From patchwork Wed Sep 9 18:03:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 97753 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 04E59C79FB6 for ; Wed, 9 Sep 2026 18:03:53 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.18923.1788977027552137474 for ; Wed, 09 Sep 2026 11:03:47 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@arm.com header.s=foss header.b=qnUJzrJH; spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: ross.burton@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 2D07D1595 for ; Wed, 9 Sep 2026 11:03:43 -0700 (PDT) Received: from cesw-amp-gbt-1s-m12830-04.lab.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 6D5C33F528 for ; Wed, 9 Sep 2026 11:03:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1788977026; bh=73RScQ0JtJ9v93uxy9/TdJQ8/8T3X+ZS9weHVaAaxrA=; h=From:To:Subject:Date:From; b=qnUJzrJHDpexoLVYLM/xOtFyAjU+y0ZZwklBdFaA/zgqjgJjt4PCnSmlT7g6VQuLC BPXPTY36lBNI9/gP3ufd7oB8PrmlnJ9qoBbbc+y3v9jkmESOsWBpYymD9G35RKmfsb bt0vJ2zNeWpabyAMYPLm+OtASuklo3U2+L192pqI= From: Ross Burton To: meta-arm@lists.yoctoproject.org Subject: [PATCH 1/3] arm-bsp/u-boot: enable OpenSSL engine stub API Date: Wed, 9 Sep 2026 19:03:39 +0100 Message-ID: <20260909180341.3858400-1-ross.burton@arm.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 18:03:53 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/meta-arm/message/7162 u-boot/lib/rsa/rsa-sign.c uses the OpenSSL engine API, but this has been removed from OpenSSL 4. Patches are being worked on upstream and the recipe in oe-core has those patches, but for ease we can simply enable the stub API to fix the build until this old recipe is removed. Signed-off-by: Ross Burton --- meta-arm-bsp/recipes-bsp/u-boot/u-boot_2025.10.bb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/meta-arm-bsp/recipes-bsp/u-boot/u-boot_2025.10.bb b/meta-arm-bsp/recipes-bsp/u-boot/u-boot_2025.10.bb index 39af337d362..e9a7e52a68e 100644 --- a/meta-arm-bsp/recipes-bsp/u-boot/u-boot_2025.10.bb +++ b/meta-arm-bsp/recipes-bsp/u-boot/u-boot_2025.10.bb @@ -5,3 +5,8 @@ DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native" SRCREV = "e50b1e8715011def8aff1588081a2649a2c6cd47" SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master" + +# u-boot/lib/rsa/rsa-sign.c uses the OpenSSL engine API, but this has been removed +# from OpenSSL 4. Upstream u-boot has been fixed but we can enable the stub engine +# API in OpenSSL until this recipe is removed. +BUILD_CFLAGS += "-DOPENSSL_ENGINE_STUBS" From patchwork Wed Sep 9 18:03:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 97754 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1B671C79FB7 for ; Wed, 9 Sep 2026 18:03:54 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.18924.1788977028109686937 for ; Wed, 09 Sep 2026 11:03:48 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@arm.com header.s=foss header.b=sv4qlRK7; spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: ross.burton@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id CED191691 for ; Wed, 9 Sep 2026 11:03:43 -0700 (PDT) Received: from cesw-amp-gbt-1s-m12830-04.lab.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 2F6303F528 for ; Wed, 9 Sep 2026 11:03:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1788977027; bh=6G4Iz9fzrE0yj+juQJ31P2OGj5VMI5zu+tcN2mHbOlM=; h=From:To:Subject:Date:In-Reply-To:References:From; b=sv4qlRK7mWnk9jStVB8noP0NjlAfbkUMsp6fDH7LVRIuf5StWMkQMV6Tg/sqEeBjK B+IAZ9xjYsZiBr0YIYIfh8C719HXUBNszO1jq/Qokwf81V+oD+5/mC86MQYxoXReux J5BwlKIYk/jZV2mMgjN3Q47EH7lceKMVfzrhA/TI= From: Ross Burton To: meta-arm@lists.yoctoproject.org Subject: [PATCH 2/3] arm/trusted-firmware-a: enable OpenSSL stub engine API Date: Wed, 9 Sep 2026 19:03:40 +0100 Message-ID: <20260909180341.3858400-2-ross.burton@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909180341.3858400-1-ross.burton@arm.com> References: <20260909180341.3858400-1-ross.burton@arm.