[{"id":3679351,"web_url":"http://patchwork.ozlabs.org/comment/3679351/","msgid":"","list_archive_url":null,"date":"2026-04-20T10:16:38","subject":"Re: [PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option","submitter":{"id":88462,"url":"http://patchwork.ozlabs.org/api/people/88462/","name":"Quentin Schulz","email":"quentin.schulz@cherry.de"},"content":"Hi Wojciech,\n\nOn 4/20/26 10:38 AM, Wojciech Dubowik wrote:\n> Some distros are using gnutls library without pkcs11 support\n> and linking of mkeficapsule will fail. Add disable pkcs11\n> option with default set to no so distros can control this\n> feature with config option.\n> \n> Suggested-by: Tom Rini \n> Cc: Franz Schnyder \n> Signed-off-by: Wojciech Dubowik \n> ---\n> Changes in v2:\n> - make use of stderr more consistent\n> - add missing ifndef around pkcs11 deinit functions\n> ---\n> tools/Kconfig | 8 ++++++++\n> tools/Makefile | 3 +++\n> tools/mkeficapsule.c | 17 ++++++++++++++++-\n> 3 files changed, 27 insertions(+), 1 deletion(-)\n> \n> diff --git a/tools/Kconfig b/tools/Kconfig\n> index ef33295b8ecd..ccc878595d3b 100644\n> --- a/tools/Kconfig\n> +++ b/tools/Kconfig\n> @@ -114,6 +114,14 @@ config TOOLS_MKEFICAPSULE\n> \t optionally sign that file. If you want to enable UEFI capsule\n> \t update feature on your target, you certainly need this.\n> \n> +config MKEFICAPSULE_DISABLE_PKCS11\n> +\tbool \"Disable pkcs11 support\"\n> +\tdepends on TOOLS_MKEFICAPSULE\n> +\tdefault n\n\nn is the default, so please don't specify it.\n\n> +\thelp\n> +\t Disable pkcs11 support. Can be used in cases when host GnuTLS\n> +\t library doesn't support it.\n> +\n> menuconfig FSPI_CONF_HEADER\n> \tbool \"FlexSPI Header Configuration\"\n> \thelp\n> diff --git a/tools/Makefile b/tools/Makefile\n> index 1a5f425ecdaa..60e84bfbf20d 100644\n> --- a/tools/Makefile\n> +++ b/tools/Makefile\n> @@ -271,6 +271,9 @@ mkeficapsule-objs := generated/lib/uuid.o \\\n> \t$(LIBFDT_OBJS) \\\n> \tmkeficapsule.o\n> hostprogs-always-$(CONFIG_TOOLS_MKEFICAPSULE) += mkeficapsule\n> +ifeq ($(CONFIG_MKEFICAPSULE_DISABLE_PKCS11),y)\n> +HOSTCFLAGS_mkeficapsule.o += -DCONFIG_MKEFICAPSULE_DISABLE_PKCS11\n> +endif\n> \n\nIs this really needed?\n\nHave\n\nconfig TOOLS_MKEFICAPSULE_DISABLE_PKCS11\n\nin the Kconfig. Then in the code simply use\n\n#if !CONFIG_IS_ENABLED(MKEFICAPSULE_DISABLE_PKCS11)\n\nand it'll be fine.\n\n> include tools/fwumdata_src/fwumdata.mk\n> \n> diff --git a/tools/mkeficapsule.c b/tools/mkeficapsule.c\n> index ec640c57e8a5..2f6e22626c51 100644\n> --- a/tools/mkeficapsule.c\n> +++ b/tools/mkeficapsule.c\n> @@ -229,9 +229,11 @@ static int create_auth_data(struct auth_context *ctx)\n> \tgnutls_pkcs7_t pkcs7;\n> \tgnutls_datum_t data;\n> \tgnutls_datum_t signature;\n> +#ifndef CONFIG_MKEFICAPSULE_DISABLE_PKCS11\n> \tgnutls_pkcs11_obj_t *obj_list;\n> \tunsigned int obj_list_size = 0;\n> \tconst char *lib;\n\nReduce the scope of those variables so we don't have to have an ifdef here.\n\n> +#endif\n> \tint ret;\n> \tbool pkcs11_cert = false;\n> \tbool pkcs11_key = false;\n> @@ -242,6 +244,7 @@ static int create_auth_data(struct auth_context *ctx)\n> \tif (!strncmp(ctx->key_file, \"pkcs11:\", strlen(\"pkcs11:\")))\n> \t\tpkcs11_key = true;\n> \n> +#ifndef CONFIG_MKEFICAPSULE_DISABLE_PKCS11\n> \tif (pkcs11_cert || pkcs11_key) {\n> \t\tlib = getenv(\"PKCS11_MODULE_PATH\");\n> \t\tif (!lib) {\n> @@ -259,6 +262,7 @@ static int create_auth_data(struct auth_context *ctx)\n> \t\t\treturn -1;\n> \t\t}\n> \t}\n> +#endif\n> \n\nThis is getting kinda ugly. I'm wondering if it wouldn't be more \nreadable to move the pkcs11-specific code into specific functions. You \ncall the function from create_auth_data() and you have two definitions \nof the function, one when CONFIG_MKEFICAPSULE_DISABLE_PKCS11 is enabled, \none for when it's not.\n\nSomething like\n\n#if CONFIG_IS_ENABLED(MKEFICAPSULE_DISABLE_PKCS11)\nstatic int mkeficapsule_import_pkcs11_crt(...)\n{\n fprintf(stdout, \"Pkcs11 support is disabled\\n\");\n return -1;\n}\n#else\nstatic int mkeficapsule_import_pkcs11_crt(...)\n{\n[...]\n}\n#endif\n\n[...]\n\nstatic int create_auth_data(struct auth_context *ctx)\n{\n[...]\n\n if (pkcs11_cert) {\n ret = mkeficapsule_import_pkcs11_crt(...);\n if (ret < 0) {\n fprintf(stdout, \"Failed to import crt: %d\\n\", ret);\n return ret;\n }\n }\n[...]\n}\n\nAlso, I think there's a missing free() after the data.data malloc if \nthere's a fail (or maybe in the event of a success, I haven't followed \nif it gets freed later on). I see a comment of a few lines saying \n\"better cleanups\" and I'm wondering why we don't do them? Any idea why?\n\nCheers,\nQuentin","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=cherry.de header.i=@cherry.de header.a=rsa-sha256\n header.s=selector1 header.b=VLSRv0lL;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)","phobos.denx.de;\n dmarc=pass (p=quarantine dis=none) header.from=cherry.de","phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de","phobos.denx.de;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=cherry.de header.i=@cherry.de header.b=\"VLSRv0lL\";\n\tdkim-atps=neutral","phobos.denx.de; dmarc=pass (p=quarantine dis=none)\n header.from=cherry.de","phobos.denx.de;\n spf=pass smtp.mailfrom=quentin.schulz@cherry.de","dkim=none (message not signed)\n header.d=none;dmarc=none action=none header.from=cherry.de;"],"Received":["from phobos.denx.de (phobos.denx.de\n [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fzhH96TK9z1yCv\n\tfor ; Mon, 20 Apr 2026 20:16:53 +1000 (AEST)","from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id 760D483B99;\n\tMon, 20 Apr 2026 12:16:45 +0200 (CEST)","by phobos.denx.de (Postfix, from userid 109)\n id B414F83E16; Mon, 20 Apr 2026 12:16:44 +0200 (CEST)","from PA4PR04CU001.outbound.protection.outlook.com\n (mail-francecentralazlp170130007.outbound.protection.outlook.com\n [IPv6:2a01:111:f403:c20a::7])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id 7BD1C839D5\n for ; Mon, 20 Apr 2026 12:16:42 +0200 (CEST)","from DBBPR04MB7737.eurprd04.prod.outlook.com (2603:10a6:10:1e5::22)\n by DBBPR04MB7801.eurprd04.prod.outlook.com (2603:10a6:10:1eb::24)\n with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9818.32; Mon, 20 Apr\n 2026 10:16:40 +0000","from DBBPR04MB7737.eurprd04.prod.outlook.com\n ([fe80::5960:fb4b:9313:2b00]) by DBBPR04MB7737.eurprd04.prod.outlook.com\n ([fe80::5960:fb4b:9313:2b00%4]) with mapi id 15.20.9818.032; Mon, 20 Apr 2026\n 10:16:40 +0000"],"X-Spam-Checker-Version":"SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de","X-Spam-Level":"","X-Spam-Status":"No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,\n DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED,\n SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2","ARC-Seal":"i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;\n b=Yt2oiZZ7ltb4K00rrSvF5KAaMdNlyDLqvi/e3cD1Q5ucwiKvPTEiDdChtcfOWSaifVANOM+EzyGLJZ8PuLYv5IRlf4Y2zX8cPmPQbDl8NfiBofzo3m4wABcZB+UJ1UVGUZb3TrNxvGViIvHc+jYvhMQcl+7zrHcWmXhaGA7VZTgy6cyb0JzW/U/Bo/212nfnPIv2xjJb6E80ffysNxe+YTfCB8SesBI8I5oqZMMPxPptExGB/79Bf0ydk6FH7rlQ6IIWDNTPP50KMLpK4mnSh/ylpUnzG5omgTCo8hthNBneLadMkLYzBV+VyRU1sh/EgmG2+4OOvBELnSwAojac2Q==","ARC-Message-Signature":"i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;\n s=arcselector10001;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;\n bh=1dl2J7w6NxMgTXq6pBjoN/02jltB/aqECKxEQhaMTn4=;\n b=JNm3b0OU9cKwDUqNBB7j7nGJAgVDRIYOhJXp0KrDwf1H+img38OG1M0EFHgiF+dhy224W4yKvqRZpXlMiWkwg+6AbXWl+KUxMPQHWavhJkHyiaFfl1p4LzQ8sFw/D8HPxJpqMvWigbSpMMuf5img/ORECJWC87Ayptd/cyJtawfJImLQTfkWLDoDH0e12R3O9heSJ7buMLz8upF6j/0fpW4oCTnuLqlQlLnqt0ul9zXAVWSsfG9keJPk1OTFwuU5yCbWO/qIVnUywZJdGEPxn5y5mYqqaW72vVx6aF/ocW49LdEQCNn+6xLbfcqty9/j3YjmvOj6ryfhF88qPwwVeA==","ARC-Authentication-Results":"i=1; mx.microsoft.com 1; spf=pass\n smtp.mailfrom=cherry.de; dmarc=pass action=none header.from=cherry.de;\n dkim=pass header.d=cherry.de; arc=none","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=cherry.de;\n s=selector1;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;\n bh=1dl2J7w6NxMgTXq6pBjoN/02jltB/aqECKxEQhaMTn4=;\n b=VLSRv0lLtXrhFBf6nkWcrG2KkKgBIDpAZG7HGU/d7YjQtwOq4HZPfuNhcLuw1LO/60bF7kdvmjrDKLEFv7xkH6wJAp9yFUoiwyM+xqBlbaIh7IWIp6CsKdNMPbuZSR/8iJc6OpSn1SCmQF7q0xdU1QoqmkGm96XP01GZqik7kec=","Message-ID":"","Date":"Mon, 20 Apr 2026 12:16:38 +0200","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option","To":"Wojciech Dubowik , u-boot@lists.denx.de","Cc":"Simon Glass , Franz