[WIP] Add firmware exclusion class by acostach · Pull Request #3794 · balena-os/meta-balena

acostach · 2026-01-23T18:24:04Z

Contributor checklist

Changes have been tested
- Covered in automated test suite
- Manual test case recorded
Change-type present on at least one commit
Signed-off-by is present
The PR complies with the Open Embedded Commit Patch Message Guidelines

Reviewer Guidelines

When submitting a review, please pick:
- 'Approve' if this change would be acceptable in the codebase (even if there are minor or cosmetic tweaks that could be improved).
- 'Request Changes' if this change would not be acceptable in our codebase (e.g. bugs, changes that will make development harder in future, security/performance issues, etc).
- 'Comment' if you don't feel you have enough information to decide either way (e.g. if you have major questions, or you don't understand the context of the change sufficiently to fully review yourself, but want to make a comment)

flowzone-app · 2026-01-23T18:27:04Z

Website deployed to CF Pages, 👀 preview link https://a382a4ff.balena-os.pages.dev

ycardaillac

I've a few remark regarding the tools to create the non essential file.

I'm also wondering if we couldn't use external tools to create a non essential firmware list and/or a essential firmware list, and just use those as explicit list of packages that should end up in our distro. Would that be possible? Would that simplify things a bit?

ycardaillac · 2026-01-26T15:37:04Z

+    ]
+}
+
+# Parse WHENCE files to obtain the list of firmware files


@acostach, can we add a comment about the whence_map that is returned? It would be overkill to extract even more function to make it more readable, but it would be great to have the bigger picture right ahead, and know what data format is returned.

Sure, the whence map is a dictionary of drivers and their associated firmware files:

whence_map = { "iwlwifi": [ "iwlwifi-9260-th-b0-jf-b0-34.ucode", "iwlwifi-9260-th-b0-jf-b0-38.ucode", ... ], "ath9k": [ "ar9271.fw", "htc_9271.fw" ] }

ycardaillac · 2026-01-26T16:15:13Z

+                    d.appendVar('BAD_RECOMMENDATIONS', " " + bad_str)
+                    bb.note(f"Policy applied: Excluded {len(extra_bad)} firmware packages.")
+        except Exception as e:
+            bb.fatal(f"Failed to enforce firmware exclusion policy: {str(e)}")


Can you confirm that this is making any firmware present in nonessential_firmware.txt, that would have ended up in the image, caught and added to BAD_RECOMMENDATIONS, and hence not installed?

@ycardaillac adding files to BAD_RECOMMENDATIONS only removes packages from RRECOMENDS, packages installed through other methods still end up in the image, but they are included in the nonessential_firmware.txt and when the files in this file are found in the image manifest, the build fails.

The alternative would be adding them to PACKAGES_EXCLUDE, but that may trigger build failures which are reportedly more difficult to debug, so we compare the non-essential firmware list to the final manifest and report the packages which shouldn't have been installed, so we can either add them to the WHITELIST or find what installs them and do the removal

acostach · 2026-02-02T16:39:52Z

/rebase

During linux-firmware recipe build a list of non-essential packages is created. After the rootfs is generated we compare that to the image manifest and fail the build if any of them made it into the image. These packages can be installed by adding them to the BALENA_ALLOWED_FIRMWARE_PACKAGES whitelist. Change-type: patch Signed-off-by: Alexandru Costache <alexandru@balena.io>

This extends the linux-firmware WHENCE and provides file paths for drivers which are not correctly specified in the upstream WHENCE, or not listed at all. Signed-off-by: Alexandru Costache <alexandru@balena.io>

We add a new class which maps all packages provided by the linux-firmware recipe to drivers and categories, and creates a list of packages which should be excluded from the final OS image. Mapping is performed by comparing the files shipped by packages to the WHENCE listing. Signed-off-by: Alexandru Costache <alexandru@balena.io>

…by default Signed-off-by: Alexandru Costache <alexandru@balena.io>

.. to check if any non BT firmware gets included in the package. The qca and btqca drivers handle Bluetooth only, and this helps us check if any device repository introduces connectivity firmware in it. Signed-off-by: Alexandru Costache <alexandru@balena.io>

