From: Fabio Estevam <festevam@gmail.com>
To: openembedded-core@lists.openembedded.org
Cc: marex@nabladev.com, Fabio Estevam <festevam@nabladev.com>
Subject: [PATCH v2] u-boot: upgrade 2026.04 -> 2026.07
Date: Fri, 17 Jul 2026 11:03:53 -0300 [thread overview]
Message-ID: <20260717140354.589759-1-festevam@gmail.com> (raw)
From: Fabio Estevam <festevam@nabladev.com>
Remove the local DT validation patch as it has been upstreamed.
Add the submitted mkeficapsule PKCS#11 detection patch so
u-boot-tools can build with target GnuTLS configurations that do
not enable p11-kit.
Signed-off-by: Fabio Estevam <festevam@nabladev.com>
---
Changes since v1:
- Apply a U-Boot patch to fix the mkeficapsule build error.
...ripts-dtc-drop-yaml-in-DT-validation.patch | 85 ---------
...apsule-Detect-GnuTLS-PKCS-11-support.patch | 179 ++++++++++++++++++
meta/recipes-bsp/u-boot/u-boot-common.inc | 2 +-
.../u-boot/u-boot-tools_2026.04.bb | 4 -
.../u-boot/u-boot-tools_2026.07.bb | 4 +
.../{u-boot_2026.04.bb => u-boot_2026.07.bb} | 3 -
6 files changed, 184 insertions(+), 93 deletions(-)
delete mode 100644 meta/recipes-bsp/u-boot/files/0001-scripts-dtc-drop-yaml-in-DT-validation.patch
create mode 100644 meta/recipes-bsp/u-boot/files/0001-tools-mkeficapsule-Detect-GnuTLS-PKCS-11-support.patch
delete mode 100644 meta/recipes-bsp/u-boot/u-boot-tools_2026.04.bb
create mode 100644 meta/recipes-bsp/u-boot/u-boot-tools_2026.07.bb
rename meta/recipes-bsp/u-boot/{u-boot_2026.04.bb => u-boot_2026.07.bb} (84%)
diff --git a/meta/recipes-bsp/u-boot/files/0001-scripts-dtc-drop-yaml-in-DT-validation.patch b/meta/recipes-bsp/u-boot/files/0001-scripts-dtc-drop-yaml-in-DT-validation.patch
deleted file mode 100644
index 9c1adc8faf..0000000000
--- a/meta/recipes-bsp/u-boot/files/0001-scripts-dtc-drop-yaml-in-DT-validation.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From e77402000f978561ff2afe405aa9e5c9037a8717 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jo=C3=A3o=20Marcos=20Costa?= <joaomarcos.costa@bootlin.com>
-Date: Wed, 29 Apr 2026 15:22:25 +0200
-Subject: [PATCH] scripts/dtc: drop yaml in DT validation
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The build issues found in dtc/yamltree were partially mitigated by a
-previous commit (807bcd844a: "scripts/dtc: Fix pkg-config behavior under
-sysroot"), but upstream dtc simply disabled yaml, and the same should be
-done here in order to permanently avoid those issues.
-
-Backport the change below from Linux v5.18 [1]:
-
-ef8795f3f1c ("dt-bindings: kbuild: Use DTB files for validation")
-
-I tested this patch with a couple Yocto builds: u-boot and u-boot-tools,
-using the current master branch (rev. "c53b0708f9"), having removed
-libyaml-native from u-boot-tools's dependencies.
