minkipc: Add libraries and applications for security feature support #1094

jiaxli-QC · 2025-09-22T10:21:26Z

Minkipc is designed to facilitate secure communication between different domains.
Add the minkipc component to dynamic-layer because it depends on the qcbor library from the meta-openembedded dynamic layer.
The Mink-idl-compiler (minkidlc) is used by security components to convert .idl files into header files. Since minkipc depends on this tool and is part of dynamic-layer, add minkidlc to dynamic-layer.

recipes-security/packagegroups/packagegroup-qcom-secure.bb

recipes-security/qcbor/qcbor_git.bb

recipes-security/minkipc/minkipc_git.bb

recipes-security/packagegroups/packagegroup-qcom-secure.bb

ricardosalveti · 2025-09-22T11:34:08Z

Also please drop 'meta-qcom: security: from the commit subjects, use 'Add recipe <>' with short meaning to the recipe.

ricardosalveti · 2025-09-22T11:35:26Z

And split the commits that are including the packages in the packagegroup.

lumag · 2025-09-23T01:15:12Z

And split the commits that are including the packages in the packagegroup.

I don't think we need packagegroup at all. In the end, we only need the qtee_supplicant to be installed into the rootfs. The rest seems to be test programs (which don't belong to the production environment) and libraries (which should be pulled via dependencies).

recipes-security/qcbor/qcbor_git.bb

lumag

Please go through all review comments and implement all of them or at least provide some response to the comments that think are not correct or not applicable.

recipes-devtools/minkidlc/minkidlc-native_git.bb

recipes-security/minkipc/minkipc/0001-minkipc-compilation-Fix-compilation-issue.patch

dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb

recipes-security/minkipc/minkipc_git.bb

recipes-security/qcomtee/qcomtee_git.bb

recipes-security/qcbor/qcbor_git.bb

recipes-security/minkipc/minkipc_git.bb

recipes-security/packagegroups/packagegroup-qcom-secure.bb

jiaxli-QC · 2025-10-24T02:12:43Z

#1094 (comment)

Hi @lumag . Currently, minkidlc has only released an x86 version binary for users, and all use cases are based on x86 hosts. More validation is needed on different hosts before expanding minkidlc support.
Since minkidlc is compiled with Rust, further testing is required to ensure Rust compilation works on other platforms.
For now, we provide minkidlc via file downloads to meet the integration needs of security components. I will coordinate with the minkidlc owner and continue to work on optimizations.

lumag · 2025-10-24T06:25:51Z

More validation is needed on different hosts before expanding minkidlc support. Since minkidlc is compiled with Rust, further testing is required to ensure Rust compilation works on other platforms. For now, we provide minkidlc via file downloads to meet the integration needs of security components. I will coordinate with the minkidlc owner and continue to work on optimizations.

OE provides support for building Rust binaries. minkidlc is provided in the source form. It has 0 tests to check for regressions, but that's a different topic. So, no. I don't think we should accept downloading a binary to be executed on the build host.

recipes-security/packagegroups/packagegroup-qcom-secure.bb

recipes-security/qcbor/qcbor_git.bb

recipes-test/images/initramfs-test-image.bb

recipes-security/qcomtee/qcomtee_git.bb

recipes-devtools/minkidlc/minkidlc-native_git.bb

recipes-security/minkipc/minkipc_git.bb

recipes-security/packagegroups/packagegroup-qcom-secure.bb

jiaxli-QC · 2025-10-28T02:30:53Z

More validation is needed on different hosts before expanding minkidlc support. Since minkidlc is compiled with Rust, further testing is required to ensure Rust compilation works on other platforms. For now, we provide minkidlc via file downloads to meet the integration needs of security components. I will coordinate with the minkidlc owner and continue to work on optimizations.

OE provides support for building Rust binaries. minkidlc is provided in the source form. It has 0 tests to check for regressions, but that's a different topic. So, no. I don't think we should accept downloading a binary to be executed on the build host.

