* [meta-ti][master][PATCH v7 1/3] linux-ti-staging: Add LUKS encryption config
2026-03-19 10:35 [meta-ti][master][PATCH v7 0/3] Add LUKS encryption with fTPM support Shiva Tripathi
@ 2026-03-19 10:35 ` Shiva Tripathi
2026-03-19 10:35 ` [meta-ti][master][PATCH v7 2/3] initramfs-module-luks-ftpm: Add fTPM support Shiva Tripathi
` (2 subsequent siblings)
3 siblings, 0 replies; 9+ messages in thread
From: Shiva Tripathi @ 2026-03-19 10:35 UTC (permalink / raw)
To: meta-ti
Cc: reatmon, rs, jcormier, praneeth, kamlesh, vishalm, k-malarvizhi,
denis, vigneshr, afd, s-tripathi1
Add kernel configuration fragment enabling dm-crypt and crypto
algorithms required for LUKS2 full disk encryption. Config is
applied when DISTRO_FEATURES contains 'luks'.
Includes ARM64 crypto optimizations and fTPM support.
Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>
---
.../linux/linux-ti-staging-6.18/luks-ftpm.cfg | 22 +++++++++++++++++++
.../linux/linux-ti-staging_6.18.bb | 8 +++++++
2 files changed, 30 insertions(+)
create mode 100644 meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg
diff --git a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg
new file mode 100644
index 00000000..291e5ee6
--- /dev/null
+++ b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging-6.18/luks-ftpm.cfg
@@ -0,0 +1,22 @@
+# Device Mapper support
+CONFIG_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_CRYPT=y
+
+# Core crypto algorithms for LUKS encryption
+CONFIG_CRYPTO_AES=y
+CONFIG_CRYPTO_XTS=y
+CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA512=y
+
+# ARM64 optimized crypto for better performance
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+
+# Userspace crypto API for cryptsetup
+CONFIG_CRYPTO_USER_API_HASH=y
+CONFIG_CRYPTO_USER_API_SKCIPHER=y
+
+# Firmware TPM support via OP-TEE
+CONFIG_TCG_FTPM_TEE=m
diff --git a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb
index 0e5ea5a5..2b064d12 100644
--- a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb
+++ b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.18.bb
@@ -35,3 +35,11 @@ module_conf_rpmsg_client_sample = "blacklist rpmsg_client_sample"
module_conf_ti_k3_r5_remoteproc = "softdep ti_k3_r5_remoteproc pre: virtio_rpmsg_bus"
module_conf_ti_k3_dsp_remoteproc = "softdep ti_k3_dsp_remoteproc pre: virtio_rpmsg_bus"
KERNEL_MODULE_PROBECONF += "rpmsg_client_sample ti_k3_r5_remoteproc ti_k3_dsp_remoteproc"
+
+# LUKS encryption with fTPM kernel configuration
+SRC_URI:append:k3 = " \
+ ${@bb.utils.contains('DISTRO_FEATURES', 'luks', 'file://luks-ftpm.cfg', '', d)} \
+"
+KERNEL_CONFIG_FRAGMENTS:append:k3 = " \
+ ${@bb.utils.contains('DISTRO_FEATURES', 'luks', '${UNPACKDIR}/luks-ftpm.cfg', '', d)} \
+"
--
2.34.1
^ permalink raw reply related [flat|nested] 9+ messages in thread* [meta-ti][master][PATCH v7 2/3] initramfs-module-luks-ftpm: Add fTPM support
2026-03-19 10:35 [meta-ti][master][PATCH v7 0/3] Add LUKS encryption with fTPM support Shiva Tripathi
2026-03-19 10:35 ` [meta-ti][master][PATCH v7 1/3] linux-ti-staging: Add LUKS encryption config Shiva Tripathi
@ 2026-03-19 10:35 ` Shiva Tripathi
2026-03-19 10:35 ` [meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS Shiva Tripathi
2026-03-19 10:45 ` [meta-ti][master][PATCH v7 0/3] Add LUKS encryption with fTPM support PRC Automation
3 siblings, 0 replies; 9+ messages in thread
From: Shiva Tripathi @ 2026-03-19 10:35 UTC (permalink / raw)
To: meta-ti
Cc: reatmon, rs, jcormier, praneeth, kamlesh, vishalm, k-malarvizhi,
denis, vigneshr, afd, s-tripathi1
Add initramfs module to dynamic-layers/security providing LUKS2 full
disk encryption with TPM-sealed keys for TI K3 platforms. Keys are
sealed by firmware TPM (fTPM) running in OP-TEE and stored in eMMC
RPMB.
