On 3/6/26 04:39, Randolph Sapp wrote: > On Thu Mar 5, 2026 at 3:12 PM CST, Denys Dmytriyenko wrote: >> On Thu, Mar 05, 2026 at 02:51:44PM -0600, Ryan Eatmon via >> lists.yoctoproject.org wrote: >>> >>> >>> On 3/5/2026 11:21 AM, Shiva Tripathi wrote: >>>> Add conditional kernel configuration fragment for LUKS encryption with >>>> fTPM support. This enables dm-crypt and necessary crypto algorithms >>>> when MACHINE_FEATURES contains 'luks-encryption'. >>>> >>>> Signed-off-by: Shiva Tripathi <[email protected]> >>>> --- >>>> .../linux/linux-ti-staging-6.18/luks-ftpm.cfg | 28 +++++++++++++++++++ >>>> .../linux/linux-ti-staging_6.18.bb | 9 ++++++ >>>> 2 files changed, 37 insertions(+) >>>> create mode 100644 >>>> meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg >>>> >>>> diff --git >>>> a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg >>>> b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg >>>> new file mode 100644 >>>> index 00000000..234cc087 >>>> --- /dev/null >>>> +++ b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg >>>> @@ -0,0 +1,28 @@ >>>> +# Device Mapper support >>>> +CONFIG_MD=y >>>> +CONFIG_BLK_DEV_DM=y >>>> +CONFIG_DM_CRYPT=y >>>> + >>>> +# Crypto algorithms for LUKS >>>> +CONFIG_CRYPTO_XTS=y >>>> +CONFIG_CRYPTO_AES=y >>>> +CONFIG_CRYPTO_AES_ARM64=y >>>> +CONFIG_CRYPTO_AES_ARM64_CE=y >>>> +CONFIG_CRYPTO_AES_ARM64_CE_BLK=y >>>> +CONFIG_CRYPTO_SHA256=y >>>> +CONFIG_CRYPTO_SHA256_ARM64=y >>>> +CONFIG_CRYPTO_SHA512=y >>>> +CONFIG_CRYPTO_USER_API_HASH=y >>>> +CONFIG_CRYPTO_USER_API_SKCIPHER=y >>>> + >>>> +# Additional crypto support for LUKS2 >>>> +CONFIG_CRYPTO_CBC=y >>>> +CONFIG_CRYPTO_ECB=y >>>> +CONFIG_CRYPTO_ESSIV=y >>>> +CONFIG_CRYPTO_LRW=y >>>> +CONFIG_CRYPTO_PCBC=y >>>> + >>>> +# TPM kernel modules needed for initramfs >>>> +CONFIG_TCG_TIS_CORE=m >>>> +CONFIG_TCG_CRB=m >>>> + >>>> diff --git a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb >>>> b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb >>>> index 8e4ccd7d..69d6217f 100644 >>>> --- a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb >>>> +++ b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb >>>> @@ -35,3 +35,12 @@ module_conf_rpmsg_client_sample = "blacklist >>>> rpmsg_client_sample" >>>> module_conf_ti_k3_r5_remoteproc = "softdep ti_k3_r5_remoteproc pre: >>>> virtio_rpmsg_bus" >>>> module_conf_ti_k3_dsp_remoteproc = "softdep ti_k3_dsp_remoteproc pre: >>>> virtio_rpmsg_bus" >>>> KERNEL_MODULE_PROBECONF += "rpmsg_client_sample ti_k3_r5_remoteproc >>>> ti_k3_dsp_remoteproc" >>>> + >>> >>> After thinking about this a little more... I'm thinking that the >>> luks-encryption is more of a DISTRO_FEATURE and not a >>> MACHINE_FEATURE. "tpm" would be a MACHINE_FEATURE. >> >> This was the first thought I had - it's a distro feature. >> >> >>> And the best most correct thing to do would be to do some >>> combination of the two. I assume that only some of our boards have >>> tpm support, right? >> >> On the other hand, isn't fTPM a software-only implementation of TPM? >> > > Yeah, though they should behave the same in userspace. It seems like there is > a > bug preventing systemd-cryptenroll from working in our case though. Obviously > there are some quirks here. >
The TPM support we are using here comes from OP-TEE based firmware TPM (Microsoft's implementation). We are not using an actual HW TPM here. Also I see, all K3 platforms already have "optee-ftpm" as MACHINE_FEATURES enabled [1] Would it be fine to use existing "optee-ftpm" as MACHINE_FEATURES with "luks" as DISTRO_FEATURES in this patch series ? Thinking of implementing same checks as suggested by Ryan, just "optee-ftpm" in place of "tpm", if that's okay ? [1]: https://github.com/YoeDistro/meta-ti/blob/master/meta-ti-bsp/conf/machine/include/k3.inc#L41 Thanks, Shiva >>> So I would go through the effort to add that to all of the correct >>> boards, and then change the logic to check both variables. I'll >>> reply on the other patches with those changes. >>> >>> >>>> +# LUKS encryption with fTPM kernel configuration >>>> +SRC_URI:append:k3 = " \ >>>> + ${@bb.utils.contains('MACHINE_FEATURES', 'luks-encryption', >>>> 'file://luks-ftpm.cfg', '', d)} \ >>> >>> ${@bb.utils.contains('DISTRO_FEATURES', 'luks', >>> 'file://luks-ftpm.cfg', '', d)} >>> >>> >>>> +" >>>> +KERNEL_CONFIG_FRAGMENTS:append:k3 = " \ >>>> + ${@bb.utils.contains('MACHINE_FEATURES', 'luks-encryption', >>>> '${UNPACKDIR}/luks-ftpm.cfg', '', d)} \ >>>> +" >>>> + >>> >>> ${@bb.utils.contains('DISTRO_FEATURES', 'luks', >>> '${UNPACKDIR}/luks-ftpm.cfg', '', d)} >
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#19665): https://lists.yoctoproject.org/g/meta-ti/message/19665 Mute This Topic: https://lists.yoctoproject.org/mt/118155818/21656 Group Owner: [email protected] Unsubscribe: https://lists.yoctoproject.org/g/meta-ti/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
