build_image, build_kernel_image, update_bootloaders: fix up rootfs_verification

build_kernel_image.sh

 #!/bin/bash
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Helper script that generates the signed kernel image
 
 . "$(dirname "$0")/common.sh"
 
@@ skipping 40 matching lines @@
 # Parse flags
 FLAGS "$@" || exit 1
 eval set -- "${FLAGS_ARGV}"
 
 # Die on error
 set -e
 
 verity_args=
 # Even with a rootfs_image, root= is not changed unless specified.
 if [[ -n "${FLAGS_rootfs_image}" && -n "${FLAGS_rootfs_hash}" ]]; then
-  info "Determining root fs block count."
   # Gets the number of blocks. 4096 byte blocks _are_ expected.
   root_fs_blocks=$(sudo dumpe2fs "${FLAGS_rootfs_image}" 2> /dev/null |
                    grep "Block count" |
                    tr -d ' ' |
                    cut -f2 -d:)
-  info "Checking root fs block size."
   root_fs_block_sz=$(sudo dumpe2fs "${FLAGS_rootfs_image}" 2> /dev/null |
                      grep "Block size" |
                      tr -d ' ' |
                      cut -f2 -d:)
+  info "rootfs is ${root_fs_blocks} blocks of ${root_fs_block_sz} bytes"
   if [[ ${root_fs_block_sz} -ne 4096 ]]; then
     error "Root file system blocks are not 4k!"
   fi
 
   info "Generating root fs hash tree."
   # Runs as sudo in case the image is a block device.
   table=$(sudo verity create ${FLAGS_verity_tree_depth} \
                         ${FLAGS_verity_hash_alg} \
                         ${FLAGS_rootfs_image} \
                         ${root_fs_blocks} \
                         ${FLAGS_rootfs_hash})
   if [[ -f "${FLAGS_rootfs_hash}" ]]; then
     sudo chmod a+r "${FLAGS_rootfs_hash}"
   fi
   # Don't claim the root device unless the root= flag is pointed to
   # the verified boot device.  Doing so will claim /dev/sdDP out from
   # under the system.
   if [[ ${FLAGS_root} = "/dev/dm-0" ]]; then
-    table=${table//HASH_DEV/\/dev\/sd%D%P}
-    table=${table//ROOT_DEV/\/dev\/sd%D%P}
+    table=${table//HASH_DEV//dev/sd%D%P}
+    table=${table//ROOT_DEV//dev/sd%D%P}
   fi
-  verity_args="dm=\"${table}\""
+  verity_args="dm=\"vroot none ro,${table}\""
   info "dm-verity configuration: ${verity_args}"
 fi
 
 mkdir -p "${FLAGS_working_dir}"
 cat <<EOF > "${FLAGS_working_dir}/boot.config"
 root=${FLAGS_root}
 dm_verity.error_behavior=${FLAGS_verity_error_behavior}
 dm_verity.max_bios=${FLAGS_verity_max_ios}
 ${verity_args}
 ${FLAGS_boot_args}
@@ skipping 85 matching lines @@
   info "Cleaning up temporary files: ${WORK}"
   rm ${WORK}
   rmdir ${FLAGS_working_dir}
 fi
 
 info "Kernel partition image emitted: ${FLAGS_to}"
 
 if [[ -f ${FLAGS_rootfs_hash} ]]; then
   info "Root filesystem hash emitted: ${FLAGS_rootfs_hash}"
 fi