profiles: extract secure eMMC boot config into shared profile

Create profiles/secure_boot_emmc.yml as a common base for secure eMMC boot with swupdate A/B partitioning, consolidating duplicated config from mxl_x86_osp_tb341_v2 and qca_ipq95xx. Moved to secure_boot_emmc.yml: - Packages: swupdate, libubootenv, imagegenerator, initramfs-generator, readmfg, libfdt, fdt-utils, kmod-sysregister - Diffconfig: secure initramfs, swupdate handlers (ext4/diskpart/diskformat), imagegenerator, MFG global signature, kernel keyring, sysregister bootcount Also remove unused packages from shared profiles: - prpl_core: drop keyctl, keyutils, kmod-sysregister - prpl: drop lvm2 Closes: PCF-2097 Fixes: PCF-1875, PCF-1878 Tracked-by: FEAT-29 Signed-off-by: Mohamed-nour Toumi <mohamed.toumi_ext@softathome.com>
2026-05-07 14:09:46 +02:00 · 2026-05-07 14:09:46 +02:00 · e457214351
commit e457214351
parent df182dbb4d
5 changed files with 50 additions and 86 deletions
--- a/profiles/mxl_x86_osp_tb341_v2.yml
+++ b/profiles/mxl_x86_osp_tb341_v2.yml
@ -9,6 +9,10 @@ description: Build images for the Maxlinear x86 devices - OSP TB341 v2
             git.maxlinear.com.
             For reference boards, source code access and reporting issues,
             please check https://gitlab.com/prpl-foundation/prplos/prplos/-/wikis/MaxLinear-Open-Service-Platform
+
+include:
+  - secure_boot_emmc
+
 feeds:
  - name: intel_x86
    uri: https://github.com/maxlinear/feed_target_x86.git
@ -177,19 +181,6 @@ packages:
  - kmod-mcast-helper
  - mod-wanmgr-system-ospv2
  - conntrack
-  - swupdate
-  - libubootenv
-  - libblkid
-  - libuuid
-  - libext2fs
-  - libfdisk
-  - imagegenerator
-  - initramfs-generator
-  - blkid
-  - libfdt
-  - fdt-utils
-  - kmod-dm
-  - losetup

 diffconfig: |
  CONFIG_DEVEL=y
@ -218,32 +209,5 @@ diffconfig: |
  CONFIG_LGM_EIP123_SUPPORT=y
  CONFIG_KERNEL_FTRACE=y
  CONFIG_IMAGEGENERATOR_BOARD="tb341_wav700"
-  CONFIG_OPENSOURCE_SWUPDATE_EXT_FILESYSTEM=y
-  CONFIG_OPENSOURCE_SWUPDATE_DISKPART_HANDLER=y
-  CONFIG_OPENSOURCE_SWUPDATE_DISKFORMAT_HANDLER=y
-  CONFIG_SAH_LIB_MFG_RO_PART_FILE="/dev/mmc0p13"
-  CONFIG_BUSYBOX_CONFIG_BLKID=y
-  CONFIG_BUSYBOX_CONFIG_BLOCKDEV=y
-  CONFIG_PACKAGE_libblkid=y
-  CONFIG_BUSYBOX_CONFIG_MODPROBE=y
-  CONFIG_EXTERNAL_CPIO=""
-  CONFIG_TARGET_SECURE_INITRAMFS=y
-  CONFIG_TARGET_SECURE_INITRAMFS_COMPRESSION_GZIP=y
-  CONFIG_INITRAMFS_GENERATOR_FLASH_TYPE_EMMC=y
-  CONFIG_INITRAMFS_GENERATOR_ROOTFS_SIG_PRELOAD=y
-  CONFIG_INITRAMFS_GENERATOR_ROOTFS_SIG_PRELOAD_MANDATORY=y
-  CONFIG_KERNEL_DEVTMPFS=y
-  # CONFIG_TARGET_ROOTFS_INITRAMFS is not set
-  CONFIG_BUSYBOX_CONFIG_LOSETUP=y
-  CONFIG_BUSYBOX_CONFIG_STAT=y
-  CONFIG_BUSYBOX_CONFIG_FEATURE_STAT_FORMAT=y
-  CONFIG_BUSYBOX_CONFIG_FEATURE_STAT_FILESYSTEM=y
  CONFIG_SAH_LIB_MFG_RO_PART_FILE="/dev/mmcblk0p13"
-  CONFIG_IMAGEGENERATOR=y
-  CONFIG_SAH_LIB_MFG_GLOBAL_SIGNATURE=y
-  CONFIG_SAH_LIB_MFG_GLOBAL_SIGNATURE_PUBLIC_PEM_FILE="/security/smd_pub.pem"
-  CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_SUPPORT=y
-  CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_KEY_NAME="mfg:Kuk"
-  CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_IV_FILE="/rom/security/initramfs/Kuk-aes-iv.hex"
-  CONFIG_SYSREGISTER_RESET_BOOTCOUNT=y
  CONFIG_SECURESTORE_LABEL="config"
--- a/profiles/prpl.yml
+++ b/profiles/prpl.yml
@ -9,7 +9,6 @@ include:
 additional_packages:
  - feed: packages
    packages:
-      - lvm2
      - opensc
      - pciids
      - pciutils
--- a/profiles/prpl_core.yml
+++ b/profiles/prpl_core.yml
@ -32,10 +32,6 @@ packages:
  - ip6tables-zz-legacy
  - iptables-mod-ipopt
  - iptables-zz-legacy
-  - keyctl
-  - keyutils
-  - kmod-crypto-user
-  - kmod-keys-encrypted
  - libdhcpoptions
  - libfwinterface
  - libfwrules
@ -82,7 +78,6 @@ packages:
  - prplmesh
  - prplmesh-dm-mapper
  - prplmesh-process-manager
-  - readmfg
  - reboot-service
  - routing-manager
  - ssh-server
@ -109,7 +104,6 @@ packages:
  - wifi-sensing
  - mod-scheduler-amxp
  - tr181-schedules
-  - kmod-sysregister

