1# SPDX-License-Identifier: MIT
2#
3# Copyright (C) 2020 BayLibre SAS
4# Author: Bartosz Golaszewski <bgolaszewski@baylibre.com>
5#
6# This bbclass allows creating of dm-verity protected partition images. It
7# generates a device image file with dm-verity hash data appended at the end
8# plus the corresponding .env file containing additional information needed
9# to mount the image such as the root hash in the form of ell variables. To
10# assure data integrity, the root hash must be stored in a trusted location
11# or cryptographically signed and verified.
12#
13# Usage:
14#     DM_VERITY_IMAGE = "core-image-full-cmdline" # or other image
15#     DM_VERITY_IMAGE_TYPE = "ext4" # or ext2, ext3 & btrfs
16#     IMAGE_CLASSES += "dm-verity-img"
17#
18# The resulting image can then be used to implement the device mapper block
19# integrity checking on the target device.
20
21# Define the location where the DM_VERITY_IMAGE specific dm-verity root hash
22# is stored where it can be installed into associated initramfs rootfs.
23STAGING_VERITY_DIR ?= "${TMPDIR}/work-shared/${MACHINE}/dm-verity"
24
25# Define the data block size to use in veritysetup.
26DM_VERITY_IMAGE_DATA_BLOCK_SIZE ?= "1024"
27
28# Define the hash block size to use in veritysetup.
29DM_VERITY_IMAGE_HASH_BLOCK_SIZE ?= "4096"
30
31# Process the output from veritysetup and generate the corresponding .env
32# file. The output from veritysetup is not very machine-friendly so we need to
33# convert it to some better format. Let's drop the first line (doesn't contain
34# any useful info) and feed the rest to a script.
35process_verity() {
36    local ENV="${STAGING_VERITY_DIR}/${IMAGE_BASENAME}.$TYPE.verity.env"
37    install -d ${STAGING_VERITY_DIR}
38    rm -f $ENV
39
40    # Each line contains a key and a value string delimited by ':'. Read the
41    # two parts into separate variables and process them separately. For the
42    # key part: convert the names to upper case and replace spaces with
43    # underscores to create correct shell variable names. For the value part:
44    # just trim all white-spaces.
45    IFS=":"
46    while read KEY VAL; do
47        printf '%s=%s\n' \
48            "$(echo "$KEY" | tr '[:lower:]' '[:upper:]' | sed 's/ /_/g')" \
49            "$(echo "$VAL" | tr -d ' \t')" >> $ENV
50    done
51
52    # Add partition size
53    echo "DATA_SIZE=$SIZE" >> $ENV
54}
55
56verity_setup() {
57    local TYPE=$1
58    local INPUT=${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.$TYPE
59    local SIZE=$(stat --printf="%s" $INPUT)
60    local OUTPUT=$INPUT.verity
61
62    if [ ${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} -ge ${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} ]; then
63        align=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE}
64    else
65        align=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE}
66    fi
67    SIZE=$(expr \( $SIZE + $align - 1 \) / $align \* $align)
68
69    cp -a $INPUT $OUTPUT
70
71    # Let's drop the first line of output (doesn't contain any useful info)
72    # and feed the rest to another function.
73    veritysetup --data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} --hash-block-size=${DM_VERITY_IMAGE_HASH_BLOCK_SIZE} --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity
74}
75
76VERITY_TYPES = " \
77    ext2.verity ext3.verity ext4.verity \
78    btrfs.verity \
79    erofs.verity erofs-lz4.verity erofs-lz4hc.verity \
80    squashfs.verity squashfs-xz.verity squashfs-lzo.verity squashfs-lz4.verity squashfs-zst.verity \
81"
82IMAGE_TYPES += "${VERITY_TYPES}"
83CONVERSIONTYPES += "verity"
84CONVERSION_CMD:verity = "verity_setup ${type}"
85CONVERSION_DEPENDS_verity = "cryptsetup-native"
86
87python __anonymous() {
88    verity_image = d.getVar('DM_VERITY_IMAGE')
89    verity_type = d.getVar('DM_VERITY_IMAGE_TYPE')
90    image_fstypes = d.getVar('IMAGE_FSTYPES')
91    pn = d.getVar('PN')
92
93    if not verity_image or not verity_type:
94        bb.warn('dm-verity-img class inherited but not used')
95        return
96
97    if verity_image != pn:
98        return # This doesn't concern this image
99
100    if len(verity_type.split()) != 1:
101        bb.fatal('DM_VERITY_IMAGE_TYPE must contain exactly one type')
102
103    d.appendVar('IMAGE_FSTYPES', ' %s.verity' % verity_type)
104
105    # If we're using wic: we'll have to use partition images and not the rootfs
106    # source plugin so add the appropriate dependency.
107    if 'wic' in image_fstypes:
108        dep = ' %s:do_image_%s' % (pn, verity_type.replace("-", "_"))
109        d.appendVarFlag('do_image_wic', 'depends', dep)
110}
111