DM-Crypt keyutils build failure on Yocto warrior - iMX 6UL

[kanimozhi_t]

Hi,

    I'm building Yocto project (Warrior branch) for iMX 6UL EVK and tried dm-crypt from https://www.nxp.com/docs/en/application-note/AN12714.pdf 

    When I tried including the meta-imx-fde-demo (as in section 3.1.5 of AN12714) into my existing Yocto warrior build, I got incompatibility error mentioning that the layer is compatible upto 'sumo'. As I'm working in warrior branch I've changed the configuration in layer and proceeded to the build. It gives me the following error:

DEBUG: Executing shell function do_compile
NOTE: make -j 4
grep: /etc/rpm/macros.dist: No such file or directory
arm-fslc-linux-gnueabi-gcc -mthumb -mfpu=neon -mfloat-abi=hard -mcpu=cortex-a7 -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security --sysroot=/home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot -I. -DPKGBUILD="\"2020-06-11\"" -DPKGVERSION="\"keyutils-1.5.9\"" -DAPIVERSION="\"libkeyutils-1.5\"" -g -Wall -Werror -fPIC -o keyutils.os -c keyutils.c
arm-fslc-linux-gnueabi-gcc -mthumb -mfpu=neon -mfloat-abi=hard -mcpu=cortex-a7 -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security --sysroot=/home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot -I. -g -Wall -Werror -o keyctl.o -c keyctl.c
arm-fslc-linux-gnueabi-gcc -mthumb -mfpu=neon -mfloat-abi=hard -mcpu=cortex-a7 -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security --sysroot=/home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot -I. -g -Wall -Werror -o request-key.o -c request-key.c
arm-fslc-linux-gnueabi-gcc -mthumb -mfpu=neon -mfloat-abi=hard -mcpu=cortex-a7 -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security --sysroot=/home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot -I. -g -Wall -Werror -o key.dns_resolver.o -c key.dns_resolver.c
In file included from /home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot/usr/include/netinet/in.h:21,
from key.dns_resolver.c:42:
/home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot/usr/include/features.h:382:4: error: #warning _FORTIFY_SOURCE requires compiling with optimization (-O) [-Werror=cpp]
# warning _FORTIFY_SOURCE requires compiling with optimization (-O)
^~~~~~~
In file included from /home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot/usr/include/bits/libc-header-start.h:33,
from /home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot/usr/include/stdio.h:27,
from keyutils.c:12:
/home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot/usr/include/features.h:382:4: error: #warning _FORTIFY_SOURCE requires compiling with optimization (-O) [-Werror=cpp]
# warning _FORTIFY_SOURCE requires compiling with optimization (-O)
^~~~~~~
In file included from /home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot/usr/include/bits/libc-header-start.h:33,
from /home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot/usr/include/stdio.h:27,
from request-key.c:19:
/home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot/usr/include/features.h:382:4: error: #warning _FORTIFY_SOURCE requires compiling with optimization (-O) [-Werror=cpp]
# warning _FORTIFY_SOURCE requires compiling with optimization (-O)
^~~~~~~
In file included from /home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot/usr/include/bits/libc-header-start.h:33,
from /home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot/usr/include/stdio.h:27,
from keyctl.c:13:
/home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/recipe-sysroot/usr/include/features.h:382:4: error: #warning _FORTIFY_SOURCE requires compiling with optimization (-O) [-Werror=cpp]
# warning _FORTIFY_SOURCE requires compiling with optimization (-O)
^~~~~~~
cc1: all warnings being treated as errors
cc1: all warnings being treated as errors
cc1: all warnings being treated as errors
cc1: all warnings being treated as errors
Makefile:120: recipe for target 'request-key.o' failed
make: *** [request-key.o] Error 1
make: *** Waiting for unfinished jobs....
Makefile:112: recipe for target 'keyutils.os' failed
make: *** [keyutils.os] Error 1
Makefile:120: recipe for target 'key.dns_resolver.o' failed
make: *** [key.dns_resolver.o] Error 1
Makefile:120: recipe for target 'keyctl.o' failed
make: *** [keyctl.o] Error 1
ERROR: oe_runmake failed
WARNING: exit code 1 from a shell command.
ERROR: Function failed: do_compile (log file is located at /home/ux/warrior_yocto/mender_build/tmp/work/cortexa7t2hf-neon-fslc-linux-gnueabi/keyutils/1.5.9-r1/temp/log.do_compile.20646)

So my question is,

1. How can I build keyutils for warrior branch?
2. How can I encrypt my rootFS with dm-crypt?

NOTE: Omitting the keyutils gives the following errors on runtime:

root@imx6ulevk:~# keyctl
-sh: keyctl: command not found
root@imx6ulevk:~# dmsetup targets
/dev/mapper/control: open failed: No such device
Failure to communicate with kernel device-mapper driver.
Check that device-mapper is available in the kernel.
Incompatible libdevmapper 1.02.155 (2018-12-18) and kernel driver (unknown version).
Command failed.

Thanks in advance.

[kile964]

Hello, I'm having the same problems (grep error and compiler optimizations warnings) on the dunfell release. Can you send me the information mentioned above?

[kile964]

For further clarification, I'm building with yocto dunfell (long term support). 

I managed to get past the optimizations warning by modifying meta-imx-fde-demo/recipes-security/keyutils/keyutils_1.5.9.bb to include:

EXTRA_OEMAKE = 'CFLAGS="${CFLAGS} -O2"'

But the tk and dm-crypt targets are not available on the built system. This is likely because dunfell is on a newer kernel. Is there any support planned for 5.4.x kernels or any suggestions about how to enable CAAM on imx8?

[kile964]

So I managed to solve the compiler optimizations error by including the following CFLAGS line in my 'meta-imx-fde-demo/recipes-security/keyutils/keyutils_1.5.9.bb' file:

EXTRA_OEMAKE = 'CFLAGS="${CFLAGS} -O2"'

But I'm finding the image does not produce the expected results from the commands listed in AN12714:

# grep -B1 -A2 tk- /proc/crypto|grep -v kernel
(blank)

# dmsetup targets 
[ 5936.486083] device-mapper: ioctl: 4.41.0-ioctl (2019-09-16) initialised: dm-devel@redhat.com
striped v1.6.0
linear v1.4.0
error v1.5.0

Now, I haven't started with the imx bsp, but rather with boundary devices nitrogren8mn (nano) bsp. Otherwise, I have followed all of the instructions. Can you suggest what might be misconfigured?

[Yuri]

Hello,

  I've sent You some comment directly.

Regards,

Yuri.

[aleksandar_niko]

Hello Yuri,

could you send me as well?

Regards,

Aleksandar

[tomaszpanek]

Hello Yuri Muhin

Could you send to my as well? Thanks a lot.

[Yuri]

tomaszpanek 

Hello,

   I've sent the comments.

Regards,

Yuri.

[aleksandar_niko]

Hello Yuri,

could you send me as well?

Regards,

Aleksandar

[aleksandar_niko]

Hello Yuri,

could you send me as well?

Regards,

Aleksandar