Hi @lumag , Do you mean we should raised the minkidlc compilation change in OE-core repo? I tried to compile the minkidlc in meta-qcom, but encountered some issues.

ERROR: minkidlc-native-git-r0 do_compile: Execution of '/local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/temp/run.do_compile.2240678' failed with exit code 101
ERROR: Logfile of failure stored in: /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/temp/log.do_compile.2240678
Log data follows:
| DEBUG: Executing shell function do_compile
| NOTE: Using rust targets from /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/rust-targets/
| NOTE: cargo = /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/recipe-sysroot-native/usr/bin/cargo
| NOTE: cargo build -v --frozen --target x86_64-unknown-linux-gnu --release --manifest-path=/local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/sources/minkidlc-git//Cargo.toml
| error: no matching package named `clap` found
| location searched: directory source `/local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/sources/cargo_home/bitbake` (which is replacing registry `crates-io`)
| required by package `idlc v0.2.1 (/local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/sources/minkidlc-git/idlc)`
| As a reminder, you're using offline mode (--frozen) which can sometimes cause surprising resolution failures, if this error is too confusing you may wish to retry without `--frozen`.
| WARNING: /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/temp/run.do_compile.2240678:186 exit 101 from '"cargo" build -v --frozen --target x86_64-unknown-linux-gnu --release --manifest-path=/local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/sources/minkidlc-git//Cargo.toml "$@"'
| WARNING: Backtrace (BB generated script):
|       #1: oe_cargo_build, /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/temp/run.do_compile.2240678, line 186
|       #2: cargo_do_compile, /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/temp/run.do_compile.2240678, line 158
|       #3: do_compile, /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/temp/run.do_compile.2240678, line 153
|       #4: main, /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/temp/run.do_compile.2240678, line 199
ERROR: Task (/local/mnt2/workspace/K2L/upstream/build/../meta-qcom/recipes-devtools/minkidlc/minkidlc-native_git.bb:do_compile) failed with exit code '1'

lumag · 2025-10-28T04:12:02Z

Hi @lumag , Do you mean we should raised the minkidlc compilation change in OE-core repo? I tried to compile the minkidlc in meta-qcom, but encountered some issues.

Please add the source code for the recipe that you are trying to build. I can't comment the failure without looking at your recipe.

jiaxli-QC · 2025-10-28T05:52:38Z

Hi @lumag , Do you mean we should raised the minkidlc compilation change in OE-core repo? I tried to compile the minkidlc in meta-qcom, but encountered some issues.

Please add the source code for the recipe that you are trying to build. I can't comment the failure without looking at your recipe.

Here is the bb file that has been created for minkidlc compilation.

SUMMARY = "Mink IDL compiler (prebuilt binary)"
DESCRIPTION = " \
Mink IDL is used to describe programming interfaces that can be used to communicate across security domain boundaries. \
Once an interface is described in an IDL source file, the Mink IDL compiler can generate target language header files. \
"

LICENSE = "BSD-3-Clause"
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=acff25b0ff46523fa016b260dbf64945"

SRC_URI = "git://github.com/quic/mink-idl-compiler.git;branch=main;protocol=https"
SRCREV = "1a52cd017ae21750c23e01851fdffd143f9c85d0"

inherit cargo native

DEPENDS += "rust-native cargo-native"

do_install() {
    install -d ${D}${bindir}
    install -m 0755 ${S}/target/debug/idlc ${D}${bindir}/minkidlc
}

FILES:${PN} += "${bindir}/minkidlc"

lumag · 2025-10-28T11:00:27Z

Use cargo-update-recipe-crates class, BBCLASSEXTEND += "native", drop the defaults.

jiaxli-QC · 2025-10-29T03:24:41Z

Use cargo-update-recipe-crates class, BBCLASSEXTEND += "native", drop the defaults.

