From patchwork Wed Sep 30 12:59:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Atharv Dubey X-Patchwork-Id: 99707 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2E4CCCA5FB1 for ; Wed, 30 Sep 2026 13:00:09 +0000 (UTC) Received: from mx0b-0002e601.pphosted.com (mx0b-0002e601.pphosted.com [148.163.154.28]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.12872.1790773202542531863 for ; Wed, 30 Sep 2026 06:00:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@ti.com header.s=proofpoint-05-2026 header.b=aU8JiMQ2; dkim=pass header.i=@ticloud.onmicrosoft.com header.s=selector1-ticloud-onmicrosoft-com header.b=bkP/IAjX; spf=pass (domain: ti.com, ip: 148.163.154.28, mailfrom: a-dubey@ti.com) Received: from pps.filterd (m0374955.ppops.net [127.0.0.1]) by mx0b-0002e601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68UB5w5h3214062; Wed, 30 Sep 2026 08:00:00 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; h=cc :content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=proofpoint-05-2026; bh=bFUDBLqlcISUf mMr2ZcEGNeYDOfMw6J/e4NVbwCbwWo=; b=aU8JiMQ2a+rsvTrVy22o/9w8YUa9v 8Mu9Sus6xyARUqQvMgI0pp+KGoRi2E95evOOU4cvLhuhUTmFnhvjvyJdUGhhpwAk YJIHJRi02Jhb9TaPlRHo1ksg6i5sWbabwxyKP9vMzg0/LgnnBnaE8jLct+H3ZQTX 88zpTm+3zsW9KgmSkMmQW0TJeDw3KGrChg0hFo32vJ+3sC+9B63KJSGop9ND/Q+c mx9FHB/fU+EnOtfaQVVvBVZZV/v3/R/BMpuSEtBEuc/YZA1s906gSmra+M4wMcBg HoO+IlrwfxbbH2GnBFIaYuB73P3a+C4e5tly4OAxyaTN+9GRcYHkZ43wQ== Received: from ch1pr05cu001.outbound.protection.outlook.com (mail-northcentralusazon11010043.outbound.protection.outlook.com [52.101.193.43]) by mx0b-0002e601.pphosted.com (PPS) with ESMTPS id 4h0ydv95s8-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 30 Sep 2026 08:00:00 -0500 (CDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=IxWRmM4aSn8EjX4aeS0BhyAcWuzBEtSAkt/uaLCHOt9qtB2NKX9SGrvTga52KzBaWUpxUNjckESxwOCgiSeKGp1uorYuDEaXQGhDP5S0PJpzRIWTWQ0dW5K+GPiVhy9+tF4jYhEncLHNLYfmiSMhYVKsmSu6yWYwLiY8eG6NccR+NpPNrFVFP7fUAmm8QBBh2415OVtx9FxGdixvIi3eOv+ep3B9IAyrSDSzxzcilzVCQKsY+i1Heo24i9WHMXAYFbnWsHaUk/mttigyW4g96nQbeohSSjW94OEcTMf0lOFcsp8iYNkcGvXSMXU/6KWiJAR6FeDnEnZ5S7WP0h347g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=bFUDBLqlcISUfmMr2ZcEGNeYDOfMw6J/e4NVbwCbwWo=; b=Tfmho15EPbs2K4XhSsgkCJeyY3XqPmnize6kj4OgSTseTMgBqRB7jmrOSa6+PJnD2TVxDv5BRtSQ1drGET8496x4IvDtNIHgdnK0R63mfxFFm6zIxHpJmt28XEXvxR8jlSJt/B0bPFVhhBgpujoGPfAh2pVyPkvMFYjtnOadsQaKcZxvOzx3wNr5BbhXYDpaGXZJOmpgBIbKjN02NO0tfFatTBrWuv9oX/GIReq3DBVuBFbAjWJjtqLB3twHaapdCdARoJP1VgDf6ZK/CRk0iM2dndiPI64wVWA2QF10ZcLgLm64NN129A/MXsKLDaPgEiKFozSMUUK6MHfJwEej9Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 198.47.23.195) smtp.rcpttodomain=konsulko.com smtp.mailfrom=ti.com; dmarc=pass (p=quarantine sp=none pct=100) action=none header.from=ti.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ticloud.onmicrosoft.com; s=selector1-ticloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=bFUDBLqlcISUfmMr2ZcEGNeYDOfMw6J/e4NVbwCbwWo=; b=bkP/IAjXFMyews0uDqxNTFQVtPZeXSyeWMylr3WzyJTZlgRg9j7nJ1liWww20y2Fgsjz/iJWds/nKED2lzejHakwmWGSdHIUjiI7qbygLGZm9fkTDPf2xN/sXtV2TClUDMbdfTBZsJBZ+e7r1n1VVR/4wNjqz8fx78CP6sG3f9E= Received: from MN0PR02CA0016.namprd02.prod.outlook.com (2603:10b6:208:530::14) by CH0PR10MB5017.namprd10.prod.outlook.com (2603:10b6:610:c3::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.15; Wed, 30 Sep 2026 12:59:57 +0000 Received: from BN2PEPF000055DD.namprd21.prod.outlook.com (2603:10b6:208:530:cafe::77) by MN0PR02CA0016.outlook.office365.com (2603:10b6:208:530::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.16 via Frontend Transport; Wed, 30 Sep 2026 12:59:56 +0000 X-MS-Exchange-Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 198.47.23.195) smtp.mailfrom=ti.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=ti.com; Received-SPF: Pass (protection.outlook.com: domain of ti.com designates 198.47.23.195 as permitted sender) receiver=protection.outlook.com; client-ip=198.47.23.195; helo=lewvzet201.ext.ti.com; pr=C Received: from lewvzet201.ext.ti.com (198.47.23.195) by BN2PEPF000055DD.mail.protection.outlook.com (10.167.245.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.3 via Frontend Transport; Wed, 30 Sep 2026 12:59:56 +0000 Received: from DLEE209.ent.ti.com (157.170.170.98) by lewvzet201.ext.ti.com (10.4.14.104) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Wed, 30 Sep 2026 07:59:42 -0500 Received: from DLEE210.ent.ti.com (157.170.170.112) by DLEE209.ent.ti.com (157.170.170.98) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Wed, 30 Sep 2026 07:59:41 -0500 Received: from lelvem-mr05.itg.ti.com (10.180.75.9) by DLEE210.ent.ti.com (157.170.170.112) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45 via Frontend Transport; Wed, 30 Sep 2026 07:59:41 -0500 Received: from lalit-ti-241.dhcp.ti.com (lalit-ti-241.dhcp.ti.com [10.24.50.31]) by lelvem-mr05.itg.ti.com (8.18.1/8.18.1) with ESMTP id 68UCxdxI4098429; Wed, 30 Sep 2026 07:59:40 -0500 From: Atharv Dubey To: , CC: , , , Subject: [meta-ti][master][PATCH v4 1/3] dm-verity-upstream: Add dynamic layer for meta-security dm-verity Date: Wed, 30 Sep 2026 18:29:36 +0530 Message-ID: <20260930125938.95629-1-a-dubey@ti.