[PATCH v6 9/9] sandbox: capsule: Generate capsule related files through binman
Sughosh Ganu
sughosh.ganu at linaro.org
Tue Aug 1 19:40:18 CEST 2023
The EFI capsule files can now be generated as part of u-boot
build. This is done through binman. Add capsule entry nodes in the
u-boot.dtsi for the sandbox architecture for generating the
capsules. Remove the corresponding generation of capsules from the
capsule update conftest file.
The capsules are generated through the config file for the sandbox
variant, and through explicit parameters for the sandbox_flattree
variant.
Also generate the FIT image used for testing the capsule update
feature on the sandbox_flattree variant through binman. Remove the now
superfluous its file which was used for generating this FIT image.
Signed-off-by: Sughosh Ganu <sughosh.ganu at linaro.org>
---
Changes since V5:
* Use the public key ESL file and other input files from the tree
instead of the /tmp/capsules/ directory being used in previous
version.
* Use macros for other input files and certs.
arch/sandbox/dts/u-boot.dtsi | 347 ++++++++++++++++++
test/py/tests/test_efi_capsule/conftest.py | 128 +------
.../tests/test_efi_capsule/uboot_bin_env.its | 36 --
3 files changed, 348 insertions(+), 163 deletions(-)
delete mode 100644 test/py/tests/test_efi_capsule/uboot_bin_env.its
diff --git a/arch/sandbox/dts/u-boot.dtsi b/arch/sandbox/dts/u-boot.dtsi
index 60bd004937..ae798660de 100644
--- a/arch/sandbox/dts/u-boot.dtsi
+++ b/arch/sandbox/dts/u-boot.dtsi
@@ -7,11 +7,358 @@
*/
#ifdef CONFIG_EFI_HAVE_CAPSULE_SUPPORT
+
+#define SANDBOX_UBOOT_IMAGE_GUID "09d7cf52-0720-4710-91d1-08469b7fe9c8"
+#define SANDBOX_UBOOT_ENV_IMAGE_GUID "5a7021f5-fef2-48b4-aaba-832e777418c0"
+#define SANDBOX_FIT_IMAGE_GUID "3673b45d-6a7c-46f3-9e60-adabb03f7937"
+#define SANDBOX_INCORRECT_GUID "058b7d83-50d5-4c47-a195-60d86ad341c4"
+
+#define UBOOT_BIN_IMAGE "test/py/tests/test_efi_capsule/test_files/u-boot.bin.new"
+#define UBOOT_ENV_IMAGE "test/py/tests/test_efi_capsule/test_files/u-boot.env.new"
+#define UBOOT_FIT_IMAGE "u-boot_bin_env.itb"
+
+#define CAPSULE_PRIV_KEY "test/py/tests/test_efi_capsule/test_files/SIGNER.key"
+#define CAPSULE_PUB_KEY "test/py/tests/test_efi_capsule/test_files/SIGNER.crt"
+#define CAPSULE_INVAL_KEY "test/py/tests/test_efi_capsule/test_files/SIGNER2.key"
+#define CAPSULE_INVAL_PUB_KEY "test/py/tests/test_efi_capsule/test_files/SIGNER2.crt"
+
/ {
#ifdef CONFIG_EFI_CAPSULE_AUTHENTICATE
signature {
capsule-key = /incbin/(CONFIG_EFI_CAPSULE_ESL_FILE);
};
#endif
+
+ binman: binman {
+ multiple-images;
+ };
+};
+
+&binman {
+ itb {
+ filename = UBOOT_FIT_IMAGE;
+
+ fit {
+ description = "Automatic U-Boot environment update";
+ #address-cells = <2>;
+
+ images {
+ u-boot-bin {
+ description = "U-Boot binary on SPI Flash";
+ compression = "none";
+ type = "firmware";
+ arch = "sandbox";
+ load = <0>;
+ blob {
+ filename = UBOOT_BIN_IMAGE;
+ };
+
+ hash-1 {
+ algo = "sha1";
+ };
+ };
+ u-boot-env {
+ description = "U-Boot environment on SPI Flash";
+ compression = "none";
+ type = "firmware";
+ arch = "sandbox";
+ load = <0>;
+ blob {
