minkipc: Add libraries and applications for security feature support #1094

jiaxli-QC · 2025-09-22T10:21:26Z

Minkipc is designed to facilitate secure communication between different domains.
Add the minkipc component to dynamic-layer because it depends on the qcbor library from the meta-openembedded dynamic layer.
The Mink-idl-compiler (minkidlc) is used by security components to convert .idl files into header files. Since minkipc depends on this tool and is part of dynamic-layer, add minkidlc to dynamic-layer.

recipes-security/packagegroups/packagegroup-qcom-secure.bb

recipes-security/qcbor/qcbor_git.bb

recipes-security/minkipc/minkipc_git.bb

recipes-security/packagegroups/packagegroup-qcom-secure.bb

ricardosalveti · 2025-09-22T11:34:08Z

Also please drop 'meta-qcom: security: from the commit subjects, use 'Add recipe <>' with short meaning to the recipe.

ricardosalveti · 2025-09-22T11:35:26Z

And split the commits that are including the packages in the packagegroup.

lumag · 2025-09-23T01:15:12Z

And split the commits that are including the packages in the packagegroup.

I don't think we need packagegroup at all. In the end, we only need the qtee_supplicant to be installed into the rootfs. The rest seems to be test programs (which don't belong to the production environment) and libraries (which should be pulled via dependencies).

recipes-security/qcbor/qcbor_git.bb

lumag

Please go through all review comments and implement all of them or at least provide some response to the comments that think are not correct or not applicable.

recipes-devtools/minkidlc/minkidlc-native_git.bb

lumag · 2025-09-28T07:41:39Z

recipes-security/minkipc/minkipc/0001-minkipc-compilation-Fix-compilation-issue.patch

+Subject: [PATCH] minkipc:compilation: Fix compilation issue
+
+- To fix compilation error: #warning "<cstdbool> is deprecated in C++17, remove the #include" [-Werror=cpp].
+- Disable downloading minkidlc in CMakeLists.txt.


And how is it related to disabling downloading of minkidlc?

dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb

recipes-security/minkipc/minkipc_git.bb

recipes-security/qcomtee/qcomtee_git.bb

recipes-security/qcbor/qcbor_git.bb

recipes-security/minkipc/minkipc_git.bb

recipes-security/packagegroups/packagegroup-qcom-secure.bb

jiaxli-QC · 2025-10-24T02:12:43Z

#1094 (comment)

Hi @lumag . Currently, minkidlc has only released an x86 version binary for users, and all use cases are based on x86 hosts. More validation is needed on different hosts before expanding minkidlc support.
Since minkidlc is compiled with Rust, further testing is required to ensure Rust compilation works on other platforms.
For now, we provide minkidlc via file downloads to meet the integration needs of security components. I will coordinate with the minkidlc owner and continue to work on optimizations.

lumag · 2025-10-24T06:25:51Z

More validation is needed on different hosts before expanding minkidlc support. Since minkidlc is compiled with Rust, further testing is required to ensure Rust compilation works on other platforms. For now, we provide minkidlc via file downloads to meet the integration needs of security components. I will coordinate with the minkidlc owner and continue to work on optimizations.

OE provides support for building Rust binaries. minkidlc is provided in the source form. It has 0 tests to check for regressions, but that's a different topic. So, no. I don't think we should accept downloading a binary to be executed on the build host.

recipes-security/packagegroups/packagegroup-qcom-secure.bb

recipes-security/qcbor/qcbor_git.bb

lumag · 2025-10-25T00:11:57Z

recipes-test/images/initramfs-test-image.bb

    util-linux-taskset \
    wpa-supplicant \
    ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'kmscube', '', d)} \
+    packagegroup-qcom-secure \


Now this will break because the package is not existing.

recipes-security/qcomtee/qcomtee_git.bb

recipes-devtools/minkidlc/minkidlc-native_git.bb

recipes-security/minkipc/minkipc_git.bb

recipes-security/packagegroups/packagegroup-qcom-secure.bb

jiaxli-QC · 2025-10-28T02:30:53Z

More validation is needed on different hosts before expanding minkidlc support. Since minkidlc is compiled with Rust, further testing is required to ensure Rust compilation works on other platforms. For now, we provide minkidlc via file downloads to meet the integration needs of security components. I will coordinate with the minkidlc owner and continue to work on optimizations.

OE provides support for building Rust binaries. minkidlc is provided in the source form. It has 0 tests to check for regressions, but that's a different topic. So, no. I don't think we should accept downloading a binary to be executed on the build host.