I updated the bb file based on the comments, but the same issue occurred during compilation. error: no matching package named clap found

DEBUG: Executing shell function do_compile
NOTE: Using rust targets from /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/rust-targets/
NOTE: cargo = /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/recipe-sysroot-native/usr/bin/cargo
NOTE: cargo build -v --frozen --target aarch64-poky-linux-gnu --release --manifest-path=/local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/sources/minkidlc-git//Cargo.toml
error: no matching package named `clap` found
location searched: directory source `/local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/sources/cargo_home/ bitbake` (which is replacing registry `crates-io`)
required by package `idlc v0.2.1 (/local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/sources/minkidlc-git/idlc)`
As a reminder, you're using offline mode (--frozen) which can sometimes cause surprising resolution failures, if this error is too confusing you may wish to retry without `--frozen`.
WARNING: /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/temp/run.do_compile.3351729:185 exit 101 from '"cargo" build -v --frozen --target aarch64-poky-linux-gnu --release --manifest-path=/local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/sources/minkidlc-git//Cargo.toml "$@"'
WARNING: Backtrace (BB generated script):
    #1: oe_cargo_build, /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/temp/run.do_compile.3351729, line 185
    #2: cargo_do_compile, /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/temp/run.do_compile.3351729, line 157
    #3: do_compile, /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/temp/run.do_compile.3351729, line 152
    #4: main, /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/temp/run.do_compile.3351729, line 198

Here is the patch

@@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=acff25b0ff46523fa016b260dbf64945"
 SRC_URI = "git://github.com/quic/mink-idl-compiler.git;branch=main;protocol=https"
 SRCREV = "1a52cd017ae21750c23e01851fdffd143f9c85d0"

-inherit cargo native
+cargo rust cargo-update-recipe-crates
+BBCLASSEXTEND += "native"
-DEPENDS += "rust-native cargo-native"

jiaxli-QC · 2025-12-10T10:03:35Z

Rename qcomtee-udev.rules to 99-qcomtee-udev.rules for change 4bdc7a3. Postpone the udev rules execution time.

dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb

jiaxli-QC · 2025-12-11T03:25:43Z

Updated SRCREV for 32f1f70.
The qualcomm/minkipc#21 has been merged into MinkIPC.

lumag

you can mask arm32 builds by using COMPATIBLE_MACHINE until arm32 support is merged into minkipc.

This was ignored, which made armv7a builds to fail

jiaxli-QC · 2025-12-11T05:53:26Z

The update masks arm32 builds by using COMPATIBLE_MACHINE.

+# The module is only promised to support ARMv8 machines
+COMPATIBLE_MACHINE = "^$"
+COMPATIBLE_MACHINE:aarch64 = "(.*)"

57a216e

github-actions · 2025-12-11T08:37:20Z

Test run workflow

Test jobs for commit `57a216e`

Job 123925 on qcs9100 - boot test (qcs9100-ride-sx) 20126434452
Job 123928 on qcs6490 - boot test (rb3gen2-core-kit) 20126434452
Job 123924 on qcs9100 - boot test (qcs9100-ride-sx) 20126434452
Job 123936 on dragonboard-820c - boot test (dragonboard-820c) 20126434452
Job 123934 on dragonboard-410c - boot test (dragonboard-410c) 20126434452
Job 123923 on qcs9100-rb8 - boot test (iq-9075-evk) 20126434452
Job 123927 on qcs8300 - boot test (qcs8300-ride-sx) 20126434452
Job 123931 on qcs8300 - boot test (qcs8300-ride-sx) 20126434452
Job 123933 on dragonboard-820c - boot test (dragonboard-820c) 20126434452
Job 123932 on qrb2210-rb1 - boot test (rb1-core-kit) 20126434452
Job 123929 on qcs6490 - boot test (rb3gen2-core-kit) 20126434452
Job 123935 on qcs9100-rb8 - boot test (iq-9075-evk) 20126434452
Job 123926 on dragonboard-410c - boot test (dragonboard-410c) 20126434452
Job 123930 on qrb2210-rb1 - boot test (rb1-core-kit) 20126434452

test-reporting-app · 2025-12-11T08:37:37Z

Test Results

12 files - 2 24 suites - 4 36m 1s ⏱️ - 1m 41s
45 tests - 5 45 ✅ - 5 0 💤 ±0 0 ❌ ±0
264 runs - 40 264 ✅ - 40 0 💤 ±0 0 ❌ ±0

Results for commit 57a216e. ± Comparison against base commit 7577fc8.

