From patchwork Thu Apr 9 07:47:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wojciech Dubowik X-Patchwork-Id: 85610 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9ED5DE9DE5F for ; Thu, 9 Apr 2026 07:52:53 +0000 (UTC) Received: from DB3PR0202CU003.outbound.protection.outlook.com (DB3PR0202CU003.outbound.protection.outlook.com [52.101.84.25]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.127015.1775720870161315731 for ; Thu, 09 Apr 2026 00:47:51 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@mt.com header.s=selector2 header.b=WrOm3Tn+; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: mt.com, ip: 52.101.84.25, mailfrom: wojciech.dubowik@mt.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ljY+2XaQPlzPxWVCqtcU7mnuSeW/Miw1KRx+uffTJsLnjsuUSKYtR9dtwEOHFXj37e8HC8QiAdyLTmXK1Bh2X4zXScJv7h/5bTwdPrVgLj6lA8UXbimejJXdJy2HaRq/A8btxf7hpN63mFlSamXySEtUftBW7OYamwzAo6jLQp0c3zPxj1YYgTeRg40FRwU0/jBs5WrS2+FRIaB6kLbfMWo9sIsUmYx2Mg7aLBVVYFDQHKg3z+yvmhxVioOOowZbKMIUmygmdvuf4hqz2KI6hr5vdKwIZQBgBKf0GZtcxj4yyzXxm/EnULJFqQbonD7ksekQoox2UB9xCvqmYCMnPg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=h0kwWEtFtb1J1jVNX5QaZXMxnNwJUAr8QdrisWxqpvc=; b=AjVCv95EGQEgmcueYB0Sa1WlgsV12Shd5WhKTfDebhzSawwJtiB4lI3zUPhXkm8yhkIMAV8yEruoh569VqtUgJ9QtomMP1/Y5f251Lk+ZUy3VvxM8evlTMMisfnghT4vrWHuKzTvzT5gjP9LOfrUMSygDCAk0mWBz0oV1WYIeCmo+YlPbSoQTzpr5JsTVX4Dw3uARQCQTm9ZWbJsQON3zaG6lXWads0AwTj5sH84Xe/iO8rGh44bRA/DFSTavdv54EamEHZSvOa0xd/7ol1slABf7BbDsYKoi4VXgqf+cmGMRl5YClAyJOsQIXKCovFqAR7X+tqH6sjsKNUV1fWTcw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=mt.com; dmarc=pass action=none header.from=mt.com; dkim=pass header.d=mt.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mt.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=h0kwWEtFtb1J1jVNX5QaZXMxnNwJUAr8QdrisWxqpvc=; b=WrOm3Tn+F3TLIFjn9yOiXdhHBvCdiwn8m0LN45gTCS9hAAFuzf59eMUqF+slcdTP/CsmaNIRCLCMUlK3gc0PcDEMkOutABvq1RsKlkRGTtkjkGtn9qBSizv8ik2Dj589gTUG2+c6sIVbWkzOpfCGYDydbbjoMH5PSIVhJUE3RXfgcXRaElY7fOiKKbwiEF9oGhJhqMi8wzXl4Q0jfBSOQiWQ2MVpzwu/cWx0sRwD1u2P7NnIAnxYzQRAAcFGbaKltXSbsVWFOmIgP/BCDbQ4jwQMSJ7HidUpHcBqXfSfaS2Ipw1D/T6VocxTvHE/bbMmZQrxRSlE4Jh2D3dJTvBT1g== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=mt.com; Received: from DB9PR03MB7180.eurprd03.prod.outlook.com (2603:10a6:10:22d::13) by DB9PR03MB7811.eurprd03.prod.outlook.com (2603:10a6:10:2c3::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.41; Thu, 9 Apr 2026 07:47:46 +0000 Received: from DB9PR03MB7180.eurprd03.prod.outlook.com ([fe80::6fd2:12a9:4423:8ddc]) by DB9PR03MB7180.eurprd03.prod.outlook.com ([fe80::6fd2:12a9:4423:8ddc%6]) with mapi id 