Hi @lumag , Do you mean we should raised the minkidlc compilation change in OE-core repo? I tried to compile the minkidlc in meta-qcom, but encountered some issues.

ERROR: minkidlc-native-git-r0 do_compile: Execution of '/local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/temp/run.do_compile.2240678' failed with exit code 101
ERROR: Logfile of failure stored in: /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/temp/log.do_compile.2240678
Log data follows:
| DEBUG: Executing shell function do_compile
| NOTE: Using rust targets from /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/rust-targets/
| NOTE: cargo = /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/recipe-sysroot-native/usr/bin/cargo
| NOTE: cargo build -v --frozen --target x86_64-unknown-linux-gnu --release --manifest-path=/local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/sources/minkidlc-git//Cargo.toml
| error: no matching package named `clap` found
| location searched: directory source `/local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/sources/cargo_home/bitbake` (which is replacing registry `crates-io`)
| required by package `idlc v0.2.1 (/local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/sources/minkidlc-git/idlc)`
| As a reminder, you're using offline mode (--frozen) which can sometimes cause surprising resolution failures, if this error is too confusing you may wish to retry without `--frozen`.
| WARNING: /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/temp/run.do_compile.2240678:186 exit 101 from '"cargo" build -v --frozen --target x86_64-unknown-linux-gnu --release --manifest-path=/local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/sources/minkidlc-git//Cargo.toml "$@"'
| WARNING: Backtrace (BB generated script):
|       #1: oe_cargo_build, /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/temp/run.do_compile.2240678, line 186
|       #2: cargo_do_compile, /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/temp/run.do_compile.2240678, line 158
|       #3: do_compile, /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/temp/run.do_compile.2240678, line 153
|       #4: main, /local/mnt2/workspace/K2L/upstream/build/tmp/work/x86_64-linux/minkidlc-native/git/temp/run.do_compile.2240678, line 199
ERROR: Task (/local/mnt2/workspace/K2L/upstream/build/../meta-qcom/recipes-devtools/minkidlc/minkidlc-native_git.bb:do_compile) failed with exit code '1'

lumag · 2025-10-28T04:12:02Z

Hi @lumag , Do you mean we should raised the minkidlc compilation change in OE-core repo? I tried to compile the minkidlc in meta-qcom, but encountered some issues.

Please add the source code for the recipe that you are trying to build. I can't comment the failure without looking at your recipe.

jiaxli-QC · 2025-10-28T05:52:38Z

Hi @lumag , Do you mean we should raised the minkidlc compilation change in OE-core repo? I tried to compile the minkidlc in meta-qcom, but encountered some issues.

Please add the source code for the recipe that you are trying to build. I can't comment the failure without looking at your recipe.

Here is the bb file that has been created for minkidlc compilation.

SUMMARY = "Mink IDL compiler (prebuilt binary)"
DESCRIPTION = " \
Mink IDL is used to describe programming interfaces that can be used to communicate across security domain boundaries. \
Once an interface is described in an IDL source file, the Mink IDL compiler can generate target language header files. \
"

LICENSE = "BSD-3-Clause"
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=acff25b0ff46523fa016b260dbf64945"

SRC_URI = "git://github.com/quic/mink-idl-compiler.git;branch=main;protocol=https"
SRCREV = "1a52cd017ae21750c23e01851fdffd143f9c85d0"

inherit cargo native

DEPENDS += "rust-native cargo-native"

do_install() {
    install -d ${D}${bindir}
    install -m 0755 ${S}/target/debug/idlc ${D}${bindir}/minkidlc
}

FILES:${PN} += "${bindir}/minkidlc"

lumag · 2025-10-28T11:00:27Z

Use cargo-update-recipe-crates class, BBCLASSEXTEND += "native", drop the defaults.

jiaxli-QC · 2025-10-29T03:24:41Z

Use cargo-update-recipe-crates class, BBCLASSEXTEND += "native", drop the defaults.