Schnyder ,\n trini@konsulko.com, \"openembedded-core @ lists . openembedded . org\"\n ,\n Francesco Dolcini ","References":"<20260420083850.8504-1-Wojciech.Dubowik@mt.com>","Content-Language":"en-US","From":"Quentin Schulz ","In-Reply-To":"<20260420083850.8504-1-Wojciech.Dubowik@mt.com>","Content-Type":"text/plain; charset=UTF-8; format=flowed","Content-Transfer-Encoding":"7bit","X-ClientProxiedBy":"FR0P281CA0251.DEUP281.PROD.OUTLOOK.COM\n (2603:10a6:d10:af::17) To DBBPR04MB7737.eurprd04.prod.outlook.com\n (2603:10a6:10:1e5::22)","MIME-Version":"1.0","X-MS-PublicTrafficType":"Email","X-MS-TrafficTypeDiagnostic":"DBBPR04MB7737:EE_|DBBPR04MB7801:EE_","X-MS-Office365-Filtering-Correlation-Id":"e08e8d85-cab1-4e1e-223c-08de9ec5e9a4","X-MS-Exchange-SenderADCheck":"1","X-MS-Exchange-AntiSpam-Relay":"0","X-Microsoft-Antispam":"BCL:0;\n ARA:13230040|366016|1800799024|376014|10070799003|56012099003|22082099003|18002099003;","X-Microsoft-Antispam-Message-Info":"\n Bdcsn2/pWesn4TOk1yPiTG0Df05COyEQ5+Liq4LkgGCXI79mMkZeyt9FItE6pR5ndUYyMrz8S1r5L2xHMM03gG6WT6MW7VpKZ39i3wycA2DPd8I1bvkXPvjb7D8u5KKrt7o/rjT+GzJs1KqM1MwB/b9o20xifFQ/05Cpuov57YWU0UTYpMTXHjh5ObRi0y77DMTPT2EBaQvANfwaCzDK3tQUSyE4t2b09JldIGAG5Y4tMLIcyp74RpMupWsr7lHImR7dOhqY/6kIQVF0ABcdShO6v3aV3snuKkt8cV2TgZm4gyydJgtpCfkon59XKioWzNnO2v9CYyrQWUe92JzTkrZnrKSjMajYvN87sfx8poYAWNTirG0ZS4BnCHwhQO01PSq01hGivet8USE7J4X9eAJtN+CQ9CwuvKQSwU1vw0ZKUvhReDVyyPiS2iTKikouuF5KltwPuiAXRX13W/Yp5S6r6TeMqhR1It0YrCYoQWNnfIa4ZFsg2knYrs+oQlACO1X7KjEhluq9ppR9h+ADmEv929azrhVWKUDRZ010F2eBfkXI5h6X/do7fqc0P/8on6cFYLIhnMpSCti1sE//dNeQz2rZe+5vtICSFGfENob+Z86qzDq1uqDKoH0rg8Lqd+CzahRfI3xiCARR9l2C0WwUrjDFS0W/G1ju1WJOaT3482E+OWE5ih2TJgL8Q7+FiT7EbLban3z/hCa0ZFWS9iRR0GjBUoBGyNizRkgfX0Y=","X-Forefront-Antispam-Report":"CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:;\n IPV:NLI; SFV:NSPM; H:DBBPR04MB7737.eurprd04.prod.outlook.com; PTR:; CAT:NONE;\n SFS:(13230040)(366016)(1800799024)(376014)(10070799003)(56012099003)(22082099003)(18002099003);\n DIR:OUT; SFP:1101;","X-MS-Exchange-AntiSpam-MessageData-ChunkCount":"1","X-MS-Exchange-AntiSpam-MessageData-0":"=?utf-8?q?CueVsvf+Irxwwwgqfv/QgRgRC9Jq?=\n\t=?utf-8?q?PaP3vVtFrkd+Ble72iTWa+1meXLLXzR/w97cUltVlld9/EHR3zBDAaHXEiOJQTzyD?=\n\t=?utf-8?q?uXcKeFDmwyH88xdlCL9umprRbL95snhTjyNH5dU4gpEO+wxx7pAm2rWrwoWeSwlwM?=\n\t=?utf-8?q?D0j9zBW3owEYxOBCOGxGJ7UORpUu4U28FqpaUB7zFYMM4dUUQyVikACfkQsIvk/xB?=\n\t=?utf-8?q?BDYPWY+uQUxAiepAxqFP0EanE1PdBTx25b+HO/mzDGUW1teZRcINOMakvdWU1Lmon?=\n\t=?utf-8?q?mpfy0tBW27q3hpyRhKS4TO3wmyvdLLirf7Ine7x7wG9DNhI/7u5p8puj/+MS2xdI5?=\n\t=?utf-8?q?N3dpSf2G8kxRSflF8iM5DXu80KGgm2fX8FUFmAZBBgFaxsntczHtLZFSF3ZwK+J6N?=\n\t=?utf-8?q?SHE3/TyP2kmPMnbcHCpJu8c7hVt27GzwoD/NIPEYptNr+xw4ytYbkaXgWkzJ7GoEa?=\n\t=?utf-8?q?4Toa/ya4EkJZIDGviffv1+U2T1EA/ZQuBQug8dK1izuImznUv43Uxx3AlVk0A0jzo?=\n\t=?utf-8?q?8oO20HCX2x8C/88GCtYaVYIjO7b3HocDaq9wSM6yKU6k2N76YnTY+IYLMKjMAHW8/?=\n\t=?utf-8?q?ktsNXhJyMB8357MeTds3LuWDedRYFBPtlWQVFmdzuSXQQo66iPjyFrbzuayXMaIAy?=\n\t=?utf-8?q?9rvZ5QabQ/8zPW7vhMnqsKQUzno8OTIr8Y350LU1T67RP4sSGtpob2hJH4O4YdMdA?=\n\t=?utf-8?q?gr5GxYbl9RAsaotFLvB8TclVBkeMxspoEl0F+iiFNVItxDtATqaMaDykJ8hqISAyC?=\n\t=?utf-8?q?KXceEDjIPxjEAvgGvWasdL78TlCEjtP9kx0LbZ/OKfHw1RKfd/8PGi3/L6B2yIQl/?=\n\t=?utf-8?q?5bY5khhJXdeipxbrogjAVB53vkk3aCkyKS8K8l0q38MHnmvCF0Qw1+e5H4gGSkab5?=\n\t=?utf-8?q?E54GbVYiB1QPdr8yosmegBwldhcqPj0R+Uy9hqbR6x8cMp9zl8c+sNO4YiJT5/9cr?=\n\t=?utf-8?q?q1dIYOgEM8fWuctGTQioxdwlbNIcWGIFC/b4dYi6/V3hEap/kuD7dbdccxrYGPBoe?=\n\t=?utf-8?q?qvf9e6Nnh7UxBm3Z/V3oLbDbyLJ9pcohenAH0KL+9BZ7qDQ+v5RDBRgqIXAFQwYO9?=\n\t=?utf-8?q?+DE/A3iiWfGeZS40//CM2RKlqQnVmLENjW2sPhknibIIjBTOJbk9Z++x4smY7Jv5u?=\n\t=?utf-8?q?wPf3rxnTGsJncAn4u3lZJV9deDwaW4VDPFu9PCEEcepuo9a+Tg0MZ6tnjTYCgqfRE?=\n\t=?utf-8?q?13rFjWyhx+tJH219a1uGLu6kRBn/5Yr3PFi4Ok/wn7E7t6b/QIqk9z4oGbA97h4Uq?=\n\t=?utf-8?q?1lM49lgm3z8tv7ry0DwqSFBn6RIvpswQWaZfYj9iak1z/BCCHWRANvgnBg/tz7cH2?=\n\t=?utf-8?q?3WX5ymB+vBRx0/pFGhUlzAY9ggdeL15DRGvT4qbkbYA3M3oGaLE1aHMjV0HiQ/obD?=\n\t=?utf-8?q?4Lh9Ix8uColL/NKywLQBwCaNZKW1fzOpt4mUmMb35y7j/QPnYQ9xhCOtHqTDT+CJh?=\n\t=?utf-8?q?THvmskuifO6ukkZf5WXu9uNXSn0JVFRU8j/8PzQXTJoNRCAEDmPobwVG48qzvOXKI?=\n\t=?utf-8?q?HFEs+c2JrHIs7rthyM2pC3GOnihQh1MLBiwPXS66EKoGHyb1jXOUSNZMNEU+bWND5?=\n\t=?utf-8?q?OBPT3pNTLelXwZrZFSAkWV+SRr/DWoRY3bAfxqIQ/BtQaMGOqE26A6oq/BkuWqGur?=\n\t=?utf-8?q?sNP935yxuygz4FpeTIk2u55bYw7wnxQpH6vQfSTSVVHSp9yc30/2NOzDs6mScBfVy?=\n\t=?utf-8?q?Sh+s/IYuS?=","X-OriginatorOrg":"cherry.de","X-MS-Exchange-CrossTenant-Network-Message-Id":"\n e08e8d85-cab1-4e1e-223c-08de9ec5e9a4","X-MS-Exchange-CrossTenant-AuthSource":"DBBPR04MB7737.eurprd04.prod.outlook.com","X-MS-Exchange-CrossTenant-AuthAs":"Internal","X-MS-Exchange-CrossTenant-OriginalArrivalTime":"20 Apr 2026 10:16:40.0271 (UTC)","X-MS-Exchange-CrossTenant-FromEntityHeader":"Hosted","X-MS-Exchange-CrossTenant-Id":"5e0e1b52-21b5-4e7b-83bb-514ec460677e","X-MS-Exchange-CrossTenant-MailboxType":"HOSTED","X-MS-Exchange-CrossTenant-UserPrincipalName":"\n UkiPVuEvRAAyYEho2MP1qg5Ay8S+sJZg8fXQDkebVio+hw8oEBl73oH1qiJb2ThbVrBVkqasVwmwfCs8IVrmD9PfFjBOkAODx0SsUe4jeF8=","X-MS-Exchange-Transport-CrossTenantHeadersStamped":"DBBPR04MB7801","X-BeenThere":"u-boot@lists.denx.de","X-Mailman-Version":"2.1.39","Precedence":"list","List-Id":"U-Boot discussion ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"u-boot-bounces@lists.denx.de","Sender":"\"U-Boot\" ","X-Virus-Scanned":"clamav-milter 0.103.8 at phobos.denx.de","X-Virus-Status":"Clean"}},{"id":3679617,"web_url":"http://patchwork.ozlabs.org/comment/3679617/","msgid":"<61daa047-74f0-4a76-a61f-de54ca4b716e@baylibre.com>","list_archive_url":null,"date":"2026-04-20T22:15:01","subject":"Re: [PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option","submitter":{"id":87228,"url":"http://patchwork.ozlabs.org/api/people/87228/","name":"David Lechner","email":"dlechner@baylibre.com"},"content":"On 4/20/26 3:38 AM, Wojciech Dubowik wrote:\n> Some distros are using gnutls library without pkcs11 support\n> and linking of mkeficapsule will fail. Add disable pkcs11\n> option with default set to no so distros can control this\n> feature with config option.\n> \n> Suggested-by: Tom Rini \n> Cc: Franz Schnyder \n> Signed-off-by: Wojciech Dubowik \n> ---\n> Changes in v2:\n> - make use of stderr more consistent\n> - add missing ifndef around pkcs11 deinit functions\n> ---\n> tools/Kconfig | 8 ++++++++\n> tools/Makefile | 3 +++\n> tools/mkeficapsule.c | 17 ++++++++++++++++-\n> 3 files changed, 27 insertions(+), 1 deletion(-)\n> \n> diff --git a/tools/Kconfig b/tools/Kconfig\n> index ef33295b8ecd..ccc878595d3b 100644\n> --- a/tools/Kconfig\n> +++ b/tools/Kconfig\n> @@ -114,6 +114,14 @@ config TOOLS_MKEFICAPSULE\n> \t optionally sign that file. If you want to enable UEFI capsule\n> \t update feature on your target, you certainly need this.\n> \n> +config MKEFICAPSULE_DISABLE_PKCS11\n\nOptions that disable something instead of enabling it are confusing.\nCan we make this MKEFICAPSULE_PKCS11 instead and invert the logic?\n\n> +\tbool \"Disable pkcs11 support\"\n> +\tdepends on TOOLS_MKEFICAPSULE\n> +\tdefault n\n\nI think it would be more convenient if we did not require PKS11 by\ndefault. Otherwise, everyone using Open Embedded that doesn't have\nthe \"p11-kit\" PACKAGECONFIG option set for GnuTLS set (which is the\ndefault) is going to get a build failure and have to research this\nand find the option and modify their config to fix the build.\n\nIt seems like it would be better to make people who actually need\nPKCS11 possibly get an error by default instead and enable the\noption. This is pure speculation on my part, but it seems like\nthis would be the smaller group.\n\n> +\thelp\n> +\t Disable pkcs11 support. Can be used in cases when host GnuTLS\n> +\t library doesn't support it.