[meta-ti][master][PATCH v7 0/3] Add LUKS encryption with fTPM support

[meta-ti][master][PATCH v7 0/3] Add LUKS encryption with fTPM support

[Shiva Tripathi]

This patch series adds LUKS full disk encryption support using firmware TPM
(fTPM) for TI K3 platforms. The implementation provides hardware-backed
encryption with keys sealed by TPM running in OP-TEE and stored in eMMC RPMB.

Background:
TI K3 platforms do not have integrated discrete TPM hardware. To provide
TPM 2.0 functionality, this implementation uses firmware TPM (fTPM) - a
Trusted Application running in OP-TEE secure world. The fTPM provides
standard TPM 2.0 interfaces while leveraging ARM TrustZone for isolation
and eMMC RPMB (Replay Protected Memory Block) for secure persistent storage.

Key features:
- Conditional builds: Enabled via DISTRO_FEATURES += "luks" with MACHINE_FEATURES as 'optee-ftpm'
- No impact on default SDK builds
- In-place encryption on first boot
- TPM persistent handle for key storage (0x81080001)
- Secure key storage in eMMC RPMB via OP-TEE
- Security model similar to CIP Core

Use case:
This is designed for K3 platforms requiring secure boot and encrypted
storage, such as industrial automation, automotive, and IoT gateways where
discrete TPM chips are cost-prohibitive but security requirements demand
hardware-backed encryption.

Testing:
- Tested on AM62x platform with kernel 6.18
- First boot: Successful in-place LUKS encryption
- Subsequent boots: Successful TPM unsealing and boot

The series is structured as follows:
1. Kernel configuration for LUKS and crypto support
2. LUKS encryption initramfs module with fTPM key management
3. Dynamic layer registration and initramfs configuration

---
Changes in v7:
- Added 'tpm-layer' collection registration to BBFILES_DYNAMIC for TPM packages
- Added meta-security to LAYERRECOMMENDS
- Link to v6: https://lore.kernel.org/all/20260318145732.2115521-1-s-tripathi1@ti.com/

Changes in v6:
- Moved initramfs-module-luks-ftpm to dynamic-layers/security/
- Added BBFILES_DYNAMIC registration for 'security' layer in layer.conf
- Eliminates hard dependency on meta-security layer
- Packagegroup LUKS logic moved from base .bb to dynamic-layers bbappend
- Link to v5: https://lore.kernel.org/all/20260306163735.1316257-1-s-tripathi1@ti.com/

Changes in v5:
- change from MACHINE_FEATURES 'luks-encryption' to DISTRO_FEATURES 'luks'
- implement dual gating using existing MACHINE_FEATURES 'optee-ftpm'
- optimize kernel config - remove unnecessary CBC, ECB, ESSIV, LRW, PCBC, SHA256_ARM64
- packagegroup-ti-core-initramfs.bb changes moved to patch 3 from patch2
- Link to v4: https://lore.kernel.org/all/20260305172115.3684326-1-s-tripathi1@ti.com/

Changes in v4:
- remove encrypted-boot-common.inc and use existing ti-core-initramfs.inc
- Link to v3: https://lore.kernel.org/all/20260304193824.2495898-1-s-tripathi1@ti.com/

Changes in v3:
 - remove separate sdimage.wks for encrypted boot, default works
 - update encrypted-boot-common.inc to use existing hook for adding TI_CORE_INITRAMFS_ENABLED dependency on luks-encryption flag
 - add logic to verify if partition has enough space for LUKS header before starting encryption

Changes in v2:
- changes to use existing ti-core-initramfs instead of adding separate
- cleanup in previous init script as per comments in v1
- /usr/bin/busybox logs updated to echo, mesg, info
- WORKDIR changed to UNPACKDIR
- Link to v1: https://lore.kernel.org/all/20260302144647.1705408-1-s-tripathi1@ti.com/

Shiva Tripathi (3):
  linux-ti-staging: Add LUKS encryption config
  initramfs-module-luks-ftpm: Add fTPM support
  conf: Enable dynamic security layer for LUKS

 meta-ti-bsp/conf/layer.conf                   |   5 +
 .../machine/include/ti-core-initramfs.inc     |   2 +-
 .../initramfs-module-luks-ftpm/luksftpm       | 341 ++++++++++++++++++
 .../initramfs-module-luks-ftpm_1.0.bb         |  41 +++
 .../packagegroup-ti-core-initramfs.bbappend   |   3 +
 .../linux/linux-ti-staging-6.18/luks-ftpm.cfg |  22 ++
 .../linux/linux-ti-staging_6.18.bb            |   8 +
 7 files changed, 421 insertions(+), 1 deletion(-)
 create mode 100644 meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm/luksftpm
 create mode 100644 meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm_1.0.bb
 create mode 100644 meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/packagegroup-ti-core-initramfs.bbappend
 create mode 100644 meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg

-- 
2.34.1

[meta-ti][master][PATCH v7 1/3] linux-ti-staging: Add LUKS encryption config

[Shiva Tripathi]

Add kernel configuration fragment enabling dm-crypt and crypto
algorithms required for LUKS2 full disk encryption. Config is
applied when DISTRO_FEATURES contains 'luks'.