I updated the bb file based on the comments, but the same issue occurred during compilation. error: no matching package named clap found

DEBUG: Executing shell function do_compile
NOTE: Using rust targets from /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/rust-targets/
NOTE: cargo = /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/recipe-sysroot-native/usr/bin/cargo
NOTE: cargo build -v --frozen --target aarch64-poky-linux-gnu --release --manifest-path=/local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/sources/minkidlc-git//Cargo.toml
error: no matching package named `clap` found
location searched: directory source `/local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/sources/cargo_home/ bitbake` (which is replacing registry `crates-io`)
required by package `idlc v0.2.1 (/local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/sources/minkidlc-git/idlc)`
As a reminder, you're using offline mode (--frozen) which can sometimes cause surprising resolution failures, if this error is too confusing you may wish to retry without `--frozen`.
WARNING: /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/temp/run.do_compile.3351729:185 exit 101 from '"cargo" build -v --frozen --target aarch64-poky-linux-gnu --release --manifest-path=/local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/sources/minkidlc-git//Cargo.toml "$@"'
WARNING: Backtrace (BB generated script):
    #1: oe_cargo_build, /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/temp/run.do_compile.3351729, line 185
    #2: cargo_do_compile, /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/temp/run.do_compile.3351729, line 157
    #3: do_compile, /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/temp/run.do_compile.3351729, line 152
    #4: main, /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-poky-linux/minkidlc/git/temp/run.do_compile.3351729, line 198

Here is the patch

@@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=acff25b0ff46523fa016b260dbf64945"
 SRC_URI = "git://github.com/quic/mink-idl-compiler.git;branch=main;protocol=https"
 SRCREV = "1a52cd017ae21750c23e01851fdffd143f9c85d0"

-inherit cargo native
+cargo rust cargo-update-recipe-crates
+BBCLASSEXTEND += "native"
-DEPENDS += "rust-native cargo-native"

lumag

This wasn't tested:

ERROR: minkipc-0.0+git-r0 do_package: Didn't find service unit 'qteesupplicant.service', specified in SYSTEMD_SERVICE:minkipc.

lumag · 2025-11-25T04:47:38Z

dynamic-layers/openembedded-layer/recipes-devtools/minkidlc/minkidlc_0.2.3.bb

+Mink IDL is used to describe programming interfaces that can be used to communicate across security domain boundaries. \
+Once an interface is described in an IDL source file, the Mink IDL compiler can generate target language header files. \
+"
+HOMEPAGE = "https://github.com/quic/mink-idl-compiler.git"


The recipe should be named mink-idl-compiler, it was pointed out beforehand.

#1094 (comment)
Did you modify the dependency in minkipc_git.bb?
DEPENDS += "mink-idl-compiler-native"

If you remove the idl from ./tmp/sysroots-components/x86_64/minkidlc-native/usr/bin/idlc, you will encounter a compilation issue. For reference, see: #1094 (comment)

Why would you remove something from the dir that is not managed by the user?

dynamic-layers/openembedded-layer/recipes-devtools/minkidlc/minkidlc_0.2.1.bb

lumag · 2025-11-25T04:50:19Z

dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb

+SRCREV = "18cbaabfb339c0751e239f2b2037bad52a0715b8"
+PV = "0.0+git"
+
+DEPENDS = "pkgconfig-native qcbor qcomtee minkidlc-native glib-2.0 systemd"


Add pkgconfig to inherits instead of having a raw dependency

No, we should include the pkgconfig-native dependency; otherwise, a compilation issue may occur during configuration.

| CMake Error at qtee_supplicant/CMakeLists.txt:58 (install): | install FILES given no DESTINATION! | | | -- Configuring incomplete, errors occurred! | WARNING: /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/temp/run.do_configure.3923812:160 exit 1 from 'cmake -G 'Ninja' -DCMAKE_MAKE_PROGRAM=ninja $oecmake_sitefile /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/sources/ minkipc-0.0+git -DCMAKE_INSTALL_PREFIX:PATH=/usr -DCMAKE_INSTALL_BINDIR:PATH=bin -DCMAKE_INSTALL_SBINDIR:PATH=sbin -DCMAKE_INSTALL_LIBEXECDIR:PATH=lib exec -DCMAKE_INSTALL_SYSCONFDIR:PATH=/etc -DCMAKE_INSTALL_SHAREDSTATEDIR:PATH=../com -DCMAKE_INSTALL_LOCALSTATEDIR:PATH=/var -DCMAKE_INSTALL_LIBDIR:PA TH=lib -DCMAKE_INSTALL_INCLUDEDIR:PATH=include -DCMAKE_INSTALL_DATAROOTDIR:PATH=share -DPYTHON_EXECUTABLE:PATH=/usr/bin/python3 -DPython_EXECUTABLE:PA TH=/usr/bin/python3 -DPython3_EXECUTABLE:PATH=/usr/bin/python3 -DLIB_SUFFIX= -DCMAKE_INSTALL_SO_NO_EXE=0 -DCMAKE_TOOLCHAIN_FILE:FILEPATH=/local/mnt2/w orkspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/toolchain.cmake -DCMAKE_NO_SYSTEM_FROM_IMPORTED=1 -DCMAKE_EXPORT_NO_PACKAGE_R EGISTRY=ON -DFETCHCONTENT_FULLY_DISCONNECTED=ON -DCMAKE_EXPORT_COMPILE_COMMANDS:BOOL=ON --log-level=VERBOSE --log-context -DBUILD_UNITTEST=ON -DCFG_EN ABLE_SYSTEMD=ON -DCFG_USE_PKGCONFIG=ON -DMINKIDLC_BIN_DIR=/local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/recipe -sysroot-native/usr/bin -Wno-dev' | WARNING: Backtrace (BB generated script): | #1: cmake_do_configure, /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/temp/run.do_configure.3923812, l ine 160 | #2: do_configure, /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/temp/run.do_configure.3923812, line 13 9 | #3: main, /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/temp/run.do_configure.3923812, line 178 ERROR: Task (/local/mnt2/workspace/K2L/upstream/build/../meta-qcom/dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb:do_configure) failed with exit code '1' NOTE: Tasks Summary: Attempted 1492 tasks of which 1491 didn't need to be rerun and 1 failed. NOTE: Writing buildhistory NOTE: Writing buildhistory took: 3 seconds