…their sizes ... after compression is run. Some devices may disable compression in their board repository, if they run older kernels. Signed-off-by: Alexandru Costache <alexandru@balena.io>

We bring all the common firmware from the rest of the layers to the common layer, for easier management. Signed-off-by: Alexandru Costache <alexandru@balena.io>

Some firmware packages are used by M.2, or USB or Mini PCIE Wifi modules, so let's group them into such categories, so we can later remove them for device-types which don't have the required interfaces. For example, a RaspberryPi Zero has an USB port but no M.2 or PCIE connectors. Signed-off-by: Alexandru Costache <alexandru@balena.io>

…nstalled by meta-balena based on available hardware interfaces In this commit we dinamically update the linux-firmware packages installed by meta-balena for each device-type based on the hardware interfaces it supports. This assumes each device type defines a list of supported hardware interfaces at device integration repository level. Signed-off-by: Alexandru Costache <alexandru@balena.io>

… packages We add the linux-firmware packages installed by meta-balena and which are not supported by the device-type specific interfaces to the list of blacklisted packages, to ensure the final audit catches any packages which should not have been installed. Signed-off-by: Alexandru Costache <alexandru@balena.io>

acostach · 2026-02-19T15:42:54Z

For Pi4-64 the following packages are removed, because it lacks the required features (only has features_USB).

Device-repository branch used: https://github.com/balena-os/balena-raspberrypi/tree/acostach/add_machine_features

linux-firmware-iwlwifi-135-6 all 1:20240909-r0
linux-firmware-iwlwifi-3160 all 1:20240909-r0
linux-firmware-iwlwifi-6000-4 all 1:20240909-r0
linux-firmware-iwlwifi-6000g2a-6 all 1:20240909-r0
linux-firmware-iwlwifi-6000g2b-6 all 1:20240909-r0
linux-firmware-iwlwifi-6050-5 all 1:20240909-r0
linux-firmware-iwlwifi-7260 all 1:20240909-r0
linux-firmware-iwlwifi-7265 all 1:20240909-r0
linux-firmware-iwlwifi-7265d all 1:20240909-r0
linux-firmware-iwlwifi-8000c all 1:20240909-r0
linux-firmware-iwlwifi-8265 all 1:20240909-r0
linux-firmware-iwlwifi-9260 all 1:20240909-r0
linux-firmware-iwlwifi-license all 1:20240909-r0
linux-firmware-rtl8192su all 1:20240909-r0
linux-firmware-rtl8723b-bt all 1:20240909-r0
linux-firmware-ti-connectivity-license all 1:20240909-r0
linux-firmware-wl12xx all 1:20240909-r0
linux-firmware-wl18xx all 1:20240909-r0
linux-firmware-wlcommon all 1:20240909-r0

acostach · 2026-02-19T15:49:47Z

Following packges are removed from iot-gate-imx8. Device repository branch used: https://github.com/balena-os/balena-iot-gate-imx8

linux-firmware-rtl8192su all 1:20240909-r0
linux-firmware-rtl8723b-bt all 1:20240909-r0
linux-firmware-ti-connectivity-license all 1:20240909-r0
linux-firmware-wl12xx all 1:20240909-r0
linux-firmware-wl18xx all 1:20240909-r0
linux-firmware-wlcommon all 1:20240909-r0

acostach · 2026-02-19T16:37:20Z

For RPI CM4 IO-BOARD, the following packages are removed, using the following branch: https://github.com/balena-os/balena-raspberrypi/tree/acostach/add_machine_features

linux-firmware-ti-connectivity-license all 1:20240909-r0
linux-firmware-wl12xx all 1:20240909-r0
linux-firmware-wlcommon all 1:20240909-r0

…plicable We no longer diferentiate by form factor for PCI devices, and thus include all PCI firmware where upstream sets "pci" in MACHINE_FEATURES. Signed-off-by: Alexandru Costache <alexandru@balena.io>

acostach · 2026-02-24T16:29:59Z

    linux-firmware-iwlwifi-7265 \
    linux-firmware-iwlwifi-8000c \
    linux-firmware-iwlwifi-8265 \
    linux-firmware-rtl8723 \


