From patchwork Mon Oct 5 12:12:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Atharv Dubey X-Patchwork-Id: 99999 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81B4DCA5FF0 for ; Mon, 5 Oct 2026 12:12:39 +0000 (UTC) Received: from mx0b-0002e601.pphosted.com (mx0b-0002e601.pphosted.com [148.163.154.28]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.18550.1791202354122943594 for ; Mon, 05 Oct 2026 05:12:34 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@ti.com header.s=proofpoint-05-2026 header.b=SIQnrfoI; dkim=pass header.i=@ticloud.onmicrosoft.com header.s=selector1-ticloud-onmicrosoft-com header.b=arjRjESI; spf=pass (domain: ti.com, ip: 148.163.154.28, mailfrom: a-dubey@ti.com) Received: from pps.filterd (m0374956.ppops.net [127.0.0.1]) by mx0b-0002e601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 695BTDtL3542695; Mon, 5 Oct 2026 07:12:32 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; h=cc :content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=proofpoint-05-2026; bh=lvS2MSUs7mCdB yrfRgoX43Y+U8shj0Cjk2bzQy9ttT4=; b=SIQnrfoINUwN4tWI3Ye8BXsjo2isb HR6QFktLBr/l0sS/rCnrZ9RS6imcHNf/458R1YljEv+1n5kgk4am5lLS92cQE16c WF5n0RPmasWISm5sKxBgtwpTrjPf3BfBcNcKKcCdr0GzcwyjCeqTqnrpaxNtdw/S M06DC8eoM2iTVT23pWqo4Pxg35hk2ZHtSkYdkkMqZbr+2JlP6iOTVscRieKK9H3w 24zRvXftLC0yojRAYNKRcohYIHJSslsXb0D66pQUJpz9T2aT8yxTVlnht0vuFO6O vOUPJxOsCW1MgcHxRMmU9yW6B+dvbziac1qEg/AUd3FHwll7K6L9Br6uA== Received: from byapr05cu005.outbound.protection.outlook.com (mail-westusazon11010043.outbound.protection.outlook.com [52.101.85.43]) by mx0b-0002e601.pphosted.com (PPS) with ESMTPS id 4h3gup5a66-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Mon, 05 Oct 2026 07:12:31 -0500 (CDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=IXWrszF5QdrGGMZw/42Fab56dNXzHOPS6kuJOZulL8JwP7ynuBJZOJqeuFSu2WLPfdFqJnyBHk4bTVrGNyvpBSEyZcUPB0gDQX090+rRGJcMkoZq067FSYqzsMkeLg+wbvAS59fAXSuHO2d0jA/NhgTdh3pwpHFMNPEPD8vZz/NPCPb9rS7wDy3h5u+7LhcX/s/CO0LAEehhPYsm6IWiInpyde0yxJq6iHTYa9Z9KyoSoPtTP4dAxK6miUrU3u716NRKwBPue3IuelchvcpSFmGvs2kii6t7nbf5Wu0kZK4/v4S8yY//bPiZdA+L7S1AkyCKOdK7v8e017ToHpBBjA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=lvS2MSUs7mCdByrfRgoX43Y+U8shj0Cjk2bzQy9ttT4=; b=B9ps+t3dc3RuFDX7QmvsuFsPOV+Ur1wNKspq1WheLwY9mRXNqxBZ46VvYCevShW3WDCQjbT6ZKrcj7lnCVV4QMUXjbTY6Ek6HM6ugqAINLUfft5Fm4ydvdJOTvjiqZ60J3Sl/3p5WcPcdoZuxR4IuTNq0mUl91yGu03M48erSz6azbkS+vVrFOkVJlMnXFNaUwTu37cZ3rVn4BiN46n5mPqXMokyTES78ta8A7H8kV+AxWakxmzaTUZNKVG1Cj7shaPFow2IOIQx67rKQ/fZc6vtxnXuAJGmJLJ042p6oYk3TIoiQOTqibndRw5JxKz/8hQHMxmB5lbL7gfQiED8yA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 198.47.23.194) smtp.rcpttodomain=konsulko.com smtp.mailfrom=ti.com; dmarc=pass (p=quarantine sp=none pct=100) action=none header.from=ti.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ticloud.onmicrosoft.com; s=selector1-ticloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lvS2MSUs7mCdByrfRgoX43Y+U8shj0Cjk2bzQy9ttT4=; b=arjRjESIP7Mb3tqZnlgZR5zT1lTB+YUUJpNH/+Y6yzeQ/3+9qre0rqYM+tPz0jDTmMzmQsFk8dtsvDrGYyY0yiIppWsrwO7avgEmsc0/KYEqN12WIYmTf5V6/8BxzSIBGOaVR0h8zwIsm5Z635adT1X+gtu77fjvoidqeIJD/XQ= Received: from CH0PR08CA0014.namprd08.prod.outlook.com (2603:10b6:610:33::19) by MN6PR10MB7998.namprd10.prod.outlook.com (2603:10b6:208:4fc::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.14; Mon, 5 Oct 2026 12:12:28 +0000 Received: from CH1PEPF0000AD81.namprd04.prod.outlook.com (2603:10b6:610:33:cafe::10) by CH0PR08CA0014.outlook.office365.com (2603:10b6:610:33::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.20 via Frontend Transport; Mon, 5 Oct 2026 12:12:28 +0000 X-MS-Exchange-Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 198.47.23.194) smtp.mailfrom=ti.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=ti.com; Received-SPF: Pass (protection.outlook.com: domain of ti.com designates 198.47.23.194 as permitted sender) receiver=protection.outlook.com; client-ip=198.47.23.194; helo=lewvzet200.ext.ti.com; pr=C Received: from lewvzet200.ext.ti.com (198.47.23.194) by CH1PEPF0000AD81.mail.protection.outlook.com (10.167.244.89) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Mon, 5 Oct 2026 12:12:28 +0000 Received: from DLEE213.ent.ti.com (157.170.170.116) by lewvzet200.ext.ti.com (10.4.14.103) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Mon, 5 Oct 2026 07:12:22 -0500 Received: from DLEE207.ent.ti.com (157.170.170.95) by DLEE213.ent.ti.com (157.170.170.116) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Mon, 5 Oct 2026 07:12:22 -0500 Received: from lelvem-mr05.itg.ti.com (10.180.75.9) by DLEE207.ent.ti.com (157.170.170.95) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45 via Frontend Transport; Mon, 5 Oct 2026 07:12:22 -0500 Received: from lalit-ti-241.dhcp.ti.com (lalit-ti-241.dhcp.ti.com [10.24.50.31]) by lelvem-mr05.itg.ti.com (8.18.1/8.18.1) with ESMTP id 695CCJ9I1103986; Mon, 5 Oct 2026 07:12:20 -0500 From: Atharv Dubey To: , CC: , , , Subject: [meta-ti][master][PATCH v5 1/3] dm-verity-upstream: Add dynamic layer for meta-security dm-verity Date: Mon, 5 Oct 2026 17:42:16 +0530 Message-ID: <20261005121218.844998-1-a-dubey@ti.