Includes ARM64 crypto optimizations and fTPM support.

Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>
---
 .../linux/linux-ti-staging-6.18/luks-ftpm.cfg | 22 +++++++++++++++++++
 .../linux/linux-ti-staging_6.18.bb            |  8 +++++++
 2 files changed, 30 insertions(+)
 create mode 100644 meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg

diff --git a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg
new file mode 100644
index 00000000..291e5ee6
--- /dev/null
+++ b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg
@@ -0,0 +1,22 @@
+# Device Mapper support
+CONFIG_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_CRYPT=y
+
+# Core crypto algorithms for LUKS encryption
+CONFIG_CRYPTO_AES=y
+CONFIG_CRYPTO_XTS=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+
+# ARM64 optimized crypto for better performance
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+
+# Userspace crypto API for cryptsetup
+CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_USER_API_SKCIPHER=y
+
+# Firmware TPM support via OP-TEE
+CONFIG_TCG_FTPM_TEE=m
diff --git a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb
index 0e5ea5a5..2b064d12 100644
--- a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb
+++ b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb
@@ -35,3 +35,11 @@ module_conf_rpmsg_client_sample = "blacklist rpmsg_client_sample"
 module_conf_ti_k3_r5_remoteproc = "softdep ti_k3_r5_remoteproc pre: virtio_rpmsg_bus"
 module_conf_ti_k3_dsp_remoteproc = "softdep ti_k3_dsp_remoteproc pre: virtio_rpmsg_bus"
 KERNEL_MODULE_PROBECONF += "rpmsg_client_sample ti_k3_r5_remoteproc ti_k3_dsp_remoteproc"
+
+# LUKS encryption with fTPM kernel configuration
+SRC_URI:append:k3 = " \
+    ${@bb.utils.contains('DISTRO_FEATURES', 'luks', 'file://luks-ftpm.cfg', '', d)} \
+"
+KERNEL_CONFIG_FRAGMENTS:append:k3 = " \
+    ${@bb.utils.contains('DISTRO_FEATURES', 'luks', '${UNPACKDIR}/luks-ftpm.cfg', '', d)} \
+"
-- 
2.34.1

[meta-ti][master][PATCH v7 2/3] initramfs-module-luks-ftpm: Add fTPM support

[Shiva Tripathi]

Add initramfs module to dynamic-layers/security providing LUKS2 full
disk encryption with TPM-sealed keys for TI K3 platforms. Keys are
sealed by firmware TPM (fTPM) running in OP-TEE and stored in eMMC
RPMB.

Features:
- First-boot in-place encryption with tpm2_getrandom key generation
- TPM-sealed key storage via persistent handle 0x81080001
- Automatic unlock on subsequent boots
- Space verification ensuring 32MB available for LUKS header

The module is built only when meta-security layer is present and gets
included in initramfs only when DISTRO_FEATURES='luks' and
MACHINE_FEATURES='optee-ftpm'

Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>
---
 .../initramfs-module-luks-ftpm/luksftpm       | 341 ++++++++++++++++++
 .../initramfs-module-luks-ftpm_1.0.bb         |  41 +++
 .../packagegroup-ti-core-initramfs.bbappend   |   3 +
 3 files changed, 385 insertions(+)
 create mode 100644 meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm/luksftpm
 create mode 100644 meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm_1.0.bb
 create mode 100644 meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/packagegroup-ti-core-initramfs.bbappend