Huh? I've just tested it with the following patch and it works (well... fails later).

diff --git a/dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb b/dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb index f40b4c98f3f8..addd59fecdb5 100644 --- a/dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb +++ b/dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb @@ -11,13 +11,13 @@ SECTION = "devel" LICENSE = "BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=2b1366ebba1ebd9ae25ad19626bbca93" -inherit cmake systemd lib_package +inherit cmake systemd lib_package pkgconfig SRC_URI = "git://github.com/qualcomm/minkipc.git;branch=main;protocol=https" SRCREV = "18cbaabfb339c0751e239f2b2037bad52a0715b8" PV = "0.0+git" -DEPENDS = "pkgconfig-native qcbor qcomtee minkidlc-native glib-2.0 systemd" +DEPENDS = "qcbor qcomtee minkidlc-native glib-2.0 systemd" EXTRA_OECMAKE = " \ -DBUILD_UNITTEST=ON \

ERROR: minkipc-0.0+git-r0 do_package: Didn't find service unit 'qteesupplicant.service', specified in SYSTEMD_SERVICE:minkipc.

BTW: I think you should also drop systemd from DEPENDS.

Systemd is required for minkipc because the qtee_supplicant's CMakeLists.txt needs to access the systemd_system_unit_dir variable, as shown in https://github.com/qualcomm/minkipc/blob/main/qtee_supplicant/CMakeLists.txt#48.

$ git diff dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb diff --git a/dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb b/dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb index b7bac68..9b902d1 100644 --- a/dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb +++ b/dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb @@ -17,7 +17,7 @@ SRC_URI = "git://github.com/qualcomm/minkipc.git;branch=main;protocol=https" SRCREV = "ca81bb6728465301abd85a004248f285f7810ab0" PV = "0.0+git" -DEPENDS = "qcbor qcomtee minkidlc-native glib-2.0 systemd" +DEPENDS = "qcbor qcomtee minkidlc-native glib-2.0" EXTRA_OECMAKE = " \ -DBUILD_UNITTEST=ON \

