On 9/9/21 1:46 PM, Tom Rini wrote:
On Thu, Sep 09, 2021 at 05:30:36PM +0900, AKASHI Takahiro wrote:
On Thu, Sep 09, 2021 at 09:27:50AM +0200, Heinrich Schuchardt wrote:
On 9/9/21 8:09 AM, AKASHI Takahiro wrote:
On Thu, Sep 09, 2021 at 07:27:10AM +0200, Heinrich Schuchardt wrote:
mkeficapsule is used to create capsules for UEFI firmware update.
To ease inclusion into U-Boot tools packages of Linux distributions we
should add it to the tools-only_defconfig.
Provide dummy values for CONFIG_AVB_BUF_ADDR, CONFIG_AVB_BUF_SIZE to
satisfy Kconfig.
Suggested-by: Vagrant Cascadian <[email protected]>
Signed-off-by: Heinrich Schuchardt <[email protected]>
---
configs/tools-only_defconfig | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/configs/tools-only_defconfig b/configs/tools-only_defconfig
index f54bc1802c..8a20d3fb05 100644
--- a/configs/tools-only_defconfig
+++ b/configs/tools-only_defconfig
@@ -5,6 +5,8 @@ CONFIG_ANDROID_BOOT_IMAGE=y
CONFIG_FIT=y
CONFIG_FIT_SIGNATURE=y
CONFIG_MISC_INIT_F=y
+CONFIG_AVB_BUF_ADDR=0x0
+CONFIG_AVB_BUF_SIZE=0x8192
# CONFIG_CMD_BOOTD is not set
# CONFIG_CMD_BOOTM is not set
# CONFIG_CMD_ELF is not set
@@ -29,4 +31,7 @@ CONFIG_SYSRESET=y
# CONFIG_VIRTIO_MMIO is not set
# CONFIG_VIRTIO_PCI is not set
# CONFIG_VIRTIO_SANDBOX is not set
-# CONFIG_EFI_LOADER is not set
+CONFIG_EFI_CAPSULE_ON_DISK=y
+CONFIG_EFI_CAPSULE_FIRMWARE_FIT=y
+CONFIG_EFI_CAPSULE_FIRMWARE_RAW=y
+CONFIG_EFI_CAPSULE_AUTHENTICATE=y
I think that we should use the way that I suggested in my patch[1].
-Takahiro Akashi
[1] https://lists.denx.de/pipermail/u-boot/2021-August/459349.html
Your patch [1] still requires some rework:
https://patchwork.ozlabs.org/project/uboot/patch/[email protected]/
[1] changes what mkeficapsule looks like and this patch makes it
available in tools-only_defconfig?
Aren't these two patches complementary?
With my patch applied, the only option we need to compile mkeficapsule is:
CONFIG_TOOLS_MKEFICAPSULE
(and optionally CONFIG_TOOLS_LIBCRYPTO)
There is no target-config dependency as you have expected.
There's two issues. First, the general one is that when just building
host tools (typically to package up in a distribution of some sort), it
shouldn't depend on how "U-Boot" was configured (set aside the default
environment problem). CONFIG_TOOLS_LIBCRYPTO is the exception here as
Agreed. That is why in response to [1] I asked Takahiro to change the
patch such that it covers both signed and unsigned capsules. I don't
want two different versions.
Currently the tool is not build at all if
CONFIG_EFI_HAVE_CAPSULE_SUPPORT is not selected. Do I understand you
right that this dependency should be lifted?
it's how we make things reproducible at least, with respect to libcrypto
related requirements. The second is that "tools-only_defconfig" is
what's used when configuring U-Boot (as tools care about
CONFIG_TOOLS_LIBCRYPTO but also LOCALVERSION).
That said, I would like to know why AVB stuff comes in for building
mkeficapsule. Is there shared code? If so, are these dummy variables
OK and not going to cause a problem?
AVB_VERIFY is implied by SANDBOX and depends on PARTITION_UUIDS.
CONFIG_EFI_HAVE_CAPSULE_SUPPORT requires EFI_LOADER.
EFI_LOADER selects PARTITION_UUIDS.
Best regards
Heinrich