\n> +\n> menuconfig FSPI_CONF_HEADER\n> \tbool \"FlexSPI Header Configuration\"\n> \thelp","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=baylibre-com.20251104.gappssmtp.com\n header.i=@baylibre-com.20251104.gappssmtp.com header.a=rsa-sha256\n header.s=20251104 header.b=LPXWoKCL;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)","phobos.denx.de;\n dmarc=none (p=none dis=none) header.from=baylibre.com","phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de","phobos.denx.de;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=baylibre-com.20251104.gappssmtp.com\n header.i=@baylibre-com.20251104.gappssmtp.com header.b=\"LPXWoKCL\";\n\tdkim-atps=neutral","phobos.denx.de;\n dmarc=none (p=none dis=none) header.from=baylibre.com","phobos.denx.de;\n spf=pass smtp.mailfrom=dlechner@baylibre.com"],"Received":["from phobos.denx.de (phobos.denx.de\n [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g00Cz70Jmz1yD8\n\tfor ; Tue, 21 Apr 2026 08:15:11 +1000 (AEST)","from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id 07A49844FF;\n\tTue, 21 Apr 2026 00:15:09 +0200 (CEST)","by phobos.denx.de (Postfix, from userid 109)\n id 80120844FF; Tue, 21 Apr 2026 00:15:07 +0200 (CEST)","from mail-ot1-x330.google.com (mail-ot1-x330.google.com\n [IPv6:2607:f8b0:4864:20::330])\n (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id 352D8801A9\n for ; Tue, 21 Apr 2026 00:15:04 +0200 (CEST)","by mail-ot1-x330.google.com with SMTP id\n 46e09a7af769-7dbd801138eso2211546a34.1\n for ; Mon, 20 Apr 2026 15:15:04 -0700 (PDT)","from ?IPV6:2600:8803:e7e4:500:49fb:b337:a968:94e7?\n ([2600:8803:e7e4:500:49fb:b337:a968:94e7])\n by smtp.gmail.com with ESMTPSA id\n 006d021491bc7-694984114f5sm33315eaf.7.2026.04.20.15.15.01\n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Mon, 20 Apr 2026 15:15:02 -0700 (PDT)"],"X-Spam-Checker-Version":"SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de","X-Spam-Level":"","X-Spam-Status":"No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,\n DKIM_VALID,RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS autolearn=ham\n autolearn_force=no version=3.4.2","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=baylibre-com.20251104.gappssmtp.com; s=20251104; t=1776723303;\n x=1777328103;\n darn=lists.denx.de;\n h=content-transfer-encoding:in-reply-to:from:content-language\n :references:cc:to:subject:user-agent:mime-version:date:message-id\n :from:to:cc:subject:date:message-id:reply-to;\n bh=en4sgSQAk+py8v0pNMYgluj7M8GwojkdYx+UQVSMgBQ=;\n b=LPXWoKCLTo2Chd/Dc2O9oOvmXdMrLYc7/os/0/8HoOSToCylaa3wzACIG7ZgD1MnYG\n 9fOX3oOAbfbQMvXs5h3LMxPYODrepM0uVxSHyMuBVRkMj3T4kLgF2s/puxIp3xpykDh5\n qFpjpmqKD+0i+Y3EzE06ALDDTC+6aFtjeEpZyvte/xHtpx18ju8ipO8PZmkkawf6A7kM\n xN3hz3qq26bHxunUvq2diyvqCFIUVQ6AVvlvrUJtjWn37NKNFDuyYNJ+8eLTliPNDajg\n 5mqd1J60oUu03xM1JCmKMWW7zqIrZgFlmy+/PAM0XUP0OQ7DI6Oj2l6Ui8dLnJ4eGyOe\n qtIg==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776723303; x=1777328103;\n h=content-transfer-encoding:in-reply-to:from:content-language\n :references:cc:to:subject:user-agent:mime-version:date:message-id\n :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id\n :reply-to;\n bh=en4sgSQAk+py8v0pNMYgluj7M8GwojkdYx+UQVSMgBQ=;\n b=ZI7oLLGWT5RRAvN7Fj4kXikEuBYZYXjQ1xhgOoPHtsA0EuqigsXafhGatCJFnUOWkS\n ZeeIxRfawdn8CSMewiVbUC4Riq+iPv/ET1Jz0vroaO15ySSfZz7bYLTAYv/gNPhqPsnR\n NTyISQNcVIS3EeMk3STprHKxyaWg4DwO9hJAcQzAqO6lpReRzi+bU0cKQvsK3x+FhhZY\n 5ViuHeSaA6E9QVC4PxQQREUOJVVIiFy30AMQpOLspKdzbCkTJCxM12ve0Ow+1AED5LaT\n CDUpXEHtVpE/8bTqIkuSMXk3bqRKGeYasVcFAYp1dIsXfmDglyMsJiEU6BBcardb5SWn\n xfKg==","X-Forwarded-Encrypted":"i=1;\n AFNElJ/ygRs8yU8poFVO5t19uPoUFkq2fHIY74SaUxVAH3tvBDNllPaJw18O7S9X85kJat8ZELAxpQM=@lists.denx.de","X-Gm-Message-State":"AOJu0YyscLXu32zbZjdIxxreurM20gOwyblNTyUdDP77AL9+L7ct3Pr6\n YzhXvx3LkCdKY3ybhWWQuWDOVXf9pf1DDk3io47nLRtZWQs+tvH4vrhPX3djkrC8LkA=","X-Gm-Gg":"AeBDietapTCpae1OrZP+/AlP6kxL4PqGflBuUlVOgZwPTBaF8i8QvuXoojIWBfzwhAL\n v3+LO83JSVecm/ZEqOMcUdjY32GinAWOW7URZvMzgH3qc2Rea8cgz1kgzVA6PyLxQGCH3Ve4zm2\n o8wW/rfGHrb/nADpBawTtNetWzdHWuhZHtkp56Yr4aHQAV3JBbbVWFvcx9Jy9TnLDvKm+pBKy70\n eWwJ80pRzMXwog9qngdXzcd44dcotjja45iQRUayeKBGDTrxJE6f6TC5kuEqLk0g64uyAgUAKNd\n lsVOT7Atzfav4HwhxHzlwb3ewyq3fOjePlM/qbFBeFf0KCk5NFJGg5KSx/6WvUdagyrixRCDWRv\n IOoZ2i3QR9rOOlfkE+/9HUUW/7wozYwyW7gzmh7XynLwl2pMVXsN25sQGh6PGCOu4hZVuzyS0fX\n hlMHVJbigW3ku7tMS2MCMUqOFIEFS/IBqJJtd0orkIwZRvcQzZsCtiW66b5pBLh8L6hXEWCmUkY\n GMkxpQR0egKY3iwD8xKpmM=","X-Received":"by 2002:a05:6820:f09:b0:67c:28d6:430e with SMTP id\n 006d021491bc7-6946385f12emr7168804eaf.28.1776723302710;\n Mon, 20 Apr 2026 15:15:02 -0700 (PDT)","Message-ID":"<61daa047-74f0-4a76-a61f-de54ca4b716e@baylibre.com>","Date":"Mon, 20 Apr 2026 17:15:01 -0500","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option","To":"Wojciech Dubowik , u-boot@lists.denx.de","Cc":"Simon Glass , Franz Schnyder ,\n trini@konsulko.com, \"openembedded-core @ lists . openembedded . org\"\n ,\n Francesco Dolcini ","References":"<20260420083850.8504-1-Wojciech.Dubowik@mt.com>","Content-Language":"en-US","From":"David Lechner ","In-Reply-To":"<20260420083850.8504-1-Wojciech.Dubowik@mt.com>","Content-Type":"text/plain; charset=UTF-8","Content-Transfer-Encoding":"7bit","X-BeenThere":"u-boot@lists.denx.de","X-Mailman-Version":"2.1.39","Precedence":"list","List-Id":"U-Boot discussion ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"u-boot-bounces@lists.denx.de","Sender":"\"U-Boot\" ","X-Virus-Scanned":"clamav-milter 0.103.8 at phobos.denx.de","X-Virus-Status":"Clean"}},{"id":3679626,"web_url":"http://patchwork.ozlabs.org/comment/3679626/","msgid":"","list_archive_url":null,"date":"2026-04-20T22:58:45","subject":"Re: [PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option","submitter":{"id":87228,"url":"http://patchwork.ozlabs.org/api/people/87228/","name":"David Lechner","email":"dlechner@baylibre.com"},"content":"On 4/20/26 5:15 PM, David Lechner wrote:\n> On 4/20/26 3:38 AM, Wojciech Dubowik wrote:\n>> Some distros are using gnutls library without pkcs11 support\n>> and linking of mkeficapsule will fail. Add disable pkcs11\n>> option with default set to no so distros can control this\n>> feature with config option.\n>>\n>> Suggested-by: Tom Rini \n>> Cc: Franz Schnyder \n>> Signed-off-by: Wojciech Dubowik \n>> ---\n>> Changes in v2:\n>> - make use of stderr more consistent\n>> - add missing ifndef around pkcs11 deinit functions\n>> ---\n>> tools/Kconfig | 8 ++++++++\n>> tools/Makefile | 3 +++\n>> tools/mkeficapsule.c | 17 ++++++++++++++++-\n>> 3 files changed, 27 insertions(+), 1 deletion(-)\n>>\n>> diff --git a/tools/Kconfig b/tools/Kconfig\n>> index ef33295b8ecd..ccc878595d3b 100644\n>> --- a/tools/Kconfig\n>> +++ b/tools/Kconfig\n>> @@ -114,6 +114,14 @@ config TOOLS_MKEFICAPSULE\n>> \t optionally sign that file. If you want to enable UEFI capsule\n>> \t update feature on your target, you certainly need this.\n>> \n>> +config MKEFICAPSULE_DISABLE_PKCS11\n> \n> Options that disable something instead of enabling it are confusing.\n> Can we make this MKEFICAPSULE_PKCS11 instead and invert the logic?\n> \n>> +\tbool \"Disable pkcs11 support\"\n>> +\tdepends on TOOLS_MKEFICAPSULE\n>> +\tdefault n\n> \n> I think it would be more convenient if we did not require PKS11 by\n> default. Otherwise, everyone using Open Embedded that doesn't have\n> the \"p11-kit\" PACKAGECONFIG option set for GnuTLS set (which is the\n> default) is going to get a build failure and have to research this\n> and find the option and modify their config to fix the build.\n> \n> It seems like it would be better to make people who actually need\n> PKCS11 possibly get an error by default instead and enable the\n> option. This is pure speculation on my part, but it seems like\n> this would be the smaller group.\n> \nOr maybe we could avoid the config option altogether and do something\nwith `pkg-config --libs gnutls --print-requires-private` at build time\nto detect if `p11-kit-1` is used by gnutls or not?","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=baylibre-com.20251104.gappssmtp.com\n header.i=@baylibre-com.20251104.gappssmtp.com header.a=rsa-sha256\n header.s=20251104 header.b=IdTok8Fp;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)","phobos.denx.de;\n dmarc=none (p=none dis=none) header.from=baylibre.com","phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de","phobos.denx.de;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=baylibre-com.20251104.gappssmtp.com\n header.i=@baylibre-com.20251104.gappssmtp.com header.b=\"IdTok8Fp\";\n\tdkim-atps=neutral","phobos.denx.de;\n dmarc=none (p=none dis=none) header.from=baylibre.com","phobos.denx.de;\n spf=pass smtp.mailfrom=dlechner@baylibre.com"],"Received":["from phobos.denx.de (phobos.denx.de\n [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g01BP3sJ8z1yHB\n\tfor ; Tue, 21 Apr 2026 08:58:53 +1000 (AEST)","from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id DACDE83A91;\n\tTue, 21 Apr 2026 00:58:50 +0200 (CEST)","by phobos.denx.de (Postfix, from userid 109)\n id 76F1483BC4; Tue, 21 Apr 2026 00:58:50 +0200 (CEST)","from mail-oi1-x233.google.com (mail-oi1-x233.google.com\n [IPv6:2607:f8b0:4864:20::233])\n (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id 22429839D5\n for ; Tue, 21 Apr 2026 00:58:48 +0200 (CEST)","by mail-oi1-x233.google.com with SMTP id\n 5614622812f47-4756e74f8edso2527624b6e.1\n for ; Mon, 20 Apr 2026 15:58:48 -0700 (PDT)","from ?IPV6:2600:8803:e7e4:500:49fb:b337:a968:94e7?