Initial commit

meta-google/recipes-phosphor/flash/inplace-gbmc-update/40-inplace-gbmc-upgrade.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+[ -z "${inplace_gbmc_upgrade-}" ] || exit
+
+# SC doesn't know another file depends on this variable
+# shellcheck disable=SC2034
+GBMC_UPGRADE_IMG=/run/initramfs/bmc-image
+
+gbmc_upgrade_internal() {
+  local version
+  version="$(gbmc_upgrade_fetch)" || return
+
+  echo "IMG Version: $version" >&2
+  local active_version
+  active_version="$(inplace-gbmc-version.sh)" || return
+  echo "Active Version: $active_version" >&2
+  if [[ "$version" == "$active_version" ]]; then
+    echo 'Version already active' >&2
+    return 0
+  fi
+
+  echo 'Verifying image' >&2
+  systemctl start inplace-gbmc-verify || return
+  echo 'Rebooting to perform update' >&2
+  reboot || return
+  # Ensure that we don't "complete" the netboot process until
+  # after the update completes
+  exit 0
+}
+
+inplace_gbmc_upgrade=1

meta-google/recipes-phosphor/flash/inplace-gbmc-update/config-bmc.json

@@ -0,0 +1,33 @@
+[{
+	"blob": "/flash/image",
+	"version": {
+		"handler": {
+			"type": "file",
+			"path": "/run/inplace-gbmc-version"
+		},
+		"actions":{
+			"open": {
+				"type": "systemd",
+				"unit": "inplace-gbmc-version.service"
+			}
+		}
+	},
+	"handler": {
+		"type": "file",
+		"path": "/run/initramfs/bmc-image"
+	},
+	"actions": {
+		"preparation": {
+			"type": "skip"
+		},
+		"verification": {
+			"type": "systemd",
+			"unit": "inplace-gbmc-verify.service"
+		},
+		"update": {
+			"type": "systemd",
+			"unit": "reboot.target",
+			"mode": "replace-irreversibly"
+		}
+	}
+}]

meta-google/recipes-phosphor/flash/inplace-gbmc-update/inplace-gbmc-verify.service

@@ -0,0 +1,6 @@
+[Unit]
+Description=Verify the Flash Image File
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/inplace-gbmc-verify.sh

meta-google/recipes-phosphor/flash/inplace-gbmc-update/inplace-gbmc-verify.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+# This script will check the signature for the BMC image against
+# the baked in keyring available.  If any aspect of this fails,
+# the scripts returns non-zero and this can be reported to the
+# host.
+#
+# 1. Verify the image
+# 2. Rename the image
+
+SIGNATURE_FILE=/tmp/bmc.sig
+STATUS_FILE=/tmp/bmc.verify
+
+# Store in /run/initramfs because the behaviour of mv changes
+# depending on whether the file is moving within a tree or not.
+IMAGE_FILE=/run/initramfs/bmc-image
+VERIFIED_FILE=/run/initramfs/image-bmc
+
+# Make sure we run ERR traps when a function returns an error
+set -e
+
+# Write out the result of the script to a status file upon exiting
+# normally or due to an error
+exit_handler() {
+  local status="$?"
+  if (( status == 0 )); then
+    echo "success" >"${STATUS_FILE}"
+  else
+    echo "failed" >"${STATUS_FILE}"
+  fi
+  trap - EXIT ERR
+  exit "$status"
+}
+trap exit_handler EXIT ERR
+
+echo "running" > ${STATUS_FILE}
+
+# Verify the image.
+verify-bmc-image.sh @ALLOW_DEV@ "$IMAGE_FILE" "$SIGNATURE_FILE" || exit
+
+# Rename the staged file for initramfs updates.
+mv ${IMAGE_FILE} ${VERIFIED_FILE}

meta-google/recipes-phosphor/flash/inplace-gbmc-update/inplace-gbmc-version.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=Version string for inplace BMC
+
+[Service]
+Type=oneshot
+StandardOutput=file:/run/inplace-gbmc-version
+StandardError=journal
+ExecStartPre=/bin/rm -f /run/inplace-gbmc-version
+ExecStart=/usr/bin/inplace-gbmc-version.sh

meta-google/recipes-phosphor/flash/inplace-gbmc-update/inplace-gbmc-version.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+grep '^VERSION_ID=' /etc/os-release | sed 's,.*-\([^-]*\),\1,g' | tr -d '\n'