summaryrefslogtreecommitdiffstats
path: root/classes
diff options
context:
space:
mode:
authorKevin Hao <kexin.hao@windriver.com>2023-03-15 10:12:24 +0800
committerArmin Kuster <akuster808@gmail.com>2023-03-20 16:27:24 -0400
commita7f73ab5918c79fcaec7d6638a2f801c8dc2aeb9 (patch)
tree98ea713718518e416c9cdb425d374839f1df90f7 /classes
parent2b2b112b056e2e01d00e6905b8908bbde0e3a8de (diff)
downloadmeta-security-a7f73ab5918c79fcaec7d6638a2f801c8dc2aeb9.tar.gz
dm-verity-img.bbclass: Fix the hash offset alignment issue
When using the kernel module parameter "dm-mod.create=" [1] to create the device-mapper device, the hash offset address we passed to kernel module is the hash block number. That means the hash offset address would have to be aligned to the max(data_block_size, hash_block_size), otherwise there would be no way to set the correct hash offset address via "dm-mo.create=". [1] https://www.kernel.org/doc/Documentation/admin-guide/device-mapper/dm-init.rst Signed-off-by: Kevin Hao <kexin.hao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat (limited to 'classes')
-rw-r--r--classes/dm-verity-img.bbclass12
1 files changed, 11 insertions, 1 deletions
diff --git a/classes/dm-verity-img.bbclass b/classes/dm-verity-img.bbclass
index c57409f..d809985 100644
--- a/classes/dm-verity-img.bbclass
+++ b/classes/dm-verity-img.bbclass
@@ -25,6 +25,9 @@ STAGING_VERITY_DIR ?= "${TMPDIR}/work-shared/${MACHINE}/dm-verity"
25# Define the data block size to use in veritysetup. 25# Define the data block size to use in veritysetup.
26DM_VERITY_IMAGE_DATA_BLOCK_SIZE ?= "1024" 26DM_VERITY_IMAGE_DATA_BLOCK_SIZE ?= "1024"
27 27
28# Define the hash block size to use in veritysetup.
29DM_VERITY_IMAGE_HASH_BLOCK_SIZE ?= "4096"
30
28# Process the output from veritysetup and generate the corresponding .env 31# Process the output from veritysetup and generate the corresponding .env
29# file. The output from veritysetup is not very machine-friendly so we need to 32# file. The output from veritysetup is not very machine-friendly so we need to
30# convert it to some better format. Let's drop the first line (doesn't contain 33# convert it to some better format. Let's drop the first line (doesn't contain
@@ -56,11 +59,18 @@ verity_setup() {
56 local SIZE=$(stat --printf="%s" $INPUT) 59 local SIZE=$(stat --printf="%s" $INPUT)
57 local OUTPUT=$INPUT.verity 60 local OUTPUT=$INPUT.verity
58 61
62 if [ ${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} -ge ${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} ]; then
63 align=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE}
64 else
65 align=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE}
66 fi
67 SIZE=$(expr \( $SIZE + $align - 1 \) / $align \* $align)
68
59 cp -a $INPUT $OUTPUT 69 cp -a $INPUT $OUTPUT
60 70
61 # Let's drop the first line of output (doesn't contain any useful info) 71 # Let's drop the first line of output (doesn't contain any useful info)
62 # and feed the rest to another function. 72 # and feed the rest to another function.
63 veritysetup --data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity 73 veritysetup --data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} --hash-block-size=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity
64} 74}
65 75
66VERITY_TYPES = " \ 76VERITY_TYPES = " \