+ filename = UBOOT_ENV_IMAGE;
+ };
+
+ hash-1 {
+ algo = "sha1";
+ };
+ };
+ };
+ };
+ };
+
+ capsule1 {
+ filename = "Test01";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ image-type-id = SANDBOX_UBOOT_IMAGE_GUID;
+
+ blob-ext {
+ filename = UBOOT_BIN_IMAGE;
+ };
+ };
+ };
+
+ capsule2 {
+ filename = "Test02";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x2>;
+ image-type-id = SANDBOX_UBOOT_ENV_IMAGE_GUID;
+
+ blob-ext {
+ filename = UBOOT_ENV_IMAGE;
+ };
+ };
+ };
+
+ capsule3 {
+ filename = "Test03";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ image-type-id = SANDBOX_INCORRECT_GUID;
+
+ blob-ext {
+ filename = UBOOT_BIN_IMAGE;
+ };
+ };
+ };
+
+ capsule4 {
+ filename = "Test04";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ image-type-id = SANDBOX_FIT_IMAGE_GUID;
+
+ blob-ext {
+ filename = UBOOT_FIT_IMAGE;
+ };
+ };
+ };
+
+ capsule5 {
+ filename = "Test05";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ image-type-id = SANDBOX_INCORRECT_GUID;
+
+ blob-ext {
+ filename = UBOOT_FIT_IMAGE;
+ };
+ };
+ };
+
+ capsule6 {
+ filename = "Test101";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ fw-version = <0x5>;
+ image-type-id = SANDBOX_UBOOT_IMAGE_GUID;
+
+ blob-ext {
+ filename = UBOOT_BIN_IMAGE;
+ };
+ };
+ };
+
+ capsule7 {
+ filename = "Test102";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x2>;
+ fw-version = <0xa>;
+ image-type-id = SANDBOX_UBOOT_ENV_IMAGE_GUID;
+
+ blob-ext {
+ filename = UBOOT_ENV_IMAGE;
+ };
+ };
+ };
+
+ capsule8 {
+ filename = "Test103";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ fw-version = <0x2>;
+ image-type-id = SANDBOX_UBOOT_IMAGE_GUID;
+
+ blob-ext {
+ filename = UBOOT_BIN_IMAGE;
+ };
+ };
+ };
+
+ capsule9 {
+ filename = "Test104";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ fw-version = <0x5>;
+ image-type-id = SANDBOX_FIT_IMAGE_GUID;
+
+ blob-ext {
+ filename = UBOOT_FIT_IMAGE;
+ };
+ };
+ };
+
+ capsule10 {
+ filename = "Test105";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ fw-version = <0x2>;
+ image-type-id = SANDBOX_FIT_IMAGE_GUID;
+
+ blob-ext {
+ filename = UBOOT_FIT_IMAGE;
+ };
+ };
+ };
+
+#ifdef CONFIG_EFI_CAPSULE_AUTHENTICATE
+ capsule11 {
+ filename = "Test11";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ image-type-id = SANDBOX_UBOOT_IMAGE_GUID;
+ private-key = CAPSULE_PRIV_KEY;
+ pub-key-cert = CAPSULE_PUB_KEY;
+ monotonic-count = <0x1>;
+
+ blob-ext {
+ filename = UBOOT_BIN_IMAGE;
+ };
+ };
+ };
+
+ capsule12 {
+ filename = "Test12";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ image-type-id = SANDBOX_UBOOT_IMAGE_GUID;
+ private-key = CAPSULE_INVAL_KEY;
+ pub-key-cert = CAPSULE_INVAL_PUB_KEY;
+ monotonic-count = <0x1>;
+
+ blob-ext {
+ filename = UBOOT_BIN_IMAGE;
+ };
+ };
+ };
+
+ capsule13 {
+ filename = "Test13";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ image-type-id = SANDBOX_FIT_IMAGE_GUID;
+ private-key = CAPSULE_PRIV_KEY;
+ pub-key-cert = CAPSULE_PUB_KEY;
+ monotonic-count = <0x1>;
+
+ blob-ext {
+ filename = UBOOT_FIT_IMAGE;
+ };
+ };
+ };
+
+ capsule14 {