Error Log

| -- Checking for module 'systemd' | -- No package 'systemd' found | CMake Error at /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/recipe-sysroot-native/usr/share/cmake-4.1/Modules/FindPkgConfig.cmake:639 (message): | The following required packages were not found: | | - systemd | | Call Stack (most recent call first): | /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/recipe-sysroot-native/usr/share/cmake-4.1/Modules/FindPkgConfig.cmake:867 (_pkg_check_modules_internal) | qtee_supplicant/CMakeLists.txt:46 (pkg_check_modules) | | | -- Configuring incomplete, errors occurred! | WARNING: /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/temp/run.do_configure.3680392:162 exit 1 from 'cmake -G 'Ninja' -DCMAKE_MAKE_PROGRAM=ninja $oecmake_sitefile /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/sources/minkipc-0.0+git -DCMAKE_INSTALL_PREFIX:PATH=/usr -DCMAKE_INSTALL_BINDIR:PATH=bin -DCMAKE_INSTALL_SBINDIR:PATH=sbin -DCMAKE_INSTALL_LIBEXECDIR:PATH=libexec -DCMAKE_INSTALL_SYSCONFDIR:PATH=/etc -DCMAKE_INSTALL_SHAREDSTATEDIR:PATH=../com -DCMAKE_INSTALL_LOCALSTATEDIR:PATH=/var -DCMAKE_INSTALL_LIBDIR:PATH=lib -DCMAKE_INSTALL_INCLUDEDIR:PATH=include -DCMAKE_INSTALL_DATAROOTDIR:PATH=share -DPYTHON_EXECUTABLE:PATH=/local/mnt/workspace/virtualenv/venv-3.13/bin/python3 -DPython_EXECUTABLE:PATH=/local/mnt/workspace/virtualenv/venv-3.13/bin/python3 -DPython3_EXECUTABLE:PATH=/local/mnt/workspace/virtualenv/venv-3.13/bin/python3 -DLIB_SUFFIX= -DCMAKE_INSTALL_SO_NO_EXE=0 -DCMAKE_TOOLCHAIN_FILE:FILEPATH=/local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/toolchain.cmake -DCMAKE_NO_SYSTEM_FROM_IMPORTED=1 -DCMAKE_EXPORT_NO_PACKAGE_REGISTRY=ON -DFETCHCONTENT_FULLY_DISCONNECTED=ON -DCMAKE_EXPORT_COMPILE_COMMANDS:BOOL=ON -DBUILD_UNITTEST=ON -DCFG_ENABLE_SYSTEMD=ON -DCFG_USE_PKGCONFIG=ON -DMINKIDLC_BIN_DIR=/local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/recipe-sysroot-native/usr/bin -Wno-dev' | WARNING: Backtrace (BB generated script): | #1: cmake_do_configure, /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/temp/run.do_configure.3680392, line 162 | #2: do_configure, /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/temp/run.do_configure.3680392, line 141 | #3: main, /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/temp/run.do_configure.3680392, line 180 ERROR: Task (/local/mnt2/workspace/K2L/upstream/build/../meta-qcom/dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb:do_configure) failed with exit code '1'

I was assuming systemd.bbclass would do DEPENDS += "systemd", but it doesn't. So adding it to DEPENDS here is valid.
Having said that, if you want to change DEPENDS after using inherit foo, you should use += to avoid overwriting the bbclass changes.

@koenkooi but also think about non-systemd distros. We should not be adding the dependency here. Instead it will come through the distro features and a correct init manager being selected.

Yeah, systemd is only used to find out the target directory, this recipe should have a PACKAGECONFIG for systemd, and include the dependency only when needed by the user (e.g. ${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}).

@jiaxli-QC ^

CMakeLists.txt:option(CFG_USE_PKGCONFIG "Use pkg-config for discovering install target directory for systemd and udev files." OFF) CMakeLists.txt:# Enable systemd to get variable from environment CMakeLists.txt:option(CFG_ENABLE_SYSTEMD "Enable systemd service unit file generation." OFF) qtee_supplicant/CMakeLists.txt: pkg_check_modules(SYSTEMD REQUIRED IMPORTED_TARGET systemd) qtee_supplicant/CMakeLists.txt: if (SYSTEMD_FOUND AND CFG_ENABLE_SYSTEMD) qtee_supplicant/CMakeLists.txt: pkg_get_variable(UNIT_DIR systemd systemd_system_unit_dir) qtee_supplicant/CMakeLists.txt: set(SYSTEMD_UNIT_DIR "${UNIT_DIR}" CACHE PATH "Location of systemd unit files.") qtee_supplicant/CMakeLists.txt:if (CFG_ENABLE_SYSTEMD) qtee_supplicant/CMakeLists.txt: install(FILES "${CMAKE_CURRENT_BINARY_DIR}/qteesupplicant.service" DESTINATION "${SYSTEMD_UNIT_DIR}")

No, that's a bad idea. Please don't add extra dependencies on systemd. Instead one should be able to pass systemd unit path through CMake conmmand line.

dynamic-layers/openembedded-layer/recipes-devtools/minkidlc/minkidlc_0.2.1.bb

lumag · 2025-11-25T05:05:04Z

dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb

+    -DMINKIDLC_BIN_DIR=${STAGING_BINDIR_NATIVE} \
+"
+
+SYSTEMD_SERVICE:${PN} = "qteesupplicant.service"


You have been asked to split QTEE supplicant to a separate package. What happened?

Hi @lumag , I responded above explaining the reason for qtee_supplicant being part of the minkipc package, quoting it here in-case it's missed.