Features:
- First-boot in-place encryption with tpm2_getrandom key generation
- TPM-sealed key storage via persistent handle 0x81080001
- Automatic unlock on subsequent boots
- Space verification ensuring 32MB available for LUKS header
The module is built only when meta-security layer is present and gets
included in initramfs only when DISTRO_FEATURES='luks' and
MACHINE_FEATURES='optee-ftpm'
Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>
---
.../initramfs-module-luks-ftpm/luksftpm | 341 ++++++++++++++++++
.../initramfs-module-luks-ftpm_1.0.bb | 41 +++
.../packagegroup-ti-core-initramfs.bbappend | 3 +
3 files changed, 385 insertions(+)
create mode 100644 meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm/luksftpm
create mode 100644 meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm_1.0.bb
create mode 100644 meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/packagegroup-ti-core-initramfs.bbappend
diff --git a/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm/luksftpm b/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm/luksftpm
new file mode 100644
index 00000000..5e3aedc4
--- /dev/null
+++ b/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm/luksftpm
@@ -0,0 +1,341 @@
+#!/bin/sh
+# initramfs-framework module for LUKS encryption with fTPM support
+
+# Configuration
+BOOT_DEV="/dev/mmcblk1p1" # Boot partition (FAT, unencrypted)
+ROOT_DEV="/dev/mmcblk1p2" # Root partition (will be encrypted)
+CRYPT_NAME="root_crypt"
+CRYPT_DEV="/dev/mapper/${CRYPT_NAME}"
+BOOT_MNT="/boot_part"
+TPM_PRIMARY_CTX="/tmp/tpm_primary.ctx"
+TPM_KEY_PRIV="/tmp/tpm_key.priv"
+TPM_KEY_PUB="/tmp/tpm_key.pub"
+TPM_KEY_CTX="/tmp/tpm_key.ctx"
+TPM2_HANDLE="0x81080001" # TPM persistent handle for LUKS key
+ENCRYPTION_MARKER="${BOOT_MNT}/.encryption_in_progress"
+
+# Wait for MMC device to appear
+wait_for_device() {
+ local device="$1"
+ local timeout="${2:-10}"
+
+ msg "Waiting for storage device ${device}..."
+ for i in $(seq 1 ${timeout}); do
+ if [ -b "${device}" ]; then
+ return 0
+ fi
+ sleep 1
+ done
+ return 1
+}
+
+# Initialize fTPM and check availability
+init_ftpm() {
+ msg "Initializing secure hardware (fTPM)..."
+
+ # Start TEE supplicant (required for fTPM TA to work)
+ if [ -x /usr/sbin/tee-supplicant ]; then
+ /usr/sbin/tee-supplicant -d &
+ TEE_SUPPLICANT_PID=$!
+ sleep 5
+ else
+ info "Warning: Trusted execution environment not available"
+ return 1
+ fi
+
+ # Load fTPM kernel module
+ if ! /sbin/modprobe tpm_ftpm_tee; then
+ info "Warning: TPM module failed to load"
+ return 1
+ fi
+
+ # Wait for TPM device
+ for i in $(seq 1 10); do
+ if [ -c /dev/tpmrm0 ]; then
+ export TPM2TOOLS_TCTI="device:/dev/tpmrm0"
+ return 0
+ fi
+ sleep 1
+ done
+
+ info "Warning: fTPM not available - encryption will be skipped"
+ return 1
+}
+
+# Generate 32-byte random key using TPM RNG
+generate_random_key() {
+ /usr/bin/tpm2_getrandom --hex 32
+}
+
+# Seal data with TPM and store in persistent handle
+tpm_seal_key() {
+ local KEY_DATA="$1"
+
+ # Create primary key in owner hierarchy
+ /usr/bin/tpm2_createprimary -C o -c "${TPM_PRIMARY_CTX}" -Q || return 1
+
+ # Create sealed object
+ echo -n "${KEY_DATA}" | \
+ /usr/bin/tpm2_create -C "${TPM_PRIMARY_CTX}" \
+ -u "${TPM_KEY_PUB}" -r "${TPM_KEY_PRIV}" \
+ -i- -Q || return 1
+
+ # Load sealed object into TPM
+ /usr/bin/tpm2_load -C "${TPM_PRIMARY_CTX}" \
+ -u "${TPM_KEY_PUB}" -r "${TPM_KEY_PRIV}" \
+ -c "${TPM_KEY_CTX}" -Q || return 1
+
+ # Make key persistent at handle (stored in TPM NV RAM - RPMB)
+ /usr/bin/tpm2_evictcontrol -C o -c "${TPM_KEY_CTX}" "${TPM2_HANDLE}" || return 1
+
+ return 0
+}
+
+# Unseal data from TPM persistent handle
+tpm_unseal_key() {
+ # Check if persistent handle exists
+ if ! /usr/bin/tpm2_getcap handles-persistent | grep -q "${TPM2_HANDLE}"; then
+ debug "ERROR: TPM persistent handle not found"
+ return 1
+ fi
+
+ # Unseal key directly from persistent handle
+ /usr/bin/tpm2_unseal -c "${TPM2_HANDLE}" || return 1
+
+ return 0
+}
+
+# Perform in-place LUKS encryption (first boot)
+encrypt_root_filesystem() {
+ msg "=========================================="
+ msg "First boot: Encrypting root filesystem"
+ msg "=========================================="
+
+ # Set marker to track encryption progress
+ touch "${ENCRYPTION_MARKER}"
+ sync
+
+ # Generate random encryption key using TPM RNG
+ msg "Generating encryption key..."