-
-[1] https://git.kernel.org/linus/ef8795f3f1ce
-
-Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
-
-Upstream-Status: Backport [https://github.com/u-boot/u-boot/commit/8ef8dee4f3a2b2021decfefd853dbd2a1632b77f]
----
- scripts/Makefile.lib | 6 ------
- scripts/dtc/Makefile | 8 --------
- scripts/dtc/update-dtc-source.sh | 2 +-
- 3 files changed, 1 insertion(+), 15 deletions(-)
-
-diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
-index b8969b7de54..d66f1ed13b1 100644
---- a/scripts/Makefile.lib
-+++ b/scripts/Makefile.lib
-@@ -86,12 +86,6 @@ base-dtb-y := $(foreach m, $(multi-dtb-y), $(firstword $(call suffix-search, $m,
- extra-y += $(dtb-y)
- extra-$(CONFIG_OF_ALL_DTBS) += $(dtb-)
-
--# U-Boot specific
--ifneq ($(CHECK_DTBS),)
--extra-y += $(patsubst %.dtb,%.dt.yaml, $(dtb-y))
--extra-$(CONFIG_OF_ALL_DTBS) += $(patsubst %.dtb,%.dt.yaml, $(dtb-))
--endif
--
- # Add subdir path
-
- extra-y := $(addprefix $(obj)/,$(extra-y))
-diff --git a/scripts/dtc/Makefile b/scripts/dtc/Makefile
-index 6f309b37e08..2ba8dba03be 100644
---- a/scripts/dtc/Makefile
-+++ b/scripts/dtc/Makefile
-@@ -17,15 +17,7 @@ fdtoverlay-objs := $(libfdt) fdtoverlay.o util.o
- # Source files need to get at the userspace version of libfdt_env.h to compile
- HOST_EXTRACFLAGS := -I$(srctree)/$(src)/libfdt
-
--ifeq ($(wildcard $(PKG_CONFIG_SYSROOT_DIR)/usr/include/yaml.h),)
- HOST_EXTRACFLAGS += -DNO_YAML
--else
--dtc-objs += yamltree.o
--# To include <yaml.h> installed in a non-default path
--HOSTCFLAGS_yamltree.o := $(shell pkg-config --cflags yaml-0.1)
--# To link libyaml installed in a non-default path
--HOSTLDLIBS_dtc := $(shell pkg-config --libs yaml-0.1)
--endif
-
- # Generated files need one more search path to include headers in source tree
- HOSTCFLAGS_dtc-lexer.lex.o := -I$(src)
-diff --git a/scripts/dtc/update-dtc-source.sh b/scripts/dtc/update-dtc-source.sh
-index 32ff17ffd08..94627541533 100755
---- a/scripts/dtc/update-dtc-source.sh
-+++ b/scripts/dtc/update-dtc-source.sh
-@@ -32,7 +32,7 @@ DTC_UPSTREAM_PATH=`pwd`/../dtc
- DTC_LINUX_PATH=`pwd`/scripts/dtc
-
- DTC_SOURCE="checks.c data.c dtc.c dtc.h flattree.c fstree.c livetree.c srcpos.c \
-- srcpos.h treesource.c util.c util.h version_gen.h yamltree.c \
-+ srcpos.h treesource.c util.c util.h version_gen.h \
- dtc-lexer.l dtc-parser.y"
- LIBFDT_SOURCE="fdt.c fdt.h fdt_addresses.c fdt_empty_tree.c \
- fdt_overlay.c fdt_ro.c fdt_rw.c fdt_strerror.c fdt_sw.c \
---
-2.47.0
-
diff --git a/meta/recipes-bsp/u-boot/files/0001-tools-mkeficapsule-Detect-GnuTLS-PKCS-11-support.patch b/meta/recipes-bsp/u-boot/files/0001-tools-mkeficapsule-Detect-GnuTLS-PKCS-11-support.patch
new file mode 100644
index 0000000000..560e391084
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/0001-tools-mkeficapsule-Detect-GnuTLS-PKCS-11-support.patch
@@ -0,0 +1,179 @@
+From 61afc0e98661629711d36d03d2b6084fcd359b30 Mon Sep 17 00:00:00 2001
+From: Wojciech Dubowik <Wojciech.Dubowik@mt.com>
+Date: Fri, 17 Jul 2026 00:00:00 +0000
+Subject: [PATCH] tools: mkeficapsule: Detect GnuTLS PKCS#11 support
+
+Some distros like OpenEmbedded are using gnutls library
+without pkcs11 support and linking of mkeficapsule will fail.
+It would make maintenance of default configs a hurdle.
+Add detection of pkcs11 support in gnutls so it's enabled
+when available and doesn't need to be set explicitly.
