[PATCH] efi_loader: move efi_var_seed.o to objtree

[Jon Mason]

On Tue, Jun 23, 2026 at 4:16 PM Heinrich Schuchardt <xypron.glpk at gmx.de> wrote:
>
> Am 23. Juni 2026 21:03:38 MESZ schrieb Jon Mason <jdmason at kudzu.us>:
> >On Fri, Jun 19, 2026 at 12:46 PM Heinrich Schuchardt <xypron.glpk at gmx.de> wrote:
> >>
> >> Am 19. Juni 2026 17:58:57 MESZ schrieb Jon Mason <jon.mason at arm.com>:
> >> >With commit bd3f9ee679b4d1456d0d3c261ab76788950e6096
> >> >(kbuild: Bump the build system to 6.1), there is an issue when trying to
> >> >build out of tree, where efi_var_seed.S wants ubootefi.var to be in the
> >> >object tree, but lib/efi_loader/efi_var_seed.o wants ubootefi.var to be
> >> >in the source tree.
> >>
> >> Ubootefi.var is an optional file with the EFI security database. Why would you ever put it into the build directory?
> >
> >I didn't know that was a limitation.
> >
> >Would you prefer that I make a change like:
> >-$(obj)/efi_var_seed.o: $(srctree)/$(EFI_VAR_SEED_FILE)
> >+$(obj)/efi_var_seed.o: $(srctree)/lib/efi_loader/$(EFI_VAR_SEED_FILE)
>
> Hello Jon,
>
> It is still not clear to me why you want to change this.
>
> If you don't like the current default, why wouldn't you change CONFIG_EFI_VAR_SEED_FILE in your local .config file to match the storage location of your seed file?

Sorry, I think I've not been clear.  I have a previously working setup
in my Yocto layer for ~2 years.
After u-boot commit bd3f9ee679b4d1456d0d3c261ab76788950e6096 (kbuild:
Bump the build system to 6.1), it no longer works.
I'm only seeing this now because Yocto recently updated u-boot to v2026.04

I'm seeing the following error:
<snip>
|   aarch64-poky-linux-gcc
--sysroot=/builder/meta-arm/build/tmp/work/qemuarm64_secureboot-poky-linux/u-boot/2026.04/recipe-sysroot
-fcanon-prefix-map
-ffile-prefix-map=/builder/meta-arm/build/workspace/sources/u-boot=/usr/src/debug/u-boot/2026.04
 -ffile-prefix-map=/builder/meta-arm/build/tmp/work/qemuarm64_secureboot-poky-linux/u-boot/2026.04/u-boot-2026.04=/usr/src/debug/u-boot/2026.04
 -ffile-prefix-map=/builder/meta-arm/build/tmp/work/qemuarm64_secureboot-poky-linux/u-boot/2026.04/recipe-sysroot=
 -ffile-prefix-map=/builder/meta-arm/build/tmp/work/qemuarm64_secureboot-poky-linux/u-boot/2026.04/recipe-sysroot-native=
 -Wp,-MMD,lib/efi_loader/.efi_var_seed.o.d -nostdinc -isystem
/builder/meta-arm/build/tmp/work/qemuarm64_secureboot-poky-linux/u-boot/2026.04/recipe-sysroot-native/usr/bin/aarch64-poky-linux/../../lib/aarch64-poky-linux/gcc/aarch64-poky-linux/16.1.0/include
-Iinclude  -I/builder/meta-arm/build/workspace/sources/u-boot/include
"-DMBEDTLS_CONFIG_FILE=\"mbedtls_def_config.h\""
-I/builder/meta-arm/build/workspace/sources/u-boot/lib/mbedtls
-I/builder/meta-arm/build/workspace/sources/u-boot/lib/mbedtls/port
-I/builder/meta-arm/build/workspace/sources/u-boot/lib/mbedtls/external/mbedtls
-I/builder/meta-arm/build/workspace/sources/u-boot/lib/mbedtls/external/mbedtls/include
 -I/builder/meta-arm/build/workspace/sources/u-boot/arch/arm/include
-include /builder/meta-arm/build/workspace/sources/u-boot/include/linux/kconfig.h
-I/builder/meta-arm/build/workspace/sources/u-boot/dts/upstream/include
 -D__KERNEL__ -D__UBOOT__ -D__ASSEMBLY__ -fno-PIE -gdwarf-4 -I.
-D__ARM__ -fno-pic -mstrict-align -ffunction-sections -fdata-sections
-fno-common -ffixed-x18 -mgeneral-regs-only -mbranch-protection=none
-pipe -march=armv8-a+crc -D__LINUX_ARM_ARCH__=8 -I
/builder/meta-arm/build/workspace/sources/u-boot/lib/efi_loader -I
./lib/efi_loader    -c -o lib/efi_loader/efi_var_seed.o
/builder/meta-arm/build/workspace/sources/u-boot/lib/efi_loader/efi_var_seed.S
| Assembler messages:
| /builder/meta-arm/build/workspace/sources/u-boot/lib/efi_loader/efi_var_seed.S:14:
Error: file not found: ubootefi.var
| make[3]: *** [/builder/meta-arm/build/workspace/sources/u-boot/scripts/Makefile.build:344:
lib/efi_loader/efi_var_seed.o] Error 1
</snip>