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 18:03:54 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/meta-arm/message/7163 The cert_create tool uses the OpenSSL engine API, which has been removed from OpenSSL 4. Enable the engine stubs to fix the build until this is resolved upstream. Also shoe-horn BUILD_CFLAGS into cert_create/Makefile, so the define is passed to the build. Signed-off-by: Ross Burton --- .../recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc index 1e06559ce28..9a2b741f335 100644 --- a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc +++ b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc @@ -93,6 +93,10 @@ def remove_options_tail (in_string): from itertools import takewhile return ' '.join(takewhile(lambda x: not x.startswith('-'), in_string.split(' '))) +# tools/cert_create/src/key.c uses the OpenSSL engine API, but this has been removed +# from OpenSSL 4. Enable the compatibility stub APIs until upstream is fixed. +BUILD_CFLAGS += "-DOPENSSL_ENGINE_STUBS" + EXTRA_OEMAKE += "${@'' if d.getVar('TFA_LTO') else "'LD=" + remove_options_tail(d.getVar('LD')) + "'"}" EXTRA_OEMAKE += "CC='${@remove_options_tail(d.getVar('CC'))}'" @@ -158,6 +162,7 @@ do_compile() { sed -i '/^LDOPTS/ s,$, \$\{BUILD_LDFLAGS},' ${S}/tools/fiptool/Makefile sed -i '/^INCLUDE_PATHS/ s,$, \$\{BUILD_CFLAGS},' ${S}/tools/fiptool/Makefile sed -i '/^LIB/ s,$, \$\{BUILD_LDFLAGS},' ${S}/tools/cert_create/Makefile + sed -i '/^INC_DIR / s,$, \$\{BUILD_CFLAGS},' ${S}/tools/cert_create/Makefile # Currently there are races if you build all the targets at once in parallel for T in ${TFA_BUILD_TARGET}; do From patchwork Wed Sep 9 18:03:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 97755 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A6A2C79FBF for ; Wed, 9 Sep 2026 18:03:54 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.19170.1788977028817273842 for ; Wed, 09 Sep 2026 11:03:49 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@arm.com header.s=foss header.b=oGaFn42M; spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: ross.burton@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 895F51595 for ; Wed, 9 Sep 2026 11:03:44 -0700 (PDT) Received: from cesw-amp-gbt-1s-m12830-04.lab.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id DC0733F528 for ; Wed, 9 Sep 2026 11:03:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1788977028; bh=wnXslB2qMvPW0o1PM6h8qg61S0eiH9HUon9AJgEvGSM=; h=From:To:Subject:Date:In-Reply-To:References:From; b=oGaFn42MZC1cE8w9Pwbp8Ubk19IyHVrQEzOGgcdEyqjerfQodfBTH1JwXLdHxdE9j wceofpCPD0lWLGJFLaj8TM6ciOJAtCSn+UTov2ucck6qMF8dfGe1NkVDLNec5KaEDG K05TsHopM2ebmitsO6xjQitc1RNlxtcPwBHW98zQ= From: Ross Burton To: meta-arm@lists.yoctoproject.org Subject: [PATCH 3/3] arm/fiptool: fix native linkage Date: Wed, 9 Sep 2026 19:03:41 +0100 Message-ID: <20260909180341.3858400-3-ross.burton@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909180341.3858400-1-ross.burton@arm.com> References: <20260909180341.3858400-1-ross.burton@arm.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 18:03:54 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/meta-arm/message/7164 The Makefiles in TF-A have changed since this recipe was last altered, and our BUILD_LDFLAGS are no longer being respected. This means the built objects don't have the correct RPATH, so they fail to run if the host doesn't have libcrypto.so.4 (from OpenSSL 4) installed. Pass all of our BUILD_* flags via HOSTCC*, and delete the now redundant sed operations. Signed-off-by: Ross Burton --- .../trusted-firmware-a/fiptool-native_2.15.0.bb | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/meta-arm/recipes-bsp/trusted-firmware-a/fiptool-native_2.15.0.bb b/meta-arm/recipes-bsp/trusted-firmware-a/fiptool-native_2.15.0.bb index 11e54fbf06e..8292eefcec3 100644 --- a/meta-arm/recipes-bsp/trusted-firmware-a/fiptool-native_2.15.0.bb +++ b/meta-arm/recipes-bsp/trusted-firmware-a/fiptool-native_2.15.0.bb @@ -17,14 +17,13 @@ DEPENDS += "openssl-native" inherit native -EXTRA_OEMAKE = "V=1 HOSTCC='${BUILD_CC}' OPENSSL_DIR=${STAGING_DIR_NATIVE}/${prefix_native}" +EXTRA_OEMAKE = "V=1 \ + HOSTCC='${BUILD_CC}' \ + HOSTCCFLAGS='${BUILD_CPPFLAGS} ${BUILD_CFLAGS}' \ + HOSTLDFLAGS='${BUILD_LDFLAGS}' \ + OPENSSL_DIR=${STAGING_DIR_NATIVE}/${prefix_native}" do_compile () { - # This is still needed to have the native fiptool executing properly by - # setting the RPATH - sed -i '/^LDOPTS/ s,$, \$\{BUILD_LDFLAGS},' ${S}/tools/fiptool/Makefile - sed -i '/^INCLUDE_PATHS/ s,$, \$\{BUILD_CFLAGS},' ${S}/tools/fiptool/Makefile - oe_runmake fiptool }