[next] Implement foundational changes for NILRT Device Encryption by amstewart · Pull Request #977 · ni/meta-nilrt

amstewart · 2026-03-23T21:41:16Z

Summary of Changes

This PR contains all the foundational changes necessary for the core features of Measured Boot / Device Encryption on NILRT. It stops short of the changes to nisystemformat which will actually affect the LUKS encryption - they will be in their own PR after this one.

Changes in this PR:

Adds additional TPM2 kernel modules to the extra_x64 set. The core TPM2 drivers have already been built into the 6.12 kernel as of ni/linux#270.
Adds TPM2 to the NILRT x64 machine features. This will coerce recipes to build with TPM2 support.
Adds TPM2 support to our grub recipe and modifies the grub config to enable boot measurements.
Adds TPM and cryptography user space tools to the safemode and runmode.
Adds the Clevis recipe - a tool for binding LUKS decryption keys to TPM state. Also adds clevis' dependencies.
Modifies the OVMF (UEFI BIOS) recipe to output its raw code and variable images, so that we can use it in QEMU to test the TPM state.
Modifies fstab to mount the Linux securityfs subsystem under /sys so that users can interrogate TPM boot measurements.
Adds a new, ubiquitous initscript - ni-cryptdisks - which will try to find and open any LUKS-encrypted disks using the TPM state (through clevis).
Creates an initramfs image for runmode - nilrt-runmode-initramfs with a custom /init that will try to mount any LUKS-encrypted disks using the TPM state. Then it pivot_roots into the real runmode rootfs (that might have been on an encrypted disk).
Modifies the grub.cfg to search for the new runmode initramfs, if it is available, and boot into it. If it is not available (backwards compat), grub will just try to boot into the registered runmode partition of record (the existing behavior).
Adds the runmode initramfs to the NILRT BSI image. It gets installed alongside the kernel.
Cleans up old RAUC content throughout.
Fixed AB#3758708 while I was working on the grub config anyway.

Justification

Testing

I have built the core package feed with this PR in place. (bitbake packagefeed-ni-core)
Tested installing both the new - initramfs-enabled - BSI and the old runmode BSI. Both boot without issue.
Extensive general hand testing of this configuration on an x64 QEMU VM equipped with a software-emulated TPM.

Procedure

I certify that the contents of this pull request complies with the Developer Certificate of Origin.

amstewart · 2026-03-24T19:18:44Z

Patch v2

Removed the leftover debug function get_luks_key() from ni-cryptdisks.
Removed the VM-keyboard modules from packagegroup-ni-initramfs, since they are not necessary in the initramfs.
Only build the init-nilrt-runmode-initramfs recipe when building the core packagefeed for x64.
Cherry-picked meta-nilrt Ensure BSI installation failures doesn't brick target #960 into this PR, to merge implementation with scarthgap.
Consolidated TPM2 user space includes into packagegroup-ni-tpm.

Revalidated with this Patchrev.

amstewart · 2026-03-24T20:11:59Z

Patch v3

Cherry picked nilrt-runmode-rootfs: cleanup /boot files in arm BSI #955.
Restored a file from the grub recipe (cfg) which was actually being used to set our nonstandard GRUB prefix value. I thought it was only being used by RAUC previously, but it is actually an override of this upstream OE-core grub recipe file.

Rebuilt the core feed with this patchrev.

chaitu236 · 2026-03-25T19:50:17Z

+partitions for NILRT. Installs the ni-cryptdisks.sh initscript.\
+"
+HOMEPAGE = "https://github.com/ni/meta-nilrt"
+SECTION = "test"


Does this belong in test section?

Fixed in Patch V4.

chaitu236 · 2026-03-25T19:58:02Z

 	efibootmgr \
 	efivar \
 	pstore-save \
+	clevis \


nit: not sorted. Maybe break out tpm related packages into their own RDEPENDS:${PN}:append:x64 section if we want to keep them together?

It gets fixed up by the final commit in the patchset. These items are moved into packagegroup-ni-tpm.

