hi Simon, On Wed, 26 Jul 2023 at 04:22, Simon Glass <s...@chromium.org> wrote: > > Hi Sughosh, > > On Tue, 25 Jul 2023 at 02:58, Sughosh Ganu <sughosh.g...@linaro.org> wrote: > > > > The EFI capsule authentication logic in u-boot expects the public key > > in the form of an EFI Signature List(ESL) to be provided as part of > > the platform's dtb. Currently, the embedding of the ESL file into the > > dtb needs to be done manually. > > > > Add a signature node in the u-boot dtsi file and include the public > > key through the capsule-key property. This file is per architecture, > > and is currently being added for sandbox and arm architectures. It > > will have to be added for other architectures which need to enable > > capsule authentication support. > > > > The path to the ESL file is specified through the > > CONFIG_EFI_CAPSULE_ESL_FILE symbol. > > > > Signed-off-by: Sughosh Ganu <sughosh.g...@linaro.org> > > --- > > Changes since V4: > > * Fix multi line comment format. > > * Drop additional blank line. > > * Remove the check for CONFIG_EFI_HAVE_CAPSULE_SUPPORT from arm's > > u-boot.dtsi. > > * Wrap the help text in the EFI_CAPSULE_ESL_FILE config at 72 chars. > >
<snip> > > diff --git a/arch/sandbox/dts/u-boot.dtsi b/arch/sandbox/dts/u-boot.dtsi > > new file mode 100644 > > index 0000000000..60bd004937 > > --- /dev/null > > +++ b/arch/sandbox/dts/u-boot.dtsi > > @@ -0,0 +1,17 @@ > > +// SPDX-License-Identifier: GPL-2.0+ > > +/* > > + * Devicetree file with miscellaneous nodes that will be included > > + * at build time into the DTB. Currently being used for including > > + * capsule related information. > > + * > > + */ > > + > > +#ifdef CONFIG_EFI_HAVE_CAPSULE_SUPPORT > > +/ { > > +#ifdef CONFIG_EFI_CAPSULE_AUTHENTICATE > > + signature { > > + capsule-key = /incbin/(CONFIG_EFI_CAPSULE_ESL_FILE); > > + }; > > +#endif > > +}; > > +#endif /* CONFIG_EFI_HAVE_CAPSULE_SUPPORT */ > > You missed my comment there. You should not need the outer #ifdef, but > if you do, please combine them into one #if I did not miss your comment. The reason I have kept both the ifdefs is that we need to include stuff which is needed only when CONFIG_EFI_CAPSULE_AUTHENTICATE is enabled, and then the rest of the stuff is needed only when CONFIG_EFI_HAVE_CAPSULE_SUPPORT is enabled. Not having both the ifdefs would result in build failures. In the u-boot.dtsi included for the arm arch, I am using a single ifdef, since we are including only the signature node in that file. -sughosh > > > diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig > > index a22e47616f..0d559ff3a1 100644 > > --- a/lib/efi_loader/Kconfig > > +++ b/lib/efi_loader/Kconfig > > @@ -235,6 +235,15 @@ config EFI_CAPSULE_MAX > > Select the max capsule index value used for capsule report > > variables. This value is used to create CapsuleMax variable. > > > > +config EFI_CAPSULE_ESL_FILE > > + string "Path to the EFI Signature List File" > > + default "" > > + depends on EFI_CAPSULE_AUTHENTICATE > > + help > > + Provides the absolute path to the EFI Signature List file which > > + will be embedded in the platform's device tree and used for > > + capsule authentication at the time of capsule update. > > + > > config EFI_DEVICE_PATH_TO_TEXT > > bool "Device path to text protocol" > > default y > > diff --git a/lib/efi_loader/Makefile b/lib/efi_loader/Makefile > > index 1a8c8d7cab..c52c9d27bd 100644 > > --- a/lib/efi_loader/Makefile > > +++ b/lib/efi_loader/Makefile > > @@ -89,3 +89,10 @@ obj-$(CONFIG_EFI_ECPT) += efi_conformance.o > > > > EFI_VAR_SEED_FILE := $(subst $\",,$(CONFIG_EFI_VAR_SEED_FILE)) > > $(obj)/efi_var_seed.o: $(srctree)/$(EFI_VAR_SEED_FILE) > > + > > +ifeq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE),y) > > +EFI_CAPSULE_KEY_PATH := $(subst $\",,$(CONFIG_EFI_CAPSULE_ESL_FILE)) > > +ifeq ("$(wildcard $(EFI_CAPSULE_KEY_PATH))","") > > +$(error .esl cerificate not found. Configure your > > CONFIG_EFI_CAPSULE_ESL_FILE) > > +endif > > +endif > > -- > > 2.34.1 > > > > Regards, > Simon