+ LUKS_KEY=$(generate_random_key)
+
+ if [ -z "${LUKS_KEY}" ]; then
+ msg "ERROR: Failed to generate encryption key"
+ rm -f "${ENCRYPTION_MARKER}"
+ return 1
+ fi
+
+ # Seal key with TPM before encryption starts
+ msg "Securing key with TPM..."
+ if ! tpm_seal_key "${LUKS_KEY}"; then
+ msg "ERROR: Failed to secure key"
+ rm -f "${ENCRYPTION_MARKER}"
+ return 1
+ fi
+
+ # Filesystem check before encryption
+ msg "Checking filesystem integrity..."
+ /usr/sbin/e2fsck -f -y "${ROOT_DEV}"
+ E2FSCK_RET=$?
+ if [ ${E2FSCK_RET} -ge 4 ]; then
+ msg "ERROR: Filesystem check failed"
+ rm -f "${ENCRYPTION_MARKER}"
+ return 1
+ fi
+
+ # Shrink filesystem before encryption to leave room for LUKS header
+ msg "Preparing filesystem for encryption..."
+ /usr/sbin/resize2fs -M "${ROOT_DEV}" || {
+ msg "ERROR: Failed to prepare filesystem"
+ rm -f "${ENCRYPTION_MARKER}"
+ return 1
+ }
+
+ # Verify partition has sufficient space for LUKS header
+ msg "Verifying space for encryption..."
+ MIN_BLOCKS=$(/usr/sbin/resize2fs -P "${ROOT_DEV}" 2>&1 | awk '/[Mm]inimum.*:/ {print $NF}')
+
+ # Get filesystem block size and device size
+ BLOCK_SIZE=$(/usr/sbin/tune2fs -l "${ROOT_DEV}" 2>/dev/null | awk '/^Block size:/ {print $NF}')
+ DEV_NAME=$(basename "${ROOT_DEV}")
+ PART_SECTORS=$(cat /sys/class/block/"${DEV_NAME}"/size 2>/dev/null)
+
+ if [ -z "${MIN_BLOCKS}" ] || [ -z "${BLOCK_SIZE}" ] || [ -z "${PART_SECTORS}" ]; then
+ msg "ERROR: Unable to determine partition geometry"
+ rm -f "${ENCRYPTION_MARKER}"
+ return 1
+ fi
+
+ # Convert filesystem blocks to 512-byte sectors
+ MIN_SECTORS=$((MIN_BLOCKS * BLOCK_SIZE / 512))
+ LUKS_SECTORS=65536 # 32MB in 512-byte sectors
+
+ if [ $((PART_SECTORS - MIN_SECTORS)) -lt ${LUKS_SECTORS} ]; then
+ msg "ERROR: Insufficient space for LUKS header (need 32MB free)"
+ rm -f "${ENCRYPTION_MARKER}"
+ return 1
+ fi
+
+ # Perform in-place encryption
+ msg "=========================================="
+ msg "Encrypting filesystem..."
+ msg "This will take several minutes."
+ msg "DO NOT POWER OFF THE DEVICE!"
+ msg "=========================================="
+
+ echo -n "${LUKS_KEY}" | \
+ /usr/sbin/cryptsetup reencrypt --encrypt \
+ --type luks2 \
+ --cipher aes-xts-plain64 \
+ --key-size 256 \
+ --hash sha256 \
+ --reduce-device-size 32M \
+ --key-file - \
+ "${ROOT_DEV}" || {
+ msg "ERROR: Encryption failed"
+ rm -f "${ENCRYPTION_MARKER}"
+ return 1
+ }
+
+ msg "=========================================="
+ msg "Encryption completed successfully!"
+ msg "=========================================="
+
+ # Remove encryption marker
+ rm -f "${ENCRYPTION_MARKER}"
+ sync
+
+ # Unlock the newly encrypted device
+ msg "Activating encrypted filesystem..."
+ echo -n "${LUKS_KEY}" | \
+ /usr/sbin/cryptsetup luksOpen "${ROOT_DEV}" "${CRYPT_NAME}" --key-file - || {
+ msg "ERROR: Failed to activate encrypted filesystem"
+ return 1
+ }
+
+ # Resize filesystem to fit the encrypted device
+ msg "Optimizing filesystem..."
+ /usr/sbin/resize2fs -f "${CRYPT_DEV}" || {
+ msg "ERROR: Failed to optimize filesystem"
+ return 1
+ }
+
+ # Verify filesystem after resize
+ /usr/sbin/e2fsck -f -y "${CRYPT_DEV}" || {
+ info "WARNING: Filesystem verification had issues, but continuing"
+ }
+
+ return 0
+}
+
+# Unlock encrypted root filesystem (subsequent boots)
+unlock_encrypted_root() {
+ msg "Unlocking encrypted filesystem..."
+
+ # Unseal key from TPM persistent handle
+ LUKS_KEY=$(tpm_unseal_key)
+
+ if [ -z "${LUKS_KEY}" ]; then
+ msg "ERROR: Failed to retrieve encryption key from TPM"
+ msg "Attempting passphrase fallback..."