+ filename = "Test14";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ image-type-id = SANDBOX_FIT_IMAGE_GUID;
+ private-key = CAPSULE_INVAL_KEY;
+ pub-key-cert = CAPSULE_INVAL_PUB_KEY;
+ monotonic-count = <0x1>;
+
+ blob-ext {
+ filename = UBOOT_FIT_IMAGE;
+ };
+ };
+ };
+
+ capsule15 {
+ filename = "Test111";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ fw-version = <0x5>;
+ image-type-id = SANDBOX_UBOOT_IMAGE_GUID;
+ private-key = CAPSULE_PRIV_KEY;
+ pub-key-cert = CAPSULE_PUB_KEY;
+ monotonic-count = <0x1>;
+
+ blob-ext {
+ filename = UBOOT_BIN_IMAGE;
+ };
+ };
+ };
+
+ capsule16 {
+ filename = "Test112";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x2>;
+ fw-version = <0xa>;
+ image-type-id = SANDBOX_UBOOT_ENV_IMAGE_GUID;
+ private-key = CAPSULE_PRIV_KEY;
+ pub-key-cert = CAPSULE_PUB_KEY;
+ monotonic-count = <0x1>;
+
+ blob-ext {
+ filename = UBOOT_ENV_IMAGE;
+ };
+ };
+ };
+
+ capsule17 {
+ filename = "Test113";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ fw-version = <0x2>;
+ image-type-id = SANDBOX_UBOOT_IMAGE_GUID;
+ private-key = CAPSULE_PRIV_KEY;
+ pub-key-cert = CAPSULE_PUB_KEY;
+ monotonic-count = <0x1>;
+
+ blob-ext {
+ filename = UBOOT_BIN_IMAGE;
+ };
+ };
+ };
+
+ capsule18 {
+ filename = "Test114";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ fw-version = <0x5>;
+ image-type-id = SANDBOX_FIT_IMAGE_GUID;
+ private-key = CAPSULE_PRIV_KEY;
+ pub-key-cert = CAPSULE_PUB_KEY;
+ monotonic-count = <0x1>;
+
+ blob-ext {
+ filename = UBOOT_FIT_IMAGE;
+ };
+ };
+ };
+
+ capsule19 {
+ filename = "Test115";
+ capsule {
+ type = "efi-capsule";
+ image-index = <0x1>;
+ fw-version = <0x2>;
+ image-type-id = SANDBOX_FIT_IMAGE_GUID;
+ private-key = CAPSULE_PRIV_KEY;
+ pub-key-cert = CAPSULE_PUB_KEY;
+ monotonic-count = <0x1>;
+
+ blob-ext {
+ filename = UBOOT_FIT_IMAGE;
+ };
+ };
+ };
+#endif /* CONFIG_EFI_CAPSULE_AUTHENTICATE */
};
#endif /* CONFIG_EFI_HAVE_CAPSULE_SUPPORT */
diff --git a/test/py/tests/test_efi_capsule/conftest.py b/test/py/tests/test_efi_capsule/conftest.py
index bee3050282..bc0f188609 100644
--- a/test/py/tests/test_efi_capsule/conftest.py
+++ b/test/py/tests/test_efi_capsule/conftest.py
@@ -33,6 +33,7 @@ def efi_capsule_data(request, u_boot_config):
check_call('mkdir -p %s' % data_dir, shell=True)
check_call('mkdir -p %s' % install_dir, shell=True)
check_call('cp %s/* %s ' % (capsules_path_dir, data_dir), shell=True)
+ check_call('cp %s/Test* %s ' % (u_boot_config.build_dir, data_dir), shell=True)
# Update dtb to add the version information
check_call('cd %s; '
@@ -56,133 +57,6 @@ def efi_capsule_data(request, u_boot_config):
'-o test_ver.dtb version.dtbo'
% (data_dir, u_boot_config.build_dir), shell=True)
- # Create capsule files
- # two regions: one for u-boot.bin and the other for u-boot.env
- check_call('cd %s; echo -n u-boot:Old > u-boot.bin.old; echo -n u-boot:New > u-boot.bin.new; echo -n u-boot-env:Old > u-boot.env.old; echo -n u-boot-env:New > u-boot.env.new' % data_dir,
- shell=True)
- check_call('sed -e \"s?BINFILE1?u-boot.bin.new?\" -e \"s?BINFILE2?u-boot.env.new?\" %s/test/py/tests/test_efi_capsule/uboot_bin_env.its > %s/uboot_bin_env.its' %