\n ([2600:8803:e7e4:500:49fb:b337:a968:94e7])\n by smtp.gmail.com with ESMTPSA id\n 5614622812f47-479a02097b6sm7750684b6e.14.2026.04.20.15.58.46\n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Mon, 20 Apr 2026 15:58:46 -0700 (PDT)"],"X-Spam-Checker-Version":"SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de","X-Spam-Level":"","X-Spam-Status":"No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,\n DKIM_VALID,RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS autolearn=ham\n autolearn_force=no version=3.4.2","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=baylibre-com.20251104.gappssmtp.com; s=20251104; t=1776725927;\n x=1777330727;\n darn=lists.denx.de;\n h=content-transfer-encoding:in-reply-to:content-language:references\n :cc:to:from:subject:user-agent:mime-version:date:message-id:from:to\n :cc:subject:date:message-id:reply-to;\n bh=wBwb5DHnaw6Kqy1D5beE2OV+bmsjw/VjFy+XD1uTLM8=;\n b=IdTok8FpK2UdQfcbx9KqRuwU5KFs03nY4PobEf5QLwyHgwP17dIcyNHXy+lj5Xm3ds\n eVfCTzII+yyTXsEqfm3rQKJDbJC1UM+63jhrlB+2l2k0qv6N504AKSeaP/ZEl44Q5uYx\n C5ja6MTuBtPZ/jPwjQ6aofJSqa6KRm9u4YCgCHFl7hFupnQXxstqaSG6+gbTfHW2+MA2\n nfhZdzWMwu1zfWY4CXP8Nv3GNZWwn/5pgwE9dFvVsvI9Yq3+WCbgqVD/GxbXF0kMxPeH\n +WBKA0Ty5eJdi50XNRbAM5I+Yh47mHW0QVbR/ge7eyciYAdI+GTP90MjB7mPtNDAB8AS\n Cd3w==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776725927; x=1777330727;\n h=content-transfer-encoding:in-reply-to:content-language:references\n :cc:to:from:subject:user-agent:mime-version:date:message-id:x-gm-gg\n :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;\n bh=wBwb5DHnaw6Kqy1D5beE2OV+bmsjw/VjFy+XD1uTLM8=;\n b=AtDca91wfjSReSABO1HjBjoqXe0NnM8bfcvqoDxrm8gBjSKn9X1KavUwVv5ZN1UrON\n NHhtT/8F/KEbC1Vh5pJIvDifZANy8vhAWguczTpiOciKNIlheaT3/4IbpdoAi9DKvBFb\n BDqZuQ6oy2Ucpk7Vrs2+YTtF9UhlcbKy6ho6vji2yc7FUFH4TCrNB6M/1GhcmELDtSXn\n coSwXslP1LluMRTvDFGd0HqijkmM9ddrECQJuUi5oIpaiSeOn6Ya8fr2O/5oeGB/Ebvn\n oZCB2k5EazAXQpJ1MsuWUwcnwdm1M0J95ltDMvIipAdmbPxNF6AuPk7QxBIIIGys1pg9\n IznA==","X-Forwarded-Encrypted":"i=1;\n AFNElJ/kkNXFj83ZoQwAqBWhtcgN0/X0hBKAaNTl+FFIdunbkwQTTVcAq2awEVGnalFojwz1Ix/5WY8=@lists.denx.de","X-Gm-Message-State":"AOJu0Yzi8Hz65lDwHVh1eqTPqp6H+uPvAsJWhzKD7djcaZPgo5/BZnZS\n YjganwFwPvMdJ6j14TQhGizUU5r1RPeGSMxs90Th7OVmQlW5I6X/ZGIUAngh8fOn2hM=","X-Gm-Gg":"AeBDiet8JVBdnGrbOoHQ9jpwA9RYZ5mXtWQTTNBtSpF38bnn6UFkFZgSZUyp5oi63tN\n q62QEIlhmbPj300n3m7jXY2rBriJZmRFNTkCxeoktoUG6A/8tgJAEB0U8G/JjNxNEJF6u55qtjr\n GtOmdpcIg6wqSdIyElys1fcW+JHd3uCcsb/UcIS5uD++LYDAooFLxB7FlBAonQoBGuDlVdoZzXx\n l38buraI4yZPowdHZ7my2I/suNCxKYKZuZjfZqKjmVkltdgK7C66kMzCc1/ZCpuiOkm6ghj0mNA\n si2TLzkLYdLmQr6XD4H6Xl989dVFSGxG7BYQcApR6+nRzo2KNmXrvt/BDSx5MFchMbI+RRwCMZ8\n TwpV3LULMk+UQnNalQ5kRfx0P/e3MlvocxhNgbBmcmyD52qLGwoHq0ILw70NMIGZioW4betL4mE\n c187gwsxrceBeD/K/mLkbxhTf4ubn4l3aF1Ae22cP3AS6qZ4zqbf5HMLn/CjjL1SKz6AcntoMfc\n UHYC8JEhkl4","X-Received":"by 2002:a05:6808:50a9:b0:463:faa3:8dda with SMTP id\n 5614622812f47-4799c958f2fmr10259586b6e.13.1776725926821;\n Mon, 20 Apr 2026 15:58:46 -0700 (PDT)","Message-ID":"","Date":"Mon, 20 Apr 2026 17:58:45 -0500","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option","From":"David Lechner ","To":"Wojciech Dubowik , u-boot@lists.denx.de","Cc":"Simon Glass , Franz Schnyder ,\n trini@konsulko.com, \"openembedded-core @ lists . openembedded . org\"\n ,\n Francesco Dolcini ","References":"<20260420083850.8504-1-Wojciech.Dubowik@mt.com>\n <61daa047-74f0-4a76-a61f-de54ca4b716e@baylibre.com>","Content-Language":"en-US","In-Reply-To":"<61daa047-74f0-4a76-a61f-de54ca4b716e@baylibre.com>","Content-Type":"text/plain; charset=UTF-8","Content-Transfer-Encoding":"7bit","X-BeenThere":"u-boot@lists.denx.de","X-Mailman-Version":"2.1.39","Precedence":"list","List-Id":"U-Boot discussion ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"u-boot-bounces@lists.denx.de","Sender":"\"U-Boot\" ","X-Virus-Scanned":"clamav-milter 0.103.8 at phobos.denx.de","X-Virus-Status":"Clean"}},{"id":3679734,"web_url":"http://patchwork.ozlabs.org/comment/3679734/","msgid":"","list_archive_url":null,"date":"2026-04-21T08:30:16","subject":"Re: [PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option","submitter":{"id":90988,"url":"http://patchwork.ozlabs.org/api/people/90988/","name":"Wojciech Dubowik","email":"Wojciech.Dubowik@mt.com"},"content":"On Mon, Apr 20, 2026 at 12:16:38PM +0200, Quentin Schulz wrote:\n\nHello Quentin,\n\n> Hi Wojciech,\n> \n> On 4/20/26 10:38 AM, Wojciech Dubowik wrote:\n> > Some distros are using gnutls library without pkcs11 support\n> > and linking of mkeficapsule will fail. Add disable pkcs11\n> > option with default set to no so distros can control this\n> > feature with config option.\n> > \n> > Suggested-by: Tom Rini \n> > Cc: Franz Schnyder \n> > Signed-off-by: Wojciech Dubowik \n> > ---\n> > Changes in v2:\n> > - make use of stderr more consistent\n> > - add missing ifndef around pkcs11 deinit functions\n> > ---\n> > tools/Kconfig | 8 ++++++++\n> > tools/Makefile | 3 +++\n> > tools/mkeficapsule.c | 17 ++++++++++++++++-\n> > 3 files changed, 27 insertions(+), 1 deletion(-)\n> > \n> > diff --git a/tools/Kconfig b/tools/Kconfig\n> > index ef33295b8ecd..ccc878595d3b 100644\n> > --- a/tools/Kconfig\n> > +++ b/tools/Kconfig\n> > @@ -114,6 +114,14 @@ config TOOLS_MKEFICAPSULE\n> > \t optionally sign that file. If you want to enable UEFI capsule\n> > \t update feature on your target, you certainly need this.\n> > +config MKEFICAPSULE_DISABLE_PKCS11\n> > +\tbool \"Disable pkcs11 support\"\n> > +\tdepends on TOOLS_MKEFICAPSULE\n> > +\tdefault n\n> \n> n is the default, so please don't specify it.\n> \n> > +\thelp\n> > +\t Disable pkcs11 support. Can be used in cases when host GnuTLS\n> > +\t library doesn't support it.\n> > +\n> > menuconfig FSPI_CONF_HEADER\n> > \tbool \"FlexSPI Header Configuration\"\n> > \thelp\n> > diff --git a/tools/Makefile b/tools/Makefile\n> > index 1a5f425ecdaa..60e84bfbf20d 100644\n> > --- a/tools/Makefile\n> > +++ b/tools/Makefile\n> > @@ -271,6 +271,9 @@ mkeficapsule-objs := generated/lib/uuid.o \\\n> > \t$(LIBFDT_OBJS) \\\n> > \tmkeficapsule.o\n> > hostprogs-always-$(CONFIG_TOOLS_MKEFICAPSULE) += mkeficapsule\n> > +ifeq ($(CONFIG_MKEFICAPSULE_DISABLE_PKCS11),y)\n> > +HOSTCFLAGS_mkeficapsule.o += -DCONFIG_MKEFICAPSULE_DISABLE_PKCS11\n> > +endif\n> \n> Is this really needed?\n> \n> Have\n> \n> config TOOLS_MKEFICAPSULE_DISABLE_PKCS11\n> \n> in the Kconfig. Then in the code simply use\n> \n> #if !CONFIG_IS_ENABLED(MKEFICAPSULE_DISABLE_PKCS11)\n> \n> and it'll be fine.\nYeis. I could simplify it.\n> \n> > include tools/fwumdata_src/fwumdata.mk\n> > diff --git a/tools/mkeficapsule.c b/tools/mkeficapsule.c\n> > index ec640c57e8a5..2f6e22626c51 100644\n> > --- a/tools/mkeficapsule.c\n> > +++ b/tools/mkeficapsule.c\n> > @@ -229,9 +229,11 @@ static int create_auth_data(struct auth_context *ctx)\n> > \tgnutls_pkcs7_t pkcs7;\n> > \tgnutls_datum_t data;\n> > \tgnutls_datum_t signature;\n> > +#ifndef CONFIG_MKEFICAPSULE_DISABLE_PKCS11\n> > \tgnutls_pkcs11_obj_t *obj_list;\n> > \tunsigned int obj_list_size = 0;\n> > \tconst char *lib;\n> \n> Reduce the scope of those variables so we don't have to have an ifdef here.\n> \n> > +#endif\n> > \tint ret;\n> > \tbool pkcs11_cert = false;\n> > \tbool pkcs11_key = false;\n> > @@ -242,6 +244,7 @@ static int create_auth_data(struct auth_context *ctx)\n> > \tif (!strncmp(ctx->key_file, \"pkcs11:\", strlen(\"pkcs11:\")))\n> > \t\tpkcs11_key = true;\n> > +#ifndef CONFIG_MKEFICAPSULE_DISABLE_PKCS11\n> > \tif (pkcs11_cert || pkcs11_key) {\n> > \t\tlib = getenv(\"PKCS11_MODULE_PATH\");\n> > \t\tif (!lib) {\n> > @@ -259,6 +262,7 @@ static int create_auth_data(struct auth_context *ctx)\n> > \t\t\treturn -1;\n> > \t\t}\n> > \t}\n> > +#endif\n> \n> This is getting kinda ugly. I'm wondering if it wouldn't be more readable to\n> move the pkcs11-specific code into specific functions. You call the function\n> from create_auth_data() and you have two definitions of the function, one\n> when CONFIG_MKEFICAPSULE_DISABLE_PKCS11 is enabled, one for when it's not.\n> \n\nWell. The idea behind was that you can have mixed pkcs11/cert files when creating\ncapsule. This is real use case as some HSM are too expensive to store public stuff.\nRearranging it would go well behind solving the current problem of OE not being able\nto compile. I can have a look into it but probably not before we solve the current\nproblem.