+
+ # Try to unlock with passphrase (interactive)
+ /usr/sbin/cryptsetup luksOpen "${ROOT_DEV}" "${CRYPT_NAME}" || {
+ fatal "ERROR: Failed to unlock encrypted filesystem"
+ }
+ else
+ # Unlock with unsealed key
+ echo -n "${LUKS_KEY}" | \
+ /usr/sbin/cryptsetup luksOpen "${ROOT_DEV}" "${CRYPT_NAME}" --key-file - || {
+ fatal "ERROR: Failed to unlock with TPM key"
+ }
+ fi
+
+ msg "Encrypted filesystem unlocked"
+}
+
+# Module enabled check
+luksftpm_enabled() {
+ # Always run this module - it handles both encrypted and unencrypted cases
+ return 0
+}
+
+# Module main function
+luksftpm_run() {
+ # Wait for storage device
+ if ! wait_for_device "${ROOT_DEV}" 10; then
+ info "Storage device not found, skipping encryption module"
+ return 0
+ fi
+
+ # Mount boot partition
+ msg "Mounting boot partition..."
+ mkdir -p "${BOOT_MNT}"
+ if ! mount "${BOOT_DEV}" "${BOOT_MNT}"; then
+ info "ERROR: Failed to mount boot partition, attempting standard boot..."
+ mkdir -p ${ROOTFS_DIR}
+ mount "${ROOT_DEV}" ${ROOTFS_DIR}
+ return 0
+ fi
+
+ # Initialize fTPM
+ TPM_AVAILABLE=0
+ if init_ftpm; then
+ TPM_AVAILABLE=1
+ fi
+
+ # Check filesystem encryption status
+ msg "Checking filesystem encryption status..."
+
+ MOUNT_DEV="${ROOT_DEV}"
+
+ if /usr/sbin/cryptsetup isLuks "${ROOT_DEV}"; then
+ msg "Filesystem is encrypted"
+ unlock_encrypted_root
+ MOUNT_DEV="${CRYPT_DEV}"
+ else
+ msg "Filesystem is not encrypted"
+
+ # Check if encryption is enabled and TPM is available
+ if [ $TPM_AVAILABLE -eq 1 ]; then
+ # Check for encryption marker (resume interrupted encryption)
+ if [ -f "${ENCRYPTION_MARKER}" ]; then
+ msg "Resuming interrupted encryption..."
+ if ! encrypt_root_filesystem; then
+ msg "ERROR: Failed to resume encryption"
+ msg "Booting without encryption..."
+ MOUNT_DEV="${ROOT_DEV}"
+ else
+ MOUNT_DEV="${CRYPT_DEV}"
+ fi
+ else
+ # First boot - perform encryption
+ if encrypt_root_filesystem; then
+ MOUNT_DEV="${CRYPT_DEV}"
+ else
+ msg "ERROR: Encryption failed - booting without encryption"
+ MOUNT_DEV="${ROOT_DEV}"
+ fi
+ fi
+ else
+ msg "TPM not available - skipping encryption"
+ MOUNT_DEV="${ROOT_DEV}"
+ fi
+ fi
+
+ # Unmount boot partition before switching root
+ umount "${BOOT_MNT}"
+
+ # Mount root filesystem to $ROOTFS_DIR (framework expects this)
+ msg "Mounting root filesystem..."
+ mkdir -p ${ROOTFS_DIR}
+ mount "${MOUNT_DEV}" ${ROOTFS_DIR} || {
+ fatal "ERROR: Failed to mount root filesystem!"
+ }
+
+ # Clean up tmpfs and sensitive variables
+ rm -f "${TPM_PRIMARY_CTX}" "${TPM_KEY_PUB}" "${TPM_KEY_PRIV}" "${TPM_KEY_CTX}"
+ unset LUKS_KEY TPM_AVAILABLE MOUNT_DEV TEE_SUPPLICANT_PID
+
+ msg "Boot complete"
+}
diff --git a/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm_1.0.bb b/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm_1.0.bb
new file mode 100644
index 00000000..595ce1f1
--- /dev/null
+++ b/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/initramfs-module-luks-ftpm_1.0.bb
@@ -0,0 +1,41 @@
+SUMMARY = "initramfs support for LUKS encryption with fTPM"
+DESCRIPTION = "Provides LUKS2 full disk encryption using firmware TPM (fTPM) for key management on TI K3 platforms"
+
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+
+# Only build for platforms with optee-ftpm support
+COMPATIBLE_MACHINE = "null"
+COMPATIBLE_MACHINE:k3 = "${@bb.utils.contains('MACHINE_FEATURES', 'optee-ftpm', '.*', 'null', d)}"
+
+FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
+
+SRC_URI = "file://luksftpm"
+
+do_install() {
+ install -d ${D}/init.d
+ # Install as 85-luksftpm (runs after udev at 01, before rootfs at 90)
+ install -m 0755 ${UNPACKDIR}/luksftpm ${D}/init.d/85-luksftpm
+}
+
+FILES:${PN} = "/init.d/85-luksftpm"
+
+# Runtime dependencies
+RDEPENDS:${PN} = "\
+ initramfs-framework-base \
+ busybox \
+ kmod \
+ cryptsetup \
+ tpm2-tools \
+ tpm2-tss \
+ libtss2-tcti-device \
+ optee-client \
+ optee-ftpm \
+ e2fsprogs-e2fsck \
+ e2fsprogs-resize2fs \
+ e2fsprogs-tune2fs \
+ util-linux-blkid \
+ kernel-module-tpm-ftpm-tee \
+"
+
+PACKAGE_ARCH = "${MACHINE_ARCH}"