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH1PEPF0000AD81:EE_|MN6PR10MB7998:EE_ X-MS-Office365-Filtering-Correlation-Id: a397c2f3-2ee9-416e-93c6-08df22d9eca6 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|376014|23010399003|1800799024|36860700016|6133799003|18002099003|10067099003|56012099006|5023799004; X-Microsoft-Antispam-Message-Info: uCcp0xYomFVbytv52CsYpLV9fdF5u1UIrAP1U7gfcFJ3DZn27lfwQuCroYs9Xks/WBO1EjetV3DkmzLpnNYGf4UFbuUl3e6T/awKC7Yl4UnvhVRcQNIBpmbhkf6A3r2ZYgDGSrZqL+iryaP5kGbqbeR7Bt6CABTVNy+vWSY0MZXdLfV3M5S1gdgUSZMk8gzR1Mnt7WzY7i7zBCzfxbI7isBqjjcxcAo8kBg+JQaBQj+M3Be7QFQcPLK6McPvjccunrvckjIOaVu1Dla+Irqa9HnOq/8lDGW1R8irwCqIoyZUa/2m8cIz1A/XfNsMwRx6JgJfAnbVvRglPtoAYIjwolSr/XgbD0nrH4hW6rbSYbFgHwQBKGhnjSkAZpfF+c53Akt4ZHAE7K33lZzEpHOqgiPfLBTrLJrLTHjQGhmjf/+6B1pF3XfBccMvGHXXUEPln3EmkmWRffzYtgPhVffZqvLKNumeIOUmQ1Dr4aITVVq/8c4/YrNqchkWvjktjTaISrqB3ELrkpO8/nOVyGPAbpBiHPlwwW8LVVTXbSqwqSCd+Ke1/8XUj7Rfcp7lz1lH02flUBJ9c8lhhW3T4tZbGWxKHpESQF/cBl5XncoIGJn+xqCnzrtX96YJXgWzTXEMcuFJbR56kginQfm8HXElfgOwVzh3KRGE047GkFbbgQUZPYS8L8PrAUI0n8BwQGqr9HLCwbZKqWXk4zHMfg0Acg== X-Forefront-Antispam-Report: CIP:198.47.23.194;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:lewvzet200.ext.ti.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(82310400026)(376014)(23010399003)(1800799024)(36860700016)(6133799003)(18002099003)(10067099003)(56012099006)(5023799004);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: YOjmhMeFAQ/X803Cp66QgQHioACqoprFf2XcVu3EqqUD2/8Trn60cEj5ZQzJw/la0vwluQwG7btULXDyzFd4UO47OLnloOtpYH4Xlox4c4y11iHzEu39u7kazQOGZneRK1Gn/MvaUGS2z/rG0r/MvvRK4Vf8tkwnOqfWOz7Q7TmYu7ERZMig7oDtojtGpXhiDTzQO0REYx5UtO96SgYi3sdZEvjho4C8/qETpPTVssBNLQLYdQT1OIZXc2KDNzIIwe1OL+wfy9PcWWIXEfKRXdAM+bDOumlRX8QQBx+CaUsoV0aGx0FKCOhLgiz8t7ZyIE5o9WAGDTDlamWaFvZa8fczdPy1dMiU7WwJUViP6wgoqif5MRpMxZEQlIea+ecIiSTZWEw0Xh1d0rEsntWHOfboid8vitX47LBzOjB5Wc5GaE8WJr7tdi2114N8aWfq X-Exchange-RoutingPolicyChecked: AprVbwROBG+SQR6T/wvmw8IujUW6f5QmgZXlmLwg5TS8NCW8egTwkn60mK8C/5m/DqBlUD/EZDLpYchaFo9ZRAWBCKMgJbugLAJhaop0ktNxQT/TYaojIILIJ1QWX5GVvTmLi10BVJGRzQRGjK6faMRX6BEgtfE+6lLCmUwbhU65HK0BwUV50zWtOHI7TJfzj4tTmjt2fl/pqxU/DfeJjsO7sD6p8HbMwW+u589hNjnzawif5EPeMN2GLF6PXn1GnWq8AWiB0eNkv7/ClCkdsQOmm3B4vcbY1SdQNg7m8G3p37O/KJrA2sxl7AZw3ZigAuk8bazNVDEgIYig5BYxzQ== X-OriginatorOrg: ti.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Oct 2026 12:12:28.2550 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: a397c2f3-2ee9-416e-93c6-08df22d9eca6 X-MS-Exchange-CrossTenant-Id: e5b49634-450b-4709-8abb-1e2b19b982b7 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e5b49634-450b-4709-8abb-1e2b19b982b7;Ip=[198.47.23.194];Helo=[lewvzet200.ext.ti.com] X-MS-Exchange-CrossTenant-AuthSource: CH1PEPF0000AD81.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN6PR10MB7998 X-Authority-Analysis: v=2.4 cv=KqjYSmWN c=1 sm=1 tr=0 ts=6ac3942f cx=c_pps a=630MGKGvePsHimlcG8SYgw==:117 a=WotqVVQAdb04rnGuttW3Kw==:17 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=660iZSQnnn4A:10 a=s63m1ICgrNkA:10 a=AlMIdn_sM9wA:10 a=VkNPw1HP01LnGYTKEx00:22 a=Z8NIEmU8O1QQgoT56wFK:22 a=jwouBfj2j3NM8CExmVVE:22 a=sozttTNsAAAA:8 a=cW7-tuCRIaqJVRneuyUA:9 X-Proofpoint-ORIG-GUID: 3mDRNpPZxgyEHB2hwRUINaNuHftyWhqc X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA1MDA0NyBTYWx0ZWRfX3kyhcscACmho 9iRIqIqOQjUieE2R7AO9/kTf32IG6EderowIhN+3VrbD7kNQIGAXcDT8qzlnaOqTP/EL2jNdxOE lxzVbQTrh87Xx9Uo+Lb0Vg+JhPCFszI= X-Proofpoint-GUID: 3mDRNpPZxgyEHB2hwRUINaNuHftyWhqc X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA1MDA0NyBTYWx0ZWRfX1z+Crb6FKAiQ WpoVBONZyeoG7dbR6cgi0uWincut+SlcrxV9MjOAkS0SrypArS4fgm2LbHmOSnoMzIZb/35oIYl J8C1ydqrLiBL3NWXv754R6zOphSRP1M12fbXAI04toJ7QwCTLlLDQJxpe3zyJogaypm7udiQvx+ kFD2G3MpGiy+dRAVkdn03sOGJngxySROGdnWojqQkbW6RQIHwWo5TLZiKMYjYLLMz7J9Xljqrue lwhgkO7kLc5Wen7FcoIXbNVM8CF67/5mH5Z2XyN4X8FNW+QNn0Mh8Vp+3bywdt1gl46ImxaPnjJ 3Zc+0fmvw7IXWBT2Zp3cRd2xhFqzHkKA9UvsxWPo0mJv2L6uSvyJsHDFCOUuR+2UD+BAMRudjYz k/galMbr6SYrNxX3rOWzW84RGfxs2kj1ubEMRkvnyDLUHUTfEy4Dr0NuEhu/hqP5d7omeQq4lLm gwCURIEW+17pLhz921Q== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-05_03,2026-10-02_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 malwarescore=0 adultscore=0 clxscore=1015 bulkscore=0 priorityscore=1501 spamscore=0 phishscore=0 lowpriorityscore=0 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610050047 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 05 Oct 2026 12:12:39 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/meta-ti/message/20432 Add an optional dynamic layer enabling dm-verity