15.20.9769.016; Thu, 9 Apr 2026 07:47:46 +0000 From: Wojciech Dubowik To: u-boot@lists.denx.de CC: Wojciech Dubowik , Franz Schnyder , trini@konsulko.com, "openembedded-core @ lists . openembedded . org" , Francesco Dolcini Subject: [PATCH] tools: mkeficapsule: Add disable pkcs11 menu option Date: Thu, 9 Apr 2026 09:47:07 +0200 Message-ID: <20260409074710.1322519-1-Wojciech.Dubowik@mt.com> X-Mailer: git-send-email 2.47.3 X-ClientProxiedBy: ZR0P278CA0076.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:22::9) To DB9PR03MB7180.eurprd03.prod.outlook.com (2603:10a6:10:22d::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DB9PR03MB7180:EE_|DB9PR03MB7811:EE_ X-MS-Office365-Filtering-Correlation-Id: 8c3df442-30ea-43bd-1b6e-08de960c4a5f X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|19092799006|1800799024|366016|376014|52116014|56012099003|38350700014|18002099003; X-Microsoft-Antispam-Message-Info: TdqFboHjkhXuXIqlXZPFQd0w/rGDNStJBu0on+lrbEfCzxMMa76Sx6DOrtlbTz7bKryRJjrN2iYJM4Zsqyh0CSuFfJ+Fw5iIBq4At+gQZtM+MT90EV0lFjQuQz2qwz+JyPPRvmts1YftZltwJlny9wGPRh+cI32fDvHVq+lZi7yrlYQAx4gqLcZ+E7o04E+2EbhSa8OZeCFEAjF9gqONhaXLj7uYUDb/EpzRQHfzutdcQh/wAQqq44Cxipvqhvy4n+rJe7SwdeKH1lBoGoZuKehexVOj02VHSBc71OL1wkvEU3RPqJ3nhyETIVhpV7yQ0M+F7A+SUaD+gH6asN4kOkONYM6ZylhE3MmZFes7ZREobj4+BwwXiHOsi2IcaOutUhvwgKEUurdercP+eCjpXuCWqxiIhQ26brVJ3y0XQNHuuYlBY+e9IOfK4peFWaljUW8g4oh0gVtJSzyhfR7kf0zE9hweOEPCUM6uUTzmhDNGAhqIGI+gvK9VIgrvk/PYwe42kLZNz2PFptSBsuS6XjHXI7oOaDjj5qy7QoPBLUdqQCVVNR3I9EOB/OBxk/9HPl65ztiH9yZ4fZR0uhXuZCK0u1rQ1f/V/kBgbx0B3MsomD3ftb9DBBl31L3W93f/kLUtHmSlTiRu1/iRuy0J+G/aqZMv/5ZjVQVL/+Ba16mbO6W2zs9ddhnz+1KdAdJgND0N/rrog8h7ZxcnCGXO/GiqpDqM9NzRP5CA/tDUM7S6+BxA9K881tahU9WDwjpZiXp0tJJQldOJkSif+ags/Xeyv8PyFirow7t6ByulgX8= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DB9PR03MB7180.eurprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(19092799006)(1800799024)(366016)(376014)(52116014)(56012099003)(38350700014)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 8dQjew9KIu6WjdTxk4i8ZdfxbA4yz5zM3Y9cZCkg4wqUBubUc6nfiv+T0ieNuVCrVnJCGbu9JIz3o6j4sEHCiptFL3SH8Zn9DwubM+297yAT1PTttNszh9cpLxboHMRgb8RTf7gdz85Yqscp5v8gmzrpOUrrP9CMjCVbHKqEebJqAoyWOx1eX0dyXJg4bIS82W37774w7jMilEHoMwB7C2Uf/nS/Dz+6nPXnxdQpzbpQmkhg8cIhlcb4GdSoltGpeSsHTssk70vcyqpYv9d/Wi7FBe6CIeBPAlWosSj8gAKIcoFVpQOe1xu68aXFq7ThvM9wxpnmBUluTiz4u4PCQwVLowLTWfALuh/nP4gG5DMEiA1uYYtukjN7b9XIyAq5ZwGw1+OsL0L36GF1Y0/yu+gNXJxtjZOcBkt/RaPQ8WuCfH0D3ZwxRkIhUr0vNlLrEN8sKhFTkrveb/65Nlk4clyWKuYiqIVrEye/0nYoqcFxPTHcOLw/rS+qfauk5mSOx6Tu+Cw/Pe8qaM+Im+LCD38Yr39l4BT3S/Jd1oM/yXhega1XUJD4MIChRf4C1Uow+C1bp6CRwSVLIRKjKNThyNeY7zOosvL1tv7bsCnqdJNOZuCtvSWh8PrlXrgfqp0r1Kzny/0jAW9Byr3QG0zLivj67WU7q+4iQQHnhIwjTaAr05WPlqEMt+oe1pDgKHX1AazEjCEunmnJhW4lXkiZBYbbJvFGEqcmncC0k6hh4nVyboJg92LWpsLkVc9p4WugDk4oRhv09cgXm+++dXH/AkGOJmN7wxuxlRG1WEJThX38U1DBvbD5K+gMtmZtg6G5E2XebH6XxtlBBYbLMirkc+GNjARzbB4WTETX8oe2veA+CgbZ26S+hJTXV6cAnsIUZacLVGiC6h+AlWPI2ecJuAEa/5oucN6sGijADKqt1zt0t3LnF9JHoXRBEJ8tRyFz8nWd7JMNLG0ffVSzfl6DDMq53rTSVrrGNgD6vn5l9CKJICAo+jJqDaWRM14O2P7tQe/ZUChfNTLTHbJgyyvNrTPSz7DnOia7BHyniKlbTy0dEASWkxMUkfIzhkEuCtybLvQVZ2dMfN4aSjIovA0vpkfBS7KRWF6TEFjS3rCsOHA0ku8yhfWFpVmJ79Nr5gG2TmZrcLMBMTxh8tbBwa8aaoE82xMTAHF/NoygbVVBm0BwwMFTSXEUENj2FzPIhhvDRbqFne+ve6e0enjbLLZzK8OCDWVFNciXp91895Qi8rthpyM13zL/6mDRcMqLujIVt6/8/YrX1jzoRjyM893LD/dobwnAlt4iSA/VxDJYLPb6GpKNLY9D+DFi8aUvwHMjtKz1xUDKjY1/q6aryU6HyUQNmC0kBmMqGeGGCPZLJ1NK99XAjFO2+SkdlJNrBCYquWFzP4M81nkWHYcHw9ZjX+nz76m7aCkGM++iorR67mMcyQbtdEUzgGCALOHgkvy111PFseL6tffloh2JJd596Vb0T/AayWHvvFq47MGl2YSdkQUHQ9yzdbANhMO0YDXe5iHA94pXoxOBC3yW0HYte6zQVFIwbmaJfB9vvOqc8l/TDMw17r2BojFGc/G5NG1m1NkKmfMXUIfvVCRJ/h+9cOmKhHo1GIJE1SBleDpihlsssY0KhIFoJP9+t7oXNBi+SCq3XEGCNz0+Esl7in6asHarLoHSe3qS3sTGCIysh2Tap1Tr3rtCUeanARGoF+UxAUnl3aTip41a3JU0e+56EQ== X-OriginatorOrg: mt.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8c3df442-30ea-43bd-1b6e-08de960c4a5f X-MS-Exchange-CrossTenant-AuthSource: DB9PR03MB7180.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Apr 2026 07:47:46.6784 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: fb4c0aee-6cd2-482f-a1a5-717e7c02496b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: /MDI81CS0PYbpkoLrrtrYHaI2fOwIZWRlH8J3xdZNXE2RB59XltwNDS1p52A2cVYKvMblD5mXdOrnC5gnuS6ew== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR03MB7811 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 09 Apr 2026 07:52:53 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/234890 Some distros are using gnutls library without pkcs11 support and linking of mkeficapsule will fail. Add disable pkcs11 option with default set to no so distros can control this feature with config option. Suggested-by: Tom Rini Cc: Franz Schnyder Signed-off-by: Wojciech Dubowik --- tools/Kconfig | 8 ++++++++ tools/Makefile | 3 +++ tools/mkeficapsule.c | 14 ++++++++++++++ 3 files changed, 25 insertions(+) diff --git a/tools/Kconfig b/tools/Kconfig index ef33295b8ecd..ccc878595d3b 100644 --- a/tools/Kconfig +++ b/tools/Kconfig @@ -114,6 +114,14 @@ config TOOLS_MKEFICAPSULE optionally sign that file. If you want to enable UEFI capsule update feature on your target, you certainly need this. +config MKEFICAPSULE_DISABLE_PKCS11 + bool "Disable pkcs11 support" + depends on TOOLS_MKEFICAPSULE + default n + help + Disable