diff --git a/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/packagegroup-ti-core-initramfs.bbappend b/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/packagegroup-ti-core-initramfs.bbappend
new file mode 100644
index 00000000..52c82389
--- /dev/null
+++ b/meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/packagegroup-ti-core-initramfs.bbappend
@@ -0,0 +1,3 @@
+LUKS_ENCRYPTION ?= "${@bb.utils.contains('MACHINE_FEATURES', 'optee-ftpm', 'initramfs-module-luks-ftpm', '', d)}"
+
+RDEPENDS:${PN}:append = " ${@bb.utils.contains('DISTRO_FEATURES', 'luks', '${LUKS_ENCRYPTION}', '', d)}"
--
2.34.1
^ permalink raw reply related [flat|nested] 9+ messages in thread* [meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS
2026-03-19 10:35 [meta-ti][master][PATCH v7 0/3] Add LUKS encryption with fTPM support Shiva Tripathi
2026-03-19 10:35 ` [meta-ti][master][PATCH v7 1/3] linux-ti-staging: Add LUKS encryption config Shiva Tripathi
2026-03-19 10:35 ` [meta-ti][master][PATCH v7 2/3] initramfs-module-luks-ftpm: Add fTPM support Shiva Tripathi
@ 2026-03-19 10:35 ` Shiva Tripathi
2026-03-19 13:59 ` Ryan Eatmon
2026-03-19 10:45 ` [meta-ti][master][PATCH v7 0/3] Add LUKS encryption with fTPM support PRC Automation
3 siblings, 1 reply; 9+ messages in thread
From: Shiva Tripathi @ 2026-03-19 10:35 UTC (permalink / raw)
To: meta-ti
Cc: reatmon, rs, jcormier, praneeth, kamlesh, vishalm, k-malarvizhi,
denis, vigneshr, afd, s-tripathi1
Register dynamic-layers/security in layer.conf with BBFILES_DYNAMIC
for both 'security' and 'tpm-layer' collections to conditionally
build LUKS encryption support when meta-security/meta-tpm layers
are present.
Add meta-security to LAYERRECOMMENDS to document the optional
dependency for LUKS functionality.
Update ti-core-initramfs.inc to auto-enable initramfs generation
when DISTRO_FEATURES contains 'luks'.
Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>
---
meta-ti-bsp/conf/layer.conf | 5 +++++
meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc | 2 +-
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf
index f78da573..36d05b5a 100644
--- a/meta-ti-bsp/conf/layer.conf
+++ b/meta-ti-bsp/conf/layer.conf
@@ -20,10 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
LAYERRECOMMENDS_meta-ti-bsp = " \
openembedded-layer \
+ meta-security \
"
BBFILES_DYNAMIC += " \
openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \
+ security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
+ security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
+ tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
+ tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
"
SIGGEN_EXCLUDERECIPES_ABISAFE += " \
diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
index 9d3cc612..15c05e04 100644
--- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
+++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
@@ -5,7 +5,7 @@
# TI_CORE_INITRAMFS_ENABLED = "0"
#
#------------------------------------------------------------------------------
-TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') else '0'}"
+TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}"
TI_CORE_INITRAMFS_KERNEL_MODULES ?= ""
TI_CORE_INITRAMFS_EXTRA_INSTALL ?= ""
--
2.34.1
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS
2026-03-19 10:35 ` [meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS Shiva Tripathi
@ 2026-03-19 13:59 ` Ryan Eatmon
2026-03-19 14:55 ` Denys Dmytriyenko
0 siblings, 1 reply; 9+ messages in thread
From: Ryan Eatmon @ 2026-03-19 13:59 UTC (permalink / raw)
To: Shiva Tripathi, meta-ti
Cc: rs, jcormier, praneeth, kamlesh, vishalm, k-malarvizhi, denis,
vigneshr, afd
On 3/19/2026 5:35 AM, Shiva Tripathi wrote:
> Register dynamic-layers/security in layer.conf with BBFILES_DYNAMIC
> for both 'security' and 'tpm-layer' collections to conditionally
> build LUKS encryption support when meta-security/meta-tpm layers
> are present.
>
> Add meta-security to LAYERRECOMMENDS to document the optional
> dependency for LUKS functionality.
>
> Update ti-core-initramfs.inc to auto-enable initramfs generation
> when DISTRO_FEATURES contains 'luks'.