\n\n> Something like\n> \n> #if CONFIG_IS_ENABLED(MKEFICAPSULE_DISABLE_PKCS11)\n> static int mkeficapsule_import_pkcs11_crt(...)\n> {\n> fprintf(stdout, \"Pkcs11 support is disabled\\n\");\n> return -1;\n> }\n> #else\n> static int mkeficapsule_import_pkcs11_crt(...)\n> {\n> [...]\n> }\n> #endif\n> \n> [...]\n> \n> static int create_auth_data(struct auth_context *ctx)\n> {\n> [...]\n> \n> if (pkcs11_cert) {\n> ret = mkeficapsule_import_pkcs11_crt(...);\n> if (ret < 0) {\n> fprintf(stdout, \"Failed to import crt: %d\\n\", ret);\n> return ret;\n> }\n> }\n> [...]\n> }\n> \n> Also, I think there's a missing free() after the data.data malloc if there's\n> a fail (or maybe in the event of a success, I haven't followed if it gets\n> freed later on). I see a comment of a few lines saying \"better cleanups\" and\n> I'm wondering why we don't do them? Any idea why?\n\nNo idea. I have noticed it myself but I have turned a blind eye on this.\nAs it seems to draw more attention now maybe it would make sense to invest a\nbit more time into it.\n\nCheers,\nWojtek\n\n> \n> Cheers,\n> Quentin","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=mt.com header.i=@mt.com header.a=rsa-sha256\n header.s=selector2 header.b=G47WF5Ed;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)","phobos.denx.de;\n dmarc=pass (p=reject dis=none) header.from=mt.com","phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de","phobos.denx.de;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=mt.com header.i=@mt.com header.b=\"G47WF5Ed\";\n\tdkim-atps=neutral","phobos.denx.de;\n dmarc=pass (p=reject dis=none) header.from=mt.com","phobos.denx.de;\n spf=fail smtp.mailfrom=Wojciech.Dubowik@mt.com","dkim=none (message not signed)\n header.d=none;dmarc=none action=none header.from=mt.com;"],"Received":["from phobos.denx.de (phobos.denx.de\n [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g0FtC2c90z1yGt\n\tfor ; Tue, 21 Apr 2026 18:30:43 +1000 (AEST)","from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id 434078433B;\n\tTue, 21 Apr 2026 10:30:34 +0200 (CEST)","by phobos.denx.de (Postfix, from userid 109)\n id E468F84378; Tue, 21 Apr 2026 10:30:32 +0200 (CEST)","from DU2PR03CU002.outbound.protection.outlook.com\n (mail-northeuropeazlp170110003.outbound.protection.outlook.com\n [IPv6:2a01:111:f403:c200::3])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id A43438431E\n for ; Tue, 21 Apr 2026 10:30:26 +0200 (CEST)","from DB9PR03MB7180.eurprd03.prod.outlook.com (2603:10a6:10:22d::13)\n by PAVPR03MB9701.eurprd03.prod.outlook.com (2603:10a6:102:315::11)\n with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9846.16; Tue, 21 Apr\n 2026 08:30:24 +0000","from DB9PR03MB7180.eurprd03.prod.outlook.com\n ([fe80::6fd2:12a9:4423:8ddc]) by DB9PR03MB7180.eurprd03.prod.outlook.com\n ([fe80::6fd2:12a9:4423:8ddc%6]) with mapi id 15.20.9846.016; Tue, 21 Apr 2026\n 08:30:24 +0000"],"X-Spam-Checker-Version":"SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de","X-Spam-Level":"","X-Spam-Status":"No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,\n DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED,\n SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2","ARC-Seal":"i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;\n b=IIEYrudo4lY9ClBdZ57wrdR2TggKuMFxuILc167WsFA2aw121atOYelBgBa/YWNFKfI+vkKsqRMh+9z0Z7hCKOyA1fdb5Myb8TLdK/O9mZZ8dXRQz1FDGEEKo3qk005obMm4SNls3A+h1k1bP661FD05pNwsqR9/PTUirtq/r7N2n9qtvbDWZrC1AgZevPQWZvHdhTmcKf57pCkD+w5JXECNnC9WpiOQJUyG4BGjlwXLzm35nBJ4+7+8GwPTN26dLtyd7q+KGgVFFLfGr/nfEzSIeY1QXRe75EIbUW9CyotEFrlXuL/AOMp4pXDTMDfP45C+yf8YEeSy3/4ddXMj9Q==","ARC-Message-Signature":"i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;\n s=arcselector10001;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;\n bh=sUi4egGUORYBuCvOmjSLQaP1g2H5xD6GVOik2Lzkmpo=;\n b=Z1rrTmGPZSPoNDSSD8fP+ViCWPGMYCBeZnYomfo0sMpjfoKV29Tk+Ddq2tyvH8qK0qpBprhmA8fBSm28J3cUPF4XhyxT32NLK838xT4RehruhaD8W8VcPzCh3fFLFq2YrzH0TnQp7FIAU7vPfYXFbsLwzooVBuR+r7NdraKC7JM0dGo0BuITBZ2zQDy3Se7JC2TfIGoNPgTQyHHuIyVmNi4Qzp9jPF7VZDQ6Ke5qviIqzrwkhNHQzdcS86KpTSBqy00AxjSALAzzopu7Vl2gNaXk/e477ITV/vRpXhuYyST7yiTjmonfkqAh648SBhLpovYaEjw3hJTF49VyhtSVBg==","ARC-Authentication-Results":"i=1; mx.microsoft.com 1; spf=pass\n smtp.mailfrom=mt.com; dmarc=pass action=none header.from=mt.com; dkim=pass\n header.d=mt.com; arc=none","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=mt.com; s=selector2;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;\n bh=sUi4egGUORYBuCvOmjSLQaP1g2H5xD6GVOik2Lzkmpo=;\n b=G47WF5Ediavxd97/CYOqG07A7lc8SjAQIp+2MRxBab+YqFNFqSQ2BTUJoA1EXZJsLYyVa210a75aQ8g4C17vTbIWy/z8YuvyaIiQ+yJkv5vR3j6S5Y2er3ZdndmNAGAidex3L0ncX3y3m4nYxJjFgeOoT/NToZCh7YxyC8ZeXzmbDbGLhnClQbWx2J28me/Msgoie+bdduFwOE6BWnW6DpR9Zh5r62wgF1EzNP/hzUyPyPyeCMSxTaDa/wkYqFDAbm/xxxSlZv+nxvVLVcOlXfEHjeA+eP1RWkcqNRu0w/tXTC1FNCKYsPwd9MD60LpT5OXTxvyMKx3BX66lG3+iQQ==","Date":"Tue, 21 Apr 2026 10:30:16 +0200","From":"Wojciech Dubowik ","To":"Quentin Schulz ","Cc":"u-boot@lists.denx.de, Simon Glass ,\n Franz Schnyder , trini@konsulko.com,\n \"openembedded-core @ lists . openembedded . org\"\n ,\n Francesco Dolcini ","Subject":"Re: [PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option","Message-ID":"","References":"<20260420083850.8504-1-Wojciech.Dubowik@mt.com>\n ","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":"","X-ClientProxiedBy":"ZR0P278CA0138.CHEP278.PROD.OUTLOOK.COM\n (2603:10a6:910:40::17) To DB9PR03MB7180.eurprd03.prod.outlook.com\n (2603:10a6:10:22d::13)","MIME-Version":"1.0","X-MS-PublicTrafficType":"Email","X-MS-TrafficTypeDiagnostic":"DB9PR03MB7180:EE_|PAVPR03MB9701:EE_","X-MS-Office365-Filtering-Correlation-Id":"543f1b3c-0e40-4dff-4b26-08de9f803bd8","X-MS-Exchange-SenderADCheck":"1","X-MS-Exchange-AntiSpam-Relay":"0","X-Microsoft-Antispam":"BCL:0;\n ARA:13230040|19092799006|366016|376014|52116014|1800799024|38350700014|18002099003|22082099003|56012099003;","X-Microsoft-Antispam-Message-Info":"\n e34b8VYOMAGYA/4SOoDhLmfdHKlv5eUzyVsIxan7Rssz7pt6bkk+GYBPU2LpSP9xP1aCh/mdFK7bzq0PmnQHxIbkMHI2LTeRCdPlmXklvhoxgK0cyKZsvWt58RDx7M3l4UsmtcCt/JgjeJ0eyYhIO55P8m2I3JlaRf/jbCOZO6m2f3eikO6urPxpZpSV3SgqXRzs/aUlG1tFG1ellIgGh8j+uWJ+aM2p0wnWv+N6R7eHJaUfDB3bjbKE7GH0f/05eA9mQ3QiBPHHdrPgYyAxD5kTavS0eqryK3zMOAiLcsklfl4T8A/J6lhdrT2/DF79VC+JSJ9six6zzcjnccwBUgTjBOWDnO9IqIFolJgN7jTlVVLCiTDbcpGBDz1RDRvCGMc+12HIYK0oFfTuJVVChOq0euAWQmFa5Zwj8nNzKtGQTKQzkgDlrbUe7pd+IQKaZ9Wj8yMujxl9PtV55QptYy8khQexbyO9e6eRnXAAsH5rXy5YzCRxz3McGJ/J86I+1N/N9mZOaNFA1TyWO/fr5dqlZy43svNXKcbAcrXo4x9oSnErsOC6kwUd5M1CcLV+duX18x7NGBfIeRBiHZWNsSokybhCUQzO1vV/Amm5TWBSAN79X1Wwititi83w9+WzJkoIPToYFP+GaC8tugwDDkl5cpuw4TaWbqVxVvm9wd91n+yJVYF7xyGEvLaLlYoeykKNaAbOjGpIQXkzfPEbLCFkx08+xEsUyu6ScHvWFNlJSZvi8UV6HtrbPJU8lXeIoUqZEiX97qvfYSvaic2FuDb56bG4t4+rev3uKSld9Cg=","X-Forefront-Antispam-Report":"CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:;\n IPV:NLI; SFV:NSPM; H:DB9PR03MB7180.eurprd03.prod.outlook.com; PTR:; CAT:NONE;\n SFS:(13230040)(19092799006)(366016)(376014)(52116014)(1800799024)(38350700014)(18002099003)(22082099003)(56012099003);\n DIR:OUT; SFP:1101;","X-MS-Exchange-AntiSpam-MessageData-ChunkCount":"1","X-MS-Exchange-AntiSpam-MessageData-0":"\n aWY+2nMvjW4/miriBzKUIsyo+FVhO3Yv43E3XEAYTEmWzP8en91VWqZT6qvmjRtyQaqWtkvl6utTLH/DeY7iDBn+OeG962ntw9u53jve49HtKyyFsYZHFx9KiwyN3yay1h8YI33JjtPXEZigbS6hBE5VSqHymlTlPEwpSAcpUN8Vs0rXMxZP9F/7TkmSZXZ3/5s1ERFCxBdFOIgQZKAyFkco1FjZcM5lbrHTAp1QSyhO9bWuJTLe4zA4nQQHcbVn+DW+VgGmPD7GVzWjuTdBhHlqqzXhDRo0v41z6PJSWTZOo4bH/i+/8aJL1SRcm5vUnXkacGRg+X5RNooYSVBppxcQwPC3+sCPMqvoidJ8eUPIllxPuvFALOEf0gnicqrKRJsPuqiZkd/eE6cpptEuNp+dGajgazpTaZUzymop45V63RLPBQRFbTOrZk0hSoNyDyGIJVaAb4sroDG27NcEKxEDR+pgBeBEBgd8sJgyCdqbDh24QBTNisijEkQkdeNHWxigo+l1O9YjV1s8ispuIsJwtk9XJF/KuW/VSrp/xitutIwcFhgueVjcQMGXBSuzJDaM19EgL1gZDqpWVWEMwPcuIrOkK73uyFxShV4/fRL4z832AiYcl4CgdU4SpD0zuSL3RBc2RIWwtfrDT14gDIWXw4I20cpLMe79mk6N1hO9yP9OK7eH9ZRaF07o4gPxlvYHVF7cAcZMOzz20ogS/RA7S7UXaBNl3BZ3VrtPuUqyaez/EEcabwEHi6/dM5Dowbjz3uRBXi54doqfgKnDasYpWPngJNa8bGf1ZsmdQd+xyUXQDf7CnwBb9Tv5IN3HVf6SB/Cn4H0qTMSEwRLqCD3S5Y/cY6o0SXlupMnwzpfotNButLYop2iAYNeTBrZnpVfImnYYFKZTfs2YoKFIxWPYMW60Mw3oRSNyBgGfcnJNdU4XxZIvS9vmjZ5Sz72BsL3W2AGNdSjJDLArFvfLyBKgf7j8BbCoNENHmZ8Y883lhsvnoooXNdB5XVrtJkaj1ZGJ3KGYgpOOFQEoqRrh9SB2K4ynn2kBDrPmFtFXYPL4t0OKUFrqH9IV3HKnW/+JtQ/qER09QDtkNtc2ciP0zWMja8DdALytpBzFIr9VvPLR8CH37EZEwjCHre+hr5h1oWz+lPq1iO5nYNeRQSGuoEJ8sD6JoM3KMmQu92i1CKz04ki34V6n+fehqdN4zco7q6+/YvPh/jWgJCHyT9nnnKCComV9sl8uUiElbOfik0TbiKp/4Hwjt0GRJBNa8Js96liUHdwPQirrkwYhLlA89gdHytsrdEn/9k7knJwpuwOHZa9mdMnr8gkxf0GO3AMKgO8yhfU5i62JrB2SN3XiiHNJCDLB50sQAr3UE85qlarotbiBmxvQqSAmS190mpqtqh9dfGzciUsPEcuoKc9Fle2eC7mfw9kXw7wNtO0kl9fViGh16yJv4NS73pDGfXcSsrDuT2f6x+qQLxo6RUf49O6uqfs4/yvaNcK5stWyC72gBvR8kRWVS1ID1vj7Nb/4SW/Y5EAppdmdyy0bHwQpmCYsWM+64AowpO4rDQ/LzC+pzCHoa3Q8QH7/+gdKoTQPR2OVnfgWmmKdX5eZtJ+03UjOvD6lD1kStbnKjTWZbJW/rh4SqfeV5tlNoCCq5hiY4IK1OT6dmvzFpt4ioE1aHl/WGsTmoKfX25jz12ke5U8DN+laX0mOQGP7+SI6FbvdBwonJvSKNOydLfwQByq8OQ==","X-OriginatorOrg":"mt.com","X-MS-Exchange-CrossTenant-Network-Message-Id":"\n 