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN2PEPF000055DD:EE_|CH0PR10MB5017:EE_ X-MS-Office365-Filtering-Correlation-Id: 64ef4b17-8515-4282-a004-08df1ef2ba77 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|36860700016|82310400026|376014|10067099003|56012099006|5023799004|18002099003; X-Microsoft-Antispam-Message-Info: uaFLHm1/38/GfFfFxDb8he+c2Jy0FhuzAqONWrb4M7oNdTV+iD0MeeVdXiADPwebsTAGzewvuUSaMJ2lpPxCdVOpOSdNCVSpj2iyXh4HKJwTNfKLvxeyOFBx8OFEiUTOJCF1Mb1ih2H2SGoK/Ich1orZyLxnUV1jhSzRwXAGBy3NMJ8T+VhWoP0gHaNtx535bzTapMvIleqx8obuElUF8XP/Arir+Iotst7t3aDhs7Cpt4txVUKij9DiBzIzGiy1sP2OX128cE9Y5DYhZHZivjJ7190LwCd3ukZQ7+5gH5LPXsnE8DTlEtQwMhYsF/M88YZvoXBSLzW2cjp1G9U4qtWsvI1KvkW4LLm74XLDMH8ONG/BSlE+9dvJ6+UyBYF03wVaYdWSYhqJ6uo7iVyk0lvC22hkjScsgTJsc/kNw7v9VkCuyF369+KAnD13hNZ76ufbLoLjlykeh6xtcBaTvJeTzdZk6SqDG7PwrDMdupvL3rIebFkyoSWvZ+3XCfJEIenBIyfJI1XqEhGYW28z+9lVQs7MXOV42KnkfnLB7ETEoohNkfJoOkiGcN0cZvYkFLaz78kiVnNH4Uf16tdf22PlmKlzFMHTJuEnYhzxqfp9H02JwJqim0OLzw0Lu4WUeN7O+nds99mLOaRIDVcSdqg+iVcG+I0Mb3ktx8j7fGjmSsJarJT8meXg/KfgAkwoetBBMVBhxEGYaBuPB2OvRA== X-Forefront-Antispam-Report: CIP:198.47.23.195;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:lewvzet201.ext.ti.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(36860700016)(82310400026)(376014)(10067099003)(56012099006)(5023799004)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 92oV1xuVt8cnXgXQ4Bh8vPJ1Th6tBjDKfvxDefUsko9ewsbNygSlns6F/b4pct7GkACz0NEW2dGIPpapJtKzyBa7Nw4e5i3teXmrxjetIgQQql8XJ1ezaODywEIxhmczx6YocF1CyOibk7cml3gO55QPXoTnV0qEEzCkTAnDiLvmjcwqbQ02a7tIm76EUdhisPHus6zAWviFbh2qz62mYrZriChAfdH714aWeptNIodqm3K7oAE1IfBLOiD+g1ALnoypFypTVFufLRG8f7ege5KUmrOzj+Wtepxyz5n8ARG2c09DEpCfUOr8BTh1eG7fbWcjDQdK//q+RxZpW4VvSH2ZQ2KETzDSC8crHJm+fSiqlHRMIjcZ6HJ1sUTSi3dW4YAR86eqU4ujOZjMykm8wJYWtb24uiEUw7Ob4NIUZGzYzP4u79Q64nbKIZT+Vd9N X-Exchange-RoutingPolicyChecked: 5mLJV6uIAtngpr3BGX1L7uxVHj9KmVBAM2RJfkxUIauL5Ap2/nOJnavg/RjccHA/eN1cYGr1h8kwTUYk1ineFa0+9b2FjSIoPXN9V6uvC9mVT82ot1HA8gNZ8ZBTzPiRMGZPxEd25mbwHjiikmfxDUUky1e4DyjDAk9yWym8VOKVevbEWPeHuxXn07QE18GIVjLvuYxdj0YJDG5r+zq5b+gIFe5N9+8AUkYzj0VHnCSraHlOnLRF7m4FYjOTHtj+AcBJXFAH2kSomQi8vq0ct9MddN6IkJ+VWUtvbfsXBLPwTbhIZvKxAr+A77eKixtbbuC6KjV2UIIufoPknzkHwA== X-OriginatorOrg: ti.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Sep 2026 12:59:56.8059 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 64ef4b17-8515-4282-a004-08df1ef2ba77 X-MS-Exchange-CrossTenant-Id: e5b49634-450b-4709-8abb-1e2b19b982b7 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e5b49634-450b-4709-8abb-1e2b19b982b7;Ip=[198.47.23.195];Helo=[lewvzet201.ext.ti.com] X-MS-Exchange-CrossTenant-AuthSource: BN2PEPF000055DD.namprd21.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5017 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTMwMDA1MSBTYWx0ZWRfXwOPCIa9mQXSz RBnw06ceTDRcyIQcXkL4P0AODOdcrpRSi8bOsFGAdkWVeq2CW6tYMJCBjFf/QUdIpoJNdSIH7FV s1c/4g3c4AwdWr1zgr1ec/ugcczrcDU= X-Proofpoint-GUID: o3qbWb035Q0ZmP28VqiBBL9iq5KzMGsw X-Authority-Analysis: v=2.4 cv=TegDJhQh c=1 sm=1 tr=0 ts=6abd07d0 cx=c_pps a=91GdPAjHHMbPGBWG17ie4w==:117 a=f+v6EHfkeJbVwR46tk4DMg==:17 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=VdqzKS8jKosA:10 a=s63m1ICgrNkA:10 a=AlMIdn_sM9wA:10 a=VkNPw1HP01LnGYTKEx00:22 a=Z8NIEmU8O1QQgoT56wFK:22 a=fPAWb5peG099m5CrUpKH:22 a=sozttTNsAAAA:8 a=cW7-tuCRIaqJVRneuyUA:9 X-Proofpoint-ORIG-GUID: o3qbWb035Q0ZmP28VqiBBL9iq5KzMGsw X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTMwMDA1MSBTYWx0ZWRfXzO4pJ8I2UoWR +dkLr9j9bhyL2Gv++IOhlFVfpHqfnvl89E3kphYzsLS5Hn+T3mh+r+61Q69lAbRATHCSbRDgX2q fK/q7TA2d6hWpCKLf7e7wyNz/1Z6r6+yHxEtbSXW7d2yTCgAjdVRrn3WhiJD6nSRMwlpqyjuoNt yKv5yzTze5/BcI6Z0gelV4cBUIXfCdN9Vg4NPL0jSxjq7MB5thSUmBrp22AShom94FB0d3Ma1Mr ttDb7kc6dMEdGVpMjGBtvzdy3j1j7YCbViWuxUXdBhmMWWUKNIyb6qP2xhHh7HRJ9X+LwAjp2ZB YzGNc3b/I/7pWqNAfWycPTJkmFr6CYB7cwWl9A6r0+nBqqpv2bhD6IMBi56/Ikvb2xNUb1xAv18 sxWy7Ai3vtSCcaH2m4kyhnqOuFphbhSNJRHnLGQk47BJ6BskAwCwBJIUhtlCTyljBAyeZmYbUco TJBEU8BBBdithyzkQZA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-30_02,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 lowpriorityscore=0 malwarescore=0 phishscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 adultscore=0 suspectscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609300051 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 30 Sep 2026 13:00:09 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/meta-ti/message/20422 Add an optional dynamic layer enabling dm-verity block-level integrity verification of the root filesystem for TI K3 platforms, using meta-security's stock dm-verity mechanism as-is. Requires meta-security to be present in bblayers.conf. dm-verity hashes the rootfs at build time; at boot, a dedicated initramfs loads the root hash and the kernel checks every block read against it. Set DM_VERITY_IMAGE to enable all the verity-related recipes for that image; other images build as usual. Signed-off-by: Atharv Dubey --- v4: - Use ti-core-initramfs instead of a separate dm-verity initramfs - Instead of a DISTRO_FEATURE, just check if DM_VERITY_IMAGE is set v3: - Disabled the automount rules from udev-aragoconf, so don't need the ignorelist for dm-verity v2: - Replaced hardcoded /dev/mmcblk1p2 with a PARTUUID --- meta-ti-bsp/conf/layer.conf | 3 +++ meta-ti-bsp/conf/machine/include/k3.inc | 7 ++++++ .../conf/include/dm-verity-upstream.inc | 23 +++++++++++++++++++ .../udev/udev-aragoconf_%.bbappend | 5 ++++ .../udev/udev-extraconf_%.bbappend | 6 +++++ meta-ti-bsp/files/wic/k3-verity.wks.in | 5 ++++ 6 files changed, 49 insertions(+) create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend create mode 100644 meta-ti-bsp/files/wic/k3-verity.wks.in diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf index 3cc54aa4..aca35cd3 100644 --- a/meta-ti-bsp/conf/layer.conf +++ b/meta-ti-bsp/conf/layer.conf @@ -20,12 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \ LAYERRECOMMENDS_meta-ti-bsp = " \ openembedded-layer \ tpm-layer \ + security \ " BBFILES_DYNAMIC += " \ openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \ tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bb \ tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bbappend \ + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bb \ + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bbappend \ " SIGGEN_EXCLUDERECIPES_ABISAFE += " \ diff --git a/meta-ti-bsp/conf/machine/include/k3.inc b/meta-ti-bsp/conf/machine/include/k3.inc index 2ebbfb9e..f19db45f 100644 --- a/meta-ti-bsp/conf/machine/include/k3.inc +++ b/meta-ti-bsp/conf/machine/include/k3.inc @@ -64,3 +64,10 @@ FALCON_INCLUDE = "" FALCON_INCLUDE:ti-falcon = "conf/machine/include/ti-falcon.inc" require ${FALCON_INCLUDE} + +# dm-verity protects the rootfs listed in DM_VERITY_IMAGE; see dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc for what that turns on. +DM_VERITY_IMAGE ??= "" + +DM_VERITY_UPSTREAM_INCLUDE = "${@'dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc' if d.getVar('DM_VERITY_IMAGE') else ''}" + +require ${DM_VERITY_UPSTREAM_INCLUDE} diff --git a/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc new file mode 100644 index 00000000..3ff2b7d6 --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc @@ -0,0 +1,23 @@ +# Enables dm-verity to check the rootfs for tampering on TI K3 boards. +DM_VERITY_IMAGE_TYPE = "ext4" +IMAGE_CLASSES += "dm-verity-img" + +# ti-core-initramfs.bbappend already wires the initramfs into the boot partition once dm-verity is enabled, so we don't need to do it here. + +# Derive the root partition's UUID from MACHINE so everyone computes the same one. +python () { + import uuid + + if not d.getVar('DM_VERITY_ROOT_PARTUUID'): + d.setVar('DM_VERITY_ROOT_PARTUUID', + str(uuid.uuid5(uuid.NAMESPACE_DNS, 'dm-verity-root-%s' % d.getVar('MACHINE')))) +} + +python () { + if d.getVar('PN') != d.getVar('DM_VERITY_IMAGE'): + return + + d.setVar('WKS_FILE', 'k3-verity.wks.in') + d.appendVar('EXTRA_IMAGE_FEATURES', ' read-only-rootfs') + d.appendVar('WICVARS', ' DM_VERITY_IMAGE DM_VERITY_IMAGE_TYPE IMAGE_NAME_SUFFIX IMGDEPLOYDIR DM_VERITY_ROOT_PARTUUID') +} diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend new file mode 100644 index 00000000..e5f6c1b2 --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend @@ -0,0 +1,5 @@ +do_install:append() { + if ${@'true' if d.getVar('DM_VERITY_IMAGE') else 'false'}; then + : > ${D}${libdir}/udev/rules.d/50-arago.rules + fi +} diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend new file mode 100644 index 00000000..a14e21ea --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend @@ -0,0 +1,6 @@ +# Nothing should ever get auto-mounted under dm-verity, so just kill the automounter. +do_install:append() { + if ${@'true' if d.getVar('DM_VERITY_IMAGE') else 'false'}; then + : > ${D}${sysconfdir}/udev/rules.d/automount.rules + fi +} diff --git a/meta-ti-bsp/files/wic/k3-verity.wks.in b/meta-ti-bsp/files/wic/k3-verity.wks.in new file mode 100644 index 00000000..62ae0ec1 --- /dev/null +++ b/meta-ti-bsp/files/wic/k3-verity.wks.in @@ -0,0 +1,5 @@ +# Disk layout for a board that boots with dm-verity enabled. + +bootloader --timeout=3 --append="rootfstype=ext4 root=PARTUUID=${DM_VERITY_ROOT_PARTUUID} ${TI_WKS_BOOTLOADER_APPEND}" +part --source bootimg-efi --sourceparams="loader=${EFI_PROVIDER}${TI_WKS_INITRAMFS}" --fstype=vfat --label boot --active --align 1024 --use-uuid --fixed-size 128M +part / --source rawcopy --sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.verity" --align 1024 --uuid ${DM_VERITY_ROOT_PARTUUID} From patchwork Wed Sep 30 12:59:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Atharv Dubey X-Patchwork-Id: 99709 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 12BB1CA5FAC for ; Wed, 30 Sep 2026 13:00:39 +0000 (UTC) Received: from mx0b-0002e601.pphosted.com (mx0b-0002e601.pphosted.com [148.163.154.28]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.12831.1790773228886404015 for ; Wed, 30 Sep 2026 06:00:29 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@ti.com header.s=proofpoint-05-2026 header.b=l6zTrTtx; dkim=pass header.i=@ticloud.onmicrosoft.com header.s=selector1-ticloud-onmicrosoft-com header.b=UI17nHCV; spf=pass (domain: ti.com, ip: 148.163.154.28, mailfrom: a-dubey@ti.com) Received: from pps.filterd (m0374956.ppops.net [127.0.0.1]) by mx0b-0002e601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68UB69px2715438; Wed, 30 Sep 2026 08:00:26 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint-05-2026; bh=Gf4ifUp6Iyk5VwZkpjzvtNBRYD+DXvaQiD8F/gtO7 04=; b=l6zTrTtxsxg+e6P13CeKVLhftFUZhDJEdLdETFoZnfbfVZqFhDiTawtMk 04QuaFomfgolZFKMfxTpcadkBAh560tPFZfCf/NbgemCHV6dkZpsDDFy1KX0r5CO YooYwpGAu1ppC2IkCW7wnXsHYi3++Xv8nwZLpCyQArZcQw8B1+gq1DBOhQnYVuRi /X5IJnkcr/wfUEENzSp0/FbLvI+8jkxyv22AkPjHF2Dd/2J9+J79Ka3P6eciTaOs 1Mscj8erK5qD+4OgW6wgbVojuleXRl73/TYf7aHODcFcfbuYq4rhe1UjmHpnv7Hq My+bOZ8vuQmK49bPNBG9XRzhZ6h/A== Received: from sn4pr2101cu001.outbound.protection.outlook.com (mail-southcentralusazon11012017.outbound.protection.outlook.com [40.93.195.17]) by mx0b-0002e601.pphosted.com (PPS) with ESMTPS id 4h0m9fdb53-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 30 Sep 2026 08:00:25 -0500 (CDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=cmMQXvvUlilxCG/3msnNFvB2NBhLKL8W2RQ3Nc2UcRuYCjRLJPSxZVtPqC9ueVwyiiyLnT+6ggWVHqcq1T4KHPh7dICGmLacladjK8i7aB85+B/zcpxWFsnH/BWBIF/AyeToYmkx2Ew8WFlitLl8TNYJuuqORy05oHtC4kDO5wGaHyqSfP9LX/P3THMMArBSu0OHxC1W6Q2XA1TKYoXvFp6D7stjilflJRjUqhrOpHNIGST7Xf4V16iC44TMLAycyL5/j1MLx5BXlCjTUtt/UgqjiNjRvYu4Ubc93K6UnGWXp6mvw4gFCus6gTewpLfrzPiLFnj3kJ9S0YFcm2JPhA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Gf4ifUp6Iyk5VwZkpjzvtNBRYD+DXvaQiD8F/gtO704=; b=cbldVVrOu7CbJD/eVMpfDJ5na72iyO3sq/wuFhMUzjbkz57j8fVh7RmGpIIgBWfyXNDrrKQNow1OOJJ9em+eYkzXHZy/KYP8tvDriK/EB8cUfB5KndWcZNRA+uV7RK240b3/sZJ012cTgjf4cq/p8kGYKWITHuROXzE50eYR3PBEPJ6mJyefGDa3nYoOpZvqsVS0HBrsglYD/9/XnHXi1NpV+Xn7weYODnDWRMmuUs9OiXzwqIZf58FwWhVMeemz4YOMux46Z7KhUw752g72OSzsKj7woWdMTOY3G5U7nA0qYbfQK82wIi10aa4g3xSZT4Ds1jGiP3WoP2aiLQkMAA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 198.47.21.194) smtp.rcpttodomain=konsulko.com smtp.mailfrom=ti.com; dmarc=pass (p=quarantine sp=none pct=100) action=none header.from=ti.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ticloud.onmicrosoft.com; s=selector1-ticloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Gf4ifUp6Iyk5VwZkpjzvtNBRYD+DXvaQiD8F/gtO704=; b=UI17nHCVXcniKG+2JOExaRNlOPlSNzitCTQ68LSCnhfE6pugWgo8C4wOkTqnZT87RiHbpD5sJwtJL2eHft8GzvGfqQoFp0wXkC7uoNwda9OOGH65RhCGiIwSlqjkL8V94sX115B5Ra24GK3wUw9GpD41tzDHOh4QcV4iwrvAOyk= Received: from LV3P220CA0012.NAMP220.PROD.OUTLOOK.COM (2603:10b6:408:234::17) by IA4PR10MB8399.namprd10.prod.outlook.com (2603:10b6:208:56b::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.5; Wed, 30 Sep 2026 13:00:24 +0000 Received: from BN1PEPF00004687.namprd05.prod.outlook.com (2603:10b6:408:234:cafe::92) by LV3P220CA0012.outlook.office365.com (2603:10b6:408:234::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.15 via Frontend Transport; Wed, 30 Sep 2026 13:00:24 +0000 X-MS-Exchange-Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 198.47.21.194) smtp.mailfrom=ti.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=ti.com; Received-SPF: Pass (protection.outlook.com: domain of ti.com designates 198.47.21.194 as permitted sender) receiver=protection.outlook.com; client-ip=198.47.21.194; helo=flwvzet200.ext.ti.com; pr=C Received: from flwvzet200.ext.ti.com (198.47.21.194) by BN1PEPF00004687.mail.protection.outlook.com (10.167.243.132) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Wed, 30 Sep 2026 13:00:22 +0000 Received: from DFLE200.ent.ti.com (10.64.6.58) by flwvzet200.ext.ti.com (10.248.192.31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Wed, 30 Sep 2026 07:59:44 -0500 Received: from DFLE204.ent.ti.com (10.64.6.62) by DFLE200.ent.ti.com (10.64.6.58) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Wed, 30 Sep 2026 07:59:44 -0500 Received: from lelvem-mr05.itg.ti.com (10.180.75.9) by DFLE204.ent.ti.com (10.64.6.62) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45 via Frontend Transport; Wed, 30 Sep 2026 07:59:44 -0500 Received: from lalit-ti-241.dhcp.ti.com (lalit-ti-241.dhcp.ti.com [10.24.50.31]) by lelvem-mr05.itg.ti.com (8.18.1/8.18.1) with ESMTP id 68UCxdxJ4098429; Wed, 30 Sep 2026 07:59:42 -0500 From: Atharv Dubey To: , CC: , , , Subject: [meta-ti][master][PATCH v4 2/3] linux-ti-staging: Add dm-verity kernel config Date: Wed, 30 Sep 2026 18:29:37 +0530 Message-ID: <20260930125938.95629-2-a-dubey@ti.