>
> Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>
> ---
> meta-ti-bsp/conf/layer.conf | 5 +++++
> meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc | 2 +-
> 2 files changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf
> index f78da573..36d05b5a 100644
> --- a/meta-ti-bsp/conf/layer.conf
> +++ b/meta-ti-bsp/conf/layer.conf
> @@ -20,10 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
>
> LAYERRECOMMENDS_meta-ti-bsp = " \
> openembedded-layer \
> + meta-security \
> "
The layer should be same as below: security and tpm-layer I was just
using meta-security as a placeholder.
> BBFILES_DYNAMIC += " \
> openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \
> + security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
> + security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
> + tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
> + tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
> "
>
> SIGGEN_EXCLUDERECIPES_ABISAFE += " \
> diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> index 9d3cc612..15c05e04 100644
> --- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> +++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> @@ -5,7 +5,7 @@
> # TI_CORE_INITRAMFS_ENABLED = "0"
> #
> #------------------------------------------------------------------------------
> -TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') else '0'}"
> +TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}"
>
> TI_CORE_INITRAMFS_KERNEL_MODULES ?= ""
> TI_CORE_INITRAMFS_EXTRA_INSTALL ?= ""
--
Ryan Eatmon reatmon@ti.com
-----------------------------------------
Texas Instruments, Inc. - LCPD - MGTS
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS
2026-03-19 13:59 ` Ryan Eatmon
@ 2026-03-19 14:55 ` Denys Dmytriyenko
2026-03-19 14:58 ` Ryan Eatmon
0 siblings, 1 reply; 9+ messages in thread
From: Denys Dmytriyenko @ 2026-03-19 14:55 UTC (permalink / raw)
To: reatmon
Cc: Shiva Tripathi, meta-ti, rs, jcormier, praneeth, kamlesh, vishalm,
k-malarvizhi, vigneshr, afd
On Thu, Mar 19, 2026 at 08:59:24AM -0500, Ryan Eatmon via lists.yoctoproject.org wrote:
>
>
> On 3/19/2026 5:35 AM, Shiva Tripathi wrote:
> >Register dynamic-layers/security in layer.conf with BBFILES_DYNAMIC
> >for both 'security' and 'tpm-layer' collections to conditionally
> >build LUKS encryption support when meta-security/meta-tpm layers
> >are present.
> >
> >Add meta-security to LAYERRECOMMENDS to document the optional
> >dependency for LUKS functionality.
> >
> >Update ti-core-initramfs.inc to auto-enable initramfs generation
> >when DISTRO_FEATURES contains 'luks'.
> >
> >Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>
> >---
> > meta-ti-bsp/conf/layer.conf | 5 +++++
> > meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc | 2 +-
> > 2 files changed, 6 insertions(+), 1 deletion(-)
> >
> >diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf
> >index f78da573..36d05b5a 100644
> >--- a/meta-ti-bsp/conf/layer.conf
> >+++ b/meta-ti-bsp/conf/layer.conf
> >@@ -20,10 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
> > LAYERRECOMMENDS_meta-ti-bsp = " \
> > openembedded-layer \
> >+ meta-security \
> > "
>
> The layer should be same as below: security and tpm-layer I was
> just using meta-security as a placeholder.
Yeah, it's quite unfortunate that layer's collection name could be different
from layer's directory name. Some maintainers keep them the same (e.g.
meta-ti-bsp), but some make them different (e.g. meta-security -> security
and meta-tpm -> tpm-layer). It could be rather confusing...
> > BBFILES_DYNAMIC += " \
> > openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \
> >+ security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
> >+ security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
> >+ tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
> >+ tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
Moreover - is there really a need to set up security top level layer here? If
only TPM tools are needed, then just tpm-layer should be enough, even when it
comes from within meta-security git repository.
E.g., we set up openembedded-layer here, but that's not meta-openembedded top
level, but instead meta-oe sub-layer inside meta-openembedded. There are
sub-layers in there, which are not needed for meta-ti-bsp dependency. Same
thought goes to tpm-layer.
> > "
> > SIGGEN_EXCLUDERECIPES_ABISAFE += " \
> >diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> >index 9d3cc612..15c05e04 100644
> >--- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> >+++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
> >@@ -5,7 +5,7 @@
> > # TI_CORE_INITRAMFS_ENABLED = "0"
> > #
> > #------------------------------------------------------------------------------
> >-TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') else '0'}"
> >+TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}"
> > TI_CORE_INITRAMFS_KERNEL_MODULES ?= ""
> > TI_CORE_INITRAMFS_EXTRA_INSTALL ?= ""
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS
2026-03-19 14:55 ` Denys Dmytriyenko
@ 2026-03-19 14:58 ` Ryan Eatmon
2026-03-19 16:35 ` Shiva Tripathi
0 siblings, 1 reply; 9+ messages in thread
From: Ryan Eatmon @ 2026-03-19 14:58 UTC (permalink / raw)
To: Denys Dmytriyenko
Cc: Shiva Tripathi, meta-ti, rs, jcormier, praneeth, kamlesh, vishalm,
k-malarvizhi, vigneshr, afd
On 3/19/2026 9:55 AM, Denys Dmytriyenko wrote:
> On Thu, Mar 19, 2026 at 08:59:24AM -0500, Ryan Eatmon via lists.yoctoproject.org wrote:
>>
>>
>> On 3/19/2026 5:35 AM, Shiva Tripathi wrote:
>>> Register dynamic-layers/security in layer.conf with BBFILES_DYNAMIC
>>> for both 'security' and 'tpm-layer' collections to conditionally
>>> build LUKS encryption support when meta-security/meta-tpm layers
>>> are present.
