Re: [meta-ti][master][PATCH v4 1/3] linux-ti-staging: Add LUKS encryption config

On 3/6/2026 8:41 AM, Shiva Tripathi wrote:
> 
> 
> On 3/6/26 04:39, Randolph Sapp wrote:
>> On Thu Mar 5, 2026 at 3:12 PM CST, Denys Dmytriyenko wrote:
>>> On Thu, Mar 05, 2026 at 02:51:44PM -0600, Ryan Eatmon via lists.yoctoproject.org wrote:
>>>>
>>>>
>>>> On 3/5/2026 11:21 AM, Shiva Tripathi wrote:
>>>>> Add conditional kernel configuration fragment for LUKS encryption with
>>>>> fTPM support. This enables dm-crypt and necessary crypto algorithms
>>>>> when MACHINE_FEATURES contains 'luks-encryption'.
>>>>>
>>>>> Signed-off-by: Shiva Tripathi <[email protected]>
>>>>> ---
>>>>>   .../linux/linux-ti-staging-6.18/luks-ftpm.cfg | 28 +++++++++++++++++++
>>>>>   .../linux/linux-ti-staging_6.18.bb            |  9 ++++++
>>>>>   2 files changed, 37 insertions(+)
>>>>>   create mode 100644 meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg
>>>>>
>>>>> diff --git a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg
>>>>> new file mode 100644
>>>>> index 00000000..234cc087
>>>>> --- /dev/null
>>>>> +++ b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg
>>>>> @@ -0,0 +1,28 @@
>>>>> +# Device Mapper support
>>>>> +CONFIG_MD=y
>>>>> +CONFIG_BLK_DEV_DM=y
>>>>> +CONFIG_DM_CRYPT=y
>>>>> +
>>>>> +# Crypto algorithms for LUKS
>>>>> +CONFIG_CRYPTO_XTS=y
>>>>> +CONFIG_CRYPTO_AES=y
>>>>> +CONFIG_CRYPTO_AES_ARM64=y
>>>>> +CONFIG_CRYPTO_AES_ARM64_CE=y
>>>>> +CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
>>>>> +CONFIG_CRYPTO_SHA256=y
>>>>> +CONFIG_CRYPTO_SHA256_ARM64=y
>>>>> +CONFIG_CRYPTO_SHA512=y
>>>>> +CONFIG_CRYPTO_USER_API_HASH=y
>>>>> +CONFIG_CRYPTO_USER_API_SKCIPHER=y
>>>>> +
>>>>> +# Additional crypto support for LUKS2
>>>>> +CONFIG_CRYPTO_CBC=y
>>>>> +CONFIG_CRYPTO_ECB=y
>>>>> +CONFIG_CRYPTO_ESSIV=y
>>>>> +CONFIG_CRYPTO_LRW=y
>>>>> +CONFIG_CRYPTO_PCBC=y
>>>>> +
>>>>> +# TPM kernel modules needed for initramfs
>>>>> +CONFIG_TCG_TIS_CORE=m
>>>>> +CONFIG_TCG_CRB=m
>>>>> +
>>>>> diff --git a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb
>>>>> index 8e4ccd7d..69d6217f 100644
>>>>> --- a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb
>>>>> +++ b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb
>>>>> @@ -35,3 +35,12 @@ module_conf_rpmsg_client_sample = "blacklist rpmsg_client_sample"
>>>>>   module_conf_ti_k3_r5_remoteproc = "softdep ti_k3_r5_remoteproc pre: virtio_rpmsg_bus"
>>>>>   module_conf_ti_k3_dsp_remoteproc = "softdep ti_k3_dsp_remoteproc pre: virtio_rpmsg_bus"
>>>>>   KERNEL_MODULE_PROBECONF += "rpmsg_client_sample ti_k3_r5_remoteproc ti_k3_dsp_remoteproc"
>>>>> +
>>>>
>>>> After thinking about this a little more... I'm thinking that the
>>>> luks-encryption is more of a DISTRO_FEATURE and not a
>>>> MACHINE_FEATURE. "tpm" would be a MACHINE_FEATURE.
>>>
>>> This was the first thought I had - it's a distro feature.
>>>
>>>
>>>> And the best most correct thing to do would be to do some
>>>> combination of the two.  I assume that only some of our boards have
>>>> tpm support, right?
>>>
>>> On the other hand, isn't fTPM a software-only implementation of TPM?
>>>
>>
>> Yeah, though they should behave the same in userspace. It seems like there is a
>> bug preventing systemd-cryptenroll from working in our case though. Obviously
>> there are some quirks here.
>>
> 
> The TPM support we are using here comes from OP-TEE based firmware TPM
> (Microsoft's implementation). We are not using an actual HW TPM here.
> Also I see, all K3 platforms already have "optee-ftpm" as
> MACHINE_FEATURES enabled [1]
> 
> Would it be fine to use existing "optee-ftpm" as MACHINE_FEATURES with
> "luks" as DISTRO_FEATURES in this patch series ?
> Thinking of implementing same checks as suggested by Ryan, just
> "optee-ftpm" in place of "tpm", if that's okay ?

I'm fine with it.


> [1]:
> https://github.com/YoeDistro/meta-ti/blob/master/meta-ti-bsp/conf/machine/include/k3.inc#L41
> 
> Thanks,
> Shiva
> 
>>>> So I would go through the effort to add that to all of the correct
>>>> boards, and then change the logic to check both variables.  I'll
>>>> reply on the other patches with those changes.
>>>>
>>>>
>>>>> +# LUKS encryption with fTPM kernel configuration
>>>>> +SRC_URI:append:k3 = " \
>>>>> +    ${@bb.utils.contains('MACHINE_FEATURES', 'luks-encryption', 'file://luks-ftpm.cfg', '', d)} \
>>>>
>>>> ${@bb.utils.contains('DISTRO_FEATURES', 'luks',
>>>> 'file://luks-ftpm.cfg', '', d)}
>>>>
>>>>
>>>>> +"
>>>>> +KERNEL_CONFIG_FRAGMENTS:append:k3 = " \
>>>>> +    ${@bb.utils.contains('MACHINE_FEATURES', 'luks-encryption', '${UNPACKDIR}/luks-ftpm.cfg', '', d)} \
>>>>> +"
>>>>> +
>>>>
>>>> ${@bb.utils.contains('DISTRO_FEATURES', 'luks',
>>>> '${UNPACKDIR}/luks-ftpm.cfg', '', d)}
>>
> 

-- 
Ryan Eatmon                [email protected]
-----------------------------------------
Texas Instruments, Inc.  -  LCPD  -  MGTS