- (u_boot_config.source_dir, data_dir),
- shell=True)
- check_call('cd %s; %s/tools/mkimage -f uboot_bin_env.its uboot_bin_env.itb' %
- (data_dir, u_boot_config.build_dir),
- shell=True)
- check_call('cd %s; %s/tools/mkeficapsule --index 1 --guid 09D7CF52-0720-4710-91D1-08469B7FE9C8 u-boot.bin.new Test01' %
- (data_dir, u_boot_config.build_dir),
- shell=True)
- check_call('cd %s; %s/tools/mkeficapsule --index 2 --guid 5A7021F5-FEF2-48B4-AABA-832E777418C0 u-boot.env.new Test02' %
- (data_dir, u_boot_config.build_dir),
- shell=True)
- check_call('cd %s; %s/tools/mkeficapsule --index 1 --guid 058B7D83-50D5-4C47-A195-60D86AD341C4 u-boot.bin.new Test03' %
- (data_dir, u_boot_config.build_dir),
- shell=True)
- check_call('cd %s; %s/tools/mkeficapsule --index 1 --guid 3673B45D-6A7C-46F3-9E60-ADABB03F7937 uboot_bin_env.itb Test04' %
- (data_dir, u_boot_config.build_dir),
- shell=True)
- check_call('cd %s; %s/tools/mkeficapsule --index 1 --guid 058B7D83-50D5-4C47-A195-60D86AD341C4 uboot_bin_env.itb Test05' %
- (data_dir, u_boot_config.build_dir),
- shell=True)
- check_call('cd %s; %s/tools/mkeficapsule --index 1 --fw-version 5 '
- '--guid 09D7CF52-0720-4710-91D1-08469B7FE9C8 u-boot.bin.new Test101' %
- (data_dir, u_boot_config.build_dir),
- shell=True)
- check_call('cd %s; %s/tools/mkeficapsule --index 2 --fw-version 10 '
- '--guid 5A7021F5-FEF2-48B4-AABA-832E777418C0 u-boot.env.new Test102' %
- (data_dir, u_boot_config.build_dir),
- shell=True)
- check_call('cd %s; %s/tools/mkeficapsule --index 1 --fw-version 2 '
- '--guid 09D7CF52-0720-4710-91D1-08469B7FE9C8 u-boot.bin.new Test103' %
- (data_dir, u_boot_config.build_dir),
- shell=True)
- check_call('cd %s; %s/tools/mkeficapsule --index 1 --fw-version 5 '
- '--guid 3673B45D-6A7C-46F3-9E60-ADABB03F7937 uboot_bin_env.itb Test104' %
- (data_dir, u_boot_config.build_dir),
- shell=True)
- check_call('cd %s; %s/tools/mkeficapsule --index 1 --fw-version 2 '
- '--guid 3673B45D-6A7C-46F3-9E60-ADABB03F7937 uboot_bin_env.itb Test105' %
- (data_dir, u_boot_config.build_dir),
- shell=True)
-
- if capsule_auth_enabled:
- # raw firmware signed with proper key
- check_call('cd %s; '
- '%s/tools/mkeficapsule --index 1 --monotonic-count 1 '
- '--private-key SIGNER.key --certificate SIGNER.crt '
- '--guid 09D7CF52-0720-4710-91D1-08469B7FE9C8 '
- 'u-boot.bin.new Test11'
- % (data_dir, u_boot_config.build_dir),
- shell=True)
- # raw firmware signed with *mal* key
- check_call('cd %s; '
- '%s/tools/mkeficapsule --index 1 --monotonic-count 1 '
- '--private-key SIGNER2.key '
- '--certificate SIGNER2.crt '
- '--guid 09D7CF52-0720-4710-91D1-08469B7FE9C8 '
- 'u-boot.bin.new Test12'
- % (data_dir, u_boot_config.build_dir),
- shell=True)
- # FIT firmware signed with proper key
- check_call('cd %s; '
- '%s/tools/mkeficapsule --index 1 --monotonic-count 1 '
- '--private-key SIGNER.key --certificate SIGNER.crt '
- '--guid 3673B45D-6A7C-46F3-9E60-ADABB03F7937 '
- 'uboot_bin_env.itb Test13'
- % (data_dir, u_boot_config.build_dir),
- shell=True)
- # FIT firmware signed with *mal* key
- check_call('cd %s; '
- '%s/tools/mkeficapsule --index 1 --monotonic-count 1 '
