Hello Takahiro,
I tried to run with EFI_SECURE_BOOT enabled on pine64-lts_defconfig.
U-Boot does not succeed to move from SPL to main U-Boot. The reason is that the SPL binary grows in size. This is due to EFI_SECURE_BOOT selecting additional code in SPL which of cause in unexpected.
This is related to the following settings getting enabled:
lib/Makefile:130: obj-$(CONFIG_OID_REGISTRY) += oid_registry.o
Symbol: OID_REGISTRY [=y] Type : bool Defined at lib/Kconfig:589 Selected by [y]: - RSA_PUBLIC_KEY_PARSER [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=y] - X509_CERTIFICATE_PARSER [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=y] - PKCS7_MESSAGE_PARSER [=y] && ASYMMETRIC_KEY_TYPE [=y] && X509_CERTIFICATE_PARSER [=y]
The OID registry is only used in lib/crypto which is never built for SPL.
lib/date.c:13: #if defined(CONFIG_LIB_DATE) || defined(CONFIG_TIMESTAMP) lib/date.c:102: #ifdef CONFIG_LIB_DATE
Symbol: LIB_DATE [=y]
Type : bool
Defined at lib/Kconfig:602
Selected by [y]:
- X509_CERTIFICATE_PARSER [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=y]
Selected by [n]:
- CMD_DATE [=n]
- DM_RTC [=n] && DM [=y]
There is a symbol CONFIG_SPL_RSA. If this symbol is enabled we probably want to enable LIB_DATE and OID_REGISTRY in SPL but not otherwise.
Furthermore common/image-sig.c is built in SPL unnecessarily:
Symbol: IMAGE_SIGN_INFO [=y] Type : bool Defined at common/Kconfig:1050 Selects: SHA1 [=y] && SHA256 [=y] Selected by [y]: - EFI_SECURE_BOOT [=y] && EFI_LOADER [=y] Selected by [n]: - FIT_SIGNATURE [=n] && FIT [=y] && DM [=y] - UT_LIB_RSA [=n] && UT_LIB [=n] && RSA [=y] && RSA_VERIFY_WITH_PKEY [=y]
I am currently testing a patch series to avoid this: https://gitlab.denx.de/u-boot/custodians/u-boot-efi/-/tree/rsa
Best regards
Heinrich