arm/uefi-secureboot: Add uefi capsule update support

UEFI capsule update is a mechanism that allows firmware updates to be
delivered and applied in a standardized way. It is part of the UEFI
specification and provides a way to update system firmware components
like the BIOS, UEFI drivers, or other platform firmware.

Signed-off-by: Javier Tia <javier.tia@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>

ci/uefi-secureboot.yml

@@ -23,7 +23,7 @@ local_conf_header:
     WKS_FILE = "efi-disk.wks.in"
     KERNEL_IMAGETYPE = "Image"
 
-    MACHINE_FEATURES:append = " efi uefi-secureboot uefi-http-boot"
+    MACHINE_FEATURES:append = " efi uefi-secureboot uefi-http-boot uefi-capsule-updates"
 
     EFI_PROVIDER = "systemd-boot"
 

meta-arm/recipes-bsp/u-boot/u-boot-uefi-capsule-update.inc

@@ -0,0 +1,3 @@
+FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
+
+SRC_URI += "file://uefi-capsule-update.cfg"

meta-arm/recipes-bsp/u-boot/u-boot-uefi-secureboot.inc

@@ -5,6 +5,7 @@ SRC_URI += "file://uefi-secureboot.cfg"
 inherit sbsign
 
 require ${@bb.utils.contains('MACHINE_FEATURES', 'uefi-http-boot', 'u-boot-uefi-http-boot.inc', '', d)}
+require ${@bb.utils.contains('MACHINE_FEATURES', 'uefi-capsule-update', 'u-boot-capsule-update.inc', '', d)}
 
 DEPENDS += 'python3-pyopenssl-native'
 

meta-arm/recipes-bsp/u-boot/u-boot/uefi-capsule-update.cfg

@@ -0,0 +1,5 @@
+CONFIG_EFI_RUNTIME_UPDATE_CAPSULE=y
+CONFIG_EFI_CAPSULE_ON_DISK=y
+CONFIG_EFI_IGNORE_OSINDICATIONS=y
+CONFIG_EFI_CAPSULE_ON_DISK_EARLY=y
+CONFIG_EFI_CAPSULE_FIRMWARE_RAW=y