OLD | NEW |
1 #!/bin/bash | 1 #!/bin/bash |
2 | 2 |
3 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved. | 3 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved. |
4 # Use of this source code is governed by a BSD-style license that can be | 4 # Use of this source code is governed by a BSD-style license that can be |
5 # found in the LICENSE file. | 5 # found in the LICENSE file. |
6 | 6 |
7 # Helper script that generates the signed kernel image | 7 # Helper script that generates the signed kernel image |
8 | 8 |
9 . "$(dirname "$0")/common.sh" | 9 . "$(dirname "$0")/common.sh" |
10 | 10 |
(...skipping 20 matching lines...) Expand all Loading... |
31 DEFINE_string boot_args "noinitrd" \ | 31 DEFINE_string boot_args "noinitrd" \ |
32 "Additional boot arguments to pass to the commandline (Default: noinitrd)" | 32 "Additional boot arguments to pass to the commandline (Default: noinitrd)" |
33 DEFINE_string root "/dev/sd%D%P" \ | 33 DEFINE_string root "/dev/sd%D%P" \ |
34 "Expected device root (Default: root=/dev/sd%D%P)" | 34 "Expected device root (Default: root=/dev/sd%D%P)" |
35 | 35 |
36 # If provided, will automatically add verified boot arguments. | 36 # If provided, will automatically add verified boot arguments. |
37 DEFINE_string rootfs_image "" \ | 37 DEFINE_string rootfs_image "" \ |
38 "Optional path to the rootfs device or image.(Default: \"\")" | 38 "Optional path to the rootfs device or image.(Default: \"\")" |
39 DEFINE_string rootfs_hash "" \ | 39 DEFINE_string rootfs_hash "" \ |
40 "Optional path to output the rootfs hash to. (Default: \"\")" | 40 "Optional path to output the rootfs hash to. (Default: \"\")" |
41 DEFINE_integer vboot_error_behavior 2 \ | 41 DEFINE_integer verity_error_behavior 2 \ |
42 "Verified boot error behavior [0: I/O errors, 1: reboot, 2: nothing] \ | 42 "Verified boot error behavior [0: I/O errors, 1: reboot, 2: nothing] \ |
43 (Default: 2)" | 43 (Default: 2)" |
44 DEFINE_integer vboot_tree_depth 1 \ | 44 DEFINE_integer verity_tree_depth 1 \ |
45 "Optional Verified boot hash tree depth. (Default: 1)" | 45 "Optional Verified boot hash tree depth. (Default: 1)" |
46 DEFINE_integer vboot_max_ios 1024 \ | 46 DEFINE_integer verity_max_ios 1024 \ |
47 "Optional number of outstanding I/O operations. (Default: 1024)" | 47 "Optional number of outstanding I/O operations. (Default: 1024)" |
48 DEFINE_string vboot_hash_alg "sha1" \ | 48 DEFINE_string verity_hash_alg "sha1" \ |
49 "Cryptographic hash algorithm used for vboot. (Default: sha1)" | 49 "Cryptographic hash algorithm used for dm-verity. (Default: sha1)" |
50 | 50 |
51 # Parse flags | 51 # Parse flags |
52 FLAGS "$@" || exit 1 | 52 FLAGS "$@" || exit 1 |
53 eval set -- "${FLAGS_ARGV}" | 53 eval set -- "${FLAGS_ARGV}" |
54 | 54 |
55 # Die on error | 55 # Die on error |
56 set -e | 56 set -e |
57 | 57 |
58 vboot_args= | 58 verity_args= |
59 # Even with a rootfs_image, root= is not changed unless specified. | 59 # Even with a rootfs_image, root= is not changed unless specified. |
60 if [[ -n "${FLAGS_rootfs_image}" && -n "${FLAGS_rootfs_hash}" ]]; then | 60 if [[ -n "${FLAGS_rootfs_image}" && -n "${FLAGS_rootfs_hash}" ]]; then |
61 info "Determining root fs block count." | 61 info "Determining root fs block count." |
62 # Gets the number of blocks. 4096 byte blocks _are_ expected. | 62 # Gets the number of blocks. 4096 byte blocks _are_ expected. |
63 root_fs_blocks=$(sudo dumpe2fs "${FLAGS_rootfs_image}" 2> /dev/null | | 63 root_fs_blocks=$(sudo dumpe2fs "${FLAGS_rootfs_image}" 2> /dev/null | |
64 grep "Block count" | | 64 grep "Block count" | |
65 tr -d ' ' | | 65 tr -d ' ' | |
66 cut -f2 -d:) | 66 cut -f2 -d:) |
67 info "Checking root fs block size." | 67 info "Checking root fs block size." |
68 root_fs_block_sz=$(sudo dumpe2fs "${FLAGS_rootfs_image}" 2> /dev/null | | 68 root_fs_block_sz=$(sudo dumpe2fs "${FLAGS_rootfs_image}" 2> /dev/null | |
