diff options
author | Kevin Hao <kexin.hao@windriver.com> | 2023-03-15 10:12:24 +0800 |
---|---|---|
committer | Armin Kuster <akuster808@gmail.com> | 2023-03-20 16:27:24 -0400 |
commit | a7f73ab5918c79fcaec7d6638a2f801c8dc2aeb9 (patch) | |
tree | 98ea713718518e416c9cdb425d374839f1df90f7 /classes | |
parent | 2b2b112b056e2e01d00e6905b8908bbde0e3a8de (diff) | |
download | meta-security-a7f73ab5918c79fcaec7d6638a2f801c8dc2aeb9.tar.gz |
dm-verity-img.bbclass: Fix the hash offset alignment issue
When using the kernel module parameter "dm-mod.create=" [1] to create
the device-mapper device, the hash offset address we passed to kernel
module is the hash block number. That means the hash offset address
would have to be aligned to the max(data_block_size, hash_block_size),
otherwise there would be no way to set the correct hash offset address
via "dm-mo.create=".
[1] https://www.kernel.org/doc/Documentation/admin-guide/device-mapper/dm-init.rst
Signed-off-by: Kevin Hao <kexin.hao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat (limited to 'classes')
-rw-r--r-- | classes/dm-verity-img.bbclass | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/classes/dm-verity-img.bbclass b/classes/dm-verity-img.bbclass index c57409f..d809985 100644 --- a/classes/dm-verity-img.bbclass +++ b/classes/dm-verity-img.bbclass | |||
@@ -25,6 +25,9 @@ STAGING_VERITY_DIR ?= "${TMPDIR}/work-shared/${MACHINE}/dm-verity" | |||
25 | # Define the data block size to use in veritysetup. | 25 | # Define the data block size to use in veritysetup. |
26 | DM_VERITY_IMAGE_DATA_BLOCK_SIZE ?= "1024" | 26 | DM_VERITY_IMAGE_DATA_BLOCK_SIZE ?= "1024" |
27 | 27 | ||
28 | # Define the hash block size to use in veritysetup. | ||
29 | DM_VERITY_IMAGE_HASH_BLOCK_SIZE ?= "4096" | ||
30 | |||
28 | # Process the output from veritysetup and generate the corresponding .env | 31 | # Process the output from veritysetup and generate the corresponding .env |
29 | # file. The output from veritysetup is not very machine-friendly so we need to | 32 | # file. The output from veritysetup is not very machine-friendly so we need to |
30 | # convert it to some better format. Let's drop the first line (doesn't contain | 33 | # convert it to some better format. Let's drop the first line (doesn't contain |
@@ -56,11 +59,18 @@ verity_setup() { | |||
56 | local SIZE=$(stat --printf="%s" $INPUT) | 59 | local SIZE=$(stat --printf="%s" $INPUT) |
57 | local OUTPUT=$INPUT.verity | 60 | local OUTPUT=$INPUT.verity |
58 | 61 | ||
62 | if [ ${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} -ge ${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} ]; then | ||
63 | align=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} | ||
64 | else | ||
65 | align=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} | ||
66 | fi | ||
67 | SIZE=$(expr \( $SIZE + $align - 1 \) / $align \* $align) | ||
68 | |||
59 | cp -a $INPUT $OUTPUT | 69 | cp -a $INPUT $OUTPUT |
60 | 70 | ||
61 | # Let's drop the first line of output (doesn't contain any useful info) | 71 | # Let's drop the first line of output (doesn't contain any useful info) |
62 | # and feed the rest to another function. | 72 | # and feed the rest to another function. |
63 | veritysetup --data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity | 73 | veritysetup --data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} --hash-block-size=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity |
64 | } | 74 | } |
65 | 75 | ||
66 | VERITY_TYPES = " \ | 76 | VERITY_TYPES = " \ |