diff --git a/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm/luksftpm b/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm/luksftpm
new file mode 100644
index 00000000..5e3aedc4
--- /dev/null
+++ b/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm/luksftpm
@@ -0,0 +1,341 @@
+#!/bin/sh
+# initramfs-framework module for LUKS encryption with fTPM support
+
+# Configuration
+BOOT_DEV="/dev/mmcblk1p1"           # Boot partition (FAT, unencrypted)
+ROOT_DEV="/dev/mmcblk1p2"           # Root partition (will be encrypted)
+CRYPT_NAME="root_crypt"
+CRYPT_DEV="/dev/mapper/${CRYPT_NAME}"
+BOOT_MNT="/boot_part"
+TPM_PRIMARY_CTX="/tmp/tpm_primary.ctx"
+TPM_KEY_PRIV="/tmp/tpm_key.priv"
+TPM_KEY_PUB="/tmp/tpm_key.pub"
+TPM_KEY_CTX="/tmp/tpm_key.ctx"
+TPM2_HANDLE="0x81080001"            # TPM persistent handle for LUKS key
+ENCRYPTION_MARKER="${BOOT_MNT}/.encryption_in_progress"
+
+# Wait for MMC device to appear
+wait_for_device() {
+    local device="$1"
+    local timeout="${2:-10}"
+
+    msg "Waiting for storage device ${device}..."
+    for i in $(seq 1 ${timeout}); do
+        if [ -b "${device}" ]; then
+            return 0
+        fi
+        sleep 1
+    done
+    return 1
+}
+
+# Initialize fTPM and check availability
+init_ftpm() {
+    msg "Initializing secure hardware (fTPM)..."
+
+    # Start TEE supplicant (required for fTPM TA to work)
+    if [ -x /usr/sbin/tee-supplicant ]; then
+        /usr/sbin/tee-supplicant -d &
+        TEE_SUPPLICANT_PID=$!
+        sleep 5
+    else
+        info "Warning: Trusted execution environment not available"
+        return 1
+    fi
+
+    # Load fTPM kernel module
+    if ! /sbin/modprobe tpm_ftpm_tee; then
+        info "Warning: TPM module failed to load"
+        return 1
+    fi
+
+    # Wait for TPM device
+    for i in $(seq 1 10); do
+        if [ -c /dev/tpmrm0 ]; then
+            export TPM2TOOLS_TCTI="device:/dev/tpmrm0"
+            return 0
+        fi
+        sleep 1
+    done
+
+    info "Warning: fTPM not available - encryption will be skipped"
+    return 1
+}
+
+# Generate 32-byte random key using TPM RNG
+generate_random_key() {
+    /usr/bin/tpm2_getrandom --hex 32
+}
+
+# Seal data with TPM and store in persistent handle
+tpm_seal_key() {
+    local KEY_DATA="$1"
+
+    # Create primary key in owner hierarchy
+    /usr/bin/tpm2_createprimary -C o -c "${TPM_PRIMARY_CTX}" -Q || return 1
+
+    # Create sealed object
+    echo -n "${KEY_DATA}" | \
+        /usr/bin/tpm2_create -C "${TPM_PRIMARY_CTX}" \
+        -u "${TPM_KEY_PUB}" -r "${TPM_KEY_PRIV}" \
+        -i- -Q || return 1
+
+    # Load sealed object into TPM
+    /usr/bin/tpm2_load -C "${TPM_PRIMARY_CTX}" \
+        -u "${TPM_KEY_PUB}" -r "${TPM_KEY_PRIV}" \
+        -c "${TPM_KEY_CTX}" -Q || return 1
+
+    # Make key persistent at handle (stored in TPM NV RAM - RPMB)
+    /usr/bin/tpm2_evictcontrol -C o -c "${TPM_KEY_CTX}" "${TPM2_HANDLE}" || return 1
+
+    return 0
+}
+
+# Unseal data from TPM persistent handle
+tpm_unseal_key() {
+    # Check if persistent handle exists
+    if ! /usr/bin/tpm2_getcap handles-persistent | grep -q "${TPM2_HANDLE}"; then
+        debug "ERROR: TPM persistent handle not found"
+        return 1
+    fi
+
+    # Unseal key directly from persistent handle
+    /usr/bin/tpm2_unseal -c "${TPM2_HANDLE}" || return 1
+
+    return 0
+}
+
+# Perform in-place LUKS encryption (first boot)
+encrypt_root_filesystem() {
+    msg "=========================================="
+    msg "First boot: Encrypting root filesystem"
+    msg "=========================================="
+
+    # Set marker to track encryption progress
+    touch "${ENCRYPTION_MARKER}"
+    sync
+
+    # Generate random encryption key using TPM RNG
+    msg "Generating encryption key..."
+    LUKS_KEY=$(generate_random_key)
+
+    if [ -z "${LUKS_KEY}" ]; then
+        msg "ERROR: Failed to generate encryption key"
+        rm -f "${ENCRYPTION_MARKER}"
+        return 1
+    fi
+
+    # Seal key with TPM before encryption starts
+    msg "Securing key with TPM..."
+    if ! tpm_seal_key "${LUKS_KEY}"; then
+        msg "ERROR: Failed to secure key"
+        rm -f "${ENCRYPTION_MARKER}"
+        return 1
+    fi
+
+    # Filesystem check before encryption
+    msg "Checking filesystem integrity..."
+    /usr/sbin/e2fsck -f -y "${ROOT_DEV}"
+    E2FSCK_RET=$?