block-level integrity verification of the root filesystem for TI K3 platforms, using meta-security's stock dm-verity mechanism as-is. Requires meta-security to be present in bblayers.conf. dm-verity hashes the rootfs at build time; at boot, a dedicated initramfs loads the root hash and the kernel checks every block read against it. Set DM_VERITY_IMAGE to enable all the verity-related recipes for that image; other images build as usual. Signed-off-by: Atharv Dubey --- v5: - unify the python functions v4: - Use ti-core-initramfs instead of a separate dm-verity initramfs - Instead of a DISTRO_FEATURE, just check if DM_VERITY_IMAGE is set v3: - Disabled the automount rules from udev-aragoconf, so don't need the ignorelist for dm-verity v2: - Replaced hardcoded /dev/mmcblk1p2 with a PARTUUID --- meta-ti-bsp/conf/layer.conf | 3 +++ meta-ti-bsp/conf/machine/include/k3.inc | 7 +++++++ .../conf/include/dm-verity-upstream.inc | 21 +++++++++++++++++++ .../udev/udev-aragoconf_%.bbappend | 5 +++++ .../udev/udev-extraconf_%.bbappend | 6 ++++++ meta-ti-bsp/files/wic/k3-verity.wks.in | 5 +++++ 6 files changed, 47 insertions(+) create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend create mode 100644 meta-ti-bsp/files/wic/k3-verity.wks.in diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf index 3cc54aa4..aca35cd3 100644 --- a/meta-ti-bsp/conf/layer.conf +++ b/meta-ti-bsp/conf/layer.conf @@ -20,12 +20,15 @@ LAYERDEPENDS_meta-ti-bsp = " \ LAYERRECOMMENDS_meta-ti-bsp = " \ openembedded-layer \ tpm-layer \ + security \ " BBFILES_DYNAMIC += " \ openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \ tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bb \ tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bbappend \ + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bb \ + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bbappend \ " SIGGEN_EXCLUDERECIPES_ABISAFE += " \ diff --git a/meta-ti-bsp/conf/machine/include/k3.inc b/meta-ti-bsp/conf/machine/include/k3.inc index 2ebbfb9e..f19db45f 100644 --- a/meta-ti-bsp/conf/machine/include/k3.inc +++ b/meta-ti-bsp/conf/machine/include/k3.inc @@ -64,3 +64,10 @@ FALCON_INCLUDE = "" FALCON_INCLUDE:ti-falcon = "conf/machine/include/ti-falcon.inc" require ${FALCON_INCLUDE} + +# dm-verity protects the rootfs listed in DM_VERITY_IMAGE; see dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc for what that turns on. +DM_VERITY_IMAGE ??= "" + +DM_VERITY_UPSTREAM_INCLUDE = "${@'dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc' if d.getVar('DM_VERITY_IMAGE') else ''}" + +require ${DM_VERITY_UPSTREAM_INCLUDE} diff --git a/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc new file mode 100644 index 00000000..e9353fcc --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc @@ -0,0 +1,21 @@ +# Enables dm-verity to check the rootfs for tampering on TI K3 boards. +DM_VERITY_IMAGE_TYPE = "ext4" +IMAGE_CLASSES += "dm-verity-img" + +# ti-core-initramfs.bbappend already wires the initramfs into the boot partition once dm-verity is enabled, so we don't need to do it here. + +python () { + import uuid + + if d.getVar('PN') != d.getVar('DM_VERITY_IMAGE'): + return + + # Derive the root partition's UUID from MACHINE so everyone computes the same one. + if not d.getVar('DM_VERITY_ROOT_PARTUUID'): + d.setVar('DM_VERITY_ROOT_PARTUUID', + str(uuid.uuid5(uuid.NAMESPACE_DNS, 'dm-verity-root-%s' % d.getVar('MACHINE')))) + + d.setVar('WKS_FILE', 'k3-verity.wks.in') + d.appendVar('EXTRA_IMAGE_FEATURES', ' read-only-rootfs') + d.appendVar('WICVARS', ' DM_VERITY_IMAGE DM_VERITY_IMAGE_TYPE IMAGE_NAME_SUFFIX IMGDEPLOYDIR DM_VERITY_ROOT_PARTUUID') +} diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend new file mode 100644 index 00000000..e5f6c1b2 --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-aragoconf_%.bbappend @@ -0,0 +1,5 @@ +do_install:append() { + if ${@'true' if d.getVar('DM_VERITY_IMAGE') else 'false'}; then + : > ${D}${libdir}/udev/rules.d/50-arago.rules + fi +} diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend new file mode 100644 index 00000000..a14e21ea --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-core/udev/udev-extraconf_%.bbappend @@ -0,0 +1,6 @@ +# Nothing should ever get auto-mounted under dm-verity, so just kill the automounter. +do_install:append() { + if ${@'true' if d.getVar('DM_VERITY_IMAGE') else 'false'}; then + : > ${D}${sysconfdir}/udev/rules.d/automount.rules + fi +} diff --git a/meta-ti-bsp/files/wic/k3-verity.wks.in b/meta-ti-bsp/files/wic/k3-verity.wks.in new file mode 100644 index 00000000..62ae0ec1 --- /dev/null +++ b/meta-ti-bsp/files/wic/k3-verity.wks.in @@ -0,0 +1,5 @@ +# Disk layout for a board that boots with dm-verity enabled. + +bootloader --timeout=3 --append="rootfstype=ext4 root=PARTUUID=${DM_VERITY_ROOT_PARTUUID} ${TI_WKS_BOOTLOADER_APPEND}" +part --source bootimg-efi --sourceparams="loader=${EFI_PROVIDER}${TI_WKS_INITRAMFS}" --fstype=vfat --label boot --active --align 1024 --use-uuid --fixed-size 128M +part / --source rawcopy --sourceparams="file=${IMGDEPLOYDIR}/${DM_VERITY_IMAGE}-${MACHINE}${IMAGE_NAME_SUFFIX}.