From patchwork Mon Aug 3 10:14:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alex Chapman X-Patchwork-Id: 94305 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C93DC55175 for ; Mon, 3 Aug 2026 10:14:32 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.40114.1785752066674227450 for ; Mon, 03 Aug 2026 03:14:26 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@arm.com header.s=foss header.b=nGCXf0/L; spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: alex.chapman@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 2CF1B143D; Mon, 3 Aug 2026 03:14:22 -0700 (PDT) Received: from e142474.cambridge.arm.com (e142474.arm.com [10.2.203.50]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 792043F632; Mon, 3 Aug 2026 03:14:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1785752066; bh=BjYSDtxnhFS89EbBcxalZrKBFvBDqYyPZzlYxW+lU+8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nGCXf0/L68CquLPKfcvp867aO/SziT3BKMjZaZBTdqG+IAdDi/YGdo+xkOxudZAm8 CFGMUKx0KNAEfJZ2ZfMM2rIuaRzQJrkrV3sDHaUmQMCzumDucIx6iAB2Lj2vWaerWn LmoGA1BaSQl9NBYGotPxIhmXEa/XsqEqN90EoO5s= From: Alex Chapman To: meta-arm@lists.yoctoproject.org Cc: Alex Chapman Subject: [PATCH 1/2] arm-bsp/docs:corstone1000/a320: Use kas shell for capsule generation Date: Mon, 3 Aug 2026 11:14:00 +0100 Message-ID: <20260803101401.3496378-2-alex.chapman@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260803101401.3496378-1-alex.chapman@arm.com> References: <20260803101401.3496378-1-alex.chapman@arm.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 10:14:32 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/meta-arm/message/7135 - Replace manual partial and rollback capsule generation with a kas shell command - Remove incorrect MPS3 capsule transfer instructions - Fix broken MPS3 section header - Update incorrect capsule amount in instructions Shortens documentation and improves clarity in capsule generation, making it easier to see how the partial and rollback capsules differ. Also correct the capsule count in the test setup instructions. Signed-off-by: Alex Chapman --- .../corstone1000-a320/topics/tests.md | 138 +++------------ .../documentation/corstone1000/user-guide.rst | 161 ++++-------------- 2 files changed, 56 insertions(+), 243 deletions(-) diff --git a/meta-arm-bsp/documentation/corstone1000-a320/topics/tests.md b/meta-arm-bsp/documentation/corstone1000-a320/topics/tests.md index 90cd87c5..c22ff6db 100644 --- a/meta-arm-bsp/documentation/corstone1000-a320/topics/tests.md +++ b/meta-arm-bsp/documentation/corstone1000-a320/topics/tests.md @@ -192,20 +192,11 @@ The following payloads can be individually updated: ### Generate capsules {.reference} -[EDK II's]($edk2_repository) `GenerateCapsule` tool is used to generate capsules and is built automatically -for the host machine during the firmware image building process. -The tool can be found at `${WORKSPACE}/build/tmp/sysroots-components/aarch64/edk2-basetools-native/usr/bin/edk2-BaseTools/BinWrappers/PosixLike/GenerateCapsule`. +Capsules are generated by running the `image_uefi_capsule` task for +`corstone1000-flash-firmware-image`. The task uses EDK II's `GenerateCapsule` +tool and creates the capsule metadata JSON automatically from the recipe settings. -:::note -The `aarch64` part of this path depends on the build host architecture -and can be different on another host. -::: - -A JSON file containing metadata about the capsule payloads needs to be created using the script -found at `${WORKSPACE}/meta-arm/meta-arm/scripts/generate_capsule_json_multiple.py`. -This JSON file is required by EDK II's `GenerateCapsule` tool to generate the capsule. - -The capsule's default metadata passed can be found in the `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-bsp/images/corstone1000-flash-firmware-image.bb` +The capsule's default metadata can be found in the `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-bsp/images/corstone1000-flash-firmware-image.bb` and `${WORKSPACE}/meta-arm/kas/corstone1000-image-configuration.yml` files. #### Valid full capsule {.reference} @@ -222,116 +213,39 @@ To generate a capsule that updates only a single component, explicitly set the f The partial capsule is also valid, but sets the firmware version to 7 only for the BL2 component, indicating that no other components should be updated. -Use the following commands to generate the `capsule_config.json` file, which is required by the EDK2 tool for capsule creation: - -``` -cd ${WORKSPACE} - -python3 meta-arm/meta-arm/scripts/generate_capsule_json_multiple.py \ ---selected_components DUMMY_START BL2 DUMMY_END \ ---components DUMMY_START BL2 TFM_S FIP INITRAMFS DUMMY_END \ ---fw_versions 0 7 0 0 0 0 \ ---guids \ -6f784cbf-7938-5c23-8d6e-24d2f1410fa9 \ -${BL2_GUID} ${TFM_S_GUID} ${FIP_GUID} ${INITRAMFS_GUID} \ -b57e432b-a250-5c73-93e3-90205e64baba \ ---hardware_instances 1 1 1 1 1 1 \ ---lowest_supported_versions 5 5 5 5 5 5 \ ---monotonic_counts 1 1 1 1 1 1 \ ---payloads \ -build/tmp/work/corstone1000_a320_fvp-poky-linux-musl/corstone1000-flash-firmware-image/1.0/sources/corstone1000-flash-firmware-image-1.0/dummy.bin \ -build/tmp/deploy/images/corstone1000-a320-fvp/trusted-firmware-m/bl2_signed.bin \ -build/tmp/deploy/images/corstone1000-a320-fvp/trusted-firmware-m/tfm_s_signed.bin \ -build/tmp/deploy/images/corstone1000-a320-fvp/signed_fip.bin \ -build/tmp/deploy/images/corstone1000-a320-fvp/Image.gz-initramfs-corstone1000-a320-fvp.bin \ -build/tmp/work/corstone1000_a320_fvp-poky-linux-musl/corstone1000-flash-firmware-image/1.0/sources/corstone1000-flash-firmware-image-1.0/dummy.bin \ ---update_image_indexes 5 1 2 3 4 6 \ ---private_keys \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_key.key \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_key.key \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_key.key \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_key.key \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_key.key \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_key.key \ ---certificates \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_cert.crt \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_cert.crt \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_cert.crt \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_cert.crt \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_cert.crt \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_cert.crt \ ---output capsule_config.json -``` - Run the command below to generate the partial capsule: ``` -./build/tmp/sysroots-components/aarch64/edk2-basetools-native/usr/bin/edk2-BaseTools/BinWrappers/PosixLike/GenerateCapsule \ --e \ --j capsule_config.json \ ---capflag PersistAcrossReset \ --o corstone1000-a320-fvp-partial-v7.uefi.capsule +cd ${WORKSPACE} +kas shell meta-arm/kas/corstone1000-a320-fvp.yml:meta-arm/ci/debug.yml -c ' + echo "CAPSULE_VERSION = \"7\"" >> conf/local.conf + echo "CAPSULE_LOWEST_SUPPORTED_VERSION = \"7\"" >> conf/local.conf + echo "CAPSULE_SELECTED_COMPONENTS = \"BL2\"" >> conf/local.conf + bitbake corstone1000-flash-firmware-image -c image_uefi_capsule +' ``` -The partial capsule will be located in the `${WORKSPACE}` directory. +The partial capsule will be located at +`${WORKSPACE}/build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000-a320-fvp-v7.uefi.capsule`. -#### Invalid capsule {.reference} +#### Rollback capsule {.reference} Generate a capsule with firmware version metadata for all payloads set lower than that of a valid capsule. The valid capsule has a default firmware version of 6 for all payloads, while the simulated invalid capsule has the firmware version set to 5 for all payloads. -Use the following commands to generate the `capsule_config.json` file, which is required by the EDK2 tool for capsule creation: +Run the command below to generate the rollback capsule: ``` cd ${WORKSPACE} - -python3 meta-arm/meta-arm/scripts/generate_capsule_json_multiple.py \ ---selected_components DUMMY_START BL2 TFM_S FIP