+    if [ ${E2FSCK_RET} -ge 4 ]; then
+        msg "ERROR: Filesystem check failed"
+        rm -f "${ENCRYPTION_MARKER}"
+        return 1
+    fi
+
+    # Shrink filesystem before encryption to leave room for LUKS header
+    msg "Preparing filesystem for encryption..."
+    /usr/sbin/resize2fs -M "${ROOT_DEV}" || {
+        msg "ERROR: Failed to prepare filesystem"
+        rm -f "${ENCRYPTION_MARKER}"
+        return 1
+    }
+
+    # Verify partition has sufficient space for LUKS header
+    msg "Verifying space for encryption..."
+    MIN_BLOCKS=$(/usr/sbin/resize2fs -P "${ROOT_DEV}" 2>&1 | awk '/[Mm]inimum.*:/ {print $NF}')
+
+    # Get filesystem block size and device size
+    BLOCK_SIZE=$(/usr/sbin/tune2fs -l "${ROOT_DEV}" 2>/dev/null | awk '/^Block size:/ {print $NF}')
+    DEV_NAME=$(basename "${ROOT_DEV}")
+    PART_SECTORS=$(cat /sys/class/block/"${DEV_NAME}"/size 2>/dev/null)
+
+    if [ -z "${MIN_BLOCKS}" ] || [ -z "${BLOCK_SIZE}" ] || [ -z "${PART_SECTORS}" ]; then
+        msg "ERROR: Unable to determine partition geometry"
+        rm -f "${ENCRYPTION_MARKER}"
+        return 1
+    fi
+
+    # Convert filesystem blocks to 512-byte sectors
+    MIN_SECTORS=$((MIN_BLOCKS * BLOCK_SIZE / 512))
+    LUKS_SECTORS=65536  # 32MB in 512-byte sectors
+
+    if [ $((PART_SECTORS - MIN_SECTORS)) -lt ${LUKS_SECTORS} ]; then
+        msg "ERROR: Insufficient space for LUKS header (need 32MB free)"
+        rm -f "${ENCRYPTION_MARKER}"
+        return 1
+    fi
+
+    # Perform in-place encryption
+    msg "=========================================="
+    msg "Encrypting filesystem..."
+    msg "This will take several minutes."
+    msg "DO NOT POWER OFF THE DEVICE!"
+    msg "=========================================="
+
+    echo -n "${LUKS_KEY}" | \
+        /usr/sbin/cryptsetup reencrypt --encrypt \
+        --type luks2 \
+        --cipher aes-xts-plain64 \
+        --key-size 256 \
+        --hash sha256 \
+        --reduce-device-size 32M \
+        --key-file - \
+        "${ROOT_DEV}" || {
+        msg "ERROR: Encryption failed"
+        rm -f "${ENCRYPTION_MARKER}"
+        return 1
+    }
+
+    msg "=========================================="
+    msg "Encryption completed successfully!"
+    msg "=========================================="
+
+    # Remove encryption marker
+    rm -f "${ENCRYPTION_MARKER}"
+    sync
+
+    # Unlock the newly encrypted device
+    msg "Activating encrypted filesystem..."
+    echo -n "${LUKS_KEY}" | \
+        /usr/sbin/cryptsetup luksOpen "${ROOT_DEV}" "${CRYPT_NAME}" --key-file - || {
+        msg "ERROR: Failed to activate encrypted filesystem"
+        return 1
+    }
+
+    # Resize filesystem to fit the encrypted device
+    msg "Optimizing filesystem..."
+    /usr/sbin/resize2fs -f "${CRYPT_DEV}" || {
+        msg "ERROR: Failed to optimize filesystem"
+        return 1
+    }
+
+    # Verify filesystem after resize
+    /usr/sbin/e2fsck -f -y "${CRYPT_DEV}" || {
+        info "WARNING: Filesystem verification had issues, but continuing"
+    }
+
+    return 0
+}
+
+# Unlock encrypted root filesystem (subsequent boots)
+unlock_encrypted_root() {
+    msg "Unlocking encrypted filesystem..."
+
+    # Unseal key from TPM persistent handle
+    LUKS_KEY=$(tpm_unseal_key)
+
+    if [ -z "${LUKS_KEY}" ]; then
+        msg "ERROR: Failed to retrieve encryption key from TPM"
+        msg "Attempting passphrase fallback..."
+
+        # Try to unlock with passphrase (interactive)
+        /usr/sbin/cryptsetup luksOpen "${ROOT_DEV}" "${CRYPT_NAME}" || {
+            fatal "ERROR: Failed to unlock encrypted filesystem"
+        }
+    else
+        # Unlock with unsealed key
+        echo -n "${LUKS_KEY}" | \
+            /usr/sbin/cryptsetup luksOpen "${ROOT_DEV}" "${CRYPT_NAME}" --key-file - || {
+            fatal "ERROR: Failed to unlock with TPM key"
+        }
+    fi
+
+    msg "Encrypted filesystem unlocked"
+}
+
+# Module enabled check
+luksftpm_enabled() {
+    # Always run this module - it handles both encrypted and unencrypted cases
+    return 0
+}
+
+# Module main function
+luksftpm_run() {
+    # Wait for storage device
+    if ! wait_for_device "${ROOT_DEV}" 10; then
+        info "Storage device not found, skipping encryption module"
+        return 0
+    fi
+
+    # Mount boot partition
+    msg "Mounting boot partition..."