543f1b3c-0e40-4dff-4b26-08de9f803bd8","X-MS-Exchange-CrossTenant-AuthSource":"DB9PR03MB7180.eurprd03.prod.outlook.com","X-MS-Exchange-CrossTenant-AuthAs":"Internal","X-MS-Exchange-CrossTenant-OriginalArrivalTime":"21 Apr 2026 08:30:24.7391 (UTC)","X-MS-Exchange-CrossTenant-FromEntityHeader":"Hosted","X-MS-Exchange-CrossTenant-Id":"fb4c0aee-6cd2-482f-a1a5-717e7c02496b","X-MS-Exchange-CrossTenant-MailboxType":"HOSTED","X-MS-Exchange-CrossTenant-UserPrincipalName":"\n EXmXGjnTY8jd5Jx7YcsMurMv2YzWLpmvjpZjTEjguphy7DP06i6zAp6TXtwnJo8rJosxh3l9XEGi5aD+yEczfg==","X-MS-Exchange-Transport-CrossTenantHeadersStamped":"PAVPR03MB9701","X-BeenThere":"u-boot@lists.denx.de","X-Mailman-Version":"2.1.39","Precedence":"list","List-Id":"U-Boot discussion ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"u-boot-bounces@lists.denx.de","Sender":"\"U-Boot\" ","X-Virus-Scanned":"clamav-milter 0.103.8 at phobos.denx.de","X-Virus-Status":"Clean"}},{"id":3679737,"web_url":"http://patchwork.ozlabs.org/comment/3679737/","msgid":"","list_archive_url":null,"date":"2026-04-21T08:34:01","subject":"Re: [PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option","submitter":{"id":90988,"url":"http://patchwork.ozlabs.org/api/people/90988/","name":"Wojciech Dubowik","email":"Wojciech.Dubowik@mt.com"},"content":"On Mon, Apr 20, 2026 at 05:58:45PM -0500, David Lechner wrote:\n\nHello David,\n\n> On 4/20/26 5:15 PM, David Lechner wrote:\n> > On 4/20/26 3:38 AM, Wojciech Dubowik wrote:\n> >> Some distros are using gnutls library without pkcs11 support\n> >> and linking of mkeficapsule will fail. Add disable pkcs11\n> >> option with default set to no so distros can control this\n> >> feature with config option.\n> >>\n> >> Suggested-by: Tom Rini \n> >> Cc: Franz Schnyder \n> >> Signed-off-by: Wojciech Dubowik \n> >> ---\n> >> Changes in v2:\n> >> - make use of stderr more consistent\n> >> - add missing ifndef around pkcs11 deinit functions\n> >> ---\n> >> tools/Kconfig | 8 ++++++++\n> >> tools/Makefile | 3 +++\n> >> tools/mkeficapsule.c | 17 ++++++++++++++++-\n> >> 3 files changed, 27 insertions(+), 1 deletion(-)\n> >>\n> >> diff --git a/tools/Kconfig b/tools/Kconfig\n> >> index ef33295b8ecd..ccc878595d3b 100644\n> >> --- a/tools/Kconfig\n> >> +++ b/tools/Kconfig\n> >> @@ -114,6 +114,14 @@ config TOOLS_MKEFICAPSULE\n> >> \t optionally sign that file. If you want to enable UEFI capsule\n> >> \t update feature on your target, you certainly need this.\n> >> \n> >> +config MKEFICAPSULE_DISABLE_PKCS11\n> > \n> > Options that disable something instead of enabling it are confusing.\n> > Can we make this MKEFICAPSULE_PKCS11 instead and invert the logic?\n> > \n> >> +\tbool \"Disable pkcs11 support\"\n> >> +\tdepends on TOOLS_MKEFICAPSULE\n> >> +\tdefault n\n> > \n> > I think it would be more convenient if we did not require PKS11 by\n> > default. Otherwise, everyone using Open Embedded that doesn't have\n> > the \"p11-kit\" PACKAGECONFIG option set for GnuTLS set (which is the\n> > default) is going to get a build failure and have to research this\n> > and find the option and modify their config to fix the build.\n> > \n> > It seems like it would be better to make people who actually need\n> > PKCS11 possibly get an error by default instead and enable the\n> > option. This is pure speculation on my part, but it seems like\n> > this would be the smaller group.\n> > \n> Or maybe we could avoid the config option altogether and do something\n> with `pkg-config --libs gnutls --print-requires-private` at build time\n> to detect if `p11-kit-1` is used by gnutls or not?\nI will have a look into it and your previous proposal. I guess from \ndiscussions that this feature is quite urgent.\n\nRegards,\nWojtek","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=mt.com header.i=@mt.com header.a=rsa-sha256\n header.s=selector2 header.b=XvqEpFJN;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=85.214.62.61; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)","phobos.denx.de;\n dmarc=pass (p=reject dis=none) header.from=mt.com","phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de","phobos.denx.de;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=mt.com header.i=@mt.com header.b=\"XvqEpFJN\";\n\tdkim-atps=neutral","phobos.denx.de;\n dmarc=pass (p=reject dis=none) header.from=mt.com","phobos.denx.de;\n spf=fail smtp.mailfrom=Wojciech.Dubowik@mt.com","dkim=none (message not signed)\n header.d=none;dmarc=none action=none header.from=mt.com;"],"Received":["from phobos.denx.de (phobos.denx.de [85.214.62.61])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g0FyF3QVmz1yGt\n\tfor ; Tue, 21 Apr 2026 18:34:13 +1000 (AEST)","from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id 067BD8431E;\n\tTue, 21 Apr 2026 10:34:09 +0200 (CEST)","by phobos.denx.de (Postfix, from userid 109)\n id 2DA1B8433B; Tue, 21 Apr 2026 10:34:08 +0200 (CEST)","from PA4PR04CU001.outbound.protection.outlook.com\n (mail-francecentralazlp170130007.outbound.protection.outlook.com\n [IPv6:2a01:111:f403:c20a::7])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id 934D784258\n for ; Tue, 21 Apr 2026 10:34:05 +0200 (CEST)","from DB9PR03MB7180.eurprd03.prod.outlook.com (2603:10a6:10:22d::13)\n by AM7PR03MB6231.eurprd03.prod.outlook.com (2603:10a6:20b:142::13)\n with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9818.32; Tue, 21 Apr\n 2026 08:34:03 +0000","from DB9PR03MB7180.eurprd03.prod.outlook.com\n ([fe80::6fd2:12a9:4423:8ddc]) by DB9PR03MB7180.eurprd03.prod.outlook.com\n ([fe80::6fd2:12a9:4423:8ddc%6]) with mapi id 15.20.9846.016; Tue, 21 Apr 2026\n 08:34:03 +0000"],"X-Spam-Checker-Version":"SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de","X-Spam-Level":"","X-Spam-Status":"No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,\n DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED,\n SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2","ARC-Seal":"i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;\n b=nihlXciYVJzDA5E8ZQp7cgUKmO99V4uEqm98kmW9ayXqnmkp2Is2erHYRE1eTDxpr2lw589gnMBtEFsIhdCsbwJCWDTP2LpHfRhcjiS8OlhHgI1CTrNcny8Ucjb3y06zLWFAjW+xgBxOozh7OiqsTfNRzageT8LdH0Tb9mLk1zKGE+eygHnw0jrkPKKDBSCqup02CP1/D5aIeYb8YJTm0vV4gwL2/Mnej/tOha0ASsAlNyWFwrFqnNI/PkDZvrLroWL+L3g1wH6qvhs5yd3JA2a1cJpIkMCwpQUojjsRck4e3uKzLHRuUvNSRwNaziw2BvN+jffY2qM5QNOegJDxWQ==","ARC-Message-Signature":"i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;\n s=arcselector10001;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;\n bh=3hOxIi3fvnM9QzM2ZEQOO+fTFSlwiwh6EgcxkXx40z4=;\n b=BunBL8g9zJZ9XgsWofsKW4V9M74K5tQPe5ZZfO1lm5rHrJO+dCt/za/WXMWJCvcaY/gQhxlN3uSmr8HWpsSkH4AvydKzFMNV5v6VKBmE3xJUoVf2+jo6a3LNUyTk91ResITncsRrK6ziAPqx2ULf7Q84bIKmWlE1DJeAOTfJB0c51Cb9PCH+5Y87SyH5EAg/kP/FaYzy1PL07Jn8lzRHelVKuc8A16JGtdqzFN6naPAkJYJ+JTaNwnE54Ix225fPu1kdT63eniT5H5eCJfbqURJ9n4AUAhctjXcuikp9Xw2o1EHlpea1iRbkRH+2hpoavdmI3XItIBNLjKFoy03SvA==","ARC-Authentication-Results":"i=1; mx.microsoft.com 1; spf=pass\n smtp.mailfrom=mt.com; dmarc=pass action=none header.from=mt.com; dkim=pass\n header.d=mt.com; arc=none","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=mt.com; s=selector2;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;\n bh=3hOxIi3fvnM9QzM2ZEQOO+fTFSlwiwh6EgcxkXx40z4=;\n b=XvqEpFJNEDNUne6h2EFa+usv4EQAxeHv+sjkBHzb509PlG0PvtvdCMaAOgBXlXwu8Pz+guzEUZnNQlAPj+uKYdhAPxhY4odqJiZ4FxrmUvu4NxePz0T/USykUfTqo1kXXLNxyBUSzu7SeumYFMKYaPQl9iU/4mqANlP4b8IMCHzeD7eiQjvcljfg7N36pWblxaQRMqaDtapl1CYtoXA/+c4iBw4SaD5Xu8wMYBe7ZRSKEbfFSSkPDNxjwpSOLc6Tg6AETVJ47Q7SPJFf6EOFzVDop9gJROvlZCtjjHf/OPYACc0r2d8sygcMp1J63At0hHwMVI8P6mRUAlzks/4vwA==","Date":"Tue, 21 Apr 2026 10:34:01 +0200","From":"Wojciech Dubowik ","To":"David Lechner ","Cc":"u-boot@lists.denx.de, Simon Glass ,\n Franz Schnyder , trini@konsulko.com,\n \"openembedded-core @ lists . openembedded . org\"\n ,\n Francesco Dolcini ","Subject":"Re: [PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option","Message-ID":"","References":"<20260420083850.8504-1-Wojciech.Dubowik@mt.com>\n <61daa047-74f0-4a76-a61f-de54ca4b716e@baylibre.com>\n ","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":"","X-ClientProxiedBy":"ZR0P278CA0201.CHEP278.PROD.OUTLOOK.COM\n (2603:10a6:910:6a::14) To DB9PR03MB7180.eurprd03.prod.outlook.com\n (2603:10a6:10:22d::13)","MIME-Version":"1.0","X-MS-PublicTrafficType":"Email","X-MS-TrafficTypeDiagnostic":"DB9PR03MB7180:EE_|AM7PR03MB6231:EE_","X-MS-Office365-Filtering-Correlation-Id":"d89aff40-fac9-4b00-561a-08de9f80be7e","X-MS-Exchange-SenderADCheck":"1","X-MS-Exchange-AntiSpam-Relay":"0","X-Microsoft-Antispam":"BCL:0;\n ARA:13230040|19092799006|366016|376014|52116014|1800799024|38350700014|56012099003|22082099003|18002099003;","X-Microsoft-Antispam-Message-Info":"\n GINMBgiI8g4pwyhtM5jV/kib+egi8+ZOUXYYAI4BO4Qx4UgY+MUjtnaY7UKLmEnfJ36fb+6xTsCJ8EUwdsZiMqz2FMgj/6LdmVBGMWyYVJd11k7WfOeMT+dXqcWCANB+Bfs29Lm7OSNxnTuzf/cf5m1g/C9NFd1zz8Km7N25UbIjYU+xG0GMHC7oSr4k0E2ZEph8ICW3autn2mZCfcnxOlCMGx5GozcZ4QaNvWRQzO7xoOsOGuyqAiqY4F9c3+E5nrJXmw13MBgegPiho/h9O/c3ZLmzs0WmBtj8N41RJtriEr99xb2GE4S9MObWrr6m3/Z7vlgy9u49RL2SucM1hV89Yz98apoS+41MygVWKIkI4WXCBj2cUguE8STrzQ985Zq0qQroTpY6ZeY07VKXqDG9bpWAHV55puzxLVTSkALuNrpl1o8httGqQ/4ldfFEu8Qf+gA1AG5jDFRHUoC0lLVOUd76Ydgc1MzVLW8jZ0wnwp0EbSaxWH28766i4gvA6Vlo3yufdguvf15gp2Kyz+AAYZloJBUUEvhuRmKIwpZSGgoQhnzpui+7rsFE11lbr5HjQQQQj/f5LpFjGhZW+XN2xYxuBBi02zY0v/p3TD/EUO+jUiv4+xeVHkNHJxKF/K+fFP0HP3ZPK4J2CFf7Nnl4q+HnKVVCiWUANHmZnGYSY+N8z4Q/x7mF4RsqG3bnm8GBXp/wHKbzuz2KWvVDKXSntMldku9iFp5YdmD26Rml7eTsn5pGfV+R9Quks9jJXTnUr0OiNXYX6F4N3ZyoPqhqzRhPDHCYwIVxrFaVM1Q=","X-Forefront-Antispam-Report":"CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:;\n IPV:NLI; SFV:NSPM; H:DB9PR03MB7180.eurprd03.prod.outlook.com; PTR:; CAT:NONE;\n SFS:(13230040)(19092799006)(366016)(376014)(52116014)(1800799024)(38350700014)(56012099003)(22082099003)(18002099003);\n DIR:OUT; SFP:1101;","X-MS-Exchange-AntiSpam-MessageData-ChunkCount":"1","X-MS-Exchange-AntiSpam-MessageData-0":"\n mT4DrpthG9IyOsMZAhiokKkJSNI+VnagoS5h2Molt4Krfj0rbMDJFWC/+4ud07fLIT3MJUAclKKXaH9Q2NZrMs7y/wpMcoGCxPj6NqT8RX46CdCmQppGenJEX8Rest04fxYKufblzstI5uii2rrp6Y/2WN74vuQysVNYFHxOxzpwt0ArMTIct/2ZA555H4kcPS5Pop1YArsmGLhyYT8bQapWgSH27ACDtyWO4gluC45i1BM11iTtkNW+ci2UY0sNjETx7UEU5rd4YjJrgLqpobcxv/TOPbgLrXzZQkr1VtVJ5XFFLNukAJBKx0dcMEsQlGFXFuk4DhSTOeyT3vpJ2OhrbzPQeMSjUUzKpAGiIgknsQgiuS9gnVRqxBD80T48j2y+4uV2iv7NqWSfjDOhIfqaKURkJzxnCwKJ8Pm1OttitGIuU7rYrR+USrGNAhiLH+MoC2rS25+Me3Uzv20An9gpUTQtyWrGMuf01HZHNHNm9os41tAgs9Mc9poWkJo7AqbTvnxL7wSCtdZQkgfaoi36MjYx5CUmpMIHCou5+E6D2RDoNZkLDalWFcnpXF8ElArdYDVltjTAM7SluKsiEG7q7bp+vVm8NU+26jSXlpDzG3sYjIUGuoiemxwnmLZ/DBRJi0hJFe9De3sn8vk0zR4dkZSE7Dge9/DksJqwheyavxWv42eTwZ41gplwPj3X+17SRFFp0b9L2UKLPeF0BBiKm/lq2rY30uhArC1Ixckcu1XJIKh6cuivc/pSm1HZfORvb86JWfAkNCcVDpkDpyUjO2KCoRPGa3pidqvKl2KjtWloUwqQttDddHj6ZvJA4n+xbNZTD7ZqjozPaJGgGC2vH0weV5ggIZSwMpKhKg7qSeVcMRn6RBy/41kDZTDwU6j26Q4DOxjzc3EeNTvnFzp4x1tYOkqDt3gGtrt8jfFLMeyPGbPQ0yeM2sMt/Ak5Q2yr7qQH8QmCXMjN7hIIqtvNSnU+SQEXLIv80X80wzP8R0TC7W2H/halZkD4cbWRUPawBZ+u65dMF47uz1/oRHTh/RIRdjKVEwZOtaeCIQeVV6uZMODoq+ZOFFkz4pM2Rl1JNe/Vq2dG+3OwPzipyWnmP7PtXIWYdCByYWpCil1jpxH0cydT8NvAYB4z5sNBehvKy+2vIx+RWNRx3cdweI+Czfc84gtMdl4OFfz9OhG46ByWkKndsEYMp/0Dv53p4ZguoGTVddiqUkqIdAZb3TJqphkdy/xshx3ziZQP8sP3krpyV+48PJE1TQ7Plqi7uJM5PYeNN2UilEql6tG0j6oGuDn6yJO6DAsSKJol7JP74TNqLLXAK1hUU9I1twycTYqluwpHORcHA/JTlDRLcH+kNXj5C9NcTI1pgdUuFi+NFqsoatgVL3O/EbuMJMGVlBREL+tVXuQmv0WTOCo1idjxKAgLQEKPhuZHGeJlAywcXo86FA7hIrq9gEnBBtqYnm9BsO0K34YM6KX+yAurjrJR1kxxKMwyICQrYWF3BsiJJ6dB+UOkLAy40QAae5egRqT7bCV/YfURKlFGcXJZ/2qyM4BxbV0ccVRCmTy9LXZF9ZjHzjdZ1ne9Vkv5j07trCgzTZMXf55L1tRXJmJdVJZ66U8/WNdyprmX64g+zFkc6uv3EU8BWkck4Z7tofRhloIgKmjNbP1LndFQpUMB9WP5slUktnvL8v5XqiPX14vbWlU6pCqpuEGfFDx+8QQ7fZP0n4WIl91QGE1zAQpr4A==","X-OriginatorOrg":"mt.com","X-MS-Exchange-CrossTenant-Network-Message-Id":"\n d89aff40-fac9-4b00-561a-08de9f80be7e","X-MS-Exchange-CrossTenant-AuthSource":"DB9PR03MB7180.eurprd03.prod.outlook.com","X-MS-Exchange-CrossTenant-AuthAs":"Internal","X-MS-Exchange-CrossTenant-OriginalArrivalTime":"21 Apr 2026 08:34:03.6414 (UTC)","X-MS-Exchange-CrossTenant-FromEntityHeader":"Hosted","X-MS-Exchange-CrossTenant-Id":"fb4c0aee-6cd2-482f-a1a5-717e7c02496b","X-MS-Exchange-CrossTenant-MailboxType":"HOSTED","X-MS-Exchange-CrossTenant-UserPrincipalName":"\n JLmPmVgXw9gduYfwWW0aQDgk2pWxnd3mv5kDon94vBJYhovj7Ji8zjAMhW3nDyyBHF6Ydn/h8qy4RAABqWSDWA==","X-MS-Exchange-Transport-CrossTenantHeadersStamped":"AM7PR03MB6231","X-BeenThere":"u-boot@lists.denx.de","X-Mailman-Version":"2.1.39","Precedence":"list","List-Id":"U-Boot discussion ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"u-boot-bounces@lists.denx.de","Sender":"\"U-Boot\" ","X-Virus-Scanned":"clamav-milter 0.103.8 at phobos.denx.de","X-Virus-Status":"Clean"}},{"id":3679780,"web_url":"http://patchwork.ozlabs.org/comment/3679780/","msgid":"","list_archive_url":null,"date":"2026-04-21T09:52:43","subject":"Re: [PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option","submitter":{"id":88462,"url":"http://patchwork.ozlabs.org/api/people/88462/","name":"Quentin Schulz","email":"quentin.schulz@cherry.de"},"content":"Hi Wojciech,\n\nOn 4/21/26 10:30 AM, Wojciech Dubowik wrote:\n> On Mon, Apr 20, 2026 at 12:16:38PM +0200, Quentin Schulz wrote:\n[...]\n>> On 4/20/26 10:38 AM, Wojciech Dubowik wrote:\n[...]\n>>> +#endif\n>>> \tint ret;\n>>> \tbool pkcs11_cert = false;\n>>> \tbool pkcs11_key = false;\n>>> @@ -242,6 +244,7 @@ static int create_auth_data(struct auth_context *ctx)\n>>> \tif (!strncmp(ctx->key_file, \"pkcs11:\", strlen(\"pkcs11:\")))\n>>> \t\tpkcs11_key = true;\n>>> +#ifndef CONFIG_MKEFICAPSULE_DISABLE_PKCS11\n>>> \tif (pkcs11_cert || pkcs11_key) {\n>>> \t\tlib = getenv(\"PKCS11_MODULE_PATH\");\n>>> \t\tif (!lib) {\n>>> @@ -259,6 +262,7 @@ static int create_auth_data(struct auth_context *ctx)\n>>> \t\t\treturn -1;\n>>> \t\t}\n>>> \t}\n>>> +#endif\n>>\n>> This is getting kinda ugly. I'm wondering if it wouldn't be more readable to\n>> move the pkcs11-specific code into specific functions. You call the function\n>> from create_auth_data() and you have two definitions of the function, one\n>> when CONFIG_MKEFICAPSULE_DISABLE_PKCS11 is enabled, one for when it's not.\n>>\n> \n> Well. The idea behind was that you can have mixed pkcs11/cert files when creating\n> capsule. This is real use case as some HSM are too expensive to store public stuff.\n> Rearranging it would go well behind solving the current problem of OE not being able\n> to compile. I can have a look into it but probably not before we solve the current\n> problem.\n> \n\nPlease read the example provided below. The logic is kept intact, it's \njust that the code within if-blocks is moved to a separate function \ninstead of having it entirely ifdef'ed within the caller. There's also \nadded benefit that if it turns out there are more callers in the future, \nwe don't need to duplicate this ifdefery in each caller.\n\nFixing a bug is not a reason for doing things hastily or not as nice as \nwe could do it. I'm not the maintainer though, so this is just me \nsharing some opinion.\n\n>> Something like\n>>\n>> #if CONFIG_IS_ENABLED(MKEFICAPSULE_DISABLE_PKCS11)\n>> static int mkeficapsule_import_pkcs11_crt(...)\n>> {\n>> fprintf(stdout, \"Pkcs11 support is disabled\\n\");\n>> return -1;\n>> }\n>> #else\n>> static int mkeficapsule_import_pkcs11_crt(...)\n>> {\n>> [...]\n>> }\n>> #endif\n>>\n>> [...]\n>>\n>> static int create_auth_data(struct auth_context *ctx)\n>> {\n>> [...]\n>>\n>> if (pkcs11_cert) {\n>> ret = mkeficapsule_import_pkcs11_crt(...);\n>> if (ret < 0) {\n>> fprintf(stdout, \"Failed to import crt: %d\\n\", ret);\n>> return ret;\n>> }\n>> }\n>> [...]