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260930125938.95629-1-a-dubey@ti.com> References: <20260930125938.95629-1-a-dubey@ti.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN1PEPF00004687:EE_|IA4PR10MB8399:EE_ X-MS-Office365-Filtering-Correlation-Id: 67bf66af-2b5a-4a79-0c30-08df1ef2ca07 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|23010399003|36860700016|82310400026|376014|22082099003|18002099003|10067099003|56012099006; X-Microsoft-Antispam-Message-Info: cee3dWHed5fnH/FCMe1ow40QnARCJil4s0Qw63pSOTHmtoHvcEKghRw/IgtwjaXE8BXU3QSdP06kEIceYW3BbSV3vYZoHViZBVPBhgd0Hk/CWbBJNU9esFX0s93sbS4lM+uaseKFF9viVooaqsyYu1Mu+t56chDPVJr3hCCN14MQay6XO7Io/zfmkbcZMF9AvBbqUra4Lu4AapHxLvBd3puEihITQDg5Cq6zfoDRCwkl3HelYu8jUI67pOI+MjOfxNEGOXq5aHjX8We6nnfH3eGMpbS80W/WV3FXXxzpCyPoajtvR45RY9MpnJd1zoSyU+l5v/AKqTSj1VQtVB7LThjU9QrDLgl+vNVEqGhEGxzIQ9w/+yEFVc0kmLRFc7jWvHx/A8RkH2SFKQlUxHZGrQvhtCQ2+rv/onnwWiaSa8v+Zj1FzGKCU4FEBp0mt6Y/bL7GfjjbTtiVKR3rFYPwqwsU//uvsyp35NieVs+KrxeARgPeEYBT14KJDhLqOfOCVZvcmMVZlzLOOSd1w9BP8Fexo1aIwSfKIA2BWN9ruWYqE1yu2EpWT3t7aT8d5nfjnSIH8GBRpvaRaDaF2NiAk9lSEeO+mu7KHPYGs+gLDh9E5w9il1bs0ekxevqnr4KhO7nN1+lNBSyuDWSACEStXAEg+NSURFcaOIA0BzpxEhFiGeDxIV6SWQV/g0i4eTiLnVuCBewRHougIOApr54VXg== X-Forefront-Antispam-Report: CIP:198.47.21.194;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:flwvzet200.ext.ti.com;PTR:ErrorRetry;CAT:NONE;SFS:(13230040)(1800799024)(23010399003)(36860700016)(82310400026)(376014)(22082099003)(18002099003)(10067099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Rytf7sXYWptDVoBphv/i4ka7mlALMtqysUqbpf6+bDfp1ZoIBcpE9R68hrM4VQ3YOEqzIJMTgxGCIwx++d220Pbp5eT3tDnG7KQYZT61uazVLzNOg/5illF2gcrQLVGmFqducENhcxnxgx+SIpqQAXitbpqPgytfLi5DSgI3PB2k1Whi7LA/CG8yAorRtYZCaXVnm49hOEBrDwIkul9xtaODQWTr2eD9KoyWv7LruoflvL8ygt/M9KSdFcwblQkJWtQggzbnKKrvYK55DwLzoZjxX86nq4Eo6DBgPzvfh3km+L4wSXP0LCpI+0PGCIl1KncZRH8AwCnnBqNMTNfL/gQ6PFPHWQOqK+NkP4fFsetAARhtoATFe/UY8ie08mYmOXtqm21sEfdsz1WUnq7D73/3wrmMeJTNotlQgdv78L+VdenuXC7NQvGUXBkIXhTk X-Exchange-RoutingPolicyChecked: 0RncPbfZ+0VgV/tgiaffakfbrHyDs1bsRWc3qmRBVw8zVKGJQbn5B19YP2IV7tx0fqGIYig2Ebz1XhBmkK6G/5nGnDk01RwgeJ86AqL5O022QOjGJzfxcSV++8d2xxh0eECxNTa2d9ArUxfveKzpnrwAzELIsywBCQZRc3ahLaoOuF0GELvuexKHl4yMJ89Ck2M8pRg/IWV1wNZKuIEJlyBSQ8R+68l2Oc2v0j2BYRogGAXzlR915ve5s/COrc1ruk+goRv8+jAQXS14HiXvzcdSOyLvWWvw1w1TcJV/Px5sxe1RE3ARDdvH1o4Yn0t89QQZMi2W1U3PvBF3yw12Pw== X-OriginatorOrg: ti.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Sep 2026 13:00:22.9146 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 67bf66af-2b5a-4a79-0c30-08df1ef2ca07 X-MS-Exchange-CrossTenant-Id: e5b49634-450b-4709-8abb-1e2b19b982b7 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e5b49634-450b-4709-8abb-1e2b19b982b7;Ip=[198.47.21.194];Helo=[flwvzet200.ext.ti.com] X-MS-Exchange-CrossTenant-AuthSource: BN1PEPF00004687.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA4PR10MB8399 X-Authority-Analysis: v=2.4 cv=VfRir1p9 c=1 sm=1 tr=0 ts=6abd07e9 cx=c_pps a=mbkJAKHg+hX/fqCzz7NXWQ==:117 a=iwqwCZQqcuTv3JOpYdM7/Q==:17 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=VdqzKS8jKosA:10 a=AlMIdn_sM9wA:10 a=VkNPw1HP01LnGYTKEx00:22 a=Z8NIEmU8O1QQgoT56wFK:22 a=jwouBfj2j3NM8CExmVVE:22 a=sozttTNsAAAA:8 a=my4mKo85e9fyUbre06AA:9 X-Proofpoint-GUID: fLMKJsbQXdGfBRwtd6nJbUVcF6zqz2Wm X-Proofpoint-ORIG-GUID: fLMKJsbQXdGfBRwtd6nJbUVcF6zqz2Wm X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTMwMDA1MSBTYWx0ZWRfX0lMYtPvk01aF Pki4wZIVuAJEMy8AA3qMAUOriDgdeh2xVGIHHbefMA7idcL9Ywm2muMcE9EGjuSI8H13s1u0x39 y+eG17UOhQVM8HGBKeBatsWVvvKsv6DiOKKfXxPaNYYSEBWdx6+VCLEfQ3WLlodURG5ioVUDOF5 GL8UOXCSY/mXAHbsvYqz6UUyMkDXMNmnPoCsa3GMgS8RXkdGRNbKFAQbMC8DVPvPGw/1Ed6N+T0 vDeQIr3qrXv83xaB5CucHQGKd+uLL6KQgNneN/fyXSUOFSR3WARWKoMH4OdIeLwq76JFD/U8UCv fimECe3ksY/Pi4Idwmoi8t0d6WbUQT1I2dz+hvGnZiCAk+eFAj130z4yYyz3h48EJYtFcviYU2Y yFhDfZPr6nCm+5yf8LS2MblKNPjyJACltL3a0tZJZGrQPmhV8JJZOQqUbDeduOYmjQadnEUOKR+ HWzNEHhXBGYOehkg8zw== X-Proofpoint-Spam-Info: AW1haW4tMjYwOTMwMDA1MSBTYWx0ZWRfX9RKF18gkXBBO lMQiVybeoVhgrP8UxdkfqKnYZKMeTyWKCJ+UN/Vimi1K+IYTRvySA8aYiwZ+ezXdqpHYiogy0Pj KGT+yzn9681cWXvWUSdasflqi9FiKLU= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-30_02,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 adultscore=0 phishscore=0 malwarescore=0 bulkscore=0 lowpriorityscore=0 priorityscore=1501 spamscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609300051 