Should be fixed in Patch V4. I decided to backport the change that moves clevis into packagegroup-ni-tpm.

chaitu236 · 2026-03-25T20:38:17Z

 CONFIG_TAP=m
 CONFIG_TARGET_CORE=m
 CONFIG_TCG_ATMEL=m
+CONFIG_TCG_CRB=m


Same as #957 we don't need CONFIG_TCG_CRB, CONFIG_TCG_TIS, CONFIG_TCG_TIS_CORE, CONFIG_TCG_TPM

I have a commit from a later patchset that I will backport to fix this. But honestly, I'm considering just implementing the allmoddefconfig task that we discussed offline.

Backported the commit from the later patchset to remove these lines. Fixed in Patch V4.

chaitu236 · 2026-03-26T21:33:53Z

Offline conversation: We've decided to merge this after release is done.

When LUKS-based disk encryption is implemented, safemode and runmode will need utilties to interact with the encrypted partitions. Add these utilities to the base packagegroup to ensure they are present in the base images. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

Remove the old RAUC grub components so that they are not confused with the contemporary components. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

All NILRT images will require TPM-interaction tools like 'clevis' to open LUKS-encrypted partitions on boot. So add them to the base packagegroup. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

The OE-core ovmf recipe generates raw OVMF image files, but then converts them to qcow2 images, and moves only the qcow2 files to the deploy directory. QEMU can use either format, but only the raw format supports writable EFI variables - which NILRT uses and which upstream OE core testing does not. So add a NILRT-specific bbappend which also outputs the raw-formatted OVMF files, for use in NILRT QEMU virtual machines. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

Create a recipe which installs an /init script to the new runmode initramfs. The initscript's primary mission is to unlock any LUKS-encrypted partitions, before switching into the real rootfs. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

The init-nilrt-ramfs is an old initrdscripts recipe for the previous RAUC prototype. It is unused. Remove it for codebase cleanliness. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

To support full Device Encryption, NILRT runmode requires an unencrypted initramfs that understands how to interact with the device TPM and decrypt and mount LUKS partitons. Create nilrt-runmode-initramfs.bb to act as such an image. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

The meta-nilrt styleguide has an example bitbake recipe at its end. Update that recipe with some better headings and comments and break it out into its own file, so that it is easier to reuse in new recipes. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

The ni-device-encryption recipe will contain content supporting fundamental LUKS-encryption of NILRT devices. At the moment, it only packages an initscript which will handle opening/closing LUKS partitions during early boot. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

The TCG TPM TIS kernel driver is now built into the x64 kernel and there is no module package for it. Remove the invalid reference to it from the restoremode (recovery initramfs) RRECOMMENDS. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

The base packagegroup requires ni-device-encryption so that all images will understand how to unlock LUKS-encrypted partitions during boot (especially safemode). The initramfs packagegroup is used to populate the rootfs for the runmode initramfs. It requires ni-device-encryption to unlock the LUKS partitions prior to switching into the real rootfs. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

amstewart · 2026-05-26T16:36:24Z

Patch V4

Rebased to the latest master/next branch.
Addressed most commentary feedback.
Revalidated that the core feed build still works.

This should be the last revision of this PR. I would like to get it merged so that we can move on to the subsequent measured boot PR I have staged and then on to complete the feature.

Copilot

Pull request overview

This PR introduces the core Yocto-layer plumbing needed to support NILRT x64 measured boot and future LUKS device encryption, including TPM2 tooling, GRUB boot flow updates, and a new runmode initramfs path to unlock encrypted disks before switching into the real runmode rootfs.

Changes:

Add TPM2 / crypto userspace dependencies (including clevis) to base and initramfs package composition.
Introduce ni-device-encryption (scripts + initscript) and a new runmode initramfs image + PID1 /init.
Update GRUB runmode boot logic and clean up legacy RAUC-related grub/initramfs content; adjust OVMF deploy outputs for QEMU TPM testing.

Reviewed changes

Copilot reviewed 31 out of 32 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
recipes-ni/ni-device-encryption/ni-device-encryption/share/pkg.sh.in	Template for exported package/version variables.
recipes-ni/ni-device-encryption/ni-device-encryption/share/const_luks.sh	Adds shared constants for LUKS keyslot conventions.
recipes-ni/ni-device-encryption/ni-device-encryption/Makefile	Build/install rules for `ni-device-encryption` utilities.
recipes-ni/ni-device-encryption/ni-device-encryption/init/ni-cryptdisks.sh.in	SysV init script to unlock LUKS volumes via clevis.
recipes-ni/ni-device-encryption/ni-device-encryption/bin/ni-reseal-luks.sh	Tooling to (re)bind clevis TPM2 policies for LUKS slots.
recipes-ni/ni-device-encryption/ni-device-encryption/.gitignore	Ignores generated script artifacts.
recipes-ni/ni-device-encryption/ni-device-encryption.bb	BitBake recipe packaging the encryption helper scripts + initscript.
recipes-kernel/linux/files/extra_x64.cfg	Removes TPM/securityfs-related configs from extra module list (now builtin elsewhere).
recipes-core/packagegroups/packagegroup-ni-tpm.bb	Updates TPM packagegroup dependencies (drops upstream `packagegroup-security-tpm2`).
recipes-core/packagegroups/packagegroup-ni-restoremode.bb	Removes invalid `kernel-module-tpm-tis` recommendation on x64.
recipes-core/packagegroups/packagegroup-ni-initramfs.bb	New packagegroup defining common initramfs package set + TPM bits on x64.
recipes-core/packagegroups/packagegroup-ni-base.bb	Pulls TPM + device-encryption dependencies into x64 base images.
recipes-core/packagegroups/packagefeed-ni-extra.bb	Removes redundant `cryptsetup` from extra feed dependencies.
recipes-core/packagegroups/packagefeed-ni-core.bb	Adds initramfs packagegroup and builds runmode initramfs init package into the core feed.
recipes-core/ovmf/ovmf_%.bbappend	Deploys raw OVMF code/vars images alongside qcow2 for QEMU testing.
recipes-core/initrdscripts/init-nilrt-runmode-initramfs/test/test_kernel-vars.sh	Adds a shell test runner for cmdline parsing helpers.
recipes-core/initrdscripts/init-nilrt-runmode-initramfs/reboot.sh	Adds initramfs reboot implementation (sysrq-based).
recipes-core/initrdscripts/init-nilrt-runmode-initramfs/kernel-vars.sh	Parses `/proc/cmdline` into exported vars used by initramfs scripts.
recipes-core/initrdscripts/init-nilrt-runmode-initramfs/init.sh.in	New runmode initramfs PID1 `/init` to unlock disks and `switch_root`.
recipes-core/initrdscripts/init-nilrt-runmode-initramfs/halt.sh	Adds initramfs halt implementation (sysrq-based).
recipes-core/initrdscripts/init-nilrt-runmode-initramfs.bb	Recipe installing `/init`, cmdline parser, and halt/reboot alternatives.
recipes-core/initrdscripts/init-nilrt-ramfs.bb	Removes legacy initrdscripts recipe from previous RAUC prototype.
recipes-core/initrdscripts/files/init-nilrt-ramfs.sh	Removes legacy initramfs `/init` implementation.
recipes-core/images/nilrt-runmode-rootfs.bb	Adds runmode initramfs into boot staging and refactors kernel/boot fixups into rootfs postprocess.
recipes-core/images/nilrt-runmode-initramfs.bb	New image for producing the runmode initramfs (`cpio.xz`).
recipes-bsp/grub/grub/grub.cfg	Removes unused legacy grub.cfg artifact from layer.
recipes-bsp/grub/grub/grub-safemode.cfg	Updates validation and runmode boot logic to optionally use a runmode ramdisk.
recipes-bsp/grub/grub/grub-runmode-bootimage.cfg	Adds `ramdisk_path` pointing to `/runmode/ramdisk.xz`.
recipes-bsp/grub/grub-nilrt.inc	Drops `grub.cfg` from grub recipe sources.
recipes-bsp/grub/grub-bootconf_%.bbappend	Removes legacy grub-bootconf bbappend (RAUC-era configuration packaging).
docs/styleguide.md	Removes embedded example recipe (moved to its own file).
docs/example.bb	New standalone example BitBake recipe referenced by the styleguide.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

The initscript doesn't "mount" any disks that it unlocks. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

The current implementation might use invalid regex characters, and anyway can be made simpler by evaluating each token using bash semantics. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

If the cryptsetup actions in the initscript fail, the script might bail out before printing important logging information. Adjust the bash commands to keep this from happening. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

The pkglibdir path is not removed by the Makefile uninstall target. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

The update-alternatives recipe BBClass needs the full path to the link location and target. So provide that. Also, there is a typo in the ``ALTERNATIVES:${PN}`` variable, it should actually be ``ALTERNATIVE``. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

amstewart · 2026-05-27T14:59:51Z

Patch V5

Implemented feedback from copilot.

Copilot

Pull request overview

Copilot reviewed 31 out of 32 changed files in this pull request and generated 7 comments.

Use the '[[:space:]]` POSIX-compliant regex metacharacter to ensure that grep properly parses cryptsetup output. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

The ni-cryptsetup initscript uses ``dmcrypt`` from the lvm2 package. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

Not all machine arches use ``lib`` as the main library name - eg. lib64. So we should reuse the ``libdir`` OE variable when creating symlinks. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

We need to coordinate the INITRAMFS_FSTYPES and IMAGE_FSTYPES, but we're doing it implicitly here. Instead, set the INITRAMFS_FSTYPES explicitly and then copy the value into the IMAGE_FSTYPES in the anonymous python function. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

amstewart · 2026-05-27T17:29:14Z

Patch V6

Implement copilot review feedback.
Revalidated the core feed build.
Revalidated that nilrt-runmode-initramfs builds.

Copilot

Pull request overview

Copilot reviewed 31 out of 32 changed files in this pull request and generated 3 comments.

Bash source files should not 'exit', they should 'return'. When they 'exit', they kill the sourcing bash process. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

class-target appends are more often ordered like ``:append:class-target`` in the OE layers. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

amstewart · 2026-05-28T15:36:44Z

Patch V7

Implemented Copilot feedback.

amstewart requested review from chaitu236 and usercw88 and removed request for chaitu236 March 23, 2026 21:42

amstewart force-pushed the feat/next/device-encryption branch 2 times, most recently from 9b23cc6 to 7fa4d0e Compare March 24, 2026 19:17

chaitu236 reviewed Mar 24, 2026

View reviewed changes

Comment thread recipes-core/images/nilrt-runmode-rootfs.bb

amstewart force-pushed the feat/next/device-encryption branch 2 times, most recently from ff44451 to 154e4c0 Compare March 24, 2026 20:06

amstewart requested a review from chaitu236 March 24, 2026 20:12

usercw88 requested changes Mar 25, 2026

View reviewed changes

Comment thread recipes-ni/ni-device-encryption/ni-device-encryption/bin/ni-reseal-luks.sh

Comment thread recipes-ni/ni-device-encryption/ni-device-encryption/bin/ni-reseal-luks.sh

Comment thread recipes-ni/ni-device-encryption/ni-device-encryption/bin/ni-reseal-luks.sh

chaitu236 reviewed Mar 25, 2026

View reviewed changes

amstewart mentioned this pull request Mar 25, 2026

Support TPM2 operations on scarthgap, add clevis to feeds, export OVMF Firmware. #957

Merged

5 tasks

chaitu236 reviewed Mar 25, 2026

View reviewed changes

amstewart mentioned this pull request Apr 17, 2026

[next] Support virtualized TPM attachments to qemu VMS, plus refactor. ni/nilrt#346

Merged

2 tasks

Alex Stewart added 12 commits May 26, 2026 12:29

grub: remove unused RAUC parts

61ff5af

Remove the old RAUC grub components so that they are not confused with the contemporary components. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

pkggrp-ni-base: add TPM tools to base image

eeed6fe

All NILRT images will require TPM-interaction tools like 'clevis' to open LUKS-encrypted partitions on boot. So add them to the base packagegroup. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

initrdscripts: remove init-nilrt-ramfs

633a62d

The init-nilrt-ramfs is an old initrdscripts recipe for the previous RAUC prototype. It is unused. Remove it for codebase cleanliness. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

docs/example.bb: suggest using DISTRO_VERSION for PV

65ab789

Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

amstewart force-pushed the feat/next/device-encryption branch from 154e4c0 to ea838b3 Compare May 26, 2026 16:34

Copilot started reviewing on behalf of amstewart May 26, 2026 16:34 View session

amstewart requested a review from chaitu236 May 26, 2026 16:40

Copilot AI reviewed May 26, 2026

View reviewed changes

Alex Stewart added 6 commits May 26, 2026 16:38

ni-device-encryption: reword initscript description

8974c08

The initscript doesn't "mount" any disks that it unlocks. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

init-nilrt-runmode-initramfs: simplify _cmdline_get_key

613d9a4

The current implementation might use invalid regex characters, and anyway can be made simpler by evaluating each token using bash semantics. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

ni-device-encryption: make initscript more reliable

48b7779

If the cryptsetup actions in the initscript fail, the script might bail out before printing important logging information. Adjust the bash commands to keep this from happening. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

init-nilrt-runmode-initramfs: use NI_CRYPTDISKS var consistently

b06f5ab

Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

ni-device-encryption: uninstall pkglibdir

01947b7

The pkglibdir path is not removed by the Makefile uninstall target. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

amstewart requested a review from Copilot May 27, 2026 15:04

Copilot started reviewing on behalf of amstewart May 27, 2026 15:04 View session

Copilot AI reviewed May 27, 2026

View reviewed changes

Alex Stewart added 5 commits May 27, 2026 13:08

ni-device-encryption: use POSIX regex in initscript

96acb6d

Use the '[[:space:]]` POSIX-compliant regex metacharacter to ensure that grep properly parses cryptsetup output. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

ni-device-encryption: RDEPEND on lvm2

1546fac

The ni-cryptsetup initscript uses ``dmcrypt`` from the lvm2 package. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

ni-device-encryption: use libdir in symlinks

04a374f

Not all machine arches use ``lib`` as the main library name - eg. lib64. So we should reuse the ``libdir`` OE variable when creating symlinks. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

ni-device-encryption: make sed syntax BSD-compliant

45977ff

Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

amstewart requested a review from Copilot May 27, 2026 17:31

Copilot started reviewing on behalf of amstewart May 27, 2026 17:31 View session

Copilot AI reviewed May 27, 2026

View reviewed changes

Comment thread recipes-core/packagegroups/packagefeed-ni-core.bb

Comment thread recipes-core/initrdscripts/init-nilrt-runmode-initramfs/kernel-vars.sh Outdated

Comment thread recipes-core/ovmf/ovmf_%.bbappend Outdated

Alex Stewart added 2 commits May 28, 2026 11:30

init-nilrt-runmode-initramfs: return from source files

4b9a8ff

Bash source files should not 'exit', they should 'return'. When they 'exit', they kill the sourcing bash process. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

ovmf: use more common class-target override syntax

71b9618

class-target appends are more often ordered like ``:append:class-target`` in the OE layers. Signed-off-by: Alex Stewart <alex.stewart@emerson.com>

chaitu236 approved these changes May 28, 2026

View reviewed changes

chaitu236 merged commit 95015f8 into ni:nilrt/master/next May 28, 2026

amstewart deleted the feat/next/device-encryption branch May 28, 2026 20:02

Uh oh!

Conversation

amstewart commented Mar 23, 2026 • edited by ni-github-admins Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of Changes

Justification

Testing

Procedure

Uh oh!

amstewart commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Patch v2

Uh oh!

Uh oh!

amstewart commented Mar 24, 2026

Patch v3

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chaitu236 commented Mar 26, 2026

Uh oh!

amstewart commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Patch V4

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

amstewart commented May 27, 2026

Patch V5

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

amstewart commented May 27, 2026

Patch V6

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

amstewart commented Mar 23, 2026 •

edited by ni-github-admins

Loading

amstewart commented Mar 24, 2026 •

edited

Loading

amstewart commented May 26, 2026 •

edited

Loading