>>>
>>> Add meta-security to LAYERRECOMMENDS to document the optional
>>> dependency for LUKS functionality.
>>>
>>> Update ti-core-initramfs.inc to auto-enable initramfs generation
>>> when DISTRO_FEATURES contains 'luks'.
>>>
>>> Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>
>>> ---
>>> meta-ti-bsp/conf/layer.conf | 5 +++++
>>> meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc | 2 +-
>>> 2 files changed, 6 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf
>>> index f78da573..36d05b5a 100644
>>> --- a/meta-ti-bsp/conf/layer.conf
>>> +++ b/meta-ti-bsp/conf/layer.conf
>>> @@ -20,10 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
>>> LAYERRECOMMENDS_meta-ti-bsp = " \
>>> openembedded-layer \
>>> + meta-security \
>>> "
>>
>> The layer should be same as below: security and tpm-layer I was
>> just using meta-security as a placeholder.
>
> Yeah, it's quite unfortunate that layer's collection name could be different
> from layer's directory name. Some maintainers keep them the same (e.g.
> meta-ti-bsp), but some make them different (e.g. meta-security -> security
> and meta-tpm -> tpm-layer). It could be rather confusing...
>
>
>>> BBFILES_DYNAMIC += " \
>>> openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \
>>> + security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
>>> + security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
>>> + tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
>>> + tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bbappend \
>
> Moreover - is there really a need to set up security top level layer here? If
> only TPM tools are needed, then just tpm-layer should be enough, even when it
> comes from within meta-security git repository.
>
> E.g., we set up openembedded-layer here, but that's not meta-openembedded top
> level, but instead meta-oe sub-layer inside meta-openembedded. There are
> sub-layers in there, which are not needed for meta-ti-bsp dependency. Same
> thought goes to tpm-layer.
Then we would only be including the tpm-layer in the layer setup, so we
should change the dynamic layer name to match in the second patch.
>
>>> "
>>> SIGGEN_EXCLUDERECIPES_ABISAFE += " \
>>> diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
>>> index 9d3cc612..15c05e04 100644
>>> --- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
>>> +++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
>>> @@ -5,7 +5,7 @@
>>> # TI_CORE_INITRAMFS_ENABLED = "0"
>>> #
>>> #------------------------------------------------------------------------------
>>> -TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') else '0'}"
>>> +TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}"
>>> TI_CORE_INITRAMFS_KERNEL_MODULES ?= ""
>>> TI_CORE_INITRAMFS_EXTRA_INSTALL ?= ""
--
Ryan Eatmon reatmon@ti.com
-----------------------------------------
Texas Instruments, Inc. - LCPD - MGTS
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS
2026-03-19 14:58 ` Ryan Eatmon
@ 2026-03-19 16:35 ` Shiva Tripathi
0 siblings, 0 replies; 9+ messages in thread
From: Shiva Tripathi @ 2026-03-19 16:35 UTC (permalink / raw)
To: Ryan Eatmon, Denys Dmytriyenko
Cc: meta-ti, rs, jcormier, praneeth, kamlesh, vishalm, k-malarvizhi,
vigneshr, afd
On 3/19/26 20:28, Ryan Eatmon wrote:
>
>
> On 3/19/2026 9:55 AM, Denys Dmytriyenko wrote:
>> On Thu, Mar 19, 2026 at 08:59:24AM -0500, Ryan Eatmon via
>> lists.yoctoproject.org wrote:
>>>
>>>
>>> On 3/19/2026 5:35 AM, Shiva Tripathi wrote:
>>>> Register dynamic-layers/security in layer.conf with BBFILES_DYNAMIC
>>>> for both 'security' and 'tpm-layer' collections to conditionally
>>>> build LUKS encryption support when meta-security/meta-tpm layers
>>>> are present.
>>>>
>>>> Add meta-security to LAYERRECOMMENDS to document the optional
>>>> dependency for LUKS functionality.
>>>>
>>>> Update ti-core-initramfs.inc to auto-enable initramfs generation
>>>> when DISTRO_FEATURES contains 'luks'.
>>>>
>>>> Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>
>>>> ---
>>>> meta-ti-bsp/conf/layer.conf | 5 +++++
>>>> meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc | 2 +-
>>>> 2 files changed, 6 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf
>>>> index f78da573..36d05b5a 100644
>>>> --- a/meta-ti-bsp/conf/layer.conf
>>>> +++ b/meta-ti-bsp/conf/layer.conf
>>>> @@ -20,10 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
>>>> LAYERRECOMMENDS_meta-ti-bsp = " \
>>>> openembedded-layer \
>>>> + meta-security \
>>>> "
>>>
>>> The layer should be same as below: security and tpm-layer I was
>>> just using meta-security as a placeholder.