 diffconfig: |
          CONFIG_DEVEL=y
--- a/profiles/qca_ipq95xx.yml
+++ b/profiles/qca_ipq95xx.yml
@ -10,6 +10,9 @@ feeds:
    uri: https://gitlab.com/prpl-foundation/prplOS/feed-qca.git
    revision: latest-24.10/ath13.1@659a90103eefa5d52942e7735a48088e7cc910c1

+include:
+  - secure_boot_emmc
+
 packages:
  - ipq95xx
  - wireless-regdb
@ -50,19 +53,6 @@ packages:
  - kmod-qca-wifi-nss-plugins
  - wifi-scripts
  - wifi-helper-scripts
-  - swupdate
-  - libubootenv
-  - imagegenerator
-  - initramfs-generator
-  - libblkid
-  - libuuid
-  - libcomerr
-  - libext2fs
-  - libfdisk
-  - blkid
-  - libfdt
-  - fdt-utils
-  - kmod-dm

 diffconfig: |
  CONFIG_BUSYBOX_CUSTOM=y
@ -74,31 +64,5 @@ diffconfig: |
  CONFIG_PACKAGE_libnl-ppe=y
  CONFIG_PACKAGE_kmod-qseecom=m
  CONFIG_BUSYBOX_CONFIG_DEVMEM=y
-  CONFIG_EXTERNAL_CPIO=""
-  CONFIG_TARGET_SECURE_INITRAMFS=y
-  CONFIG_TARGET_SECURE_INITRAMFS_COMPRESSION_GZIP=y
-  CONFIG_INITRAMFS_GENERATOR_FLASH_TYPE_EMMC=y
-  CONFIG_INITRAMFS_GENERATOR_ROOTFS_SIG_PRELOAD=y
-  CONFIG_INITRAMFS_GENERATOR_ROOTFS_SIG_PRELOAD_MANDATORY=y
  CONFIG_IMAGEGENERATOR_BOARD="qca_ipq95xx_freedom"
-  CONFIG_OPENSOURCE_SWUPDATE_EXT_FILESYSTEM=y
-  CONFIG_OPENSOURCE_SWUPDATE_DISKPART_HANDLER=y
-  CONFIG_OPENSOURCE_SWUPDATE_DISKFORMAT_HANDLER=y
-  CONFIG_BUSYBOX_CONFIG_BLKID=y
-  CONFIG_BUSYBOX_CONFIG_BLOCKDEV=y
-  CONFIG_INITRAMFS_GENERATOR_ROOTFS_SIG_PRELOAD=y
-  CONFIG_BUSYBOX_CONFIG_MODPROBE=y
-  CONFIG_KERNEL_DEVTMPFS=y
-  # CONFIG_TARGET_ROOTFS_INITRAMFS is not set
-  CONFIG_BUSYBOX_CONFIG_LOSETUP=y
-  CONFIG_BUSYBOX_CONFIG_STAT=y
-  BUSYBOX_CONFIG_FEATURE_STAT_FORMAT=y
-  BUSYBOX_CONFIG_FEATURE_STAT_FILESYSTEM=y
  CONFIG_SAH_LIB_MFG_RO_PART_FILE="/dev/mmcblk0p30"
-  CONFIG_IMAGEGENERATOR=y
-  CONFIG_SAH_LIB_MFG_GLOBAL_SIGNATURE=y
-  CONFIG_SAH_LIB_MFG_GLOBAL_SIGNATURE_PUBLIC_PEM_FILE="/security/smd_pub.pem"