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 30 Sep 2026 13:00:39 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/meta-ti/message/20424 Add a kernel config fragment enabling dm-verity and its crypto dependencies (CONFIG_DM_VERITY, CONFIG_DM_CRYPT, CONFIG_BLK_DEV_DM). Applied via KERNEL_CONFIG_FRAGMENTS, which setup-defconfig.inc reads and merges directly through merge_config.sh. Gated on DM_VERITY_IMAGE being set, matching the rest of the dm-verity dynamic layer. Signed-off-by: Atharv Dubey --- .../security-layer/recipes-kernel/linux/files/dm-verity.cfg | 5 +++++ .../recipes-kernel/linux/linux-ti-staging_%.bbappend | 5 +++++ 2 files changed, 10 insertions(+) create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/files/dm-verity.cfg create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/linux-ti-staging_%.bbappend diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/files/dm-verity.cfg b/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/files/dm-verity.cfg new file mode 100644 index 00000000..c50ce403 --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/files/dm-verity.cfg @@ -0,0 +1,5 @@ +CONFIG_MD=y +CONFIG_BLK_DEV_DM=y +CONFIG_DM_CRYPT=y +CONFIG_DM_VERITY=y +CONFIG_CRYPTO_SHA256=y diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/linux-ti-staging_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/linux-ti-staging_%.bbappend new file mode 100644 index 00000000..9a380cf6 --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/linux-ti-staging_%.bbappend @@ -0,0 +1,5 @@ +# Enable the dm-verity kernel config fragment via KERNEL_CONFIG_FRAGMENTS. +FILESEXTRAPATHS:prepend := "${THISDIR}/files:" + +SRC_URI += "${@'file://dm-verity.cfg' if d.getVar('DM_VERITY_IMAGE') else ''}" +KERNEL_CONFIG_FRAGMENTS += "${@'${UNPACKDIR}/dm-verity.cfg' if d.getVar('DM_VERITY_IMAGE') else ''}" From patchwork Wed Sep 30 12:59:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Atharv Dubey X-Patchwork-Id: 99708 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 14550CA5FB1 for ; Wed, 30 Sep 2026 13:00:19 +0000 (UTC) Received: from mx0b-0002e601.pphosted.com (mx0b-0002e601.pphosted.com [148.163.154.28]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.12824.1790773208931750753 for ; Wed, 30 Sep 2026 06:00:09 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@ti.com header.s=proofpoint-05-2026 header.b=oy92QhvM; dkim=pass header.i=@ticloud.onmicrosoft.com header.s=selector1-ticloud-onmicrosoft-com header.b=harJDjru; spf=pass (domain: ti.com, ip: 148.163.154.28, mailfrom: a-dubey@ti.com) Received: from pps.filterd (m0374955.ppops.net [127.0.0.1]) by mx0b-0002e601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68UB5w5k3214062; Wed, 30 Sep 2026 08:00:06 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint-05-2026; bh=+ubxDtna6gYWTszCfJGhQoKyDa5EFO6ccZJZQ2skN 9A=; b=oy92QhvMvNea720vITUZVzl5HHpXLq/2M7vS2TmBsk1UL3OxFfRCpkgsi 4tT8q+6JZGmHvgN0vnOug6Ph16fQAEyQXaxACifNOb8k5D/Ve9cYcdys73kNeeLb Dk9yZjKZeJ1jBoZQ4Y7Aq2l10c2x0NQf7qUs+iu5Rs9TUBlPr735tEfWjHrjWKU2 er86RNGErH9P4mt62XYbFm2PiOGA3mi/yG5XQwBpMP0PKh2CfYD0FV9q8xRNbVgj Otzb1jGjzK3pcdOP1406JUwITj4STZIglT3jSE3dv8QuZhoYCBVkSZhli0w17yoS SVNq1mUaPIo1/CGFDI6OhzBwTjzyQ== Received: from sn4pr0501cu005.outbound.protection.outlook.com (mail-southcentralusazon11011066.outbound.protection.outlook.com [40.93.194.66]) by mx0b-0002e601.pphosted.com (PPS) with ESMTPS id 4h0ydv95sx-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 30 Sep 2026 08:00:06 -0500 (CDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=XVigWkkslGVNMzwPQmr2n6J4ilUzzx0RuEptI7tS15+K/59UlgfJIVOnPlnRZHEVh88KCP5zSqDYrvG6upVvVr0WpvPSeZ8ZdNwxP9ZYoa2grPkyTXhXOlMzOOMEIp38rio+2DhV17zpY8gXOAq7sHtGOebgihJcNqC1uuelsb0qhbJK0XJ81Ihy53MTR3tdwSNFgvb4iMY01AelQmYPmR+YTE1MiLG++/NH/U6mfo9DSLdHZLhOT4mPJeUCdLbfyxiB6Yc82TzbISv9s9H5/mfOJ4zYjHu+aszhG7C/Ei1FyevfuWnVN+5lPpaKtb7VomG8mMSxmgi6IospFWm4oA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=+ubxDtna6gYWTszCfJGhQoKyDa5EFO6ccZJZQ2skN9A=; b=qX6BsIBeezFrDfwzLBKpGk1pw6ilbbwQ3pBXcIL90ingVU500lf/TJaY4ndt4SbLtdwWqPsGfbulGK92w0Mdq2CA1Bb39GbL/8ohGkPbVtlI6h7Dbab17QRBpgxB/aI+obMraMW+XJ7AW7NTlZlCrUqYopbYbg1AmdjY+sE5E1GSOMk5cLmPv2NYkROCQCy4SUSaktwNvqcr+b21waFPD3E2qQgOdfkIeFbO/ACBmUAIQue5KxdJWdDCjru29NjGlYQKsCR7eoqkr3jgPpxnGCcjKTboN8psKKliDcc+eZlUVeMnlhQ0IOcgm+a5ydSMXTggTVlYE4JrpKjm5ypLLA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 198.47.23.195) smtp.rcpttodomain=konsulko.com smtp.mailfrom=ti.com; dmarc=pass (p=quarantine sp=none pct=100) action=none header.from=ti.