Hello @ricardosalveti, the reason that qtee_supplicant is part of the minkipc repository is because it is an indispensable part of the Mink-IPC communication stack. It isn't just a client application which uses the Mink-IPC library to communicate with QTEE, it is a daemon hosting listener services which are invoked by QTEE to request access to REE (Rich Execution Environment such as Linux) hosted services such a File system and System time. Hosting it in a separate repo would decouple this important daemon from the Mink IPC stack, making many important and mandatory security services hosted in QTEE in-operational if the daemon isn't available on the system.

The OPTEE Linux stack also has a similar supplicant called tee-supplicant, which is also part of the same repo as the library which enables communication with OPTEE. Please refer: https://github.com/OP-TEE/optee_client/tree/master/tee-supplicant

You replied why it is a part of the repo. We are asking to split it to a separate package, generated by the recipe.

dynamic-layers/openembedded-layer/recipes-devtools/minkidlc/minkidlc_0.2.1.bb

dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb

harshaldev27 · 2025-11-25T10:54:56Z

dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb

+MINK ('Mink is Not a Kernel') is a capability-based security framework, \
+which is a synchronous message passing facility based on the Object-Capability model, \
+designed to facilitate secure communication between different domains. \
+qteesupplicant service is designed for invocation dispatch and handling callbacks. \


Hello @ricardosalveti , we have a 1-1 mapping in-terms of functionality between all the binaries and libraries in optee_client and minkipc.
libteec -> libminkteec and/or libminkadaptor
tee-supplicant -> qtee_supplicant

The minkipc repository is also meant to be used by all the normal world client side exactly as you mentioned.
Also, I see the meta-freescale layer is installing all the contents of the optee_client repo, including the tee-supplicant binary as a single package: https://git.yoctoproject.org/meta-freescale/tree/recipes-security/optee-imx/optee-client_3.19.0.imx.bb?h=kirkstone

We want to ensure that any users familiar with OPTEE, and wishing to get a taste of QCOMTEE are immediately able to map familiar OPTEE functionality to QCOMTEE. And so, we are trying to follow them as closely as possible.

Let us know if you feel that a separate package is really the right way to go, in that case we can raise that change. 😄

dynamic-layers/openembedded-layer/recipes-devtools/minkidlc/minkidlc_0.2.1.bb

The Mink-idl-compiler (minkidlc) is used by security components to convert .idl files into header files. Since minkipc depends on this tool and is part of dynamic-layer, add minkidlc to dynamic-layer. Signed-off-by: Jiaxing Li <[email protected]>

Minkipc is designed to facilitate secure communication between different domains. Add the minkipc component to dynamic-layer because it depends on the qcbor library from the meta-openembedded dynamic layer. Signed-off-by: Jiaxing Li <[email protected]>

ricardosalveti

Rename minkidlc to mink-idl-compiler.

Provide qteesupplicant as a separated package in the minkipc recipe.

Both comments were already given multiple times, and still not yet addressed.

jiaxli-QC · 2025-12-02T03:33:46Z

Rename minkidlc to mink-idl-compiler.

Provide qteesupplicant as a separated package in the minkipc recipe.

Both comments were already given multiple times, and still not yet addressed.

Hi @ricardosalveti , many thanks for you notification.

For renaming the minkidlc:
I've tried it before, but I encountered compilation issue if rename to mink-idl-compiler, please see: minkipc: Add libraries and applications for security feature support #1094 (comment).
It seems the do_prepare_recipe_sysroot cannot handle - symbol correctly.
Error log

ERROR: minkipc-0.0+git-r0 do_prepare_recipe_sysroot: Error executing a python function in exec_func_python() autogenerated:

The stack trace of python calls that resulted in this exception/failure was:
File: 'exec_func_python() autogenerated', lineno: 2, function: <module>
     0001:
 *** 0002:extend_recipe_sysroot(d)
     0003:
File: '/local/mnt2/workspace/K2L/upstream/build/../oe-core/meta/classes-global/staging.bbclass', lineno: 624, function: extend_recipe_sysroot
     0620:
     0621:    # Handle deferred binfiles
     0622:    for l in binfiles:
     0623:        (targetdir, dest) = binfiles[l]
 *** 0624:        staging_copyfile(l, targetdir, dest, postinsts, seendirs)
     0625:
     0626:    bb.note("Installed into sysroot: %s" % str(msg_adding))
     0627:    bb.note("Skipping as already exists in sysroot: %s" % str(msg_exists))
     0628:
File: '/local/mnt2/workspace/K2L/upstream/build/../oe-core/meta/classes-global/staging.bbclass', lineno: 165, function: staging_copyfile
     0161:        os.symlink(linkto, dest)
     0162:        #bb.warn(c)
     0163:    else:
     0164:        try:
 *** 0165:            os.link(c, dest)
     0166:        except OSError as err:
     0167:            if err.errno == errno.EXDEV:
     0168:                bb.utils.copyfile(c, dest)
     0169:            else:
Exception: FileNotFoundError: [Errno 2] No such file or directory: '/local/mnt2/workspace/K2L/upstream/build/tmp/sysroots-components/x86_64/mink-idl-compiler-native/usr/bin/idlc' -> '/local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/recipe-sysroot-native/usr/bin/idlc'