-  CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_SUPPORT=y
-  CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_KEY_NAME="mfg:Kuk"
-  CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_IV_FILE="/rom/security/initramfs/Kuk-aes-iv.hex"
-  CONFIG_SYSREGISTER_RESET_BOOTCOUNT=y
--- a/profiles/secure_boot_emmc.yml
+++ b/profiles/secure_boot_emmc.yml
@ -0,0 +1,43 @@
+---
+description: Common configuration for secure eMMC boot with swupdate A/B partitioning
+
+packages:
+  - fdt-utils
+  - imagegenerator
+  - initramfs-generator
+  - kmod-crypto-user
+  - kmod-keys-encrypted
+  - kmod-sysregister
+  - libfdt
+  - libubootenv
+  - losetup
+  - readmfg
+  - swupdate
+
+diffconfig: |
+  CONFIG_EXTERNAL_CPIO=""
+  CONFIG_TARGET_SECURE_INITRAMFS=y
+  CONFIG_TARGET_SECURE_INITRAMFS_COMPRESSION_GZIP=y
+  CONFIG_INITRAMFS_GENERATOR_FLASH_TYPE_EMMC=y
+  CONFIG_INITRAMFS_GENERATOR_ROOTFS_SIG_PRELOAD=y
+  CONFIG_INITRAMFS_GENERATOR_ROOTFS_SIG_PRELOAD_MANDATORY=y
+  CONFIG_OPENSOURCE_SWUPDATE_EXT_FILESYSTEM=y
+  CONFIG_OPENSOURCE_SWUPDATE_DISKPART_HANDLER=y
+  CONFIG_OPENSOURCE_SWUPDATE_DISKFORMAT_HANDLER=y
+  CONFIG_BUSYBOX_CONFIG_BLKID=y
+  CONFIG_BUSYBOX_CONFIG_BLOCKDEV=y
+  CONFIG_BUSYBOX_CONFIG_LOSETUP=y
+  CONFIG_BUSYBOX_CONFIG_MODPROBE=y
+  CONFIG_BUSYBOX_CONFIG_STAT=y
+  CONFIG_BUSYBOX_CONFIG_FEATURE_STAT_FORMAT=y
+  CONFIG_BUSYBOX_CONFIG_FEATURE_STAT_FILESYSTEM=y
+  CONFIG_KERNEL_DEVTMPFS=y
+  # CONFIG_TARGET_ROOTFS_INITRAMFS is not set
+  CONFIG_IMAGEGENERATOR=y
+  CONFIG_SAH_LIB_MFG_GLOBAL_SIGNATURE=y
+  CONFIG_SAH_LIB_MFG_GLOBAL_SIGNATURE_PUBLIC_PEM_FILE="/security/smd_pub.pem"
+  CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_SUPPORT=y
+  CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_KEY_NAME="mfg:Kuk"
+  CONFIG_SAH_LIB_MFG_SECURE_MFG_KERNEL_KEYRING_IV_FILE="/rom/security/initramfs/Kuk-aes-iv.hex"
+  CONFIG_SYSREGISTER_RESET_BOOTCOUNT=y
+  CONFIG_SAH_AMX_PCM_SECURESTORE=y