diff options
| author | Ilias Apalodimas <ilias.apalodimas@linaro.org> | 2021-07-17 17:26:44 +0300 |
|---|---|---|
| committer | Heinrich Schuchardt <xypron.glpk@gmx.de> | 2021-07-18 14:43:56 +0200 |
| commit | ddf67daac39de76d2697d587148f4c2cb768f492 (patch) | |
| tree | 2f6625c0035401e56d52ddc000e0b3ffddfa892e /lib/efi_loader/Makefile | |
| parent | d934ed577e9257e64e08bc722a7715e586c4a2bc (diff) | |
| download | u-boot-ddf67daac39de76d2697d587148f4c2cb768f492.zip u-boot-ddf67daac39de76d2697d587148f4c2cb768f492.tar.gz u-boot-ddf67daac39de76d2697d587148f4c2cb768f492.tar.bz2 | |
efi_capsule: Move signature from DTB to .rodata
The capsule signature is now part of our DTB. This is problematic when a
user is allowed to change/fixup that DTB from U-Boots command line since he
can overwrite the signature as well.
So Instead of adding the key on the DTB, embed it in the u-boot binary it
self as part of it's .rodata. This assumes that the U-Boot binary we load
is authenticated by a previous boot stage loader.
Reviewed-by: Masami Hiramatsu <masami.hiramatsu@linaro.org>
Tested-by: Masami Hiramatsu <masami.hiramatsu@linaro.org>
Tested-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Diffstat (limited to 'lib/efi_loader/Makefile')
| -rw-r--r-- | lib/efi_loader/Makefile | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/lib/efi_loader/Makefile b/lib/efi_loader/Makefile index fd344ce..9b36943 100644 --- a/lib/efi_loader/Makefile +++ b/lib/efi_loader/Makefile @@ -20,11 +20,19 @@ always += helloworld.efi targets += helloworld.o endif +ifeq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE),y) +EFI_CAPSULE_KEY_PATH := $(subst $\",,$(CONFIG_EFI_CAPSULE_KEY_PATH)) +ifeq ("$(wildcard $(EFI_CAPSULE_KEY_PATH))","") +$(error .esl cerificate not found. Configure your CONFIG_EFI_CAPSULE_KEY_PATH) +endif +endif + obj-$(CONFIG_CMD_BOOTEFI_HELLO) += helloworld_efi.o obj-$(CONFIG_CMD_BOOTEFI_BOOTMGR) += efi_bootmgr.o obj-y += efi_boottime.o obj-y += efi_helper.o obj-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += efi_capsule.o +obj-$(CONFIG_EFI_CAPSULE_AUTHENTICATE) += efi_capsule_key.o obj-$(CONFIG_EFI_CAPSULE_FIRMWARE) += efi_firmware.o obj-y += efi_console.o obj-y += efi_device_path.o |