It is useful to read information about the current TPM state, where
supported, e.g. for debugging purposes when verified boot fails.

Add support for this to the TPM interface as well as Cr50. Add a simple
sandbox test.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

- We now have a new enough sbsigntools in the distro, stop building.
- Use the 20220801 tag for Jammy.
- Move to pygit2 1.9.2 (current version) as the old one doesn't build on
 "Jammy".
- Add the working directory to the list of safe directories for git.
- Move to pytest 6.2.5 to address other issues.
- This move exposed a number of minor issues in the existing scripts we
  used within CI to perform the jobs themselves.  The most notable changes
  here involve using 'set +e / set -e' to enforce when we should or should
  not make non-zero buildman status be a fatal error.

Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Simon Glass <sjg@chromium.org>

Add a command to look at VBE methods and their status. Provide a test for
all of this as well.

Signed-off-by: Simon Glass <sjg@chromium.org>

Use the sandbox_flattree build to check that everything works correctly
with BOOTMETH_GLOBAL disabled.

Update the tests as needed.

Signed-off-by: Simon Glass <sjg@chromium.org>

Update sandbox to include the VBE bootmeth. Update a few existing tests to
take account of this change, specifically that the new bootmeth now
appears when scanning.

Signed-off-by: Simon Glass <sjg@chromium.org>

Add support for VBE simple, which permits firmware update of a single
image stored in MMC or another block device.

Signed-off-by: Simon Glass <sjg@chromium.org>

At present there is a confusing array of functions that handle the
device tree fix-ups needed for booting an OS. We should be able to switch
to using events to clean this up.

As a first step, create a new event type and call it from the standard
place.

Note that this event uses the ofnode interface only, since this can
support live tree which is more efficient when making lots of updates.

Signed-off-by: Simon Glass <sjg@chromium.org>

This was a work-around for the fact that global bootmeths such as EFI
bootmgr and VBE don't use a particular bootdev, or at least select it
themselves so that we don't need to scan all bootdevs when using that
bootmeth.

Drop the system bootdev entirely.

Signed-off-by: Simon Glass <sjg@chromium.org>

Now that we can separate this out from the normal bootmeths, update the
code to create it always.

We cannot rely on the device tree to create this, since the EFI project
is quite opposed to having anything in the device tree that helps U-Boot
with its processing.

Signed-off-by: Simon Glass <sjg@chromium.org>

Typically we want to find and use global bootmeths first, since they have
the best idea of how the system should boot. We then use normal bootmeths
as a fallback.

Add the logic for this, putting global bootmeths at the end of the
ordering. We can then easily scan the global bootmeths first, then drop
them from the list for subsequent bootdev-centric scans.

This changes the ordering of global bootmeths, so update the
bootflow_system() accordingly.

Drop the comment from bootmeth_setup_iter_order() since this is an
exported function and it should be in the header file.

Signed-off-by: Simon Glass <sjg@chromium.org>