+
+Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260609070105.525348-1-wojciech.dubowik@mt.com/T/#u]
+
+Reviewed-by: Simon Glass <sjg@chromium.org>
+Acked-by: Quentin Schulz <quentin.schulz@cherry.de>
+Suggested-by: Tom Rini <trini@konsulko.com>
+Cc: Franz Schnyder <fra.schnyder@gmail.com>
+Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@mt.com>
+---
+ tools/Makefile | 5 +++
+ tools/mkeficapsule.c | 95 +++++++++++++++++++++++++++++++++-----------
+ 2 files changed, 77 insertions(+), 23 deletions(-)
+
+diff --git a/tools/Makefile b/tools/Makefile
+index 1a5f425ecdaa..e85f5a354b81 100644
+--- a/tools/Makefile
++++ b/tools/Makefile
+@@ -271,6 +271,11 @@ mkeficapsule-objs := generated/lib/uuid.o \
+ $(LIBFDT_OBJS) \
+ mkeficapsule.o
+ hostprogs-always-$(CONFIG_TOOLS_MKEFICAPSULE) += mkeficapsule
++GNUTLS_SUPPORTS_P11KIT = $(shell pkg-config --libs gnutls --print-requires-private \
++ 2> /dev/null | grep p11-kit-1)
++ifeq ($(GNUTLS_SUPPORTS_P11KIT),p11-kit-1)
++HOSTCFLAGS_mkeficapsule.o += -DMKEFICAPSULE_PKCS11
++endif
+
+ include tools/fwumdata_src/fwumdata.mk
+
+diff --git a/tools/mkeficapsule.c b/tools/mkeficapsule.c
+index ec640c57e8a5..c3cf48f4cc1d 100644
+--- a/tools/mkeficapsule.c
++++ b/tools/mkeficapsule.c
+@@ -207,6 +207,71 @@ static int write_capsule_file(FILE *f, void *data, size_t size, const char *msg)
+ return 0;
+ }
+
++#ifdef MKEFICAPSULE_PKCS11
++static int pkcs11_init(void)
++{
++ const char *lib;
++ int ret;
++
++ lib = getenv("PKCS11_MODULE_PATH");
++ if (!lib) {
++ fprintf(stdout,
++ "PKCS11_MODULE_PATH not set in the environment\n");
++ return -1;
++ }
++
++ gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
++ gnutls_global_init();
++
++ ret = gnutls_pkcs11_add_provider(lib, "trusted");
++ if (ret < 0) {
++ fprintf(stdout, "Failed to add pkcs11 provider\n");
++ return -1;
++ }
++
++ return 0;
++}
++
++static int import_pkcs11_crt(gnutls_x509_crt_t *x509, struct auth_context *ctx)
++{
++ gnutls_pkcs11_obj_t *obj_list;
++ unsigned int obj_list_size = 0;
++ int ret;
++
++ ret = gnutls_pkcs11_obj_list_import_url4(&obj_list, &obj_list_size,
++ ctx->cert_file, 0);
++ if (ret < 0 || obj_list_size == 0)
++ return -1;
++
++ gnutls_x509_crt_import_pkcs11(*x509, obj_list[0]);
++
++ return 0;
++}
++
++static int import_pkcs11_key(gnutls_privkey_t *pkey, struct auth_context *ctx)
++{
++ return gnutls_privkey_import_pkcs11_url(*pkey, ctx->key_file);
++}
++#else
++static int pkcs11_init(void)
++{
++ fprintf(stderr, "Pkcs11 support is disabled\n");
++ return -1;
++}
++
++static int import_pkcs11_crt(gnutls_x509_crt_t *x509, struct auth_context *ctx)
++{
++ fprintf(stderr, "Pkcs11 support is disabled\n");
++ return -1;
++}
++
++static int import_pkcs11_key(gnutls_privkey_t *pkey, struct auth_context *ctx)
++{
++ fprintf(stderr, "Pkcs11 support is disabled\n");
++ return -1;
++}
++#endif
++
+ /**
+ * create_auth_data - compose authentication data in capsule
+ * @auth_context: Pointer to authentication context
+@@ -229,9 +294,6 @@ static int create_auth_data(struct auth_context *ctx)
+ gnutls_pkcs7_t pkcs7;
+ gnutls_datum_t data;
+ gnutls_datum_t signature;
+- gnutls_pkcs11_obj_t *obj_list;
+- unsigned int obj_list_size = 0;
+- const char *lib;
+ int ret;
+ bool pkcs11_cert = false;
+ bool pkcs11_key = false;
+@@ -243,19 +305,8 @@ static int create_auth_data(struct auth_context *ctx)
+ pkcs11_key = true;
+
+ if (pkcs11_cert || pkcs11_key) {
+- lib = getenv("PKCS11_MODULE_PATH");
+- if (!lib) {
+- fprintf(stdout,
+- "PKCS11_MODULE_PATH not set in the environment\n");
+- return -1;
+- }
+-
+- gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
+- gnutls_global_init();
+-
+- ret = gnutls_pkcs11_add_provider(lib, "trusted");
++ ret = pkcs11_init();
+ if (ret < 0) {
+- fprintf(stdout, "Failed to add pkcs11 provider\n");
+ return -1;
+ }
+ }