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ticloud.onmicrosoft.com; s=selector1-ticloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+ubxDtna6gYWTszCfJGhQoKyDa5EFO6ccZJZQ2skN9A=; b=harJDjru87Db0OBjY1Z05g6teKFBjF6V6i1gN3XQS39pOaRf8Dt4/iwvnrDG2J7Anu5fE3G8UJwv8Fv5oz2DAsK7voNHKoBp0TYtTIPu0kHiJyYi6vrqR9JMkebChyS9Epmq8ZRM5InUM1Z6bI8rvSh1dDcu58UrsoZvjsW1LPc= Received: from BL1P222CA0010.NAMP222.PROD.OUTLOOK.COM (2603:10b6:208:2c7::15) by SN7PR10MB6450.namprd10.prod.outlook.com (2603:10b6:806:2a1::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.9; Wed, 30 Sep 2026 13:00:03 +0000 Received: from BN2PEPF000055E0.namprd21.prod.outlook.com (2603:10b6:208:2c7:cafe::75) by BL1P222CA0010.outlook.office365.com (2603:10b6:208:2c7::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.15 via Frontend Transport; Wed, 30 Sep 2026 13:00:03 +0000 X-MS-Exchange-Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 198.47.23.195) smtp.mailfrom=ti.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=ti.com; Received-SPF: Pass (protection.outlook.com: domain of ti.com designates 198.47.23.195 as permitted sender) receiver=protection.outlook.com; client-ip=198.47.23.195; helo=lewvzet201.ext.ti.com; pr=C Received: from lewvzet201.ext.ti.com (198.47.23.195) by BN2PEPF000055E0.mail.protection.outlook.com (10.167.245.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.3 via Frontend Transport; Wed, 30 Sep 2026 13:00:03 +0000 Received: from DLEE207.ent.ti.com (157.170.170.95) by lewvzet201.ext.ti.com (10.4.14.104) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Wed, 30 Sep 2026 07:59:46 -0500 Received: from DLEE210.ent.ti.com (157.170.170.112) by DLEE207.ent.ti.com (157.170.170.95) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Wed, 30 Sep 2026 07:59:46 -0500 Received: from lelvem-mr05.itg.ti.com (10.180.75.9) by DLEE210.ent.ti.com (157.170.170.112) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45 via Frontend Transport; Wed, 30 Sep 2026 07:59:46 -0500 Received: from lalit-ti-241.dhcp.ti.com (lalit-ti-241.dhcp.ti.com [10.24.50.31]) by lelvem-mr05.itg.ti.com (8.18.1/8.18.1) with ESMTP id 68UCxdxK4098429; Wed, 30 Sep 2026 07:59:44 -0500 From: Atharv Dubey To: , CC: , , , Subject: [meta-ti][master][PATCH v4 3/3] ti-core-initramfs: Extend with dm-verity support Date: Wed, 30 Sep 2026 18:29:38 +0530 Message-ID: <20260930125938.95629-3-a-dubey@ti.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260930125938.95629-1-a-dubey@ti.com> References: <20260930125938.95629-1-a-dubey@ti.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN2PEPF000055E0:EE_|SN7PR10MB6450:EE_ X-MS-Office365-Filtering-Correlation-Id: 77639b5e-9939-4f62-bb8a-08df1ef2be3a X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|23010399003|82310400026|376014|36860700016|6133799003|10067099003|56012099006|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: 6TOLBtIAm3CFlYqrg7LRIMTrbSt24OihgbbyuvXXp9OTSOOn7dF68OrbjKMuruYZDh7FU1gE6ZZiDq+MCjXwFLUuIG1zjByz/3ILDSJHfRuzJU10f57gjyaacXGiuPH+BdsOLXhxtekHgmHZRfYXfvcWgxL/bOY0dKSWeJxHsRfrBHdoq0UmRhQfo1ZCKv20H3KPXQWXRYIFiw6/jC4I904OkLuZrcpEu6zbrfTCkqjQPWU2ErrblAfDAVtYMdmR4go5thiYJh5TgJR71c3ojFMDiERQsuoqDS4QuOpK8IYiqfoeWAwh35mnBOkdTnkqtEcBZCdTDYJxdfb48bSlMp3AWF9co7A2hX8k+PraAzwunX0EZqnPnYuRS5CEKQElPlUqx6mjHKWnQpQyOpfwynhJMYi2Hv+zguyE13GsfiIrLL2RQhDPh0LbmdDVBdOCu5Q2x6q1ZtqqueDeIxgvP6mqduwze/g/NdtotCMKw/tZAOCW/qDBKC9NyG6oGCH/THNu6sGkBjje2s11JuM58hU+tyt+Y8VwfyGM4hUy7EHhFnX691WL0OE4HGhFuBgYn6TV5zUdq6BTNOrUKIyr7EFSweaAoYj0slmRr7+Ps76jwm5yIznRmKCOl7VsS8z21YtCMzvn0nDSaUBT0uhG7tvQmyumRT3Bp2L6vqXh6z2QSup7vAhDGOZ3tf2oKEvCOnS0mFT6gFnqa5K4xwVOPQ== X-Forefront-Antispam-Report: CIP:198.47.23.195;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:lewvzet201.ext.ti.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(1800799024)(23010399003)(82310400026)(376014)(36860700016)(6133799003)(10067099003)(56012099006)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Zvh/A3IzisArIAkqol07ZP4bzFd5qA32wGoO4bVFa35zxXs9Fnu38iP/V3wCglQuqc2OQxRItoS54BXFXfyK7EHhdx3W0k9z6nfbpWGkTL1e84C1y9GQnNKTDIRnPCqe3n8WL8/ZcpylBQRmH77vkAk6XZ0tHtNn5kNYT1KsBCzBFrTw5Kulc37+xZ4tR8XHXRxaZzhUeapmJzmxa6iAV3FJ0s9sZ6c+061PX1w/ZI23dEiX6Ln3aNUhaZspm/Fe5JkIvHdOC3RdHwxjqPO6nek0GTx0+PJ9a5YFeUl5SX6nX7A4gLUcbAA4iSMhsvpFiH8d+eQqvcAw+WxGwg/r6Il2jsQvZ4Cjg9lWgfmL7WVMIDe1BF8tJvdyL+rm1SppfDzTMGaFiQ5q35hsjqErUESezw1LJWMuRZBZ6Hlfki/jjlX8FiCKNHe5htoQtLnp X-Exchange-RoutingPolicyChecked: LVMR6SD2c2zuSlPeC6bf2LOnrf4P9aVaRCbH0wQXmF20/aie2QbeMz+TaYb63fZPFbcM31xZ8XttDaaxCbbV67uNz8/BYd2/vOgLWCuioJ6VxpgPtxunkMLzdFBNIxM5zTA1m3H+QQlkvjtY1F/JUOBgeRD8IGzKFAaz1793of2EjjoEsFpxMvcC48C+gX5IamxzBAZY2/+E3qiSlJsd0Dx+J0JbUA3o+sVjFv37F761aC4sNFYri7CnlyW+GGa9M3cjKZooPBei9BE0b7fyj2hDJb477yc7w9uonpa/6KlFHnRx5Mgyxm24hz+sDhVLSn5i88iDSI2prO8YJ4TTVg== X-OriginatorOrg: ti.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Sep 2026 13:00:03.1087 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 77639b5e-9939-4f62-bb8a-08df1ef2be3a X-MS-Exchange-CrossTenant-Id: e5b49634-450b-4709-8abb-1e2b19b982b7 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e5b49634-450b-4709-8abb-1e2b19b982b7;Ip=[198.47.23.195];Helo=[lewvzet201.ext.ti.com] X-MS-Exchange-CrossTenant-AuthSource: BN2PEPF000055E0.namprd21.