Generate the capsule

Capsule generation tools create capsule files that update firmware on devices. They package firmware updates into a format that can be installed directly on hardware. These tools work on both Linux and Windows, offering flexibility for different development environments. To keep updates secure and verified, they use OpenSSL for generating and signing certificates. Prerequisites to run the capsule Before you begin, do the following:

• Generate the capsule. For scripts and instructions, see: https://github.com/qualcomm/cbsp-boot-utilities/tree/main/uefi_capsule_generation.
• Obtain the git clone link cbsp-boot-utilities/uefi_capsule_generation/ directory at https://github.com/qualcomm/cbsp-boot-utilities.git.

The following tools are required for Linux and Windows.

​

Sign the capsule

To sign capsule-based system firmware updates using the instructions from the Capsule Generation, follow these steps:

1. Generate signing keys:
   • Use OpenSSL command line utilities to create a new self-signed X.509 certificate chain. This involves generating a private key and a corresponding public certificate.
   • The system uses the private key to sign the firmware update capsules, and the UEFI firmware uses the public certificate to verify the signature.
2. Sign the firmware update capsule:
   • Use the signing keys to sign the firmware update capsule. This process authenticates the capsule and ensures it hasn’t been tampered with.
   • The signing process involves creating a hash of the firmware update payload and then encrypting this hash with the private key to create a digital signature.
   • Place these certificates in a folder named `Certificates’. Sample files available in this folder might include QcFMPCert.pem, QcFMPRoot.pub.pem, and QcFMPSub.pub.pem.
3. Verify the capsule:
   • The UEFI firmware uses the public certificate to verify the digital signature on the capsule. If the signature is valid and matches the trusted certificate, the firmware update process will proceed.
   • The boot devicetree (DT) provides the root certificate—either QcFMPRoot.cer or NewRoot.cer at the following node: /sw/uefi/uefiplat/QcCapsuleRootCert.
   • This boot DT node is a UEFI DT node, so its binary location depends on the platform. On platforms where xbl_config.elf contains both XBL and UEFI DT nodes, it’s part of xbl_config.elf. On platforms where the UEFI DT nodes are split out, it’s part of uefi_dtbs.elf (or its compressed/KVM variants) instead. For the full platform breakdown, see Boot interfaces overview. Either file can be updated using the QDTE tool.
   • Capsule update can only be performed if the root certificate is already present on the device, specifically within this boot DT node.
   • Ensure the certificate is correctly embedded in the applicable binary and available on the device before initiating any capsule update process.

This verification step ensures the system applies only authorized firmware updates.