pkcs11 support. Can be used in cases when host GnuTLS + library doesn't support it. + menuconfig FSPI_CONF_HEADER bool "FlexSPI Header Configuration" help diff --git a/tools/Makefile b/tools/Makefile index 1a5f425ecdaa..60e84bfbf20d 100644 --- a/tools/Makefile +++ b/tools/Makefile @@ -271,6 +271,9 @@ mkeficapsule-objs := generated/lib/uuid.o \ $(LIBFDT_OBJS) \ mkeficapsule.o hostprogs-always-$(CONFIG_TOOLS_MKEFICAPSULE) += mkeficapsule +ifeq ($(CONFIG_MKEFICAPSULE_DISABLE_PKCS11),y) +HOSTCFLAGS_mkeficapsule.o += -DCONFIG_MKEFICAPSULE_DISABLE_PKCS11 +endif include tools/fwumdata_src/fwumdata.mk diff --git a/tools/mkeficapsule.c b/tools/mkeficapsule.c index ec640c57e8a5..ad1c46f0e909 100644 --- a/tools/mkeficapsule.c +++ b/tools/mkeficapsule.c @@ -229,9 +229,11 @@ static int create_auth_data(struct auth_context *ctx) gnutls_pkcs7_t pkcs7; gnutls_datum_t data; gnutls_datum_t signature; +#ifndef CONFIG_MKEFICAPSULE_DISABLE_PKCS11 gnutls_pkcs11_obj_t *obj_list; unsigned int obj_list_size = 0; const char *lib; +#endif int ret; bool pkcs11_cert = false; bool pkcs11_key = false; @@ -242,6 +244,7 @@ static int create_auth_data(struct auth_context *ctx) if (!strncmp(ctx->key_file, "pkcs11:", strlen("pkcs11:"))) pkcs11_key = true; +#ifndef CONFIG_MKEFICAPSULE_DISABLE_PKCS11 if (pkcs11_cert || pkcs11_key) { lib = getenv("PKCS11_MODULE_PATH"); if (!lib) { @@ -259,6 +262,7 @@ static int create_auth_data(struct auth_context *ctx) return -1; } } +#endif if (!pkcs11_cert) { ret = read_bin_file(ctx->cert_file, &cert.data, &file_size); @@ -301,6 +305,7 @@ static int create_auth_data(struct auth_context *ctx) /* load x509 certificate */ if (pkcs11_cert) { +#ifndef CONFIG_MKEFICAPSULE_DISABLE_PKCS11 ret = gnutls_pkcs11_obj_list_import_url4(&obj_list, &obj_list_size, ctx->cert_file, 0); if (ret < 0 || obj_list_size == 0) { @@ -309,6 +314,10 @@ static int create_auth_data(struct auth_context *ctx) } gnutls_x509_crt_import_pkcs11(x509, obj_list[0]); +#else + fprintf(stdout, "Pkcs11 support is disabled\n"); + return -1; +#endif } else { ret = gnutls_x509_crt_import(x509, &cert, GNUTLS_X509_FMT_PEM); if (ret < 0) { @@ -320,12 +329,17 @@ static int create_auth_data(struct auth_context *ctx) /* load a private key */ if (pkcs11_key) { +#ifndef CONFIG_MKEFICAPSULE_DISABLE_PKCS11 ret = gnutls_privkey_import_pkcs11_url(pkey, ctx->key_file); if (ret < 0) { fprintf(stderr, "error in %d: %s\n", __LINE__, gnutls_strerror(ret)); return -1; } +#else + fprintf(stdout, "Pkcs11 support is disabled\n"); + return -1; +#endif } else { ret = gnutls_privkey_import_x509_raw(pkey, &key, GNUTLS_X509_FMT_PEM, 0, 0);