${DM_VERITY_IMAGE_TYPE}.verity" --align 1024 --uuid ${DM_VERITY_ROOT_PARTUUID} From patchwork Mon Oct 5 12:12:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Atharv Dubey X-Patchwork-Id: 100000 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61647CA5FCE for ; Mon, 5 Oct 2026 12:12:59 +0000 (UTC) Received: from mx0a-0002e601.pphosted.com (mx0a-0002e601.pphosted.com [148.163.150.75]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.18546.1791202370825846405 for ; Mon, 05 Oct 2026 05:12:51 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@ti.com header.s=proofpoint-05-2026 header.b=bxxCO3eB; dkim=pass header.i=@ticloud.onmicrosoft.com header.s=selector1-ticloud-onmicrosoft-com header.b=Qnxvfxxc; spf=pass (domain: ti.com, ip: 148.163.150.75, mailfrom: a-dubey@ti.com) Received: from pps.filterd (m0380145.ppops.net [127.0.0.1]) by m0380145.ppops.net (8.18.1.11/8.18.1.11) with ESMTP id 695BSJEi3814775; Mon, 5 Oct 2026 07:12:48 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint-05-2026; bh=Gf4ifUp6Iyk5VwZkpjzvtNBRYD+DXvaQiD8F/gtO7 04=; b=bxxCO3eBb/wETwPZBdJHp1kHSsLrRdiQolw5jsCSgOUDdZ0j2wAKTHeKH QRSGrwHhD3ItMJGve+Z3+aCaIt16slcJbgsglwGalJuR69dn2DRCvmjI5C4pGQbn GyTV1aHD1K7kMllcQe+3pNTLtlgosklfV+VyLQHGI3G8A1QXPUOkO58B0aEeb7uJ hXZ/txtOTiAf+8p5QMwdgd9XDZ+qzBnjyYBa4nun0zQzVbfP4jywjN1L8c1LZ/mm Vge61FP5wtNwzinq19Cy2yDtY0BPYR747M4ZE0V6xE3SQcknOIzGoM/VRWjS6Oed QawK0R184QkK84YzwyGQPiR7dQLJw== Received: from ch5pr02cu005.outbound.protection.outlook.com (mail-northcentralusazon11012020.outbound.protection.outlook.com [40.107.200.20]) by m0380145.ppops.net (PPS) with ESMTPS id 4h3jqncxby-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Mon, 05 Oct 2026 07:12:48 -0500 (CDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=cK1m3awjoGHkr1TUFxOFFsG3fR+93C0gufZChM0/olyEEINtJgnTClS+2HYE0E8IcO+d3vGZD5pdveiSK9y+H47ETHeHC5a4rW9IeszOdvkxt9yzP6/si2su0y6jK2OKKjN2Bj+kBj6vb+Sug9KuwMlMlUU4jcC7pCSXKholyongsusiCYd0Vg1UuAbg0HkJtxS8DWuzfgHT70rqhDa/8gQilbKK4Ki/ThUXxxOyJR+A21nVTQdduc873sQviIY3ak4FSu8o5gBK5yVwgFzL7fmPtIaqEmI3fNowcJdeuzgIvMe0cIAvrxNjgKZHkxr6IVcfkLuwSdJKqpP1LkoaOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Gf4ifUp6Iyk5VwZkpjzvtNBRYD+DXvaQiD8F/gtO704=; b=pqq93JIwj5Yy5VADus+nBqU2t7tlh/XAMUAyokU2VEjHIIZYfJKfDMd4tkuaoEYT5sjM87LwhJFU3gsjU7e9Z4h/1S0uumeDRwGgdwJtSOoQ6mCBjhBhUdoBkHRSQnC1kqs7dH00F3aWG3rJ5scySgoVfhwrfyUPs+z7qqHL37Zpfe/j/yzIghwsw0wZdd3zuuohl1hZFrAwLmZc1gCI+KiVXSQheVRIjlTl56msf4jdLQjZCghsxO+3D5WhiZi+trHslozK2iXM0lJ75QMqpi3j/4ucPT0cuyjlpau2v0R5ATTgB0uQQTYCY5FJub7hAbbI6+/+3kAAiZia+l/jig== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 198.47.23.195) smtp.rcpttodomain=konsulko.com smtp.mailfrom=ti.com; dmarc=pass (p=quarantine sp=none pct=100) action=none header.from=ti.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ticloud.onmicrosoft.com; s=selector1-ticloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Gf4ifUp6Iyk5VwZkpjzvtNBRYD+DXvaQiD8F/gtO704=; b=QnxvfxxcfyRmwnSjRb3vfAS7sjf4BsA7FASuCVEd5Nvpk3bzkxfxwHGWuKgyBYyPS09YeOBlyUrAUDaTF7B1aqJX0fW4S4qlaiPY4zAYtrYFjc1ZQZ52UPyYkJKxSAD41nZhV8ppMQk91gO4VePp8/L6sAxPdBN6mHh2KgSdB5s= Received: from CH2PR10CA0009.namprd10.prod.outlook.com (2603:10b6:610:4c::19) by DS4PPFB033C1B5C.namprd10.prod.outlook.com (2603:10b6:f:fc00::d42) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.14; Mon, 5 Oct 2026 12:12:44 +0000 Received: from CH1PEPF0000AD83.namprd04.prod.outlook.com (2603:10b6:610:4c:cafe::43) by CH2PR10CA0009.outlook.office365.com (2603:10b6:610:4c::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.20 via Frontend Transport; Mon, 5 Oct 2026 12:12:44 +0000 X-MS-Exchange-Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 198.47.23.195) smtp.mailfrom=ti.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=ti.com; Received-SPF: Pass (protection.outlook.com: domain of ti.com designates 198.47.23.195 as permitted sender) receiver=protection.outlook.com; client-ip=198.47.23.195; helo=lewvzet201.ext.ti.com; pr=C Received: from lewvzet201.ext.ti.com (198.47.23.195) by CH1PEPF0000AD83.mail.protection.outlook.com (10.167.244.85) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Mon, 5 Oct 2026 12:12:43 +0000 Received: from DLEE210.ent.ti.com (157.170.170.112) by lewvzet201.ext.ti.com (10.4.14.104) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Mon, 5 Oct 2026 07:12:24 -0500 Received: from DLEE200.ent.ti.com (157.170.170.75) by DLEE210.ent.ti.com (157.170.170.112) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Mon, 5 Oct 2026 07:12:24 -0500 Received: from lelvem-mr05.itg.ti.com (10.180.75.9) by DLEE200.ent.ti.com (157.170.170.75) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45 via Frontend Transport; Mon, 5 Oct 2026 07:12:24 -0500 Received: from lalit-ti-241.dhcp.ti.com (lalit-ti-241.dhcp.ti.com [10.24.50.31]) by lelvem-mr05.itg.ti.com (8.18.1/8.18.1) with ESMTP id 695CCJ9J1103986; Mon, 5 Oct 2026 07:12:22 -0500 From: Atharv Dubey To: , CC: , , , Subject: [meta-ti][master][PATCH v5 2/3] linux-ti-staging: Add dm-verity kernel config Date: Mon, 5 Oct 2026 17:42:17 +0530 Message-ID: <20261005121218.844998-2-a-dubey@ti.