ERROR: Logfile of failure stored in: /local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/temp/log.do_prepare_recipe_sysroot.3013549
ERROR: Task (/local/mnt2/workspace/K2L/upstream/build/../meta-qcom/dynamic-layers/openembedded-layer/recipes-security/minkipc/minkipc_git.bb:do_prepare_recipe_sysroot) failed with exit code '1'

For providing qteesupplicant as a separated package
the binary is packaged into ${PN}-bin, while the libraries are packaged into ${PN}, please see: minkipc: Add libraries and applications for security feature support #1094 (comment)

.../build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/packages-split$ tree minkipc minkipc-bin
minkipc
└── usr
    └── lib
        ├── libfsservice.so.1 -> libfsservice.so.1.0.0
        ├── libfsservice.so.1.0.0
        ├── libgpfsservice.so.1 -> libgpfsservice.so.1.0.0
        ├── libgpfsservice.so.1.0.0
        ├── libminkadaptor.so.0 -> libminkadaptor.so.0.1.0
        ├── libminkadaptor.so.0.1.0
        ├── libminkteec.so.1 -> libminkteec.so.1.0.0
        ├── libminkteec.so.1.0.0
        ├── libtaautoload.so.1 -> libtaautoload.so.1.0.0
        ├── libtaautoload.so.1.0.0
        ├── libtimeservice.so.1 -> libtimeservice.so.1.0.0
        ├── libtimeservice.so.1.0.0
        └── systemd
            ├── system
            │   └── qteesupplicant.service
            └── system-preset
                └── 98-minkipc.preset
minkipc-bin
└── usr
    └── bin
        ├── gp_test_client
        ├── qtee_supplicant
        └── smcinvoke_client

2 directories, 3 files

They've already been installed into different packages, how do we want to separate them?

lumag · 2025-12-02T14:22:56Z

Rename minkidlc to mink-idl-compiler.
Provide qteesupplicant as a separated package in the minkipc recipe.
Both comments were already given multiple times, and still not yet addressed.

Hi @ricardosalveti , many thanks for you notification.

For renaming the minkidlc:
I've tried it before, but I encountered compilation issue if rename to mink-idl-compiler, please see: minkipc: Add libraries and applications for security feature support #1094 (comment).
It seems the do_prepare_recipe_sysroot cannot handle - symbol correctly.

This is wrong. Moreover, I tried it here and it worked.

Exception: FileNotFoundError: [Errno 2] No such file or directory: '/local/mnt2/workspace/K2L/upstream/build/tmp/sysroots-components/x86_64/mink-idl-compiler-native/usr/bin/idlc' -> '/local/mnt2/workspace/K2L/upstream/build/tmp/work/armv8-2a-qcom-linux/minkipc/0.0+git/recipe-sysroot-native/usr/bin/idlc'

Clean the tmpdir completely and try again.

For providing qteesupplicant as a separated package
the binary is packaged into ${PN}-bin, while the libraries are packaged into ${PN}, please see: minkipc: Add libraries and applications for security feature support #1094 (comment)

They've already been installed into different packages, how do we want to separate them?