+    mkdir -p "${BOOT_MNT}"
+    if ! mount "${BOOT_DEV}" "${BOOT_MNT}"; then
+        info "ERROR: Failed to mount boot partition, attempting standard boot..."
+        mkdir -p ${ROOTFS_DIR}
+        mount "${ROOT_DEV}" ${ROOTFS_DIR}
+        return 0
+    fi
+
+    # Initialize fTPM
+    TPM_AVAILABLE=0
+    if init_ftpm; then
+        TPM_AVAILABLE=1
+    fi
+
+    # Check filesystem encryption status
+    msg "Checking filesystem encryption status..."
+
+    MOUNT_DEV="${ROOT_DEV}"
+
+    if /usr/sbin/cryptsetup isLuks "${ROOT_DEV}"; then
+        msg "Filesystem is encrypted"
+        unlock_encrypted_root
+        MOUNT_DEV="${CRYPT_DEV}"
+    else
+        msg "Filesystem is not encrypted"
+
+        # Check if encryption is enabled and TPM is available
+        if [ $TPM_AVAILABLE -eq 1 ]; then
+            # Check for encryption marker (resume interrupted encryption)
+            if [ -f "${ENCRYPTION_MARKER}" ]; then
+                msg "Resuming interrupted encryption..."
+                if ! encrypt_root_filesystem; then
+                    msg "ERROR: Failed to resume encryption"
+                    msg "Booting without encryption..."
+                    MOUNT_DEV="${ROOT_DEV}"
+                else
+                    MOUNT_DEV="${CRYPT_DEV}"
+                fi
+            else
+                # First boot - perform encryption
+                if encrypt_root_filesystem; then
+                    MOUNT_DEV="${CRYPT_DEV}"
+                else
+                    msg "ERROR: Encryption failed - booting without encryption"
+                    MOUNT_DEV="${ROOT_DEV}"
+                fi
+            fi
+        else
+            msg "TPM not available - skipping encryption"
+            MOUNT_DEV="${ROOT_DEV}"
+        fi
+    fi
+
+    # Unmount boot partition before switching root
+    umount "${BOOT_MNT}"
+
+    # Mount root filesystem to $ROOTFS_DIR (framework expects this)
+    msg "Mounting root filesystem..."
+    mkdir -p ${ROOTFS_DIR}
+    mount "${MOUNT_DEV}" ${ROOTFS_DIR} || {
+        fatal "ERROR: Failed to mount root filesystem!"
+    }
+
+    # Clean up tmpfs and sensitive variables
+    rm -f "${TPM_PRIMARY_CTX}" "${TPM_KEY_PUB}" "${TPM_KEY_PRIV}" "${TPM_KEY_CTX}"
+    unset LUKS_KEY TPM_AVAILABLE MOUNT_DEV TEE_SUPPLICANT_PID
+
+    msg "Boot complete"
+}
diff --git a/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm_1.0.bb b/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm_1.0.bb
new file mode 100644
index 00000000..595ce1f1
--- /dev/null
+++ b/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm_1.0.bb
@@ -0,0 +1,41 @@
+SUMMARY = "initramfs support for LUKS encryption with fTPM"
+DESCRIPTION = "Provides LUKS2 full disk encryption using firmware TPM (fTPM) for key management on TI K3 platforms"
+
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+
+# Only build for platforms with optee-ftpm support
+COMPATIBLE_MACHINE = "null"
+COMPATIBLE_MACHINE:k3 = "${@bb.utils.contains('MACHINE_FEATURES', 'optee-ftpm', '.*', 'null', d)}"
+
+FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
+
+SRC_URI = "file://luksftpm"
+
+do_install() {
+    install -d ${D}/init.d
+    # Install as 85-luksftpm (runs after udev at 01, before rootfs at 90)
+    install -m 0755 ${UNPACKDIR}/luksftpm ${D}/init.d/85-luksftpm
+}
+
+FILES:${PN} = "/init.d/85-luksftpm"
+
+# Runtime dependencies
+RDEPENDS:${PN} = "\
+    initramfs-framework-base \
+    busybox \
+    kmod \
+    cryptsetup \
+    tpm2-tools \
+    tpm2-tss \
+    libtss2-tcti-device \
+    optee-client \
+    optee-ftpm \
+    e2fsprogs-e2fsck \
+    e2fsprogs-resize2fs \
+    e2fsprogs-tune2fs \
+    util-linux-blkid \
+    kernel-module-tpm-ftpm-tee \
+"
+
+PACKAGE_ARCH = "${MACHINE_ARCH}"
diff --git a/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/packagegroup-ti-core-initramfs.bbappend b/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/packagegroup-ti-core-initramfs.bbappend
new file mode 100644
index 00000000..52c82389
--- /dev/null
+++ b/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/packagegroup-ti-core-initramfs.bbappend
@@ -0,0 +1,3 @@
+LUKS_ENCRYPTION ?= "${@bb.utils.contains('MACHINE_FEATURES', 'optee-ftpm', 'initramfs-module-luks-ftpm', '', d)}"
+
+RDEPENDS:${PN}:append = " ${@bb.utils.contains('DISTRO_FEATURES', 'luks', '${LUKS_ENCRYPTION}', '', d)}"
-- 
2.34.1

[meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS

[Shiva Tripathi]

Register dynamic-layers/security in layer.conf with BBFILES_DYNAMIC
for both 'security' and 'tpm-layer' collections to conditionally
build LUKS encryption support when meta-security/meta-tpm layers
are present.

Add meta-security to LAYERRECOMMENDS to document the optional
dependency for LUKS functionality.

Update ti-core-initramfs.inc to auto-enable initramfs generation
when DISTRO_FEATURES contains 'luks'.

Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>
---
 meta-ti-bsp/conf/layer.conf                            | 5 +++++
 meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf
index f78da573..36d05b5a 100644
--- a/meta-ti-bsp/conf/layer.conf
+++ b/meta-ti-bsp/conf/layer.conf
@@ -20,10 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
 
 LAYERRECOMMENDS_meta-ti-bsp = " \
     openembedded-layer \
+    meta-security \
 "
 
 BBFILES_DYNAMIC += " \
     openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \
+    security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
+    security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
+    tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
+    tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
 "
 
 SIGGEN_EXCLUDERECIPES_ABISAFE += " \
diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
index 9d3cc612..15c05e04 100644
--- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
+++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
@@ -5,7 +5,7 @@
 #   TI_CORE_INITRAMFS_ENABLED = "0"
 #
 #------------------------------------------------------------------------------
-TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') else '0'}"
+TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}"
 
 TI_CORE_INITRAMFS_KERNEL_MODULES ?= ""
 TI_CORE_INITRAMFS_EXTRA_INSTALL ?= ""
-- 
2.34.1

Re: [meta-ti][master][PATCH v7 0/3] Add LUKS encryption with fTPM support

[PRC Automation]

meta-ti / na / 20260319103533.2431033-1-s-tripathi1

PRC Results: FAIL

=========================================================
  check-yocto-patches: PASS
=========================================================
Patches
----------------------------------------
WARN - [meta-ti][master][PATCH v7 1/3] linux-ti-staging: Add LUKS encryption config
    WARN: Revised patch missing a comment. (REVISION-1)
        patch
    
    For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
WARN - [meta-ti][master][PATCH v7 2/3] initramfs-module-luks-ftpm: Add fTPM support
    WARN: Revised patch missing a comment. (REVISION-1)
        patch
    
    For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
WARN - [meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS
    WARN: Revised patch missing a comment. (REVISION-1)
        patch
    
    For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887



=========================================================
  apply-yocto-patch: PASS
=========================================================
master
=====================
Summary:
- Patch Series: [meta-ti][master][PATCH v7 0/3] Add LUKS encryption with fTPM support
- Submitter: From: Shiva Tripathi <s-tripathi1@ti.com>
- Date: Date: Thu, 19 Mar 2026 16:05:30 +0530
- Num Patches: 3
- Mailing List (public inbox) Commit SHA: 509e15023c33e5c515959e07bb3a4376ab769e89

Applied to:
- Repository: lcpd-prc-meta-ti
- Base Branch: master-wip
- Commit Author: Ryan Eatmon <reatmon@ti.com>
- Commit Subject: conf: Add falcon support natively
- Commit SHA: 1ce070a6b1f8bb797c65b51a7968ffe0348ba053

Patches
----------------------------------------
All patches applied



=========================================================
  check-yocto-repo: FAIL
=========================================================
master
=====================
FAIL
    WARN: .bbappend files might need a guard to make them check-layer compliant. (GUARD-1)
        meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/packagegroup-ti-core-initramfs.bbappend
    
    For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887

Re: [meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS

[Ryan Eatmon]

On 3/19/2026 5:35 AM, Shiva Tripathi wrote:
> Register dynamic-layers/security in layer.conf with BBFILES_DYNAMIC
> for both 'security' and 'tpm-layer' collections to conditionally
> build LUKS encryption support when meta-security/meta-tpm layers
> are present.
> 
> Add meta-security to LAYERRECOMMENDS to document the optional
> dependency for LUKS functionality.
> 
> Update ti-core-initramfs.inc to auto-enable initramfs generation
> when DISTRO_FEATURES contains 'luks'.
> 
> Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>
> ---
>   meta-ti-bsp/conf/layer.conf                            | 5 +++++
>   meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc | 2 +-
>   2 files changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf
> index f78da573..36d05b5a 100644
> --- a/meta-ti-bsp/conf/layer.conf
> +++ b/meta-ti-bsp/conf/layer.conf
> @@ -20,10 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
>   
>   LAYERRECOMMENDS_meta-ti-bsp = " \
>       openembedded-layer \
> +    meta-security \
>   "

The layer should be same as below:  security and tpm-layer  I was just 
using meta-security as a placeholder.



>   BBFILES_DYNAMIC += " \
>       openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \
> +    security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
> +    security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
> +    tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
> +    tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
>   "
>   
>   SIGGEN_EXCLUDERECIPES_ABISAFE += " \
> diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> index 9d3cc612..15c05e04 100644
> --- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> +++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> @@ -5,7 +5,7 @@
>   #   TI_CORE_INITRAMFS_ENABLED = "0"
>   #
>   #------------------------------------------------------------------------------
> -TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') else '0'}"
> +TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}"
>   
>   TI_CORE_INITRAMFS_KERNEL_MODULES ?= ""
>   TI_CORE_INITRAMFS_EXTRA_INSTALL ?= ""

-- 
Ryan Eatmon                reatmon@ti.com
-----------------------------------------
Texas Instruments, Inc.  -  LCPD  -  MGTS

Re: [meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS

[Denys Dmytriyenko]