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20261005121218.844998-1-a-dubey@ti.com> References: <20261005121218.844998-1-a-dubey@ti.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH1PEPF0000AD83:EE_|DS4PPFB033C1B5C:EE_ X-MS-Office365-Filtering-Correlation-Id: 6bfd1380-b843-4db9-9c58-08df22d9f600 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|36860700016|376014|23010399003|1800799024|22082099003|18002099003|10067099003|56012099006; X-Microsoft-Antispam-Message-Info: MyPc5u6C8/dIBD9udOdOHZ8I7/P0857CmNLzaVx4W1oIWanzWH9O8wHdmT8f6ApcM4Tzh8COX7DinW8Y5NOez0+Gq0yGq5GfvbpSPgv1Qo7/mna4Xjk7++aeQu50KfFiCJ8WKLbOB8rQnkrgXGm/v/0q9gCIXQRiVoOLD7wfFhch4fEwU4PZXSkNd74ZjttxHOOkp5j4RyI5ulLhbNA15jptDZ1bigzHsd7Ie3zKYxHQTz+b5Xw/3xuSSltj1kzhe76G4eSTbXCoD0ZJNc2f+UDkfEjKelDFvmBua201tXAb/nXObFVvBR0wzqeFZD4AMINxAncKtKe4ClvepUk0ZysCYz1a7rg+d91Vk6JJw4XSUC/RqveOrOb7rDBtqr9yci8vnLEXueSw91BMLzSQFYmXjBOm2pThUyLznqOtLgUMKKU/x2BQrky98adca5e81nV32IYSp1Lh6So1s6Y+Bfen4vWULk7b6rZnMFG7vajADEV7y8i4ZP1yEn1mYexL/iv1JLmzyjToJmqu7+ORQtNbd4Bx2iy8J+wSXJwqPmf6WJ+i1i0wQgv3qwdg5kLARTEQfdxxhHAWTd05hvzldRsZYm5FZnV2zx1/5e2cCeTiM+gsvgIIIuAICl9AC6hqMlob290RLPRtUeLavOIFxPnVT0UWv/7ayYjUSJfG2K5lSEluTUiek2ECcqfuboWA15ZmHiFkl8otkFGQj/ZQ8A== X-Forefront-Antispam-Report: CIP:198.47.23.195;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:lewvzet201.ext.ti.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(82310400026)(36860700016)(376014)(23010399003)(1800799024)(22082099003)(18002099003)(10067099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: pBBDAckgGxQ0riobzUacayaAo2wMKp+gwWUJgGtFJSdCX87gJcGdmHfTwbOq3y7R/56t6JS87Poa6okjj4WL+7y71i7Uv5dq0Tiyr287ZDdgKIk7OSx+M5bV9W69qfbOdOOBSmW/SdrSTgUty7iePT2SDE8uwkBbseKyaVgzqw8U4Z/jgTkPNSffXD5utl5bY/2LhI0Vx3HdAQkVDAkIpfMXa/ZnX5TvS70wmR/e6O1qkmQCdLpS4jZAJGu8gF3iWvz12D9UcdQYQdVxqe4a0F9yROXO7PxVeAgbVC0AiSeNqg34jy/da1iT0knlomLHq0SwGeS1G5Ahf0wuJehisZ919ZX5zTBVZsNbBKcqsanaQCEP1G9i6RK64U2U6YC3pViMLVmn6ooU6ZJ8XdRvaUD3YZlbUv+sVBOb6B9WkISTfcF57xAYWQ/UnJKvyJ0s X-Exchange-RoutingPolicyChecked: PTWt/HIfvwovgJb1smnCs5mAHr8y7jLLXPFdXwZKQ3qM8OwUrbwrGDP0qXXlkha4ocm67K27H75dkq9DitA5sFkqVFo2dElm5kxIoEYAZTGN3a8bWl9LwIcXDyhIk9PWlhS3W3cIPsi6h1+5AnXMYZeIYiIZ4cS0j5EPKy4d14tOqX/QknSOceClWvBtFk2FrFliMbGdWDuHlnAxUthFPtZiS3KZ7oE+jTMERzRCGWbTlv3f+xNHv7xPTXJenlQFyh+XeRYtve8YnS+LjAyA4/M24iwn7evS9FQl0UYgk+Z5SaLwXp7ynSH5LvFJX8BjSS8qsMuQe1hmrOWUShXoCw== X-OriginatorOrg: ti.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Oct 2026 12:12:43.9408 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 6bfd1380-b843-4db9-9c58-08df22d9f600 X-MS-Exchange-CrossTenant-Id: e5b49634-450b-4709-8abb-1e2b19b982b7 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e5b49634-450b-4709-8abb-1e2b19b982b7;Ip=[198.47.23.195];Helo=[lewvzet201.ext.ti.com] X-MS-Exchange-CrossTenant-AuthSource: CH1PEPF0000AD83.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS4PPFB033C1B5C X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA1MDA0NyBTYWx0ZWRfX8K3Sp2X+XiRZ Yw+UAOZV1wfgU6TaaBao7rOvLZg55WK4FSiK3vK0QC7f4QP5b0S0p+nlhAR1pKoOAXmhkgPnpmo s9M3T0ye16UU+UJ1QxBObtcuoyqNsRU= X-Authority-Analysis: v=2.4 cv=I6/w19gg c=1 sm=1 tr=0 ts=6ac39440 cx=c_pps a=Og0UtPbLppQH9mpfBaDriA==:117 a=f+v6EHfkeJbVwR46tk4DMg==:17 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=660iZSQnnn4A:10 a=s63m1ICgrNkA:10 a=AlMIdn_sM9wA:10 a=VkNPw1HP01LnGYTKEx00:22 a=Z8NIEmU8O1QQgoT56wFK:22 a=gO1vWkAQAl3rybz1DQOp:22 a=sozttTNsAAAA:8 a=my4mKo85e9fyUbre06AA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA1MDA0NyBTYWx0ZWRfX+1YGsl91j57r 3+PgVRwy5sVxhRdVHKJYto5uILaIT5oAbwM540HQI/apgxBcPgybB5xpBI+dDHTmwpFGJGM12jS HcIAOwbbgOphAzB7KTSa0mR+n343HRhZb4nTaIYl8ysKdc4CoFstmfsnEH2V0Osp/5u5s8VFc2p aSq9RtC0CXoe3ETfRLXxdAnKwNCQu/dd3iDWh3AGCexP/SX2VgUgdP/gB3vBqIitTKO7mfwnUVX phZyE+VISJNzwaN8p8KyiyD/TKs8yQDxiSfbgrvMV92boTYKrgui9NaSPuXfhwJGdCmf2/h37cv jLKCAsb6+LStVKoGF5IXXaulLyBYDsjkhzA9FwP1oHZF9asCTT5fiS7Pw2xmPFEUOGkfaJqp1YP MAqRMvdFHYABRjc41625rz/G2miyhJ9PqOYZMJA8ujAADhWaotsPm6QIeFAzLJVrEJnKWYyFC6d p9ynilOIXKKEA7ipWyA== X-Proofpoint-ORIG-GUID: nHw1ayORXbj0mGw24t6U8acL29qYWAxx X-Proofpoint-GUID: nHw1ayORXbj0mGw24t6U8acL29qYWAxx X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-05_03,2026-10-02_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 