69 grep "Block size" | | 69 grep "Block size" | |
70 tr -d ' ' | | 70 tr -d ' ' | |
71 cut -f2 -d:) | 71 cut -f2 -d:) |
72 if [[ ${root_fs_block_sz} -ne 4096 ]]; then | 72 if [[ ${root_fs_block_sz} -ne 4096 ]]; then |
73 error "Root file system blocks are not 4k!" | 73 error "Root file system blocks are not 4k!" |
74 fi | 74 fi |
75 | 75 |
76 info "Generating root fs hash tree." | 76 info "Generating root fs hash tree." |
77 # Runs as sudo in case the image is a block device. | 77 # Runs as sudo in case the image is a block device. |
78 table=$(sudo verity create ${FLAGS_vboot_tree_depth} \ | 78 table=$(sudo verity create ${FLAGS_verity_tree_depth} \ |
79 ${FLAGS_vboot_hash_alg} \ | 79 ${FLAGS_verity_hash_alg} \ |
80 ${FLAGS_rootfs_image} \ | 80 ${FLAGS_rootfs_image} \ |
81 ${root_fs_blocks} \ | 81 ${root_fs_blocks} \ |
82 ${FLAGS_rootfs_hash}) | 82 ${FLAGS_rootfs_hash}) |
83 if [[ -f "${FLAGS_rootfs_hash}" ]]; then | 83 if [[ -f "${FLAGS_rootfs_hash}" ]]; then |
84 sudo chmod a+r "${FLAGS_rootfs_hash}" | 84 sudo chmod a+r "${FLAGS_rootfs_hash}" |
85 fi | 85 fi |
86 # Don't claim the root device unless the root= flag is pointed to | 86 # Don't claim the root device unless the root= flag is pointed to |
87 # the verified boot device. Doing so will claim /dev/sdDP out from | 87 # the verified boot device. Doing so will claim /dev/sdDP out from |
88 # under the system. | 88 # under the system. |
89 if [[ ${FLAGS_root} = "/dev/dm-0" ]]; then | 89 if [[ ${FLAGS_root} = "/dev/dm-0" ]]; then |
90 table=${table//HASH_DEV/\/dev\/sd%D%P} | 90 table=${table//HASH_DEV/\/dev\/sd%D%P} |
91 table=${table//ROOT_DEV/\/dev\/sd%D%P} | 91 table=${table//ROOT_DEV/\/dev\/sd%D%P} |
92 fi | 92 fi |
93 vboot_args="dm=\"${table}\"" | 93 verity_args="dm=\"${table}\"" |
94 info "dm-verity configuration: ${vboot_args}" | 94 info "dm-verity configuration: ${verity_args}" |
95 fi | 95 fi |
96 | 96 |
97 mkdir -p "${FLAGS_working_dir}" | 97 mkdir -p "${FLAGS_working_dir}" |
98 cat <<EOF > "${FLAGS_working_dir}/boot.config" | 98 cat <<EOF > "${FLAGS_working_dir}/boot.config" |
99 root=${FLAGS_root} | 99 root=${FLAGS_root} |
100 dm_verity.error_behavior=${FLAGS_vboot_error_behavior} | 100 dm_verity.error_behavior=${FLAGS_verity_error_behavior} |
101 dm_verity.max_bios=${FLAGS_vboot_max_ios} | 101 dm_verity.max_bios=${FLAGS_verity_max_ios} |
102 ${vboot_args} | 102 ${verity_args} |
103 ${FLAGS_boot_args} | 103 ${FLAGS_boot_args} |
104 EOF | 104 EOF |
105 | 105 |
106 WORK="${WORK} ${FLAGS_working_dir}/boot.config" | 106 WORK="${WORK} ${FLAGS_working_dir}/boot.config" |
107 info "Emitted cross-platform boot params to ${FLAGS_working_dir}/boot.config" | 107 info "Emitted cross-platform boot params to ${FLAGS_working_dir}/boot.config" |
108 | 108 |
109 # FIXME: At the moment, we're working on signed images for x86 only. ARM will | 109 # FIXME: At the moment, we're working on signed images for x86 only. ARM will |
110 # support this before shipping, but at the moment they don't. | 110 # support this before shipping, but at the moment they don't. |
111 if [[ "${FLAGS_arch}" = "x86" ]]; then | 111 if [[ "${FLAGS_arch}" = "x86" ]]; then |
112 | 112 |
(...skipping 76 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
189 info "Cleaning up temporary files: ${WORK}" | 189 info "Cleaning up temporary files: ${WORK}" |
190 rm ${WORK} | 190 rm ${WORK} |
191 rmdir ${FLAGS_working_dir} | 191 rmdir ${FLAGS_working_dir} |
192 fi | 192 fi |
193 | 193 |
194 info "Kernel partition image emitted: ${FLAGS_to}" | 194 info "Kernel partition image emitted: ${FLAGS_to}" |
195 | 195 |
196 if [[ -f ${FLAGS_rootfs_hash} ]]; then | 196 if [[ -f ${FLAGS_rootfs_hash} ]]; then |
197 info "Root filesystem hash emitted: ${FLAGS_rootfs_hash}" | 197 info "Root filesystem hash emitted: ${FLAGS_rootfs_hash}" |
198 fi | 198 fi |
OLD | NEW |