On Thu, Mar 19, 2026 at 08:59:24AM -0500, Ryan Eatmon via lists.yoctoproject.org wrote:
> 
> 
> On 3/19/2026 5:35 AM, Shiva Tripathi wrote:
> >Register dynamic-layers/security in layer.conf with BBFILES_DYNAMIC
> >for both 'security' and 'tpm-layer' collections to conditionally
> >build LUKS encryption support when meta-security/meta-tpm layers
> >are present.
> >
> >Add meta-security to LAYERRECOMMENDS to document the optional
> >dependency for LUKS functionality.
> >
> >Update ti-core-initramfs.inc to auto-enable initramfs generation
> >when DISTRO_FEATURES contains 'luks'.
> >
> >Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>
> >---
> >  meta-ti-bsp/conf/layer.conf                            | 5 +++++
> >  meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc | 2 +-
> >  2 files changed, 6 insertions(+), 1 deletion(-)
> >
> >diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf
> >index f78da573..36d05b5a 100644
> >--- a/meta-ti-bsp/conf/layer.conf
> >+++ b/meta-ti-bsp/conf/layer.conf
> >@@ -20,10 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
> >  LAYERRECOMMENDS_meta-ti-bsp = " \
> >      openembedded-layer \
> >+    meta-security \
> >  "
> 
> The layer should be same as below:  security and tpm-layer  I was
> just using meta-security as a placeholder.

Yeah, it's quite unfortunate that layer's collection name could be different 
from layer's directory name. Some maintainers keep them the same (e.g. 
meta-ti-bsp), but some make them different (e.g. meta-security -> security 
and meta-tpm -> tpm-layer). It could be rather confusing...


> >  BBFILES_DYNAMIC += " \
> >      openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \
> >+    security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
> >+    security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
> >+    tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
> >+    tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \

Moreover - is there really a need to set up security top level layer here? If 
only TPM tools are needed, then just tpm-layer should be enough, even when it 
comes from within meta-security git repository.

E.g., we set up openembedded-layer here, but that's not meta-openembedded top 
level, but instead meta-oe sub-layer inside meta-openembedded. There are 
sub-layers in there, which are not needed for meta-ti-bsp dependency. Same 
thought goes to tpm-layer.


> >  "
> >  SIGGEN_EXCLUDERECIPES_ABISAFE += " \
> >diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> >index 9d3cc612..15c05e04 100644
> >--- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> >+++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> >@@ -5,7 +5,7 @@
> >  #   TI_CORE_INITRAMFS_ENABLED = "0"
> >  #
> >  #------------------------------------------------------------------------------
> >-TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') else '0'}"
> >+TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}"
> >  TI_CORE_INITRAMFS_KERNEL_MODULES ?= ""
> >  TI_CORE_INITRAMFS_EXTRA_INSTALL ?= ""

Re: [meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS

[Ryan Eatmon]

On 3/19/2026 9:55 AM, Denys Dmytriyenko wrote:
> On Thu, Mar 19, 2026 at 08:59:24AM -0500, Ryan Eatmon via lists.yoctoproject.org wrote:
>>
>>
>> On 3/19/2026 5:35 AM, Shiva Tripathi wrote:
>>> Register dynamic-layers/security in layer.conf with BBFILES_DYNAMIC
>>> for both 'security' and 'tpm-layer' collections to conditionally
>>> build LUKS encryption support when meta-security/meta-tpm layers
>>> are present.
>>>
>>> Add meta-security to LAYERRECOMMENDS to document the optional
>>> dependency for LUKS functionality.
>>>
>>> Update ti-core-initramfs.inc to auto-enable initramfs generation
>>> when DISTRO_FEATURES contains 'luks'.
>>>
>>> Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>
>>> ---
>>>   meta-ti-bsp/conf/layer.conf                            | 5 +++++
>>>   meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc | 2 +-
>>>   2 files changed, 6 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf
>>> index f78da573..36d05b5a 100644
>>> --- a/meta-ti-bsp/conf/layer.conf
>>> +++ b/meta-ti-bsp/conf/layer.conf
>>> @@ -20,10 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
>>>   LAYERRECOMMENDS_meta-ti-bsp = " \
>>>       openembedded-layer \
>>> +    meta-security \
>>>   "
>>
>> The layer should be same as below:  security and tpm-layer  I was
>> just using meta-security as a placeholder.
> 
> Yeah, it's quite unfortunate that layer's collection name could be different
> from layer's directory name. Some maintainers keep them the same (e.g.
> meta-ti-bsp), but some make them different (e.g. meta-security -> security
> and meta-tpm -> tpm-layer). It could be rather confusing...
> 
> 
>>>   BBFILES_DYNAMIC += " \
>>>       openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \
>>> +    security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
>>> +    security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
>>> +    tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
>>> +    tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
> 
> Moreover - is there really a need to set up security top level layer here? If
> only TPM tools are needed, then just tpm-layer should be enough, even when it
> comes from within meta-security git repository.
> 
> E.g., we set up openembedded-layer here, but that's not meta-openembedded top
> level, but instead meta-oe sub-layer inside meta-openembedded. There are
> sub-layers in there, which are not needed for meta-ti-bsp dependency. Same
> thought goes to tpm-layer.

