From: Fabio Estevam <[email protected]> Remove the local DT validation patch as it has been upstreamed.
Add the submitted mkeficapsule PKCS#11 detection patch so u-boot-tools can build with target GnuTLS configurations that do not enable p11-kit. Signed-off-by: Fabio Estevam <[email protected]> --- Changes since v1: - Apply a U-Boot patch to fix the mkeficapsule build error. ...ripts-dtc-drop-yaml-in-DT-validation.patch | 85 --------- ...apsule-Detect-GnuTLS-PKCS-11-support.patch | 179 ++++++++++++++++++ meta/recipes-bsp/u-boot/u-boot-common.inc | 2 +- .../u-boot/u-boot-tools_2026.04.bb | 4 - .../u-boot/u-boot-tools_2026.07.bb | 4 + .../{u-boot_2026.04.bb => u-boot_2026.07.bb} | 3 - 6 files changed, 184 insertions(+), 93 deletions(-) delete mode 100644 meta/recipes-bsp/u-boot/files/0001-scripts-dtc-drop-yaml-in-DT-validation.patch create mode 100644 meta/recipes-bsp/u-boot/files/0001-tools-mkeficapsule-Detect-GnuTLS-PKCS-11-support.patch delete mode 100644 meta/recipes-bsp/u-boot/u-boot-tools_2026.04.bb create mode 100644 meta/recipes-bsp/u-boot/u-boot-tools_2026.07.bb rename meta/recipes-bsp/u-boot/{u-boot_2026.04.bb => u-boot_2026.07.bb} (84%) diff --git a/meta/recipes-bsp/u-boot/files/0001-scripts-dtc-drop-yaml-in-DT-validation.patch b/meta/recipes-bsp/u-boot/files/0001-scripts-dtc-drop-yaml-in-DT-validation.patch deleted file mode 100644 index 9c1adc8faf..0000000000 --- a/meta/recipes-bsp/u-boot/files/0001-scripts-dtc-drop-yaml-in-DT-validation.patch +++ /dev/null @@ -1,85 +0,0 @@ -From e77402000f978561ff2afe405aa9e5c9037a8717 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jo=C3=A3o=20Marcos=20Costa?= <[email protected]> -Date: Wed, 29 Apr 2026 15:22:25 +0200 -Subject: [PATCH] scripts/dtc: drop yaml in DT validation -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The build issues found in dtc/yamltree were partially mitigated by a -previous commit (807bcd844a: "scripts/dtc: Fix pkg-config behavior under -sysroot"), but upstream dtc simply disabled yaml, and the same should be -done here in order to permanently avoid those issues. - -Backport the change below from Linux v5.18 [1]: - -ef8795f3f1c ("dt-bindings: kbuild: Use DTB files for validation") - -I tested this patch with a couple Yocto builds: u-boot and u-boot-tools, -using the current master branch (rev. "c53b0708f9"), having removed -libyaml-native from u-boot-tools's dependencies. - -[1] https://git.kernel.org/linus/ef8795f3f1ce - -Signed-off-by: João Marcos Costa <[email protected]> - -Upstream-Status: Backport [https://github.com/u-boot/u-boot/commit/8ef8dee4f3a2b2021decfefd853dbd2a1632b77f] ---- - scripts/Makefile.lib | 6 ------ - scripts/dtc/Makefile | 8 -------- - scripts/dtc/update-dtc-source.sh | 2 +- - 3 files changed, 1 insertion(+), 15 deletions(-) - -diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib -index b8969b7de54..d66f1ed13b1 100644 ---- a/scripts/Makefile.lib -+++ b/scripts/Makefile.lib -@@ -86,12 +86,6 @@ base-dtb-y := $(foreach m, $(multi-dtb-y), $(firstword $(call suffix-search, $m, - extra-y += $(dtb-y) - extra-$(CONFIG_OF_ALL_DTBS) += $(dtb-) - --# U-Boot specific --ifneq ($(CHECK_DTBS),) --extra-y += $(patsubst %.dtb,%.dt.yaml, $(dtb-y)) --extra-$(CONFIG_OF_ALL_DTBS) += $(patsubst %.dtb,%.dt.yaml, $(dtb-)) --endif -- - # Add subdir path - - extra-y := $(addprefix $(obj)/,$(extra-y)) -diff --git a/scripts/dtc/Makefile b/scripts/dtc/Makefile -index 6f309b37e08..2ba8dba03be 100644 ---- a/scripts/dtc/Makefile -+++ b/scripts/dtc/Makefile -@@ -17,15 +17,7 @@ fdtoverlay-objs := $(libfdt) fdtoverlay.o util.o - # Source files need to get at the userspace version of libfdt_env.h to compile - HOST_EXTRACFLAGS := -I$(srctree)/$(src)/libfdt - --ifeq ($(wildcard $(PKG_CONFIG_SYSROOT_DIR)/usr/include/yaml.h),) - HOST_EXTRACFLAGS += -DNO_YAML --else --dtc-objs += yamltree.o --# To include <yaml.h> installed in a non-default path --HOSTCFLAGS_yamltree.o := $(shell pkg-config --cflags yaml-0.1) --# To link libyaml installed in a non-default path --HOSTLDLIBS_dtc := $(shell pkg-config --libs yaml-0.1) --endif - - # Generated files need one more search path to include headers in source tree - HOSTCFLAGS_dtc-lexer.lex.o := -I$(src) -diff --git a/scripts/dtc/update-dtc-source.sh b/scripts/dtc/update-dtc-source.sh -index 32ff17ffd08..94627541533 100755 ---- a/scripts/dtc/update-dtc-source.sh -+++ b/scripts/dtc/update-dtc-source.sh -@@ -32,7 +32,7 @@ DTC_UPSTREAM_PATH=`pwd`/../dtc - DTC_LINUX_PATH=`pwd`/scripts/dtc - - DTC_SOURCE="checks.c data.c dtc.c dtc.h flattree.c fstree.c livetree.c srcpos.c \ -- srcpos.h treesource.c util.c util.h version_gen.h yamltree.c \ -+ srcpos.h treesource.c util.c util.h version_gen.h \ - dtc-lexer.l dtc-parser.y" - LIBFDT_SOURCE="fdt.c fdt.h fdt_addresses.c fdt_empty_tree.c \ - fdt_overlay.c fdt_ro.c fdt_rw.c fdt_strerror.c fdt_sw.c \ --- -2.47.0 - diff --git a/meta/recipes-bsp/u-boot/files/0001-tools-mkeficapsule-Detect-GnuTLS-PKCS-11-support.patch b/meta/recipes-bsp/u-boot/files/0001-tools-mkeficapsule-Detect-GnuTLS-PKCS-11-support.patch new file mode 100644 index 0000000000..560e391084 --- /dev/null +++ b/meta/recipes-bsp/u-boot/files/0001-tools-mkeficapsule-Detect-GnuTLS-PKCS-11-support.patch @@ -0,0 +1,179 @@ +From 61afc0e98661629711d36d03d2b6084fcd359b30 Mon Sep 17 00:00:00 2001 +From: Wojciech Dubowik <[email protected]> +Date: Fri, 17 Jul 2026 00:00:00 +0000 +Subject: [PATCH] tools: mkeficapsule: Detect GnuTLS PKCS#11 support + +Some distros like OpenEmbedded are using gnutls library +without pkcs11 support and linking of mkeficapsule will fail. +It would make maintenance of default configs a hurdle. +Add detection of pkcs11 support in gnutls so it's enabled +when available and doesn't need to be set explicitly. + +Upstream-Status: Submitted [https://lore.kernel.org/u-boot/[email protected]/T/#u] + +Reviewed-by: Simon Glass <[email protected]> +Acked-by: Quentin Schulz <[email protected]> +Suggested-by: Tom Rini <[email protected]> +Cc: Franz Schnyder <[email protected]> +Signed-off-by: Wojciech Dubowik <[email protected]> +--- + tools/Makefile | 5 +++ + tools/mkeficapsule.c | 95 +++++++++++++++++++++++++++++++++----------- + 2 files changed, 77 insertions(+), 23 deletions(-) + +diff --git a/tools/Makefile b/tools/Makefile +index 1a5f425ecdaa..e85f5a354b81 100644 +--- a/tools/Makefile ++++ b/tools/Makefile +@@ -271,6 +271,11 @@ mkeficapsule-objs := generated/lib/uuid.o \ + $(LIBFDT_OBJS) \ + mkeficapsule.o + hostprogs-always-$(CONFIG_TOOLS_MKEFICAPSULE) += mkeficapsule ++GNUTLS_SUPPORTS_P11KIT = $(shell pkg-config --libs gnutls --print-requires-private \ ++ 2> /dev/null | grep p11-kit-1) ++ifeq ($(GNUTLS_SUPPORTS_P11KIT),p11-kit-1) ++HOSTCFLAGS_mkeficapsule.o += -DMKEFICAPSULE_PKCS11 ++endif + + include tools/fwumdata_src/fwumdata.mk + +diff --git a/tools/mkeficapsule.c b/tools/mkeficapsule.c +index ec640c57e8a5..c3cf48f4cc1d 100644 +--- a/tools/mkeficapsule.c ++++ b/tools/mkeficapsule.c +@@ -207,6 +207,71 @@ static int write_capsule_file(FILE *f, void *data, size_t size, const char *msg) + return 0; + } + ++#ifdef MKEFICAPSULE_PKCS11 ++static int pkcs11_init(void) ++{ ++ const char *lib; ++ int ret; ++ ++ lib = getenv("PKCS11_MODULE_PATH"); ++ if (!lib) { ++ fprintf(stdout, ++ "PKCS11_MODULE_PATH not set in the environment\n"); ++ return -1; ++ } ++ ++ gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL); ++ gnutls_global_init(); ++ ++ ret = gnutls_pkcs11_add_provider(lib, "trusted"); ++ if (ret < 0) { ++ fprintf(stdout, "Failed to add pkcs11 provider\n"); ++ return -1; ++ } ++ ++ return 0; ++} ++ ++static int import_pkcs11_crt(gnutls_x509_crt_t *x509, struct auth_context *ctx) ++{ ++ gnutls_pkcs11_obj_t *obj_list; ++ unsigned int obj_list_size = 0; ++ int ret; ++ ++ ret = gnutls_pkcs11_obj_list_import_url4(&obj_list, &obj_list_size, ++ ctx->cert_file, 0); ++ if (ret < 0 || obj_list_size == 0) ++ return -1; ++ ++ gnutls_x509_crt_import_pkcs11(*x509, obj_list[0]); ++ ++ return 0; ++} ++ ++static int import_pkcs11_key(gnutls_privkey_t *pkey, struct auth_context *ctx) ++{ ++ return gnutls_privkey_import_pkcs11_url(*pkey, ctx->key_file); ++} ++#else ++static int pkcs11_init(void) ++{ ++ fprintf(stderr, "Pkcs11 support is disabled\n"); ++ return -1; ++} ++ ++static int import_pkcs11_crt(gnutls_x509_crt_t *x509, struct auth_context *ctx) ++{ ++ fprintf(stderr, "Pkcs11 support is disabled\n"); ++ return -1; ++} ++ ++static int import_pkcs11_key(gnutls_privkey_t *pkey, struct auth_context *ctx) ++{ ++ fprintf(stderr, "Pkcs11 support is disabled\n"); ++ return -1; ++} ++#endif ++ + /** + * create_auth_data - compose authentication data in capsule + * @auth_context: Pointer to authentication context +@@ -229,9 +294,6 @@ static int create_auth_data(struct auth_context *ctx) + gnutls_pkcs7_t pkcs7; + gnutls_datum_t data; + gnutls_datum_t signature; +- gnutls_pkcs11_obj_t *obj_list; +- unsigned int obj_list_size = 0; +- const char *lib; + int ret; + bool pkcs11_cert = false; + bool pkcs11_key = false; +@@ -243,19 +305,8 @@ static int create_auth_data(struct auth_context *ctx) + pkcs11_key = true; + + if (pkcs11_cert || pkcs11_key) { +- lib = getenv("PKCS11_MODULE_PATH"); +- if (!lib) { +- fprintf(stdout, +- "PKCS11_MODULE_PATH not set in the environment\n"); +- return -1; +- } +- +- gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL); +- gnutls_global_init(); +- +- ret = gnutls_pkcs11_add_provider(lib, "trusted"); ++ ret = pkcs11_init(); + if (ret < 0) { +- fprintf(stdout, "Failed to add pkcs11 provider\n"); + return -1; + } + } +@@ -301,14 +352,12 @@ static int create_auth_data(struct auth_context *ctx) + + /* load x509 certificate */ + if (pkcs11_cert) { +- ret = gnutls_pkcs11_obj_list_import_url4(&obj_list, &obj_list_size, +- ctx->cert_file, 0); +- if (ret < 0 || obj_list_size == 0) { +- fprintf(stdout, "Failed to import crt_file URI objects\n"); ++ ret = import_pkcs11_crt(&x509, ctx); ++ if (ret < 0) { ++ fprintf(stderr, "error in import_pkcs11_crt(): %s\n", ++ gnutls_strerror(ret)); + return -1; + } +- +- gnutls_x509_crt_import_pkcs11(x509, obj_list[0]); + } else { + ret = gnutls_x509_crt_import(x509, &cert, GNUTLS_X509_FMT_PEM); + if (ret < 0) { +@@ -320,9 +369,9 @@ static int create_auth_data(struct auth_context *ctx) + + /* load a private key */ + if (pkcs11_key) { +- ret = gnutls_privkey_import_pkcs11_url(pkey, ctx->key_file); ++ ret = import_pkcs11_key(&pkey, ctx); + if (ret < 0) { +- fprintf(stderr, "error in %d: %s\n", __LINE__, ++ fprintf(stderr, "error in import_pkcs11_key(): %s\n", + gnutls_strerror(ret)); + return -1; + } +-- +2.47.3 diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc index 574768b9f8..229d779498 100644 --- a/meta/recipes-bsp/u-boot/u-boot-common.inc +++ b/meta/recipes-bsp/u-boot/u-boot-common.inc @@ -12,7 +12,7 @@ PE = "1" # We use the revision in order to avoid having to fetch it from the # repo during parse -SRCREV = "88dc2788777babfd6322fa655df549a019aa1e69" +SRCREV = "ece349ade2973e220f524ce59e59711cc919263f" SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master;tag=v${PV}" diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2026.04.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2026.04.bb deleted file mode 100644 index 6c3ef7efd1..0000000000 --- a/meta/recipes-bsp/u-boot/u-boot-tools_2026.04.bb +++ /dev/null @@ -1,4 +0,0 @@ -require u-boot-common.inc -require u-boot-tools.inc - -SRC_URI += "file://0001-scripts-dtc-drop-yaml-in-DT-validation.patch" diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2026.07.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2026.07.bb new file mode 100644 index 0000000000..9e7a178310 --- /dev/null +++ b/meta/recipes-bsp/u-boot/u-boot-tools_2026.07.bb @@ -0,0 +1,4 @@ +require u-boot-common.inc +require u-boot-tools.inc + +SRC_URI += "file://0001-tools-mkeficapsule-Detect-GnuTLS-PKCS-11-support.patch" diff --git a/meta/recipes-bsp/u-boot/u-boot_2026.04.bb b/meta/recipes-bsp/u-boot/u-boot_2026.07.bb similarity index 84% rename from meta/recipes-bsp/u-boot/u-boot_2026.04.bb rename to meta/recipes-bsp/u-boot/u-boot_2026.07.bb index b6345c8875..5259fd5832 100644 --- a/meta/recipes-bsp/u-boot/u-boot_2026.04.bb +++ b/meta/recipes-bsp/u-boot/u-boot_2026.07.bb @@ -3,8 +3,6 @@ require u-boot.inc DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native" -SRC_URI += "file://0001-scripts-dtc-drop-yaml-in-DT-validation.patch" - # workarounds for aarch64 kvm qemu boot regressions SRC_URI:append:qemuarm64 = " file://disable-CONFIG_BLOBLIST.cfg" SRC_URI:append:genericarm64 = " file://disable-CONFIG_BLOBLIST.cfg" @@ -14,7 +12,6 @@ SRC_URI_RISCV = "\ ${@bb.utils.contains ("TUNE_FEATURES", "a", "file://u-boot-riscv-isa_a.cfg", "", d)} \ ${@bb.utils.contains ("TUNE_FEATURES", "f", "file://u-boot-riscv-isa_f.cfg", "", d)} \ ${@bb.utils.contains ("TUNE_FEATURES", "d", "file://u-boot-riscv-isa_d.cfg", "", d)} \ - ${@bb.utils.contains ("TUNE_FEATURES", "c", "file://u-boot-riscv-isa_c.cfg", "", d)} \ ${@bb.utils.contains_any("TUNE_FEATURES", "b zbb", "file://u-boot-riscv-isa_zbb.cfg", "", d)} \ ${@bb.utils.contains ("TUNE_FEATURES", "zicbom", "file://u-boot-riscv-isa_zicbom.cfg", "", d)} \ " -- 2.43.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241193): https://lists.openembedded.org/g/openembedded-core/message/241193 Mute This Topic: https://lists.openembedded.org/mt/120315592/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
