From 5d316e87e00315f4a51578be141b3c728a0bc2a3 Mon Sep 17 00:00:00 2001 From: Atharv Dubey Date: Mon, 5 Oct 2026 17:42:16 +0530 Subject: [PATCH] dm-verity-upstream: Add dynamic layer for meta-security dm-verity Add an optional dynamic layer enabling dm-verity block-level integrity verification of the root filesystem for TI K3 platforms, using meta-security's stock dm-verity mechanism as-is. Requires meta-security to be present in bblayers.conf. dm-verity hashes the rootfs at build time; at boot, a dedicated initramfs loads the root hash and the kernel checks every block read against it. Set DM_VERITY_IMAGE to enable all the verity-related recipes for that image; other images build as usual. Signed-off-by: Atharv Dubey Signed-off-by: Ryan Eatmon --- meta-ti-bsp/conf/layer.conf | 3 +++ meta-ti-bsp/conf/machine/include/k3.inc | 7 +++++++ 2 files changed, 10 insertions(+) diff --git a/meta-ti-bsp/conf/layer.conf b/meta-ti-bsp/conf/layer.conf index 5ae078dd8..34833e7ca 100644 --- a/meta-ti-bsp/conf/layer.conf +++ b/meta-ti-bsp/conf/layer.conf @@ -21,6 +21,7 @@ LAYERRECOMMENDS_meta-ti-bsp = " \ multimedia-layer \ openembedded-layer \ tpm-layer \ + security \ " BBFILES_DYNAMIC += " \ @@ -28,6 +29,8 @@ BBFILES_DYNAMIC += " \ openembedded-layer:${LAYERDIR}/dynamic-layers/openembedded-layer/recipes*/*/*.bbappend \ tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bb \ tpm-layer:${LAYERDIR}/dynamic-layers/tpm-layer/recipes*/*/*.bbappend \ + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bb \ + security:${LAYERDIR}/dynamic-layers/security-layer/recipes*/*/*.bbappend \ " SIGGEN_EXCLUDERECIPES_ABISAFE += " \ diff --git a/meta-ti-bsp/conf/machine/include/k3.inc b/meta-ti-bsp/conf/machine/include/k3.inc index b571d5448..9f987f71b 100644 --- a/meta-ti-bsp/conf/machine/include/k3.inc +++ b/meta-ti-bsp/conf/machine/include/k3.inc @@ -64,3 +64,10 @@ TI_WKS_BOOTLOADER_APPEND ?= "console=${KERNEL_CONSOLE}" do_image_wic[depends] += "virtual/bootloader:do_deploy" SERIAL_CONSOLES = "115200;ttyS2 115200;ttyS0" + +# dm-verity protects the rootfs listed in DM_VERITY_IMAGE; see dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc for what that turns on. +DM_VERITY_IMAGE ??= "" + +DM_VERITY_UPSTREAM_INCLUDE = "${@'dynamic-layers/security-layer/conf/include/dm-verity-upstream.inc' if d.getVar('DM_VERITY_IMAGE') else ''}" + +require ${DM_VERITY_UPSTREAM_INCLUDE}