On 3/6/2026 8:41 AM, Shiva Tripathi wrote:
On 3/6/26 04:39, Randolph Sapp wrote:
On Thu Mar 5, 2026 at 3:12 PM CST, Denys Dmytriyenko wrote:
On Thu, Mar 05, 2026 at 02:51:44PM -0600, Ryan Eatmon via
lists.yoctoproject.org wrote:
On 3/5/2026 11:21 AM, Shiva Tripathi wrote:
Add conditional kernel configuration fragment for LUKS encryption with
fTPM support. This enables dm-crypt and necessary crypto algorithms
when MACHINE_FEATURES contains 'luks-encryption'.
Signed-off-by: Shiva Tripathi <[email protected]>
---
.../linux/linux-ti-staging-6.18/luks-ftpm.cfg | 28 +++++++++++++++++++
.../linux/linux-ti-staging_6.18.bb | 9 ++++++
2 files changed, 37 insertions(+)
create mode 100644
meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg
diff --git
a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg
b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg
new file mode 100644
index 00000000..234cc087
--- /dev/null
+++ b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg
@@ -0,0 +1,28 @@
+# Device Mapper support
+CONFIG_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_CRYPT=y
+
+# Crypto algorithms for LUKS
+CONFIG_CRYPTO_XTS=y
+CONFIG_CRYPTO_AES=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA256_ARM64=y
+CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_USER_API_SKCIPHER=y
+
+# Additional crypto support for LUKS2
+CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_ECB=y
+CONFIG_CRYPTO_ESSIV=y
+CONFIG_CRYPTO_LRW=y
+CONFIG_CRYPTO_PCBC=y
+
+# TPM kernel modules needed for initramfs
+CONFIG_TCG_TIS_CORE=m
+CONFIG_TCG_CRB=m
+
diff --git a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb
b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb
index 8e4ccd7d..69d6217f 100644
--- a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb
+++ b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb
@@ -35,3 +35,12 @@ module_conf_rpmsg_client_sample = "blacklist
rpmsg_client_sample"
module_conf_ti_k3_r5_remoteproc = "softdep ti_k3_r5_remoteproc pre:
virtio_rpmsg_bus"
module_conf_ti_k3_dsp_remoteproc = "softdep ti_k3_dsp_remoteproc pre:
virtio_rpmsg_bus"
KERNEL_MODULE_PROBECONF += "rpmsg_client_sample ti_k3_r5_remoteproc
ti_k3_dsp_remoteproc"
+
After thinking about this a little more... I'm thinking that the
luks-encryption is more of a DISTRO_FEATURE and not a
MACHINE_FEATURE. "tpm" would be a MACHINE_FEATURE.
This was the first thought I had - it's a distro feature.
And the best most correct thing to do would be to do some
combination of the two. I assume that only some of our boards have
tpm support, right?
On the other hand, isn't fTPM a software-only implementation of TPM?
Yeah, though they should behave the same in userspace. It seems like there is a
bug preventing systemd-cryptenroll from working in our case though. Obviously
there are some quirks here.
The TPM support we are using here comes from OP-TEE based firmware TPM
(Microsoft's implementation). We are not using an actual HW TPM here.
Also I see, all K3 platforms already have "optee-ftpm" as
MACHINE_FEATURES enabled [1]
Would it be fine to use existing "optee-ftpm" as MACHINE_FEATURES with
"luks" as DISTRO_FEATURES in this patch series ?
Thinking of implementing same checks as suggested by Ryan, just
"optee-ftpm" in place of "tpm", if that's okay ?
I'm fine with it.
[1]:
https://github.com/YoeDistro/meta-ti/blob/master/meta-ti-bsp/conf/machine/include/k3.inc#L41
Thanks,
Shiva
So I would go through the effort to add that to all of the correct
boards, and then change the logic to check both variables. I'll
reply on the other patches with those changes.
+# LUKS encryption with fTPM kernel configuration
+SRC_URI:append:k3 = " \
+ ${@bb.utils.contains('MACHINE_FEATURES', 'luks-encryption',
'file://luks-ftpm.cfg', '', d)} \
${@bb.utils.contains('DISTRO_FEATURES', 'luks',
'file://luks-ftpm.cfg', '', d)}
+"
+KERNEL_CONFIG_FRAGMENTS:append:k3 = " \
+ ${@bb.utils.contains('MACHINE_FEATURES', 'luks-encryption',
'${UNPACKDIR}/luks-ftpm.cfg', '', d)} \
+"
+
${@bb.utils.contains('DISTRO_FEATURES', 'luks',
'${UNPACKDIR}/luks-ftpm.cfg', '', d)}
--
Ryan Eatmon [email protected]
-----------------------------------------
Texas Instruments, Inc. - LCPD - MGTS
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#19666):
https://lists.yoctoproject.org/g/meta-ti/message/19666
Mute This Topic: https://lists.yoctoproject.org/mt/118155818/21656
Group Owner: [email protected]
Unsubscribe: https://lists.yoctoproject.org/g/meta-ti/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