+@@ -301,14 +352,12 @@ static int create_auth_data(struct auth_context *ctx)
+
+ /* load x509 certificate */
+ if (pkcs11_cert) {
+- ret = gnutls_pkcs11_obj_list_import_url4(&obj_list, &obj_list_size,
+- ctx->cert_file, 0);
+- if (ret < 0 || obj_list_size == 0) {
+- fprintf(stdout, "Failed to import crt_file URI objects\n");
++ ret = import_pkcs11_crt(&x509, ctx);
++ if (ret < 0) {
++ fprintf(stderr, "error in import_pkcs11_crt(): %s\n",
++ gnutls_strerror(ret));
+ return -1;
+ }
+-
+- gnutls_x509_crt_import_pkcs11(x509, obj_list[0]);
+ } else {
+ ret = gnutls_x509_crt_import(x509, &cert, GNUTLS_X509_FMT_PEM);
+ if (ret < 0) {
+@@ -320,9 +369,9 @@ static int create_auth_data(struct auth_context *ctx)
+
+ /* load a private key */
+ if (pkcs11_key) {
+- ret = gnutls_privkey_import_pkcs11_url(pkey, ctx->key_file);
++ ret = import_pkcs11_key(&pkey, ctx);
+ if (ret < 0) {
+- fprintf(stderr, "error in %d: %s\n", __LINE__,
++ fprintf(stderr, "error in import_pkcs11_key(): %s\n",
+ gnutls_strerror(ret));
+ return -1;
+ }
+--
+2.47.3
diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc
index 574768b9f8..229d779498 100644
--- a/meta/recipes-bsp/u-boot/u-boot-common.inc
+++ b/meta/recipes-bsp/u-boot/u-boot-common.inc
@@ -12,7 +12,7 @@ PE = "1"
# We use the revision in order to avoid having to fetch it from the
# repo during parse
-SRCREV = "88dc2788777babfd6322fa655df549a019aa1e69"
+SRCREV = "ece349ade2973e220f524ce59e59711cc919263f"
SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master;tag=v${PV}"
diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2026.04.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2026.04.bb
deleted file mode 100644
index 6c3ef7efd1..0000000000
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2026.04.bb
+++ /dev/null
@@ -1,4 +0,0 @@
-require u-boot-common.inc
-require u-boot-tools.inc
-
-SRC_URI += "file://0001-scripts-dtc-drop-yaml-in-DT-validation.patch"
diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2026.07.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2026.07.bb
new file mode 100644
index 0000000000..9e7a178310
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2026.07.bb
@@ -0,0 +1,4 @@
+require u-boot-common.inc
+require u-boot-tools.inc
+
+SRC_URI += "file://0001-tools-mkeficapsule-Detect-GnuTLS-PKCS-11-support.patch"
diff --git a/meta/recipes-bsp/u-boot/u-boot_2026.04.bb b/meta/recipes-bsp/u-boot/u-boot_2026.07.bb
similarity index 84%
rename from meta/recipes-bsp/u-boot/u-boot_2026.04.bb
rename to meta/recipes-bsp/u-boot/u-boot_2026.07.bb
index b6345c8875..5259fd5832 100644
--- a/meta/recipes-bsp/u-boot/u-boot_2026.04.bb
+++ b/meta/recipes-bsp/u-boot/u-boot_2026.07.bb
@@ -3,8 +3,6 @@ require u-boot.inc
DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native"
-SRC_URI += "file://0001-scripts-dtc-drop-yaml-in-DT-validation.patch"
-
# workarounds for aarch64 kvm qemu boot regressions
SRC_URI:append:qemuarm64 = " file://disable-CONFIG_BLOBLIST.cfg"
SRC_URI:append:genericarm64 = " file://disable-CONFIG_BLOBLIST.cfg"
@@ -14,7 +12,6 @@ SRC_URI_RISCV = "\
${@bb.utils.contains ("TUNE_FEATURES", "a", "file://u-boot-riscv-isa_a.cfg", "", d)} \
${@bb.utils.contains ("TUNE_FEATURES", "f", "file://u-boot-riscv-isa_f.cfg", "", d)} \
${@bb.utils.contains ("TUNE_FEATURES", "d", "file://u-boot-riscv-isa_d.cfg", "", d)} \
- ${@bb.utils.contains ("TUNE_FEATURES", "c", "file://u-boot-riscv-isa_c.cfg", "", d)} \
${@bb.utils.contains_any("TUNE_FEATURES", "b zbb", "file://u-boot-riscv-isa_zbb.cfg", "", d)} \
${@bb.utils.contains ("TUNE_FEATURES", "zicbom", "file://u-boot-riscv-isa_zicbom.cfg", "", d)} \
"
--
2.43.0
reply other threads:[~2026-07-17 14:04 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260717140354.589759-1-festevam@gmail.com \
--to=festevam@gmail.com \
--cc=festevam@nabladev.com \
--cc=marex@nabladev.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox