Re: [PATCH] initramfs: move fTPM and tee-supplicant initialization to local-top stage

[Uladzimir Bely <ubely@ilbers.de>]

On Wed, 2024-07-10 at 11:03 +0530, 'Rakesh Kumar' via isar-users wrote:
> To ensure proper initialization of the fTPM and tee-supplicant
> services before
> the root filesystem is mounted, we are relocating their
> initialization to the
> local-top section of initramfs. This change ensures that the
> encrypted filesystems
> are properly initialized and ready for use before the root filesystem
> is mounted at
> local-bottom stage.
> 
> Reason for local-top:
> 
> * Early Initialization: The local-top scripts run before the root
> filesystem is mounted.
>   This timing is essential for encrypted root filesystems since the
> decryption process must be
>   completed before the filesystem can be accessed.
> 
> * Dependency Handling: The encryption setup requires initializing
> dependencies such as
>   fTPM (firmware Trusted Platform Module) devices. Performing these
> tasks early in the boot process
>   ensures that all necessary components are in place before the root
> filesystem is mounted.
> 
> Signed-off-by: Rakesh Kumar <kumar.rakesh@siemens.com>
> ---
>  .../initramfs-tee-ftpm-hook/initramfs-tee-ftpm-hook_0.1.bb    | 4
> ++--
>  .../initramfs-tee-supplicant-hook_0.1.bb                      | 4
> ++--
>  2 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/meta/recipes-initramfs/initramfs-tee-ftpm-
> hook/initramfs-tee-ftpm-hook_0.1.bb b/meta/recipes-
> initramfs/initramfs-tee-ftpm-hook/initramfs-tee-ftpm-hook_0.1.bb
> index db38e618..82fec1bb 100644
> --- a/meta/recipes-initramfs/initramfs-tee-ftpm-hook/initramfs-tee-
> ftpm-hook_0.1.bb
> +++ b/meta/recipes-initramfs/initramfs-tee-ftpm-hook/initramfs-tee-
> ftpm-hook_0.1.bb
> @@ -17,11 +17,11 @@ DEBIAN_DEPENDS = "initramfs-tools"
>  
>  do_install[cleandirs] += " \
>      ${D}/usr/share/initramfs-tools/hooks \
> -    ${D}/usr/share/initramfs-tools/scripts/local-bottom"
> +    ${D}/usr/share/initramfs-tools/scripts/local-top"
>  
>  do_install() {
>      install -m 0755 "${WORKDIR}/tee-ftpm.hook" \
>          "${D}/usr/share/initramfs-tools/hooks/tee-ftpm"
>      install -m 0755 "${WORKDIR}/tee-ftpm.script" \
> -        "${D}/usr/share/initramfs-tools/scripts/local-bottom/tee-
> ftpm"
> +        "${D}/usr/share/initramfs-tools/scripts/local-top/tee-ftpm"
>  }
> diff --git a/meta/recipes-initramfs/initramfs-tee-supplicant-
> hook/initramfs-tee-supplicant-hook_0.1.bb b/meta/recipes-
> initramfs/initramfs-tee-supplicant-hook/initramfs-tee-supplicant-
> hook_0.1.bb
> index 3768b8e0..a7a19bee 100644
> --- a/meta/recipes-initramfs/initramfs-tee-supplicant-hook/initramfs-
> tee-supplicant-hook_0.1.bb
> +++ b/meta/recipes-initramfs/initramfs-tee-supplicant-hook/initramfs-
> tee-supplicant-hook_0.1.bb
> @@ -17,11 +17,11 @@ DEBIAN_DEPENDS = "initramfs-tools, tee-
> supplicant, procps"
>  
>  do_install[cleandirs] += " \
>      ${D}/usr/share/initramfs-tools/hooks \
> -    ${D}/usr/share/initramfs-tools/scripts/local-bottom"
> +    ${D}/usr/share/initramfs-tools/scripts/local-top"
>  
>  do_install() {
>      install -m 0755 "${WORKDIR}/tee-supplicant.hook" \
>          "${D}/usr/share/initramfs-tools/hooks/tee-supplicant"
>      install -m 0755 "${WORKDIR}/tee-supplicant.script" \
> -        "${D}/usr/share/initramfs-tools/scripts/local-bottom/tee-
> supplicant"
> +        "${D}/usr/share/initramfs-tools/scripts/local-top/tee-
> supplicant"
>  }
> -- 
> 2.39.2
> 

Applied v2 to next, thanks.

-- 
Best regards,
Uladzimir.



-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/isar-users/e5cf41d3a2a12ec0b26c7d920cf8138073b7e8ea.camel%40ilbers.de.