My ubootefi.var is in the root of the u-boot source when building
(where it has always been), but it is no longer being found.

Something is broken, and I _think_ it is not being seen by others
because they build in their source tree (whereas my obj tree is in
another location in my file system, due to how yocto works).  That is
assuming that this is being tested, otherwise it is broken for
everyone and not just me.

With the patch in my first email, and some changes to my yocto
recipes, it is working again.
With the changes I suggested in my previous email, and some changes to
my yocto recipes, it is working again.

I understand your first point that the ubootefi.var file is coming
from outside, and thus doesn't belong in obj.  This is why I did some
more ugly hacking today to find the changes I suggested earlier today.
It seems like the S file is looking in the local directory,
lib/efi_loader.

I am more than happy to test out any patches, if you come up with one
that addresses the issue.

Thanks,
Jon

>
> Best regards
>
> Heinrich
>
>
> >
> >This seems to work for my use case, and still keeps it in the src directory.
> >
> >Thanks,
> >Jon
> >
> >>
> >> Heinrich
> >>
> >> >
> >> >If we change efi_var_seed.o to look in the objtree, then it should work
> >> >in both local and out-of-tree.  However, it would require anything
> >> >previously working to put ubootefi.vars to the objtree, but it's broken
> >> >now anyway.
> >> >
> >> >Signed-off-by: Jon Mason <jon.mason at arm.com>
> >> >---
> >> > lib/efi_loader/Makefile | 2 +-
> >> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >> >
> >> >diff --git a/lib/efi_loader/Makefile b/lib/efi_loader/Makefile
> >> >index f490081f6542..9c836f6ee237 100644
> >> >--- a/lib/efi_loader/Makefile
> >> >+++ b/lib/efi_loader/Makefile
> >> >@@ -74,7 +74,7 @@ obj-$(CONFIG_EFI_ECPT) += efi_conformance.o
> >> > obj-$(CONFIG_EFI_DEBUG_SUPPORT) += efi_debug_support.o
> >> >
> >> > EFI_VAR_SEED_FILE := $(subst $\",,$(CONFIG_EFI_VAR_SEED_FILE))
> >> >-$(obj)/efi_var_seed.o: $(srctree)/$(EFI_VAR_SEED_FILE)
> >> >+$(obj)/efi_var_seed.o: $(objtree)/$(EFI_VAR_SEED_FILE)
> >> >
> >> > ifeq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE),y)
> >> > capsule_crt_path=($(subst $(quote),,$(CONFIG_EFI_CAPSULE_CRT_FILE)))
> >>
>