This pull request removes 5 tests.

0_qcs8300-ride-sx-smoke-test ‑ dmesg
0_qcs8300-ride-sx-smoke-test ‑ ip
0_qcs8300-ride-sx-smoke-test ‑ pwd
0_qcs8300-ride-sx-smoke-test ‑ uname
lava ‑ 0_qcs8300-ride-sx-smoke-test

♻️ This comment has been updated with latest results.

github-actions · 2025-12-11T09:20:52Z

Test run workflow

Test jobs for commit `57a216e`

Job 123925 on qcs9100 - boot test (qcs9100-ride-sx) 20126434452
Job 123943 on qcs8300 - boot test (qcs8300-ride-sx) 20126434452
Job 123928 on qcs6490 - boot test (rb3gen2-core-kit) 20126434452
Job 123924 on qcs9100 - boot test (qcs9100-ride-sx) 20126434452
Job 123936 on dragonboard-820c - boot test (dragonboard-820c) 20126434452
Job 123934 on dragonboard-410c - boot test (dragonboard-410c) 20126434452
Job 123941 on qcs6490 - boot test (rb3gen2-core-kit) 20126434452
Job 123923 on qcs9100-rb8 - boot test (iq-9075-evk) 20126434452
Job 123927 on qcs8300 - boot test (qcs8300-ride-sx) 20126434452
Job 123931 on qcs8300 - boot test (qcs8300-ride-sx) 20126434452
Job 123933 on dragonboard-820c - boot test (dragonboard-820c) 20126434452
Job 123942 on qcs8300 - boot test (qcs8300-ride-sx) 20126434452
Job 123932 on qrb2210-rb1 - boot test (rb1-core-kit) 20126434452
Job 123929 on qcs6490 - boot test (rb3gen2-core-kit) 20126434452
Job 123935 on qcs9100-rb8 - boot test (iq-9075-evk) 20126434452
Job 123926 on dragonboard-410c - boot test (dragonboard-410c) 20126434452
Job 123930 on qrb2210-rb1 - boot test (rb1-core-kit) 20126434452

dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb

Minkipc is designed to facilitate secure communication between different domains. Add the minkipc component to dynamic-layer because it depends on the qcbor library from the meta-openembedded dynamic layer. Signed-off-by: Jiaxing Li <[email protected]>

jiaxli-QC · 2025-12-11T10:21:38Z

Updated the comment at minkipc_git.bb, line 36 for 869fcee

dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb

jiaxli-QC requested review from lumag, ndechesne, ricardosalveti, sbanerjee-quic and vkraleti as code owners September 22, 2025 10:21

lumag requested changes Sep 22, 2025

View reviewed changes

lumag mentioned this pull request Sep 23, 2025

Stop downloading binary for the IDL compiler qualcomm/minkipc#11

Open

jiaxli-QC force-pushed the master branch from c758cb5 to 0415319 Compare September 28, 2025 07:15

lumag reviewed Sep 28, 2025

View reviewed changes

recipes-security/qcbor/qcbor_git.bb Outdated Show resolved Hide resolved

lumag requested changes Sep 28, 2025

View reviewed changes

lumag reviewed Oct 22, 2025

View reviewed changes

recipes-security/minkipc/minkipc_git.bb Outdated Show resolved Hide resolved

lumag reviewed Oct 22, 2025

View reviewed changes

recipes-security/minkipc/minkipc_git.bb Outdated Show resolved Hide resolved

lumag reviewed Oct 22, 2025

View reviewed changes

recipes-security/packagegroups/packagegroup-qcom-secure.bb Outdated Show resolved Hide resolved