- '--private-key SIGNER2.key '
- '--certificate SIGNER2.crt '
- '--guid 3673B45D-6A7C-46F3-9E60-ADABB03F7937 '
- 'uboot_bin_env.itb Test14'
- % (data_dir, u_boot_config.build_dir),
- shell=True)
- # raw firmware signed with proper key with version information
- check_call('cd %s; '
- '%s/tools/mkeficapsule --index 1 --monotonic-count 1 '
- '--fw-version 5 '
- '--private-key SIGNER.key --certificate SIGNER.crt '
- '--guid 09D7CF52-0720-4710-91D1-08469B7FE9C8 '
- 'u-boot.bin.new Test111'
- % (data_dir, u_boot_config.build_dir),
- shell=True)
- # raw firmware signed with proper key with version information
- check_call('cd %s; '
- '%s/tools/mkeficapsule --index 2 --monotonic-count 1 '
- '--fw-version 10 '
- '--private-key SIGNER.key --certificate SIGNER.crt '
- '--guid 5A7021F5-FEF2-48B4-AABA-832E777418C0 '
- 'u-boot.env.new Test112'
- % (data_dir, u_boot_config.build_dir),
- shell=True)
- # raw firmware signed with proper key with lower version information
- check_call('cd %s; '
- '%s/tools/mkeficapsule --index 1 --monotonic-count 1 '
- '--fw-version 2 '
- '--private-key SIGNER.key --certificate SIGNER.crt '
- '--guid 09D7CF52-0720-4710-91D1-08469B7FE9C8 '
- 'u-boot.bin.new Test113'
- % (data_dir, u_boot_config.build_dir),
- shell=True)
- # FIT firmware signed with proper key with version information
- check_call('cd %s; '
- '%s/tools/mkeficapsule --index 1 --monotonic-count 1 '
- '--fw-version 5 '
- '--private-key SIGNER.key --certificate SIGNER.crt '
- '--guid 3673B45D-6A7C-46F3-9E60-ADABB03F7937 '
- 'uboot_bin_env.itb Test114'
- % (data_dir, u_boot_config.build_dir),
- shell=True)
- # FIT firmware signed with proper key with lower version information
- check_call('cd %s; '
- '%s/tools/mkeficapsule --index 1 --monotonic-count 1 '
- '--fw-version 2 '
- '--private-key SIGNER.key --certificate SIGNER.crt '
- '--guid 3673B45D-6A7C-46F3-9E60-ADABB03F7937 '
- 'uboot_bin_env.itb Test115'
- % (data_dir, u_boot_config.build_dir),
- shell=True)
-
# Create a disk image with EFI system partition
check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat %s %s' %
(mnt_point, image_path), shell=True)
diff --git a/test/py/tests/test_efi_capsule/uboot_bin_env.its b/test/py/tests/test_efi_capsule/uboot_bin_env.its
deleted file mode 100644
index fc65907481..0000000000
--- a/test/py/tests/test_efi_capsule/uboot_bin_env.its
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Automatic software update for U-Boot
- * Make sure the flashing addresses ('load' prop) is correct for your board!
- */
-
-/dts-v1/;
-
-/ {
- description = "Automatic U-Boot environment update";
- #address-cells = <2>;
-
- images {
- u-boot-bin {
- description = "U-Boot binary on SPI Flash";
- data = /incbin/("BINFILE1");
- compression = "none";
- type = "firmware";
- arch = "sandbox";
- load = <0>;
- hash-1 {
- algo = "sha1";
- };
- };
- u-boot-env {
- description = "U-Boot environment on SPI Flash";
- data = /incbin/("BINFILE2");
- compression = "none";
- type = "firmware";
- arch = "sandbox";
- load = <0>;
- hash-1 {
- algo = "sha1";
- };
- };
- };
-};
--
2.34.1
More information about the U-Boot
mailing list