malwarescore=0 impostorscore=0 adultscore=0 lowpriorityscore=0 phishscore=0 suspectscore=0 clxscore=1015 priorityscore=1501 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610050047 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 05 Oct 2026 12:12:59 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/meta-ti/message/20433 Add a kernel config fragment enabling dm-verity and its crypto dependencies (CONFIG_DM_VERITY, CONFIG_DM_CRYPT, CONFIG_BLK_DEV_DM). Applied via KERNEL_CONFIG_FRAGMENTS, which setup-defconfig.inc reads and merges directly through merge_config.sh. Gated on DM_VERITY_IMAGE being set, matching the rest of the dm-verity dynamic layer. Signed-off-by: Atharv Dubey --- .../security-layer/recipes-kernel/linux/files/dm-verity.cfg | 5 +++++ .../recipes-kernel/linux/linux-ti-staging_%.bbappend | 5 +++++ 2 files changed, 10 insertions(+) create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/files/dm-verity.cfg create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/linux-ti-staging_%.bbappend diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/files/dm-verity.cfg b/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/files/dm-verity.cfg new file mode 100644 index 00000000..c50ce403 --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/files/dm-verity.cfg @@ -0,0 +1,5 @@ +CONFIG_MD=y +CONFIG_BLK_DEV_DM=y +CONFIG_DM_CRYPT=y +CONFIG_DM_VERITY=y +CONFIG_CRYPTO_SHA256=y diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/linux-ti-staging_%.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/linux-ti-staging_%.bbappend new file mode 100644 index 00000000..9a380cf6 --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-kernel/linux/linux-ti-staging_%.bbappend @@ -0,0 +1,5 @@ +# Enable the dm-verity kernel config fragment via KERNEL_CONFIG_FRAGMENTS. +FILESEXTRAPATHS:prepend := "${THISDIR}/files:" + +SRC_URI += "${@'file://dm-verity.cfg' if d.getVar('DM_VERITY_IMAGE') else ''}" +KERNEL_CONFIG_FRAGMENTS += "${@'${UNPACKDIR}/dm-verity.cfg' if d.getVar('DM_VERITY_IMAGE') else ''}" From patchwork Mon Oct 5 12:12:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Atharv Dubey X-Patchwork-Id: 100001 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 63C0BCA5FF0 for ; Mon, 5 Oct 2026 12:13:19 +0000 (UTC) Received: from mx0a-0002e601.pphosted.com (mx0a-0002e601.pphosted.com [148.163.150.75]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.18565.1791202398121268401 for ; Mon, 05 Oct 2026 05:13:18 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@ti.com header.s=proofpoint-05-2026 header.b=ZYYlTsHj; dkim=pass header.i=@ticloud.onmicrosoft.com header.s=selector1-ticloud-onmicrosoft-com header.b=LZLs+mqe; spf=pass (domain: ti.com, ip: 148.163.150.75, mailfrom: a-dubey@ti.com) Received: from pps.filterd (m0380145.ppops.net [127.0.0.1]) by m0380145.ppops.net (8.18.1.11/8.18.1.11) with ESMTP id 695BSJEp3814775; Mon, 5 Oct 2026 07:13:17 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint-05-2026; bh=5aA67IoaB1Ur8dhGasNoe/WbVabtEbqMiXoYGBqQt Pc=; b=ZYYlTsHjOSjOVRNyZEiEUW0UM7/qgfZA93zCKx/vC4b+a4/WFyHbE9vHR 1viSQLhZzknzHiTWcdRGdorbGTYIRMmX+wu85SOIaakzahN6MmNIR3KbvxZgffZf Vs5X+GX0/baSj9vCcWaL1gVO7I+WyR/KXh+aSLjiLHnFB96I/DS7Nwi7cG84ivej oKE9zy2BLRt2bIqZu8BvBquvmTqP96a67DqldvIC+w1zXaVb9fqI9qUNgqal4tlk cKVBGv8HKpHUPVI03Rex6SBjfjAeojxjqu6Kg5II26ZJP0SAgSBFR0NcGY7jeqyw BXcGNaswSI2McTmFJE3TFtDUUSJzw== Received: from ph0pr06cu001.outbound.protection.outlook.com (mail-westus3azon11011029.outbound.protection.outlook.com [40.107.208.29]) by m0380145.ppops.net (PPS) with ESMTPS id 4h3jqncxdf-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Mon, 05 Oct 2026 07:13:17 -0500 (CDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=XgiEPs2Yv8K0z0mmp0h8RuUKwg2zsdajrlBxTN24v8APs/k3J7H/x64huHLInHYPCnrfw8cihU5qY5Zb6kqb4xuhwMzuLvaQQDMdExKstwJYpPBxGjZlT3hM9RXYxrnwZ7szBPtwrmMGz9UY25EvBMa8a4aRXWGYG99pO0orQ5i7ppYdkodUViPaoVt3IYNV4pF9WFNWlvf6oCRizuUdTUQKjK36AQD2mcvipf62lN4yIAW7qsg5kh3VkROPvjT8osK30Oa/MqMpZ119JNgrwPDhfYXo38ws5aocK+lATxWtAqtn14ekXCMaji1MHcBVBgrhMP613seoaInJbodyjA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5aA67IoaB1Ur8dhGasNoe/WbVabtEbqMiXoYGBqQtPc=; b=YbYam+Zu2XwcfxSeJebSBBmEKqfMJHlQgyjbliRwRdxE15s7pTIriT7PWXRursKQsqbBBhNI1LTuioFWHSk1sWsU+AC5GQ4Nk8SgHrGopf3xpMqjPuOd4Xd1K7H6dgqMKYC3Vo1y0+McwBK6o15LlWDne9IXCNRsqzlHe3H5UwRxoGGe5c9D4KGg/uB8tJK+o04iNqzXTA5yhK0z7K/6KSFY454V0XGsdb86zmtmt9BwZPRc6V8f8XycXIY2KoBpBpBsAioBt12484/MSka3+cs88J8TtuttfIm7lsRzeHl0ANI4b9lbKnoqMtqIDlmtXhXU+TctP4BD78xmJdzjlw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 198.47.21.194) smtp.rcpttodomain=konsulko.com smtp.mailfrom=ti.com; dmarc=pass (p=quarantine sp=none pct=100) action=none header.from=ti.