@@ -20,12 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \
LAYERRECOMMENDS_meta-ti-bsp = " \
openembedded-layer \
tpm-layer \
+ security \
"
BBFILES_DYNAMIC += " \
openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \
tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bb \
tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bbappend \
+ security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bb \
+ security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bbappend \
"
SIGGEN_EXCLUDERECIPES_ABISAFE += " \
@@ -64,3 +64,13 @@ FALCON_INCLUDE = ""
FALCON_INCLUDE:ti-falcon = "conf/machine/include/ti-falcon.inc"
require ${FALCON_INCLUDE}
+
+# Upstream dm-verity path: meta-security's own dm-verity-img.bbclass +
+# dm-verity-image-initramfs, used as-is (build-time hashing). Only active
+# when the security layer is present and this feature is explicitly
+# requested -- see dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc
+DISTRO_FEATURES[validitems] += "dm-verity-upstream"
+
+DM_VERITY_UPSTREAM_INCLUDE = "${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc', '', d)}"
+
+require ${DM_VERITY_UPSTREAM_INCLUDE}
new file mode 100644
@@ -0,0 +1,17 @@
+# Enables dm-verity to check the rootfs for tampering on TI K3 boards.
+DM_VERITY_IMAGE ?= "arago-base-image"
+DM_VERITY_IMAGE_TYPE = "ext4"
+IMAGE_CLASSES += "dm-verity-img"
+
+DM_VERITY_INITRAMFS_IMAGE = "dm-verity-image-initramfs"
+
+python () {
+ if d.getVar('PN') != d.getVar('DM_VERITY_IMAGE'):
+ return
+
+ d.setVar('WKS_FILE', 'k3-verity.wks.in')
+ d.appendVar('EXTRA_IMAGE_FEATURES', ' read-only-rootfs')
+ d.appendVar('WICVARS', ' DM_VERITY_IMAGE DM_VERITY_IMAGE_TYPE IMAGE_NAME_SUFFIX IMGDEPLOYDIR')
+ d.appendVarFlag('do_image_wic', 'depends', ' %s:do_image_complete' % d.getVar('DM_VERITY_INITRAMFS_IMAGE'))
+ d.appendVar('IMAGE_BOOT_FILES', ' %s-%s.cpio.gz' % (d.getVar('DM_VERITY_INITRAMFS_IMAGE'), d.getVar('MACHINE')))
+}
new file mode 100644
@@ -0,0 +1 @@
+/dev/mmcblk1p2
new file mode 100644
@@ -0,0 +1,14 @@
+# Under dm-verity, the raw root partition looks unmounted to udev's
+# auto-mount check, so it tries to mount it a second time on its own,
+# outside of dm-verity's protection. This tells it to skip that partition.
+FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
+
+SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'file://dm-verity.ignorelist', '', d)}"
+
+do_install:append() {
+ if ${@bb.utils.contains('DISTRO_FEATURES', 'dm-verity-upstream', 'true', 'false', d)}; then
+ install -m 0644 ${UNPACKDIR}/dm-verity.ignorelist ${D}${sysconfdir}/udev/mount.ignorelist.d/dm-verity
+ fi
+}
+
+FILES:${PN}-automount += "${sysconfdir}/udev/mount.ignorelist.d"
new file mode 100644
@@ -0,0 +1,5 @@
+# Disk layout for a board that boots with dm-verity enabled.
+
+bootloader --timeout=3 --append="rootfstype=ext4 root=/dev/mmcblk1p2 ${TI_WKS_BOOTLOADER_APPEND}"
+part --source bootimg-efi --sourceparams="loader=${EFI_PROVIDER},initrd=${DM_VERITY_INITRAMFS_IMAGE}-${MACHINE}.cpio.gz" --fstype=vfat --label boot --active --align 1024 --use-uuid --fixed-size 128M
+part / --source rawcopy --sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.verity" --align 1024
Add an optional dynamic layer enabling dm-verity block-level integrity verification of the root filesystem for TI K3 platforms, using meta-security's stock dm-verity mechanism as-is. dm-verity hashes the rootfs at build time; at boot, a dedicated initramfs loads the root hash and the kernel checks every block read against it. Wires DM_VERITY_IMAGE/WKS_FILE for the K3 boot chain, hooking do_image_wic instead of INITRAMFS_IMAGE to avoid a 3-way circular dependency through kernel-fit-image.bbclass. DM_VERITY_IMAGE selects which image recipe gets verity-enabled (default arago-base-image, overridable in local.conf); all effects are scoped to PN == DM_VERITY_IMAGE, so building any other image type is unaffected. Only active when the "security" layer and dm-verity-upstream feature are enabled. Signed-off-by: Atharv Dubey <a-dubey@ti.com> --- meta-ti-bsp/conf/layer.conf | 3 +++ meta-ti-bsp/conf/machine/include/k3.inc | 10 ++++++++++ .../conf/include/dm-verity-upstream.inc | 17 +++++++++++++++++ .../udev/files/dm-verity.ignorelist | 1 + .../recipes-core/udev/udev-extraconf_%.bbappend | 14 ++++++++++++++ meta-ti-bsp/files/wic/k3-verity.wks.in | 5 +++++ 6 files changed, 50 insertions(+) create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/files/dm-verity.ignorelist create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend create mode 100644 meta-ti-bsp/files/wic/k3-verity.wks.in