INITRAMFS DUMMY_END \ ---components DUMMY_START BL2 TFM_S FIP INITRAMFS DUMMY_END \ ---fw_versions 5 5 5 5 5 5 \ ---guids \ -6f784cbf-7938-5c23-8d6e-24d2f1410fa9 \ -${BL2_GUID} ${TFM_S_GUID} ${FIP_GUID} ${INITRAMFS_GUID} \ -b57e432b-a250-5c73-93e3-90205e64baba \ ---hardware_instances 1 1 1 1 1 1 \ ---lowest_supported_versions 5 5 5 5 5 5 \ ---monotonic_counts 1 1 1 1 1 1 \ ---payloads \ -build/tmp/work/corstone1000_a320_fvp-poky-linux-musl/corstone1000-flash-firmware-image/1.0/sources/corstone1000-flash-firmware-image-1.0/dummy.bin \ -build/tmp/deploy/images/corstone1000-a320-fvp/trusted-firmware-m/bl2_signed.bin \ -build/tmp/deploy/images/corstone1000-a320-fvp/trusted-firmware-m/tfm_s_signed.bin \ -build/tmp/deploy/images/corstone1000-a320-fvp/signed_fip.bin \ -build/tmp/deploy/images/corstone1000-a320-fvp/Image.gz-initramfs-corstone1000-a320-fvp.bin \ -build/tmp/work/corstone1000_a320_fvp-poky-linux-musl/corstone1000-flash-firmware-image/1.0/sources/corstone1000-flash-firmware-image-1.0/dummy.bin \ ---update_image_indexes 5 1 2 3 4 6 \ ---private_keys \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_key.key \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_key.key \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_key.key \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_key.key \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_key.key \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_key.key \ ---certificates \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_cert.crt \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_cert.crt \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_cert.crt \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_cert.crt \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_cert.crt \ -build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000_capsule_cert.crt \ ---output capsule_config.json -``` - -Run the command below to generate the invalid capsule: - -``` -./build/tmp/sysroots-components/aarch64/edk2-basetools-native/usr/bin/edk2-BaseTools/BinWrappers/PosixLike/GenerateCapsule \ --e \ --j capsule_config.json \ ---capflag PersistAcrossReset \ --o corstone1000-a320-fvp-v5.uefi.capsule +kas shell meta-arm/kas/corstone1000-a320-fvp.yml:meta-arm/ci/debug.yml -c ' + echo "CAPSULE_VERSION = \"5\"" >> conf/local.conf + echo "CAPSULE_LOWEST_SUPPORTED_VERSION = \"5\"" >> conf/local.conf + bitbake corstone1000-flash-firmware-image -c image_uefi_capsule +' ``` -The invalid capsule will be located in the `${WORKSPACE}` directory. +The rollback capsule will be located at +`${WORKSPACE}/build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000-a320-fvp-v5.uefi.capsule`. ### Transfer capsules to target {.reference} @@ -369,8 +283,8 @@ as opposed to the on-disk method (delivery of capsules using a file on a mass st ``` sudo cp ${WORKSPACE}/build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000-a320-fvp-v6.uefi.capsule /mnt/ir-acs-live-image-generic-arm64/ - sudo cp ${WORKSPACE}/corstone1000-a320-fvp-v5.uefi.capsule /mnt/ir-acs-live-image-generic-arm64/ - sudo cp ${WORKSPACE}/corstone1000-a320-fvp-partial-v7.uefi.capsule /mnt/ir-acs-live-image-generic-arm64/ + sudo cp ${WORKSPACE}/build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000-a320-fvp-v5.uefi.capsule /mnt/ir-acs-live-image-generic-arm64/ + sudo cp ${WORKSPACE}/build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000-a320-fvp-v7.uefi.capsule /mnt/ir-acs-live-image-generic-arm64/ sync ``` @@ -401,7 +315,7 @@ To run the test: cd ${WORKSPACE} && tmux ``` - 2. Run the FVP within `tmux` with the IR prebuilt image which now also contains the two capsules: + 2. Run the FVP within `tmux` with the IR prebuilt image which now also contains the three capsules: ``` kas shell meta-arm/kas/corstone1000-a320-fvp.yml:meta-arm/ci/debug.yml \ @@ -526,7 +440,7 @@ Do not terminate FVP between the positive full capsule update and partial capsul #### Positive partial capsule update {.reference} -Follow the steps