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ticloud.onmicrosoft.com; s=selector1-ticloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5aA67IoaB1Ur8dhGasNoe/WbVabtEbqMiXoYGBqQtPc=; b=LZLs+mqeXExw73QgPp2G3JurNguLaCKGim627Trz43fZ3xy6QKJtRVKqxXAV9XDRLuuiDrZJx4NhQ2zfbcbmQ5yX5IF3awMe8Gmdcste9M4XJMDRcfZNrtKPFGn8zRl5yA3nPvUCVL7rKJufrTObU2heuYRAnRcXOImEGx9+2C8= Received: from SJ0PR03CA0264.namprd03.prod.outlook.com (2603:10b6:a03:3a0::29) by DS0PR10MB7201.namprd10.prod.outlook.com (2603:10b6:8:f2::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.14; Mon, 5 Oct 2026 12:13:04 +0000 Received: from SJ5PEPF000001D6.namprd05.prod.outlook.com (2603:10b6:a03:3a0:cafe::15) by SJ0PR03CA0264.outlook.office365.com (2603:10b6:a03:3a0::29) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.20 via Frontend Transport; Mon, 5 Oct 2026 12:13:03 +0000 X-MS-Exchange-Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 198.47.21.194) smtp.mailfrom=ti.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=ti.com; Received-SPF: Pass (protection.outlook.com: domain of ti.com designates 198.47.21.194 as permitted sender) receiver=protection.outlook.com; client-ip=198.47.21.194; helo=flwvzet200.ext.ti.com; pr=C Received: from flwvzet200.ext.ti.com (198.47.21.194) by SJ5PEPF000001D6.mail.protection.outlook.com (10.167.242.58) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Mon, 5 Oct 2026 12:13:02 +0000 Received: from DFLE201.ent.ti.com (10.64.6.59) by flwvzet200.ext.ti.com (10.248.192.31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Mon, 5 Oct 2026 07:12:26 -0500 Received: from DFLE213.ent.ti.com (10.64.6.71) by DFLE201.ent.ti.com (10.64.6.59) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Mon, 5 Oct 2026 07:12:26 -0500 Received: from lelvem-mr05.itg.ti.com (10.180.75.9) by DFLE213.ent.ti.com (10.64.6.71) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45 via Frontend Transport; Mon, 5 Oct 2026 07:12:26 -0500 Received: from lalit-ti-241.dhcp.ti.com (lalit-ti-241.dhcp.ti.com [10.24.50.31]) by lelvem-mr05.itg.ti.com (8.18.1/8.18.1) with ESMTP id 695CCJ9K1103986; Mon, 5 Oct 2026 07:12:24 -0500 From: Atharv Dubey To: , CC: , , , Subject: [meta-ti][master][PATCH v5 3/3] ti-core-initramfs: Extend with dm-verity support Date: Mon, 5 Oct 2026 17:42:18 +0530 Message-ID: <20261005121218.844998-3-a-dubey@ti.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20261005121218.844998-1-a-dubey@ti.com> References: <20261005121218.844998-1-a-dubey@ti.com> MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SJ5PEPF000001D6:EE_|DS0PR10MB7201:EE_ X-MS-Office365-Filtering-Correlation-Id: 61a4d678-0d3b-4bf2-d1a0-08df22da0107 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700016|376014|82310400026|23010399003|1800799024|18002099003|22082099003|6133799003|10067099003|56012099006; X-Microsoft-Antispam-Message-Info: qoB7C3nZUJO6mUlZ3uB9H73d8NahBN+M1pMsYsV92l3vlKrCZEwxd2wY/SyL2gOZx0qT18HjkS9xpLpqnZuo1eorozmY2Nc7DgOWcJhKSx0bcpepOQsIaf1zpPSGNTRbLFOIR2027k/6uTTrBlINojLCZrHCcPl2PsHwvkdpOP5zhl0uTB8oFPAzkVVqpiSDfB38cKT7kUFnv8tSaZDBP9gNjRIXj9MekizvbhJU5qZrCOgP0iLhRka40Q9Sfh27AcD+OnJK6vP4NZgKim6k7IKQ8gov41ltmKNdrKy3badlroJZ1KEuoqJIoy86vs8i+KAcktji2AL0UBvcjkVsBuel/uN9zRrwE9zrW+9Qug3ga2K+w0ynv9kUaQZx2rZqKTkVXK3UeED7t1naIeXJfm9763pzfAYt6q2eocC+BZuiWksgxZezp/fm9FMcMoWOocvdg4fnznMZvoRH7XXr/Nt8xg/cO3+ma7qRe1c0Y4aY8llBqb0t0ZyX3EszKS72RnNq1FJeHszagENcv/PXduA+Tj8zGadolN+3/OaLgDUdZwwz6F2UaBwtYjVB3oGhCuItdnhJz7sQe8B+1rWSjA5c0Y22k4AQKPcQduJR4oE3YRmtMSKhOYB+SNs/WmiBTjXFln+OjlpamAVxRNMgHTWs032JYTDykO7zoveP2dYO03O9bmvT0NJ8zqw3jIUCwRpFZ30WTTVLPsgRLmMq4w== X-Forefront-Antispam-Report: CIP:198.47.21.194;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:flwvzet200.ext.ti.com;PTR:ErrorRetry;CAT:NONE;SFS:(13230040)(36860700016)(376014)(82310400026)(23010399003)(1800799024)(18002099003)(22082099003)(6133799003)(10067099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: hyiD2Z2R7ckqd2UTAwPddd5jZEzWKpJJ6KcKplHySHq6L4ZL5mzgccNDYK+f3ttPRwqODNdOIVig1A+4C7QYE9Ym5gxBWp5oRwOhOlkSCTa/wvdaAR3Rx1HhXY47VrincqaUZ0jzbkOVeLw5Dw0bozGiUwSxK9ywNmiTg5pChDVxG79nif0Bs/Lkqo2DOe83EH1WB67I0ED7FxIF7WyvJ+exvH8jCnN4rqqoOuiVUw9CU/W/NYloVBDSt8J3iBPb3WrRSAOTexodNA8UkqwxKsqIEX+oo6UuIoVETAMV72BHiqlp6RvH986mw0yHMUN6lL9CD5UpZLHNEpw5oiZRk8b0vO94W/sIBVFefh9keDujTuQgbqt6vfOW6YOlHIiZfurnnwWHdbWKR0YEflseje3RlczBwNjt1EUTXsThYa5J4m2CLaHg/SQdU8CKhLMe X-Exchange-RoutingPolicyChecked: W5IW6ZEV5CoUI7wWZ3XOtCMPv1VLBZGgvpOYwaXGRQwB2XrOj04r64ETqgaO/cVyjIViZ4+77PimrYF92VX0fLpbo4KlxioxILM0zdJy6IDIM3XIASX44cqJhBhNx9ZFPwP1n70E7q0KNq+fRSyllTt3aUURJUTM0POo9CXg30gmT/l1fQiqQtiFhcjqu0XpKfe1q89jMFImv42iH4CUweXp4V9TZ5MRed3vreaue1ciBs/6p8UKQSaJiv/eoNeRQuRcZNmDopE/MJi+/aA9LtrKTf6L5/b5QSvGNxSZesLMZ5HTGO3UL3UUKsuSH+smgvBL9EFay1SDkcfr23SPBQ== X-OriginatorOrg: ti.