Then we would only be including the tpm-layer in the layer setup, so we 
should change the dynamic layer name to match in the second patch.


> 
>>>   "
>>>   SIGGEN_EXCLUDERECIPES_ABISAFE += " \
>>> diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
>>> index 9d3cc612..15c05e04 100644
>>> --- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
>>> +++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
>>> @@ -5,7 +5,7 @@
>>>   #   TI_CORE_INITRAMFS_ENABLED = "0"
>>>   #
>>>   #------------------------------------------------------------------------------
>>> -TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') else '0'}"
>>> +TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}"
>>>   TI_CORE_INITRAMFS_KERNEL_MODULES ?= ""
>>>   TI_CORE_INITRAMFS_EXTRA_INSTALL ?= ""

-- 
Ryan Eatmon                reatmon@ti.com
-----------------------------------------
Texas Instruments, Inc.  -  LCPD  -  MGTS

Re: [meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS

[Shiva Tripathi]

On 3/19/26 20:28, Ryan Eatmon wrote:
> 
> 
> On 3/19/2026 9:55 AM, Denys Dmytriyenko wrote:
>> On Thu, Mar 19, 2026 at 08:59:24AM -0500, Ryan Eatmon via
>> lists.yoctoproject.org wrote:
>>>
>>>
>>> On 3/19/2026 5:35 AM, Shiva Tripathi wrote:
>>>> Register dynamic-layers/security in layer.conf with BBFILES_DYNAMIC
>>>> for both 'security' and 'tpm-layer' collections to conditionally
>>>> build LUKS encryption support when meta-security/meta-tpm layers
>>>> are present.
>>>>
>>>> Add meta-security to LAYERRECOMMENDS to document the optional
>>>> dependency for LUKS functionality.
>>>>
>>>> Update ti-core-initramfs.inc to auto-enable initramfs generation
>>>> when DISTRO_FEATURES contains 'luks'.
>>>>
>>>> Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>
>>>> ---
>>>>   meta-ti-bsp/conf/layer.conf                            | 5 +++++
>>>>   meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc | 2 +-
>>>>   2 files changed, 6 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf
>>>> index f78da573..36d05b5a 100644
>>>> --- a/meta-ti-bsp/conf/layer.conf
>>>> +++ b/meta-ti-bsp/conf/layer.conf
>>>> @@ -20,10 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
>>>>   LAYERRECOMMENDS_meta-ti-bsp = " \
>>>>       openembedded-layer \
>>>> +    meta-security \
>>>>   "
>>>
>>> The layer should be same as below:  security and tpm-layer  I was
>>> just using meta-security as a placeholder.
>>
>> Yeah, it's quite unfortunate that layer's collection name could be
>> different
>> from layer's directory name. Some maintainers keep them the same (e.g.
>> meta-ti-bsp), but some make them different (e.g. meta-security ->
>> security
>> and meta-tpm -> tpm-layer). It could be rather confusing...
>>
>>
>>>>   BBFILES_DYNAMIC += " \
>>>>       openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-
>>>> layer/recipes*/*/*.bbappend \
>>>> +    security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
>>>> +    security:${LAYERDIR}/dynamic-layers/security/recipes*/*/
>>>> *.bbappend \
>>>> +    tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
>>>> +    tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/
>>>> *.bbappend \
>>
>> Moreover - is there really a need to set up security top level layer
>> here? If
>> only TPM tools are needed, then just tpm-layer should be enough, even
>> when it
>> comes from within meta-security git repository.
>>
>> E.g., we set up openembedded-layer here, but that's not meta-
>> openembedded top
>> level, but instead meta-oe sub-layer inside meta-openembedded. There are
>> sub-layers in there, which are not needed for meta-ti-bsp dependency.
>> Same
>> thought goes to tpm-layer.
> 
> Then we would only be including the tpm-layer in the layer setup, so we
> should change the dynamic layer name to match in the second patch.
> 
> 

I was thinking security top layer would be providing LUKS/cryptsetup,
but on evaluating found it's not the case. Yes security can be removed,
tpm-layer is sufficient - verified after testing.

Will address these changes along with dynamic layer name change.

Thanks,
Shiva

>>
>>>>   "
>>>>   SIGGEN_EXCLUDERECIPES_ABISAFE += " \
>>>> diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
>>>> b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
>>>> index 9d3cc612..15c05e04 100644
>>>> --- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
>>>> +++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
>>>> @@ -5,7 +5,7 @@
>>>>   #   TI_CORE_INITRAMFS_ENABLED = "0"
>>>>   #
>>>>  
>>>> #------------------------------------------------------------------------------
>>>> -TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if
>>>> d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or
>>>> d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') else '0'}"
>>>> +TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if
>>>> d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or
>>>> d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or
>>>> bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}"
>>>>   TI_CORE_INITRAMFS_KERNEL_MODULES ?= ""
>>>>   TI_CORE_INITRAMFS_EXTRA_INSTALL ?= ""
>