for the [Positive full capsule update test], ensuring you use `corstone1000-a320-fvp-partial-v7.uefi.capsule` instead of `corstone1000-a320-fvp-v6.uefi.capsule`. +Follow the steps for the [Positive full capsule update test], ensuring you use `corstone1000-a320-fvp-v7.uefi.capsule` instead of `corstone1000-a320-fvp-v6.uefi.capsule`. Once the system has fully booted again, read [Verifying firmware versions with ESRT] to confirm that the firmware version reflects the updated capsule. diff --git a/meta-arm-bsp/documentation/corstone1000/user-guide.rst b/meta-arm-bsp/documentation/corstone1000/user-guide.rst index 72dd37b8..36c6ae35 100644 --- a/meta-arm-bsp/documentation/corstone1000/user-guide.rst +++ b/meta-arm-bsp/documentation/corstone1000/user-guide.rst @@ -942,20 +942,11 @@ The following payloads can be individually updated: Generate Capsules ***************** -`EDK II's `__ ``GenerateCapsule`` tool is used to generate capsules and is built automatically -for the host machine during the firmware image building process. -The tool can be found at ``${WORKSPACE}/build/tmp/sysroots-components/aarch64/edk2-basetools-native/usr/bin/edk2-BaseTools/BinWrappers/PosixLike/GenerateCapsule``. +Capsules are generated by running the ``image_uefi_capsule`` task for +``corstone1000-flash-firmware-image``. The task uses EDK II's ``GenerateCapsule`` +tool and creates the capsule metadata JSON automatically from the recipe settings. -.. note:: - - The ``aarch64`` part of this path depends on the build host architecture - and can be different on another host. - -A JSON file containing metadata about the capsule payloads needs to be created using the script -found at ``${WORKSPACE}/meta-arm/meta-arm/scripts/generate_capsule_json_multiple.py``. -This JSON file is required by EDK II's ``GenerateCapsule`` tool to generate the capsule. - -The capsule's default metadata passed can be found in the ``${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-bsp/images/corstone1000-flash-firmware-image.bb`` +The capsule's default metadata can be found in the ``${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-bsp/images/corstone1000-flash-firmware-image.bb`` and ``${WORKSPACE}/meta-arm/kas/corstone1000-image-configuration.yml`` files. Valid Full Capsule @@ -974,118 +965,40 @@ To generate a capsule that updates only a single component, explicitly set the f The **partial capsule** is also valid, but sets the firmware version to **7** **only** for the **BL2** component, indicating that no other components should be updated. -Use the following commands to generate the `capsule_config.json` file, which is required by the EDK2 tool for capsule creation: - -.. code-block:: console - - cd ${WORKSPACE} - - python3 meta-arm/meta-arm/scripts/generate_capsule_json_multiple.py \ - --selected_components DUMMY_START BL2 DUMMY_END \ - --components DUMMY_START BL2 TFM_S FIP INITRAMFS DUMMY_END \ - --fw_versions 0 7 0 0 0 0 \ - --guids \ - 6f784cbf-7938-5c23-8d6e-24d2f1410fa9 \ - ${BL2_GUID} ${TFM_S_GUID} ${FIP_GUID} ${INITRAMFS_GUID} \ - b57e432b-a250-5c73-93e3-90205e64baba \ - --hardware_instances 1 1 1 1 1 1 \ - --lowest_supported_versions 5 5 5 5 5 5 \ - --monotonic_counts 1 1 1 1 1 1 \ - --payloads \ - build/tmp/work/corstone1000_${TARGET}-poky-linux-musl/corstone1000-flash-firmware-image/1.0/sources/corstone1000-flash-firmware-image-1.0/dummy.bin \ - build/tmp/deploy/images/corstone1000-${TARGET}/trusted-firmware-m/bl2_signed.bin \ - build/tmp/deploy/images/corstone1000-${TARGET}/trusted-firmware-m/tfm_s_signed.bin \ - build/tmp/deploy/images/corstone1000-${TARGET}/signed_fip.bin \ - build/tmp/deploy/images/corstone1000-${TARGET}/Image.gz-initramfs-corstone1000-${TARGET}.bin \ - build/tmp/work/corstone1000_${TARGET}-poky-linux-musl/corstone1000-flash-firmware-image/1.0/sources/corstone1000-flash-firmware-image-1.0/dummy.bin \ - --update_image_indexes 5 1 2 3 4 6 \ - --private_keys \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_key.key \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_key.key \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_key.key \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_key.key \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_key.key \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_key.key \ - --certificates \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_cert.crt \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_cert.crt \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_cert.crt \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_cert.crt \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_cert.crt \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_cert.crt \ - --output capsule_config.json - Run the command below to generate the partial capsule: .. code-block:: console - ./build/tmp/sysroots-components/aarch64/edk2-basetools-native/usr/bin/edk2-BaseTools/BinWrappers/PosixLike/GenerateCapsule \ - -e \ - -j capsule_config.json \ - --capflag PersistAcrossReset \ - -o corstone1000-${TARGET}-partial-v7.uefi.capsule + cd ${WORKSPACE} + kas shell meta-arm/kas/corstone1000-${TARGET}.yml:meta-arm/ci/debug.yml -c ' + echo "CAPSULE_VERSION = \"7\"" >> conf/local.conf + echo "CAPSULE_LOWEST_SUPPORTED_VERSION = \"7\"" >> conf/local.conf + echo "CAPSULE_SELECTED_COMPONENTS = \"BL2\"" >> conf/local.conf + bitbake corstone1000-flash-firmware-image -c image_uefi_capsule + ' -The partial capsule will be located in the ``${WORKSPACE}`` directory. +The partial capsule will be located at +``${WORKSPACE}/build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000-${TARGET}-v7.uefi.capsule``. -Invalid Capsule -=============== +Rollback Capsule +================ Generate a capsule with firmware version metadata for all payloads set lower than that of a valid capsule. The valid capsule has a default firmware version of 6 for all payloads, while the simulated invalid capsule has the firmware version set to 5 for all payloads. -Use the following commands to generate the `capsule_config.json` file, which is required by the EDK2 tool for capsule creation: +Run the command below to generate the rollback capsule: .. code-block:: console cd ${WORKSPACE} + kas shell meta-arm/kas/corstone1000-${TARGET}.yml:meta-arm/ci/debug.yml -c ' + echo "CAPSULE_VERSION = \"5\"" >> conf/local.conf + echo "CAPSULE_LOWEST_SUPPORTED_VERSION = \"5\"" >> conf/local.conf + bitbake corstone1000-flash-firmware-image -c image_uefi_capsule + ' - python3 meta-arm/meta-arm/scripts/generate_capsule_json_multiple.py \ - --selected_components DUMMY_START BL2 TFM_S FIP INITRAMFS DUMMY_END \ - --components DUMMY_START BL2 TFM_S FIP INITRAMFS DUMMY_END \ - --fw_versions 5 5 5 5 5 5 \ - --guids \ - 6f784cbf-7938-5c23-8d6e-24d2f1410fa9 \ - ${BL2_GUID} ${TFM_S_GUID} ${FIP_GUID} ${INITRAMFS_GUID} \ - b57e432b-a250-5c73-93e3-90205e64baba \ - --hardware_instances 1 1 1 1 1 1 \ - --lowest_supported_versions 5 5 5 5 5 5 \ - --monotonic_counts 1 1 1 1 1 1 \ - --payloads \ - build/tmp/work/corstone1000_${TARGET}-poky-linux-musl/corstone1000-flash-firmware-image/1.0/sources/corstone1000-flash-firmware-image-1.0/dummy.bin \ - build/tmp/deploy/images/corstone1000-${TARGET}/trusted-firmware-m/bl2_signed.bin \ - build/tmp/deploy/images/corstone1000-${TARGET}/trusted-firmware-m/tfm_s_signed.bin \ - build/tmp/deploy/images/corstone1000-${TARGET}/signed_fip.bin \ - build/tmp/deploy/images/corstone1000-${TARGET}/Image.gz-initramfs-corstone1000-${TARGET}.bin \ - build/tmp/work/corstone1000_${TARGET}-poky-linux-musl/corstone1000-flash-firmware-image/1.0/sources/corstone1000-flash-firmware-image-1.0/dummy.bin \ - --update_image_indexes 5 1 2 3 4 6 \ - --private_keys \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_key.key \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_key.key \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_key.key \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_key.key \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_key.key \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_key.key \ - --certificates \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_cert.crt \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_cert.crt \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_cert.crt \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_cert.crt \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_cert.crt \ - build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000_capsule_cert.crt \ - --output capsule_config.json - - -Run the command below to generate the invalid capsule: - -.. code-block:: console - - ./build/tmp/sysroots-components/aarch64/edk2-basetools-native/usr/bin/edk2-BaseTools/BinWrappers/PosixLike/GenerateCapsule \ - -e \ - -j capsule_config.json \ - --capflag PersistAcrossReset \ - -o corstone1000-${TARGET}-v5.uefi.capsule - -The invalid capsule will be located in the ``${WORKSPACE}`` directory. +The rollback capsule will be located at +``${WORKSPACE}/build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000-${TARGET}-v5.uefi.capsule``. *************************** Transfer Capsules to Target @@ -1094,20 +1007,6 @@ Transfer Capsules to Target The capsule delivery process described below is the direct method (usage of capsules from the ACS image) as opposed to the on-disk method (delivery of capsules using a file on a mass storage device). -MPS3 -==== - -#. Prepare a USB drive as explained in `this `_ section. - -#. Copy the capsule files to the root directory of the ``BOOT`` partition in the USB drive. - - .. code-block:: console - - cp ${WORKSPACE}/build/tmp/deploy/images/corstone1000-mps3/corstone1000-mps3-v6.uefi.capsule /dev/sdc/BOOT/ - cp ${WORKSPACE}/corstone1000-mps3-v5.uefi.capsule /dev/sdc/EFI/BOOT/ - cp ${WORKSPACE}/corstone1000-mps3-partial-v7.uefi.capsule /dev/sdc/EFI/BOOT/ - sync - .. note:: The staging steps below are shared between ``mps3`` and ``fvp``. @@ -1134,10 +1033,10 @@ MPS3 cd ${WORKSPACE} wic cp ${WORKSPACE}/build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000-${TARGET}-v6.uefi.capsule \ ${ACS_STAGED_IMAGE}:1/corstone1000-${TARGET}-v6.uefi.capsule - wic cp ${WORKSPACE}/corstone1000-${TARGET}-v5.uefi.capsule \ + wic cp ${WORKSPACE}/build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000-${TARGET}-v5.uefi.capsule \ ${ACS_STAGED_IMAGE}:1/corstone1000-${TARGET}-v5.uefi.capsule - wic cp ${WORKSPACE}/corstone1000-${TARGET}-partial-v7.uefi.capsule \ - ${ACS_STAGED_IMAGE}:1/corstone1000-${TARGET}-partial-v7.uefi.capsule + wic cp ${WORKSPACE}/build/tmp/deploy/images/corstone1000-${TARGET}/corstone1000-${TARGET}-v7.uefi.capsule \ + ${ACS_STAGED_IMAGE}:1/corstone1000-${TARGET}-v7.uefi.capsule .. important:: @@ -1145,7 +1044,7 @@ MPS3 as doing so might inadvertently trigger the on-disk update method. MPS3 -=== +==== #. Write ``${ACS_STAGED_IMAGE}`` to the ACS USB drive by following the `MPS3 ACS image steps `_ and replacing @@ -1173,7 +1072,7 @@ Positive Full Capsule Update Test - MPS3: - #. Plug the prepared USB drive which has the IR prebuilt image and two capsules to the MPS3. + #. Plug the prepared USB drive which has the IR prebuilt image and three capsules to the MPS3. #. Power cycle the MPS3. - FVP: @@ -1184,7 +1083,7 @@ Positive Full Capsule Update Test cd ${WORKSPACE} && tmux - #. Run the FVP within ``tmux`` with the IR prebuilt image which now also contains the two capsules: + #. Run the FVP within ``tmux`` with the IR prebuilt image which now also contains the three capsules: .. code-block:: console @@ -1329,7 +1228,7 @@ Positive Partial Capsule Update Test ==================================== Follow the steps for the `positive full capsule update test `__ ensuring you use -``corstone1000-${TARGET}-partial-v7.uefi.capsule`` instead of ``corstone1000-${TARGET}-v6.uefi.capsule``. +``corstone1000-${TARGET}-v7.uefi.capsule`` instead of ``corstone1000-${TARGET}-v6.uefi.capsule``. Once the system has fully booted again, `read the ESRT `__ to confirm that the firmware version reflects the updated capsule.