>>
>> Yeah, it's quite unfortunate that layer's collection name could be
>> different
>> from layer's directory name. Some maintainers keep them the same (e.g.
>> meta-ti-bsp), but some make them different (e.g. meta-security ->
>> security
>> and meta-tpm -> tpm-layer). It could be rather confusing...
>>
>>
>>>> BBFILES_DYNAMIC += " \
>>>> openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-
>>>> layer/recipes*/*/*.bbappend \
>>>> + security:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
>>>> + security:${LAYERDIR}/dynamic-layers/security/recipes*/*/
>>>> *.bbappend \
>>>> + tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/*.bb \
>>>> + tpm-layer:${LAYERDIR}/dynamic-layers/security/recipes*/*/
>>>> *.bbappend \
>>
>> Moreover - is there really a need to set up security top level layer
>> here? If
>> only TPM tools are needed, then just tpm-layer should be enough, even
>> when it
>> comes from within meta-security git repository.
>>
>> E.g., we set up openembedded-layer here, but that's not meta-
>> openembedded top
>> level, but instead meta-oe sub-layer inside meta-openembedded. There are
>> sub-layers in there, which are not needed for meta-ti-bsp dependency.
>> Same
>> thought goes to tpm-layer.
>
> Then we would only be including the tpm-layer in the layer setup, so we
> should change the dynamic layer name to match in the second patch.
>
>
I was thinking security top layer would be providing LUKS/cryptsetup,
but on evaluating found it's not the case. Yes security can be removed,
tpm-layer is sufficient - verified after testing.
Will address these changes along with dynamic layer name change.
Thanks,
Shiva
>>
>>>> "
>>>> SIGGEN_EXCLUDERECIPES_ABISAFE += " \
>>>> diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
>>>> b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
>>>> index 9d3cc612..15c05e04 100644
>>>> --- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
>>>> +++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc
>>>> @@ -5,7 +5,7 @@
>>>> # TI_CORE_INITRAMFS_ENABLED = "0"
>>>> #
>>>>
>>>> #------------------------------------------------------------------------------
>>>> -TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if
>>>> d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or
>>>> d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') else '0'}"
>>>> +TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if
>>>> d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or
>>>> d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or
>>>> bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}"
>>>> TI_CORE_INITRAMFS_KERNEL_MODULES ?= ""
>>>> TI_CORE_INITRAMFS_EXTRA_INSTALL ?= ""
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [meta-ti][master][PATCH v7 0/3] Add LUKS encryption with fTPM support
2026-03-19 10:35 [meta-ti][master][PATCH v7 0/3] Add LUKS encryption with fTPM support Shiva Tripathi
` (2 preceding siblings ...)
2026-03-19 10:35 ` [meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS Shiva Tripathi
@ 2026-03-19 10:45 ` PRC Automation
3 siblings, 0 replies; 9+ messages in thread
From: PRC Automation @ 2026-03-19 10:45 UTC (permalink / raw)
To: Shiva Tripathi
Cc: meta-ti, reatmon, rs, jcormier, praneeth, kamlesh, vishalm,
k-malarvizhi, denis, vigneshr, afd
meta-ti / na / 20260319103533.2431033-1-s-tripathi1
PRC Results: FAIL
=========================================================
check-yocto-patches: PASS
=========================================================
Patches
----------------------------------------
WARN - [meta-ti][master][PATCH v7 1/3] linux-ti-staging: Add LUKS encryption config
WARN: Revised patch missing a comment. (REVISION-1)
patch
For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
WARN - [meta-ti][master][PATCH v7 2/3] initramfs-module-luks-ftpm: Add fTPM support
WARN: Revised patch missing a comment. (REVISION-1)
patch
For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
WARN - [meta-ti][master][PATCH v7 3/3] conf: Enable dynamic security layer for LUKS
WARN: Revised patch missing a comment. (REVISION-1)
patch
For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
=========================================================
apply-yocto-patch: PASS
=========================================================
master
=====================
Summary:
- Patch Series: [meta-ti][master][PATCH v7 0/3] Add LUKS encryption with fTPM support
- Submitter: From: Shiva Tripathi <s-tripathi1@ti.com>
- Date: Date: Thu, 19 Mar 2026 16:05:30 +0530
- Num Patches: 3
- Mailing List (public inbox) Commit SHA: 509e15023c33e5c515959e07bb3a4376ab769e89
Applied to:
- Repository: lcpd-prc-meta-ti
- Base Branch: master-wip
- Commit Author: Ryan Eatmon <reatmon@ti.com>
- Commit Subject: conf: Add falcon support natively
- Commit SHA: 1ce070a6b1f8bb797c65b51a7968ffe0348ba053
Patches
----------------------------------------
All patches applied
=========================================================
check-yocto-repo: FAIL
=========================================================
master
=====================
FAIL
WARN: .bbappend files might need a guard to make them check-layer compliant. (GUARD-1)
meta-ti-bsp/dynamic-layers/security/recipes-ti/initramfs/packagegroup-ti-core-initramfs.bbappend
For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
^ permalink raw reply [flat|nested] 9+ messages in thread