TODO: Remove duplicates, must be a typo

…ound Signed-off-by: Alexandru Costache <alexandru@balena.io>

…isted in WHENCE This speeds up testing, because the issues can be extracted from the build outputs. Also, if the build passes, the manifest is made available for checking. Signed-off-by: Alexandru Costache <alexandru@balena.io>

Signed-off-by: Yann CARDAILLAC <yann.cardaillac@balena.io>

acostach temporarily deployed to balena-cloud.com January 23, 2026 18:24 — with GitHub Actions Inactive

acostach had a problem deploying to sign.balena-cloud.com January 23, 2026 18:26 — with GitHub Actions Failure

flowzone-app bot enabled auto-merge January 23, 2026 18:27

acostach force-pushed the wip_firmware_exclusion branch from 7c4ad43 to 071a6bc Compare January 24, 2026 11:47

acostach temporarily deployed to balena-cloud.com January 24, 2026 11:47 — with GitHub Actions Inactive

ycardaillac reviewed Jan 26, 2026

View reviewed changes

acostach added 10 commits February 12, 2026 19:17

meta-balena-common/recipes-kernel: Add a local WHENCE for linux-firmware

8397d38

This extends the linux-firmware WHENCE and provides file paths for drivers which are not correctly specified in the upstream WHENCE, or not listed at all. Signed-off-by: Alexandru Costache <alexandru@balena.io>

recipes-core/packagegroups: Separate and avoid including BT firmware …

7185c8c

…by default Signed-off-by: Alexandru Costache <alexandru@balena.io>

classes/balena-firmware-exclusion: Create report of all packages and …

4d4ca35

…their sizes ... after compression is run. Some devices may disable compression in their board repository, if they run older kernels. Signed-off-by: Alexandru Costache <alexandru@balena.io>

recipes-core/packagegroups: Centralize shipped firmware

617a24e

We bring all the common firmware from the rest of the layers to the common layer, for easier management. Signed-off-by: Alexandru Costache <alexandru@balena.io>

include/balena-os: Switch to using upstream MACHINE_FEATURES where ap…

941a100

…plicable We no longer diferentiate by form factor for PCI devices, and thus include all PCI firmware where upstream sets "pci" in MACHINE_FEATURES. Signed-off-by: Alexandru Costache <alexandru@balena.io>

acostach commented Feb 24, 2026

View reviewed changes

acostach and others added 5 commits February 25, 2026 13:10

classes/image-balena: Don't fail build if non-essential firmware is f…

64d641b

…ound Signed-off-by: Alexandru Costache <alexandru@balena.io>

initial sorting mechanism

9bb4778

refacto

1b6dc0d

fail at the first error

f8d5aae

Signed-off-by: Yann CARDAILLAC <yann.cardaillac@balena.io>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP] Add firmware exclusion class#3794

[WIP] Add firmware exclusion class#3794
acostach wants to merge 16 commits intomasterfrom
wip_firmware_exclusion

acostach commented Jan 23, 2026

Uh oh!

flowzone-app bot commented Jan 23, 2026 •

edited

Loading

Uh oh!

ycardaillac left a comment •

edited

Loading

Uh oh!

ycardaillac Jan 26, 2026

Uh oh!

acostach Feb 19, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ycardaillac Jan 26, 2026

Uh oh!

acostach Feb 20, 2026

Uh oh!

acostach commented Feb 2, 2026

Uh oh!

acostach commented Feb 19, 2026 •

edited

Loading

Uh oh!

acostach commented Feb 19, 2026 •

edited

Loading

Uh oh!

acostach commented Feb 19, 2026 •

edited

Loading

Uh oh!

acostach Feb 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

acostach commented Jan 23, 2026

Contributor checklist

Reviewer Guidelines

Uh oh!

flowzone-app bot commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ycardaillac left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ycardaillac Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

acostach Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ycardaillac Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

acostach Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

acostach commented Feb 2, 2026

Uh oh!

acostach commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

acostach commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

acostach commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

acostach Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

flowzone-app bot commented Jan 23, 2026 •

edited

Loading

ycardaillac left a comment •

edited

Loading

acostach commented Feb 19, 2026 •

edited

Loading

acostach commented Feb 19, 2026 •

edited

Loading

acostach commented Feb 19, 2026 •

edited

Loading