\n>> }\n\nCheers,\nQuentin","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=cherry.de header.i=@cherry.de header.a=rsa-sha256\n header.s=selector1 header.b=nifJgvoX;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)","phobos.denx.de;\n dmarc=pass (p=quarantine dis=none) header.from=cherry.de","phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de","phobos.denx.de;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=cherry.de header.i=@cherry.de header.b=\"nifJgvoX\";\n\tdkim-atps=neutral","phobos.denx.de; dmarc=pass (p=quarantine dis=none)\n header.from=cherry.de","phobos.denx.de;\n spf=pass smtp.mailfrom=quentin.schulz@cherry.de","dkim=none (message not signed)\n header.d=none;dmarc=none action=none header.from=cherry.de;"],"Received":["from phobos.denx.de (phobos.denx.de\n [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g0Hj23HGVz1yCv\n\tfor ; Tue, 21 Apr 2026 19:52:54 +1000 (AEST)","from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id F3D0F843C0;\n\tTue, 21 Apr 2026 11:52:51 +0200 (CEST)","by phobos.denx.de (Postfix, from userid 109)\n id 2D728843D0; Tue, 21 Apr 2026 11:52:51 +0200 (CEST)","from DB3PR0202CU003.outbound.protection.outlook.com\n (mail-northeuropeazlp170100001.outbound.protection.outlook.com\n [IPv6:2a01:111:f403:c200::1])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id 1D99C8439E\n for ; Tue, 21 Apr 2026 11:52:49 +0200 (CEST)","from DBBPR04MB7737.eurprd04.prod.outlook.com (2603:10a6:10:1e5::22)\n by DB9PR04MB8316.eurprd04.prod.outlook.com (2603:10a6:10:246::20)\n with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9818.33; Tue, 21 Apr\n 2026 09:52:44 +0000","from DBBPR04MB7737.eurprd04.prod.outlook.com\n ([fe80::5960:fb4b:9313:2b00]) by DBBPR04MB7737.eurprd04.prod.outlook.com\n ([fe80::5960:fb4b:9313:2b00%4]) with mapi id 15.20.9818.033; Tue, 21 Apr 2026\n 09:52:44 +0000"],"X-Spam-Checker-Version":"SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de","X-Spam-Level":"","X-Spam-Status":"No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,\n DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED,\n SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2","ARC-Seal":"i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;\n b=oBwfzYox01H1NeJmSV4tLie1OXGVblI0nOmFrXBdzL8myfqbcOfoquUCF91XoAYcdpJH/KKzt7OYWMIIgbxIoi1QqJdPjvZymSbr/BelM0e923meeuKRIILv6ZbnDQn4IZYiwtS+RCA+Ce7UgnuC5ftvBsGk4T+AHtF/TJOww3an/7tgWVu3eqJJW0yOwiuvT6AtXmKXw+o9PJFfT6x07Qv8sHtVLmpRHXzshtvBfeAEj1pIopGv349G8Rc81Pr2bk1Mt2qqpT//RB/IC+CCL3zP2b8rTjkLKQ/v3Wa4b6Wcp59CCPiqYUEVIHP6HfSU4RZW3bI4dckanSxTqVOt9w==","ARC-Message-Signature":"i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;\n s=arcselector10001;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;\n bh=bLN/e9976zfiV6vWKFco1PWeY+zH6meJf4aTreOU6no=;\n b=nVyVrxO/uvlEYeLrhurWtcoSqp7j5K58ODgbCHjr8uyzMydQ53Dr9xnll8CyWCLtfwlbX+60U+C8IDj4ER1vzjQfcoAFUZGadTDFUjqM7fqyLQgztqxTcAU5JXQy3addrVcAwmrplliyQLNro9TeT1Fg8loPZdrs9JME6vLo4iia0lR64FvuhOb0NgDtdbNTe+MgeXqzb8dWEKtvdnIbiaTBcQKvTYUhsgFuvxi4YERYXOUzuP5xFD/y91bglm4S6K8FZNLoFIngVGd+eb8msbdKyEgAlJrMzIWLb8Y/OsC8drNRbLyX/x+ETsWepp5dTgIMT1hBU7aNqfz8FldJtA==","ARC-Authentication-Results":"i=1; mx.microsoft.com 1; spf=pass\n smtp.mailfrom=cherry.de; dmarc=pass action=none header.from=cherry.de;\n dkim=pass header.d=cherry.de; arc=none","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=cherry.de;\n s=selector1;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;\n bh=bLN/e9976zfiV6vWKFco1PWeY+zH6meJf4aTreOU6no=;\n b=nifJgvoXPtTQ4G3chJxMTDq3u+pfPsZJDBhoa1wmZbh5FEEbRTzDzHu8KXdKV1eBJOOV0lB2Vqx/KtuYS0TcOkCjJa9TdXoR46JG2qwdOqUiDWlHNiATHRstS57E8l2ZErA9p1MjOe3CPIQFSxJbq4j0+Ip0alIbh+a2Z8QDb7I=","Message-ID":"","Date":"Tue, 21 Apr 2026 11:52:43 +0200","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH v2] tools: mkeficapsule: Add disable pkcs11 menu option","To":"Wojciech Dubowik ","Cc":"u-boot@lists.denx.de, Simon Glass ,\n Franz Schnyder , trini@konsulko.com,\n \"openembedded-core @ lists . openembedded . org\"\n ,\n Francesco Dolcini ","References":"<20260420083850.8504-1-Wojciech.Dubowik@mt.com>\n ","Content-Language":"en-US","From":"Quentin Schulz ","In-Reply-To":"","Content-Type":"text/plain; charset=UTF-8; format=flowed","Content-Transfer-Encoding":"7bit","X-ClientProxiedBy":"VE1PR03CA0008.eurprd03.prod.outlook.com\n (2603:10a6:802:a0::20) To DBBPR04MB7737.eurprd04.prod.outlook.com\n (2603:10a6:10:1e5::22)","MIME-Version":"1.0","X-MS-PublicTrafficType":"Email","X-MS-TrafficTypeDiagnostic":"DBBPR04MB7737:EE_|DB9PR04MB8316:EE_","X-MS-Office365-Filtering-Correlation-Id":"364c072b-cc9b-4406-9726-08de9f8bbc7e","X-MS-Exchange-SenderADCheck":"1","X-MS-Exchange-AntiSpam-Relay":"0","X-Microsoft-Antispam":"BCL:0;\n ARA:13230040|1800799024|366016|376014|10070799003|18002099003|56012099003|22082099003;","X-Microsoft-Antispam-Message-Info":"\n CzN1VQsWf9OCmpCDgdPOH58rtEWcx06HncGtDvwaAMhrOyehG6f5Kkdhpc9E4VP2QU0hQPmcFJAARMTepyB/6ZxHon52STVx+Cra9Wj1ovIpvnvFhTNtERNo7RVcefxig7+ebnN3PI8wQ7NZ70uPtaOp3F/ALFnuz8yjqGuHiJva7FzIytQasTBc/iKziHBCmH0Fnj/qFUrfWGMD4Kye7iKAMUgvLlH3FYzEACfVQ/iNgukiLXmfiYfaG4YYJrZ1LeFzBrb7A3iSP9H5nrM+yt8RGrX3wVmY3HXgzTkDxQj361ohhoSBYICWMzeEDW7kxca6GkPGMg15kV9fhzd9e+S1pkG5SXpBtFHMDNo76PWTxBBWGcRPoHPi9CSfwdQewkQMw35mX2v8f0E8ZrlAQ/2WKufHh5Bum4ALaW6rrNVsdbyIs9LCUJ94IqXiD5Yet9PLpXRrgDnD898newn+l+YkFcVaLxGPGWHOO7ifJRitTd4kEjJWRstLzfc06uHP9bBuA1iSGSCgSX2uOcLchh2Yww+rao257tWhW9B7qPI/8CP9Uk9KF4O5iAzU2A1p0bDBMM7EFhT3gtQ2cLSpn7uIg/HA+Fwq2I+cqMhXmZzUUGR5jslsjuEb58BEeIW8CT8kNW8ENr4Mu3TfiUF6jY7bBMPnuRezfcOv/2NvzJiO7sHrhiOn34UGTjNAbiXLRn/BjygMDbNYidJHFr7HkN2hg2kTlQg2Qc7v7zodRZM=","X-Forefront-Antispam-Report":"CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:;\n IPV:NLI; SFV:NSPM; H:DBBPR04MB7737.eurprd04.prod.outlook.com; PTR:; CAT:NONE;\n SFS:(13230040)(1800799024)(366016)(376014)(10070799003)(18002099003)(56012099003)(22082099003);\n DIR:OUT; SFP:1101;","X-MS-Exchange-AntiSpam-MessageData-ChunkCount":"1","X-MS-Exchange-AntiSpam-MessageData-0":"=?utf-8?q?nXV6U7JCZu1LiTI3CHNoXWuah38D?=\n\t=?utf-8?q?7exrOOPhhqRnjIFRcs+dvQ9TmftNMA5PTMZ/0zswQrT4HebRm4INDLkLfSto2j/6c?=\n\t=?utf-8?q?1ADOpfrF191fSKOzW8IaesqzmWt7bSHxnwuwOa4qk/aBBJK1FuPxWDim5fxaOSq/A?=\n\t=?utf-8?q?35DW+F0/rGWKWlSvpSTqmJh9+/jrHwZeisqYxqym4AW6WUY7OA0qQaCtd8OY1R8QX?=\n\t=?utf-8?q?0/f5Y3F6AHGrsU6/lZQQN7di+6ESa/CQPQGQG1Df92KB/V5sp4Wu7Gx0Ar/9SY/kc?=\n\t=?utf-8?q?IX/lkK/wU/cmVUYqMtUD7oXi3JnPa2zSc6G0+tydULSUl+WwJbp3GmvKWS3i4Y8Ug?=\n\t=?utf-8?q?o0vKdRuiCnVvLeJD4gZfDvbbCk8glWPFiXDSPzMRAVzg8V00L6LfoJIbHa3eNmvaX?=\n\t=?utf-8?q?McSwcI7A0eW2yUs9WOYNaMLeI+vNSTk1EImfuYfm5NURL6OACnneJUFvBRWUKXtiN?=\n\t=?utf-8?q?4ufTU56M8p+G4IMca2tGmo0OtpVV4S7+GLtuPM+erq+m8h6jVJPWiA3nfXhcSv51t?=\n\t=?utf-8?q?GzEXLGyKfQ/IRWRKzVzfDnZWLXKrlP2rpcakO+QOqOgwsxly2i47VbarRCxLBwRNe?=\n\t=?utf-8?q?KyV9CL95djxcjmaHaDc3Ztkf/ns/tYhqeh+v7pAuiVDDeVHuME9/Ti02mtCEmZQiU?=\n\t=?utf-8?q?k610HZXuZTfRwj22r/x5dubYJEfXaC5fEGayeOOodJNIAOZ2efVLkJy50YrabWiAK?=\n\t=?utf-8?q?xAhh6hiOSh5QpmhOgmTsqqcnMSmF4ZjpI7aIezaV+OzE40VTO5X8WXhROTNm3dCbD?=\n\t=?utf-8?q?TSeDcNLGeYt0T6+KkGBrxVPpFJIp6QFgpnHWy/bH/kcyxXAebM7sFVyAwCSAymI7l?=\n\t=?utf-8?q?YS81E4TxFICBMzGL9QaUWj5Yhc18S9ibwOeYOpy6OmcKNhQ/O6us2sdiSeVn0aIR6?=\n\t=?utf-8?q?6y1DdOThZsXEnpV3RF+O9X4ooGzuDpcnZ+b8HILPA2nxccrm2bbYi2ttHcNT3JoSz?=\n\t=?utf-8?q?Gckf1oBuk5utg+j2mDAcuu0tGWMtqcv67qLoaRgOnPkWfMvFi8SrlqeSteu208w1E?=\n\t=?utf-8?q?EvQgOEbb+bn3hjzjStqT7AJHAss9pWgV5FfX++xEaq6AncNCe0/0W3IVMXTR35f+T?=\n\t=?utf-8?q?qtaQpqZx+ogbhgZrsoGdpABDrN+rQWeW3/9S+tTKcWCkgYQVsAOybmQZ5uY1Wk3av?=\n\t=?utf-8?q?XyLLY/PC1Ub42I8s4vzsbPrjAZBDhAR+95O4CqhhFo4bYUclRUvKQy0w1HGh/lg04?=\n\t=?utf-8?q?g/z9tAKjZShtHgvT303dpeB923ft1AssgvPeES8tKa0zv1oMpgsUA33XdToslTE89?=\n\t=?utf-8?q?aPs8STlO5/JfWqLcX43pbCzjT4HJ/BiuCbr2Eejp0BDbL4eadidEWda6rwWJyCAq6?=\n\t=?utf-8?q?ZR+n3vwZfMfHV/r9lV0wd58o9JvEqLj1PtqQsNLh4eMVEyniS4EA0IBGsLabRLSu0?=\n\t=?utf-8?q?EcT3LEc9HbrskqlkK33UNCfjBporryHqfQ/QI5HhO8V2ebG5nfHJNu/dPsgzEnn51?=\n\t=?utf-8?q?2bFoMyBy3Q+Mjuri/UnpyEB/f+Jlna5WUdyg3Nk+B5JvkI9d+ReQLBesiKuqEffS9?=\n\t=?utf-8?q?aP54d7VOTK7pynb4fVRGRxcTAEGi94h+RGty6WjA3FlaXKJleGp3iCLVwC7qjCtrw?=\n\t=?utf-8?q?fu0ws+lytWz4bIM8hcQiMSD82j2fTzcRoLh1yMjQyaA9t7vVZ9MzRJd6h4sGk8QxO?=\n\t=?utf-8?q?7D3vLiYa2Nu9qdtlkKsVXp7OtGUNhwtA1W8gtIwhbUM1NQtSzuUiH5Xdzq6BmSPoy?=\n\t=?utf-8?q?mcjLYzWav?=","X-OriginatorOrg":"cherry.de","X-MS-Exchange-CrossTenant-Network-Message-Id":"\n 364c072b-cc9b-4406-9726-08de9f8bbc7e","X-MS-Exchange-CrossTenant-AuthSource":"DBBPR04MB7737.eurprd04.prod.outlook.com","X-MS-Exchange-CrossTenant-AuthAs":"Internal","X-MS-Exchange-CrossTenant-OriginalArrivalTime":"21 Apr 2026 09:52:44.6099 (UTC)","X-MS-Exchange-CrossTenant-FromEntityHeader":"Hosted","X-MS-Exchange-CrossTenant-Id":"5e0e1b52-21b5-4e7b-83bb-514ec460677e","X-MS-Exchange-CrossTenant-MailboxType":"HOSTED","X-MS-Exchange-CrossTenant-UserPrincipalName":"\n 6VEsXvz8aRIWg5xb1d7AatIuCn1csnXAXrp46tnY/2tCkchDhUhGAXorGzTyyIad2ApPVw4PsClzgdjhqa61tPDetqcaaFGL1lIfLv/JdHM=","X-MS-Exchange-Transport-CrossTenantHeadersStamped":"DB9PR04MB8316","X-BeenThere":"u-boot@lists.denx.de","X-Mailman-Version":"2.1.39","Precedence":"list","List-Id":"U-Boot discussion ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"u-boot-bounces@lists.denx.de","Sender":"\"U-Boot\" ","X-Virus-Scanned":"clamav-milter 0.103.8 at phobos.denx.de","X-Virus-Status":"Clean"}}]