Re: [RFC PATCH 2/4] scripts/Makefile.lib: Embed capsule public key in platform's dtb

[Tom Rini]

On Mon, Aug 14, 2023 at 02:33:07PM +0530, Sughosh Ganu wrote:
> The EFI capsule authentication logic in u-boot expects the public key
> in the form of an EFI Signature List(ESL) to be provided as part of
> the platform's dtb. Currently, the embedding of the ESL file into the
> dtb needs to be done manually.
> 
> Add a target for generating a dtsi file which contains the signature
> node with the ESL file included as a property under the signature
> node. Include the dtsi file in the dtb. This brings the embedding of
> the ESL in the dtb into the U-Boot build flow.
> 
> The path to the ESL file is specified through the
> CONFIG_EFI_CAPSULE_ESL_FILE symbol.
> 
> Signed-off-by: Sughosh Ganu <sughosh.g...@linaro.org>
> ---
>  lib/efi_loader/Kconfig             |  9 +++++++++
>  lib/efi_loader/capsule_esl.dtsi.in | 11 +++++++++++
>  scripts/Makefile.lib               | 17 +++++++++++++++++
>  3 files changed, 37 insertions(+)
>  create mode 100644 lib/efi_loader/capsule_esl.dtsi.in
> 
> diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
> index 9989e3f384..f40a62a0ba 100644
> --- a/lib/efi_loader/Kconfig
> +++ b/lib/efi_loader/Kconfig
> @@ -272,6 +272,15 @@ config EFI_CAPSULE_MAX
>         Select the max capsule index value used for capsule report
>         variables. This value is used to create CapsuleMax variable.
>  
> +config EFI_CAPSULE_ESL_FILE
> +     string "Path to the EFI Signature List File"
> +     default ""

No default.

[snip]
> diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
> index f41b16781d..cf4eef0b05 100644
> --- a/scripts/Makefile.lib
> +++ b/scripts/Makefile.lib
> @@ -334,8 +334,25 @@ cmd_dtc = mkdir -p $(dir ${dtc-tmp}) ; \
>               ; \
>       sed "s:$(pre-tmp):$(<):" $(depfile).pre.tmp $(depfile).dtc.tmp > 
> $(depfile)
>  
> +ifdef CONFIG_EFI_CAPSULE_AUTHENTICATE
> +quiet_cmd_capsule_esl_gen = CAPSULE_ESL_GEN $@
> +cmd_capsule_esl_gen = \
> +     $(shell sed "s:ESL_BIN_FILE:$(capsule_esl_path):" 
> $(capsule_esl_input_file) > $@)
> +
> +$(obj)/.capsule_esl.dtsi:
> +     $(call cmd_capsule_esl_gen)
> +
> +capsule_esl_input_file=$(srctree)/lib/efi_loader/capsule_esl.dtsi.in
> +capsule_esl_dtsi = .capsule_esl.dtsi
> +capsule_esl_path=$(abspath $(srctree)/$(subst 
> $(quote),,$(CONFIG_EFI_CAPSULE_ESL_FILE)))

This seems right.

> +include_files += $(capsule_esl_dtsi)
> +
> +$(obj)/%.dtb: $(src)/%.dts $(DTC) $(obj)/.capsule_esl.dtsi FORCE
> +     $(call if_changed_dep,dtc)
> +else
>  $(obj)/%.dtb: $(src)/%.dts $(DTC) FORCE
>       $(call if_changed_dep,dtc)
> +endif

I think this implies to me that we should have been depending on
$(include_files) (once renamed to be less vague) here already ?

-- 
Tom

signature.asc
Description: PGP signature