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN7PR10MB6450 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTMwMDA1MSBTYWx0ZWRfXyVqFyJk2/YPh m0STkeE5Zw6f+rOQrJpFI9mPq2WxOmING617jAyNwIB8oUtfBLn46NzryLpea/PRS1hleewunFf LFT5R8Z333hzr5RF+w+t+H8J3MU2qeM= X-Proofpoint-GUID: tSuISkVhPOXM_YtwRBicp3JjrZGPMteN X-Authority-Analysis: v=2.4 cv=TegDJhQh c=1 sm=1 tr=0 ts=6abd07d6 cx=c_pps a=1t1hxDBgkqdAqWWjFE2LMw==:117 a=f+v6EHfkeJbVwR46tk4DMg==:17 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=VdqzKS8jKosA:10 a=s63m1ICgrNkA:10 a=AlMIdn_sM9wA:10 a=VkNPw1HP01LnGYTKEx00:22 a=Z8NIEmU8O1QQgoT56wFK:22 a=fPAWb5peG099m5CrUpKH:22 a=sozttTNsAAAA:8 a=NeSs6gxnhKp23kAhfuoA:9 X-Proofpoint-ORIG-GUID: tSuISkVhPOXM_YtwRBicp3JjrZGPMteN X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTMwMDA1MSBTYWx0ZWRfX1IYJ9Zl9TQ9J 7jCPgTbXMojy8RgB299nhOQc6W5fWag1Hxx6wu8SoJaOwUnbtRT1j6bNSSJJC8TLky7AfniYO7g gMoh0eF2o1+uxl/60GLAMbJ8osjoSzHZK9rjK4CcWTMsujZGt3WqIs2XXk7K12yGHNWpmwC7j1V 3sXscbW/hci5WatKSDGjvFfPHnQxiCPmzumj8JXGaoQjfI/9HpxIBzKLuP2I8nxSRs5SKZRgW9H BkEkA2Mep0QUZ+ngpVQO/HF7m09U1CLKNR/E0Grlu1wBm/LEaSW/roXIz6+TSbXvFqJtlVAobSi hyZioZl4fh9wJkBCV1jI/1wdYCVvV1zuYUAN1SW89KWpaqm0rEg/+E9FL07OFtdUWP24cnJfM9l AICkI6dNRSP2ErZvnJZFa0VPlKZQ+iB06vdZ5jL2/IWs5rk64E1E0o0Lgp7tEakY7eKcYrJU0nK Zf9XO+HO1EriUPbScBw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-30_02,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 lowpriorityscore=0 malwarescore=0 phishscore=0 bulkscore=0 clxscore=1015 priorityscore=1501 adultscore=0 suspectscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2609300051 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 30 Sep 2026 13:00:19 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/meta-ti/message/20423 Add dm-verity support to ti-core-initramfs by: - Enabling dm-verity modules and tools (cryptsetup, util-linux-mount) when DM_VERITY_IMAGE is set - Adding do_rootfs[nostamp] and do_image[nostamp] to rebuild initramfs after rootfs verity task completes - Making deploy_verity_hash gracefully handle missing .verity.env file on first pass with bbwarn Signed-off-by: Atharv Dubey --- .../machine/include/ti-core-initramfs.inc | 4 +-- .../initramfs/ti-core-initramfs.bbappend | 25 +++++++++++++++++++ 2 files changed, 27 insertions(+), 2 deletions(-) create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc index c816f1dc..08da8e80 100644 --- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc +++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc @@ -5,7 +5,7 @@ # TI_CORE_INITRAMFS_ENABLED = "0" # #------------------------------------------------------------------------------ -TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}" +TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) or d.getVar('DM_VERITY_IMAGE') else '0'}" TI_CORE_INITRAMFS_KERNEL_MODULES ?= "" TI_CORE_INITRAMFS_EXTRA_INSTALL ?= "" @@ -22,4 +22,4 @@ TI_WKS_INITRAMFS ?= "${@ ',initrd=${TI_CORE_INITRAMFS_IMAGE_FILE}' if d.getVar(' IMAGE_BOOT_FILES += "${@ '${TI_CORE_INITRAMFS_IMAGE_FILE}' if d.getVar('TI_CORE_INITRAMFS_ENABLED') == "1" else ''}" -INITRAMFS_IMAGE ?= "${@ '${TI_CORE_INITRAMFS_IMAGE}' if d.getVar('TI_CORE_INITRAMFS_ENABLED') == "1" else ''}" +INITRAMFS_IMAGE ?= "${@ '${TI_CORE_INITRAMFS_IMAGE}' if d.getVar('TI_CORE_INITRAMFS_ENABLED') == "1" else ''}" \ No newline at end of file diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend new file mode 100644 index 00000000..25fe775f --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend @@ -0,0 +1,25 @@ +# Install the essential utils for dm-verity in ti-core-initramfs +TI_CORE_INITRAMFS_EXTRA_INSTALL:append = "${@' initramfs-module-dmverity cryptsetup util-linux-mount' if d.getVar('DM_VERITY_IMAGE') else ''}" + +# Ensure dm-verity.env is updated also when rebuilding DM_VERITY_IMAGE +do_image[nostamp] = "1" +do_rootfs[nostamp] = "1" + +IMAGE_FSTYPES = "${INITRAMFS_FSTYPES}" + +deploy_verity_hash() { + # The .verity.env file is created by the DM_VERITY_IMAGE build (e.g., arago-base-image). + # On the first pass, it won't exist yet because the initramfs is built before the rootfs + # (due to INITRAMFS_IMAGE dependency). The do_rootfs[nostamp] = "1" causes this task + # to re-run after the rootfs is built, at which point the file will exist. + if [ -f ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env ]; then + install -D -m 0644 \ + ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env \ + ${IMAGE_ROOTFS}${datadir}/misc/dm-verity.env + else + bbwarn "dm-verity.env not found at ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env - will retry on rebuild (nostamp)" + fi +} + + +IMAGE_PREPROCESS_COMMAND += "deploy_verity_hash;"