[RFC] qcom-capsule: integrate QDTE for OEM root cert injection (PoC) - #2456
Igor Opaniuk (igoropaniuk) wants to merge 3 commits into
Conversation
Package the upstream PyPI pyfdt 0.3 release (Neil 'Superna' Armstrong's pure-Python flattened device tree library) as a -native recipe, primarily to satisfy QDTE's dtwrapper.py at build time. Placed under dynamic-layers/openembedded-layer/recipes-devtools/python/ so the recipe is only loaded when meta-oe provides the openembedded-layer collection. Signed-off-by: Igor Opaniuk <igor.opaniuk@oss.qualcomm.com>
QDTE (https://github.com/qualcomm/DTE) is a Tkinter device tree editor with a --nogui mode for scripted DTB / xbl_config.elf modification. The next commit wires it into the capsule build pipeline to inject the OEM root CA certificate into the post-DDR DTB embedded in xbl_config.elf. Placed under dynamic-layers/openembedded-layer/recipes-devtools/ because the recipe depends on python3-pyfdt-native, which lives in the same dynamic layer; both come and go together. Signed-off-by: Igor Opaniuk <igor.opaniuk@oss.qualcomm.com>
Switch the QcCapsuleRootCert injection step in patch_xblconfig_cert() from cbsp-boot-utilities (dump / set-dtb- property / replace) to QDTE's qdte --nogui --modify, which disassembles xbl_config.elf, edits the named DTB property, and reassembles in a single invocation. Signed-off-by: Igor Opaniuk <igor.opaniuk@oss.qualcomm.com>
|
xueqnie Could you please verify whether the integration of the FMP root certificate into |
|
I've created qualcomm/DTE#5, that upstreams this series of patches to QDTE |
sure |
|
|
Hi xueqnie, Thanks a lot for testing and confirming that it works for you. I really appreciate your help here. To help this PR land faster, could you please take a look at qualcomm/DTE#5 and leave your review there? The current PR is blocked until the DTE PR lands. |
There was a problem hiding this comment.
This is a good candidate to meta-openembedded/meta-python/recipes-devtools/python/python3-pyfdt_0.3.bb, please send it upstream.
There was a problem hiding this comment.
Not sure it's a good idea, as pyfdt version 0.3 was released in 2014 ( is the only public release) and is effectively unmaintained. My initial intention was to make a transition of the tool to pylibfdt instead
There was a problem hiding this comment.
The pylibfdt can be packed in oe-core/meta/recipes-kernel/dtc/dtc_1.8.1.bb, python is currently disabled on the recipe but I will take a look for creating PACKAGECONFIG.
There was a problem hiding this comment.
Igor Opaniuk (@igoropaniuk) can you expriment this pylibfdt?
# cat recipes-kernel/dtc/dtc_%.bbappend
inherit python3-dir
EXTRA_OEMESON:qcom = "-Dvalgrind=disabled -Dpython=enabled"
PACKAGES:append:qcom = " pylibfdt"
FILES:pylibfdt:qcom = "${PYTHON_SITEPACKAGES_DIR}"
I have a pacth on my side that I can send upstream to oe-core but will be good to have some tests first.
|
Given the current challenges with contributing changes directly to the DTE tool, and considering that the ongoing discussion with the DTE maintainer may take months, I’m planning to include all required patches in this PR here for now (as patch files for qdte recipe). This would allow us to land the PR faster and we will keep the patches in meta-qcom until the required functionality is fully merged into DTE. I'll rebase the PR, address outstanding issues today-tomorrow. Ricardo Salveti (@ricardosalveti) Dmitry Baryshkov (@lumag) Jose Quaresma (@quaresmajose) Nicolas Dechesne (@ndechesne) will it work for you? |
Don't forget to tag the patches with the correct Upstream-Status and keep the tags up to date. |
|
This pull request has been marked as stale due to 30 days of inactivity. To prevent automatic closure in 5 days, remove the stale label or add a comment. You can reopen a closed pull request at any time. |
5 participants
This PoR PR demonstrates that QDTE tool (https://github.com/qualcomm/DTE/) can replace the cbsp-boot-utilities cert-injection step in the UEFI capsule pipeline, it packages QDTE with 5 recipe-local patches that make
--noguirunnable on a minimal Yocto sysroot, but they haven't been sent upstream yet (no PRs created yet).Also, to make the integration cleaner, additional steps should be done in the QDTE project itself:
--noguifrom GUI properly. Patches 0001 and 0002 are stubs; the structural fix is movingcontroller.pyand friends out of the headless import path entirely (qdte/{core,gui,cli}/split). Patches 0001+0002 go away when this lands.pyproject.toml+ proper packaging. QDTE has nopyproject.toml/setup.py/ package init. Adding one with[project.scripts]lets the recipe collapse toinherit setuptools3 nativeand drops the hand-rolled wrapper + PYTHONPATH gymnastics.pythoninsubprocesswithsys.executable. ~17 sites acrossassemble.py,Autocmd.py,controller.py,non_hlos_parser.py,version_2_assemble.py,sign.py,XBLConfig/*.py. Modern sysroots ship onlypython3. The current recipe carries an ephemeralpython -> python3PATH shim, which ugly and Yocto-specific. Nicer fix would be droping the subprocess pattern entirely and import the target modules directly.I’d like to keep this RFC open for a while so it can serve as a reference for QDTE maintainers, outlining what we’re trying to achieve and the scope of work needed to make this integration cleaner.