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Oct 2026 12:13:02.4095 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 61a4d678-0d3b-4bf2-d1a0-08df22da0107 X-MS-Exchange-CrossTenant-Id: e5b49634-450b-4709-8abb-1e2b19b982b7 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=e5b49634-450b-4709-8abb-1e2b19b982b7;Ip=[198.47.21.194];Helo=[flwvzet200.ext.ti.com] X-MS-Exchange-CrossTenant-AuthSource: SJ5PEPF000001D6.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR10MB7201 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDA1MDA0NyBTYWx0ZWRfX+7pciEQvIqZG /kgiS8FpCCi0qNyjbJsv8oYp2UdU+htjgFZ0AzBR/OrySib2Dsfz+C3PjiqAhPh1TEOWbDRpXyp bIA0MmWw8qTmtGiY1tuKPGTVkA8Ji3Q= X-Authority-Analysis: v=2.4 cv=I6/w19gg c=1 sm=1 tr=0 ts=6ac3945d cx=c_pps a=WFfob/tpvpsU+KY5JpTU8Q==:117 a=iwqwCZQqcuTv3JOpYdM7/Q==:17 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=660iZSQnnn4A:10 a=AlMIdn_sM9wA:10 a=VkNPw1HP01LnGYTKEx00:22 a=Z8NIEmU8O1QQgoT56wFK:22 a=gO1vWkAQAl3rybz1DQOp:22 a=sozttTNsAAAA:8 a=NeSs6gxnhKp23kAhfuoA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDA1MDA0NyBTYWx0ZWRfX27kBjvjFsuRR MmFxcCOHCJws7xreBaWT9vBwsaA8BdWgCtEz27EXp0IlewriaTejXai/BK6C6RxUmvXYwxUbJpv yARmJKJSZXXzly22QYY8Kb546y3qs77VonKv/4cBJu9JlAPBB5q2fMDb8iFEXI6cTXPOE16NcnC 64eNK5KCUMzReB0GOGxE2iven+3fRVo9nne35D1XkLC8/W+IGtik1b7XSQ6RYALA5y6AXtTlWqd 7k50MYRCU5BhtrxpRkLQegeaTh2lFWRDljfvAwBiz7S3LojIF5603ZL0unoUoLNWOXctCvCEiQK 536fTcWWSmD83azOpmUwY0vT+wFFc6lkHoa5lXujzzcDja++/UCQBjut1gcsszHm8zpyMyb5VRL zfquRjhCx/MFNIkdbBw1XMqAjTKdXmsCrgCKd+wmqNh0Vmjjacwea4799kuAVK4khPEsSVzVgBs TQ/bHHV59A+1sMrAFgg== X-Proofpoint-ORIG-GUID: -b67uXj-bC30jqukFRBeYdCL6bu_KfRf X-Proofpoint-GUID: -b67uXj-bC30jqukFRBeYdCL6bu_KfRf X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-05_03,2026-10-02_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 malwarescore=0 impostorscore=0 adultscore=0 lowpriorityscore=0 phishscore=0 suspectscore=0 clxscore=1015 priorityscore=1501 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610050047 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 05 Oct 2026 12:13:19 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/meta-ti/message/20434 Add dm-verity support to ti-core-initramfs by: - Enabling dm-verity modules and tools (cryptsetup, util-linux-mount) when DM_VERITY_IMAGE is set - Adding do_rootfs[nostamp] and do_image[nostamp] to rebuild initramfs after rootfs verity task completes - Making deploy_verity_hash gracefully handle missing .verity.env file on first pass with bbwarn Signed-off-by: Atharv Dubey --- .../machine/include/ti-core-initramfs.inc | 2 +- .../initramfs/ti-core-initramfs.bbappend | 25 +++++++++++++++++++ 2 files changed, 26 insertions(+), 1 deletion(-) create mode 100644 meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend diff --git a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc index c816f1dc..65d30b2c 100644 --- a/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc +++ b/meta-ti-bsp/conf/machine/include/ti-core-initramfs.inc @@ -5,7 +5,7 @@ # TI_CORE_INITRAMFS_ENABLED = "0" # #------------------------------------------------------------------------------ -TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) else '0'}" +TI_CORE_INITRAMFS_ENABLED ?= "${@ '1' if d.getVar('TI_CORE_INITRAMFS_KERNEL_MODULES') or d.getVar('TI_CORE_INITRAMFS_EXTRA_INSTALL') or bb.utils.contains('DISTRO_FEATURES', 'luks', True, False, d) or d.getVar('DM_VERITY_IMAGE') else '0'}" TI_CORE_INITRAMFS_KERNEL_MODULES ?= "" TI_CORE_INITRAMFS_EXTRA_INSTALL ?= "" diff --git a/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend b/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend new file mode 100644 index 00000000..25fe775f --- /dev/null +++ b/meta-ti-bsp/dynamic-layers/security-layer/recipes-ti/initramfs/ti-core-initramfs.bbappend @@ -0,0 +1,25 @@ +# Install the essential utils for dm-verity in ti-core-initramfs +TI_CORE_INITRAMFS_EXTRA_INSTALL:append = "${@' initramfs-module-dmverity cryptsetup util-linux-mount' if d.getVar('DM_VERITY_IMAGE') else ''}" + +# Ensure dm-verity.env is updated also when rebuilding DM_VERITY_IMAGE +do_image[nostamp] = "1" +do_rootfs[nostamp] = "1" + +IMAGE_FSTYPES = "${INITRAMFS_FSTYPES}" + +deploy_verity_hash() { + # The .verity.env file is created by the DM_VERITY_IMAGE build (e.g., arago-base-image). + # On the first pass, it won't exist yet because the initramfs is built before the rootfs + # (due to INITRAMFS_IMAGE dependency). The do_rootfs[nostamp] = "1" causes this task + # to re-run after the rootfs is built, at which point the file will exist. + if [ -f ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env ]; then + install -D -m 0644 \ + ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env \ + ${IMAGE_ROOTFS}${datadir}/misc/dm-verity.env + else + bbwarn "dm-verity.env not found at ${STAGING_VERITY_DIR}/${DM_VERITY_IMAGE}.${DM_VERITY_IMAGE_TYPE}.verity.env - will retry on rebuild (nostamp)" + fi +} + + +IMAGE_PREPROCESS_COMMAND += "deploy_verity_hash;"