We have asked to put qteesupplicant in a separate package. No other debugging binaries in it.

ricardosalveti · 2025-12-02T22:20:35Z

You also have the following files as part of the minkipc package:

        └── systemd
            ├── system
            │   └── qteesupplicant.service
            └── system-preset
                └── 98-minkipc.preset

Add a minkipc-qteesupplicant package which includes both qtee_supplicant and qteesupplicant.service.

jiaxli-QC requested review from lumag, ndechesne, ricardosalveti, sbanerjee-quic and vkraleti as code owners September 22, 2025 10:21

lumag requested changes Sep 22, 2025

View reviewed changes

lumag mentioned this pull request Sep 23, 2025

Stop downloading binary for the IDL compiler qualcomm/minkipc#11

Open

jiaxli-QC force-pushed the master branch from c758cb5 to 0415319 Compare September 28, 2025 07:15

lumag reviewed Sep 28, 2025

View reviewed changes

recipes-security/qcbor/qcbor_git.bb Outdated Show resolved Hide resolved

lumag requested changes Sep 28, 2025

View reviewed changes

lumag reviewed Oct 22, 2025

View reviewed changes

recipes-security/minkipc/minkipc_git.bb Outdated Show resolved Hide resolved

lumag reviewed Oct 22, 2025

View reviewed changes

recipes-security/minkipc/minkipc_git.bb Outdated Show resolved Hide resolved

lumag reviewed Oct 22, 2025

View reviewed changes

recipes-security/packagegroups/packagegroup-qcom-secure.bb Outdated Show resolved Hide resolved

jiaxli-QC force-pushed the master branch 2 times, most recently from 2f341ae to 4893e2c Compare October 24, 2025 10:40

lumag reviewed Oct 25, 2025

View reviewed changes

recipes-security/packagegroups/packagegroup-qcom-secure.bb Outdated Show resolved Hide resolved

lumag requested changes Oct 25, 2025

View reviewed changes

jiaxli-QC force-pushed the master branch from 4893e2c to bd08893 Compare October 25, 2025 08:57

This was referenced Oct 29, 2025

qcbor: library to expose Qualcomm Security Package #1166

Closed

qcom-tee: add a library for security feature support #1167

Merged

jiaxli-QC force-pushed the master branch 2 times, most recently from 0889041 to 5e52741 Compare November 25, 2025 03:14

jiaxli-QC requested review from harshaldev27, lumag, ricardosalveti and vksharma-oss November 25, 2025 03:52

lumag requested changes Nov 25, 2025

View reviewed changes

lumag reviewed Nov 25, 2025

View reviewed changes

dynamic-layers/openembedded-layer/recipes-devtools/minkidlc/minkidlc_0.2.1.bb Outdated Show resolved Hide resolved

lumag reviewed Nov 25, 2025

View reviewed changes

dynamic-layers/openembedded-layer/recipes-devtools/minkidlc/minkidlc_0.2.1.bb Outdated Show resolved Hide resolved

harshaldev27 reviewed Nov 25, 2025

View reviewed changes

jiaxli-QC force-pushed the master branch 2 times, most recently from c303704 to 53303af Compare November 26, 2025 10:25

lumag reviewed Nov 26, 2025

View reviewed changes

dynamic-layers/openembedded-layer/recipes-devtools/minkidlc/minkidlc_0.2.1.bb Outdated Show resolved Hide resolved

jiaxli-QC force-pushed the master branch from 53303af to be36d15 Compare December 1, 2025 07:03

jiaxli-QC requested review from harshaldev27, koenkooi, lumag and quaresmajose December 1, 2025 07:20

jiaxli-QC changed the title ~~recipes-security: Add security components on mainline~~ minkipc: Add libraries and applications for security feature support Dec 1, 2025

jiaxli-QC force-pushed the master branch from be36d15 to 7fe97be Compare December 1, 2025 07:58

ricardosalveti requested changes Dec 1, 2025

View reviewed changes

jiaxli-QC closed this Dec 2, 2025

jiaxli-QC reopened this Dec 2, 2025

jiaxli-QC requested a review from ricardosalveti December 2, 2025 07:31

minkipc: Add libraries and applications for security feature support #1094

Are you sure you want to change the base?

minkipc: Add libraries and applications for security feature support #1094

Conversation

jiaxli-QC commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ricardosalveti commented Sep 22, 2025

Uh oh!

ricardosalveti commented Sep 22, 2025

Uh oh!

lumag commented Sep 23, 2025

Uh oh!

Uh oh!

lumag left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jiaxli-QC commented Oct 24, 2025

Uh oh!

lumag commented Oct 24, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jiaxli-QC commented Oct 28, 2025

Uh oh!

lumag commented Oct 28, 2025

Uh oh!

jiaxli-QC commented Oct 28, 2025

Uh oh!

lumag commented Oct 28, 2025

Uh oh!

jiaxli-QC commented Oct 29, 2025

Uh oh!

lumag left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

jiaxli-QC commented Sep 22, 2025 •

edited

Loading

jiaxli-QC commented Dec 2, 2025 •

edited

Loading