flashy: Support getting ImageFormats via buildname and add grandcanyon image formats

[lhl2617]

Summary

Corresponding diff in fw-util: bc32863

Previously flashy was not able to acquire platform-specific image formats that are used to validate images/devices. This diff introduces a feature in which the ImageFormats to validate against are obtained via the buildname from /etc/issue.

This feature is required as grandcanyon is retrofitted to vboot as in bc32863

Test plan

Unit tests go test ./...
Please help run validation tests as per bc32863

/opt/flashy -checkimage -imagepath <IMAGE>

[lhl2617]

This was moved from the validate package (to prevent an import cycle)

[facebook-github-bot]

@kawmarco has imported this pull request. If you are a Facebook employee, you can view this diff on Phabricator.

[lhl2617]

Ah--I also meant to start another discussion here--instead of doing it this way which hides platform-specific checks embedded inside the image validation logic I was wondering if making a step tools/flashy/checks_and_remediations/common/41_validate_image_partitions.go for every platform would be a more sensible choice?

The problem is that the check-image utility will not be privy to that (and hence will wrongly validate the image and allow non-vboot images to pass validation). Every single platform would also require its XX_validate_image_partitions.go step, which if we forgot to add would mean forgoing the very important step of validating images.

[lhl2617]

Ah--I also meant to start another discussion here--instead of doing it this way which hides platform-specific checks embedded inside the image validation logic I was wondering if making a step tools/flashy/checks_and_remediations/common/41_validate_image_partitions.go for every platform would be a more sensible choice?

The problem is that the check-image utility will not be privy to that (and hence will wrongly validate the image and allow non-vboot images to pass validation). Every single platform would also require its XX_validate_image_partitions.go step, which if we forgot to add would mean forgoing the very important step of validating images.

@kawmarco should we make image validation a platform-specific step with a step file for every single platform? That way we can specify the formats that are valid for each platform, which is a plus.

The problem would arise when one forgets to create this step for a new platform--but hopefully cross-checking this with flashy should not be a problem: I will write a test to make sure that all buildnames in https://github.com/facebook/openbmc/blob/helium/tools/platforms/platform_build_names has a corresponding image validation step and also flash step if necessary.

[kawmarco]

Hey @lhl2617, thanks for bringing up the discussion. I think it should be good to move it to a platform-specific step for now as AFAIK it's the only platform that needs this check. In the future, we can try figuring out if we need a better abstraction for this but, given this is only needed for systems transitioning to vboot, these likely won't be needed for most of the platform's lifetime (i.e. eventually production and factory systems will be all vboot enabled, and the non-vboot version should fail normal vboot checks).

The problem is that the check-image utility will not be privy to that (and hence will wrongly validate the image and allow non-vboot images to pass validation

Sounds like a reasonable compromise to me 👍

[lhl2617]

There will be some tricky conflicts to fix with #150, so I'll implement this after that gets merged into helium.

[lhl2617]

Superseded by #156