jiaxli-QC force-pushed the master branch 2 times, most recently from 2f341ae to 4893e2c Compare October 24, 2025 10:40

lumag reviewed Oct 25, 2025

View reviewed changes

recipes-security/packagegroups/packagegroup-qcom-secure.bb Outdated Show resolved Hide resolved

lumag requested changes Oct 25, 2025

View reviewed changes

jiaxli-QC force-pushed the master branch from 4893e2c to bd08893 Compare October 25, 2025 08:57

This was referenced Oct 29, 2025

qcbor: library to expose Qualcomm Security Package #1166

Closed

qcom-tee: add a library for security feature support #1167

Merged

jiaxli-QC force-pushed the master branch 2 times, most recently from 95cbf7e to b6b7b6d Compare December 10, 2025 09:40

jiaxli-QC requested a review from anujm1 December 10, 2025 09:45

jiaxli-QC force-pushed the master branch from b6b7b6d to 4bdc7a3 Compare December 10, 2025 10:01

lumag requested changes Dec 10, 2025

View reviewed changes

dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb Show resolved Hide resolved

jiaxli-QC force-pushed the master branch from 4bdc7a3 to 32f1f70 Compare December 11, 2025 03:22

lumag requested changes Dec 11, 2025

View reviewed changes

jiaxli-QC force-pushed the master branch from 32f1f70 to 57a216e Compare December 11, 2025 05:42

jiaxli-QC requested a review from lumag December 11, 2025 05:54

lumag requested changes Dec 11, 2025

View reviewed changes

dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb Outdated Show resolved Hide resolved

jiaxli-QC force-pushed the master branch from 57a216e to 869fcee Compare December 11, 2025 10:18

jiaxli-QC requested a review from lumag December 11, 2025 10:19

lumag approved these changes Dec 11, 2025

View reviewed changes

vksharma-oss approved these changes Dec 11, 2025

View reviewed changes

vkraleti approved these changes Dec 11, 2025

View reviewed changes

ricardosalveti reviewed Dec 11, 2025

View reviewed changes

dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb Show resolved Hide resolved

ricardosalveti approved these changes Dec 11, 2025

View reviewed changes

ricardosalveti enabled auto-merge December 11, 2025 16:21

jiaxli-QC requested review from lumag, ricardosalveti, vkraleti and vksharma-oss December 12, 2025 13:09

minkipc: Add libraries and applications for security feature support #1094

Are you sure you want to change the base?

minkipc: Add libraries and applications for security feature support #1094

Conversation

jiaxli-QC commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ricardosalveti commented Sep 22, 2025

Uh oh!

ricardosalveti commented Sep 22, 2025

Uh oh!

lumag commented Sep 23, 2025

Uh oh!

Uh oh!

lumag left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jiaxli-QC commented Oct 24, 2025

Uh oh!

lumag commented Oct 24, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jiaxli-QC commented Oct 28, 2025

Uh oh!

lumag commented Oct 28, 2025

Uh oh!

jiaxli-QC commented Oct 28, 2025

Uh oh!

lumag commented Oct 28, 2025

Uh oh!

jiaxli-QC commented Oct 29, 2025

Uh oh!

jiaxli-QC commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

jiaxli-QC commented Dec 11, 2025

Uh oh!

lumag left a comment

Choose a reason for hiding this comment

Uh oh!

jiaxli-QC commented Dec 11, 2025

Uh oh!

github-actions bot commented Dec 11, 2025

Test run workflow

Test jobs for commit 57a216e

Uh oh!

jiaxli-QC commented Sep 22, 2025 •

edited

Loading

jiaxli-QC commented Dec 10, 2025 •

edited

Loading

Test jobs for commit `57a216e`

test-reporting-app bot commented Dec 11, 2025 •

edited

Loading

Test jobs for commit `57a216e`