsule/FmpAuthHeader.py    |  2 +-
 2 files changed, 54 insertions(+), 21 deletions(-)

-- 
2.14.2.windows.3