Skip to content

Commit a786582

Browse files
manuelh-devfidencio
manuelh-dev
authored and
fidencio
committed
rootfs: deprecate initramfs dm-verity mode
Remove the initramfs folder, its build steps, and use the kernel based dm-verity enforcement for the handlers which used the initramfs mode. Also, remove the initramfs verity mode capability from the shims and their configs. Signed-off-by: Manuel Huber <manuelh@nvidia.com>
1 parent cf7f340 commit a786582

File tree

29 files changed

+171
-545
lines changed

29 files changed

+171
-545
lines changed

‎.github/workflows/build-kata-static-tarball-amd64.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -312,7 +312,7 @@ jobs:
312312
ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
313313
TARGET_BRANCH: ${{ inputs.target-branch }}
314314
RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
315-
MEASURED_ROOTFS_MODE: initramfs
315+
MEASURED_ROOTFS: yes
316316

317317
- name: store-artifact shim-v2
318318
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

‎.github/workflows/build-kata-static-tarball-s390x.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -307,6 +307,7 @@ jobs:
307307
ARTEFACT_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
308308
TARGET_BRANCH: ${{ inputs.target-branch }}
309309
RELEASE: ${{ inputs.stage == 'release' && 'yes' || 'no' }}
310+
MEASURED_ROOTFS: no
310311

311312
- name: store-artifact shim-v2
312313
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

‎src/libs/kata-types/src/config/hypervisor/mod.rs‎

Lines changed: 45 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -78,16 +78,9 @@ const MAX_BRIDGE_SIZE: u32 = 5;
7878
const KERNEL_PARAM_DELIMITER: &str = " ";
7979
/// Block size (in bytes) used by dm-verity block size validation.
8080
pub const VERITY_BLOCK_SIZE_BYTES: u64 = 512;
81-
/// Kernel dm-verity mode handled by the initramfs.
82-
pub const VERITY_MODE_INITRAMFS: &str = "initramfs";
83-
/// Kernel dm-verity mode handled directly by the kernel.
84-
pub const VERITY_MODE_KERNELINIT: &str = "kernelinit";
85-
8681
/// Parsed kernel dm-verity parameters.
8782
#[derive(Clone, Debug, Default, Deserialize, Serialize)]
8883
pub struct KernelVerityParams {
89-
/// Verity mode ("kernelinit" or "initramfs").
90-
pub mode: String,
9184
/// Root hash value.
9285
pub root_hash: String,
9386
/// Salt used to generate verity hash tree.
@@ -129,22 +122,6 @@ pub fn parse_kernel_verity_params(params: &str) -> Result<Option<KernelVerityPar
129122
values.insert(key.to_string(), value.to_string());
130123
}
131124

132-
let mode = values
133-
.get("mode")
134-
.ok_or_else(|| {
135-
io::Error::new(
136-
io::ErrorKind::InvalidData,
137-
"Missing kernel_verity_params mode",
138-
)
139-
})?
140-
.to_string();
141-
if mode != VERITY_MODE_KERNELINIT && mode != VERITY_MODE_INITRAMFS {
142-
return Err(io::Error::new(
143-
io::ErrorKind::InvalidData,
144-
format!("Invalid kernel_verity_params mode: {mode}"),
145-
));
146-
}
147-
148125
let root_hash = values
149126
.get("root_hash")
150127
.ok_or_else(|| {
@@ -172,61 +149,54 @@ pub fn parse_kernel_verity_params(params: &str) -> Result<Option<KernelVerityPar
172149
}
173150
};
174151

175-
let (data_blocks, data_block_size, hash_block_size) = if mode == VERITY_MODE_KERNELINIT {
176-
let data_blocks = parse_uint_field("data_blocks")?;
177-
let data_block_size = parse_uint_field("data_block_size")?;
178-
let hash_block_size = parse_uint_field("hash_block_size")?;
179-
180-
if salt.is_empty() {
181-
return Err(io::Error::new(
182-
io::ErrorKind::InvalidData,
183-
"Missing kernel_verity_params salt",
184-
));
185-
}
186-
if data_blocks == 0 {
187-
return Err(io::Error::new(
188-
io::ErrorKind::InvalidData,
189-
"Invalid kernel_verity_params data_blocks: must be non-zero",
190-
));
191-
}
192-
if data_block_size == 0 {
193-
return Err(io::Error::new(
194-
io::ErrorKind::InvalidData,
195-
"Invalid kernel_verity_params data_block_size: must be non-zero",
196-
));
197-
}
198-
if hash_block_size == 0 {
199-
return Err(io::Error::new(
200-
io::ErrorKind::InvalidData,
201-
"Invalid kernel_verity_params hash_block_size: must be non-zero",
202-
));
203-
}
204-
if data_block_size % VERITY_BLOCK_SIZE_BYTES != 0 {
205-
return Err(io::Error::new(
206-
io::ErrorKind::InvalidData,
207-
format!(
208-
"Invalid kernel_verity_params data_block_size: must be multiple of {}",
209-
VERITY_BLOCK_SIZE_BYTES
210-
),
211-
));
212-
}
213-
if hash_block_size % VERITY_BLOCK_SIZE_BYTES != 0 {
214-
return Err(io::Error::new(
215-
io::ErrorKind::InvalidData,
216-
format!(
217-
"Invalid kernel_verity_params hash_block_size: must be multiple of {}",
218-
VERITY_BLOCK_SIZE_BYTES
219-
),
220-
));
221-
}
152+
let data_blocks = parse_uint_field("data_blocks")?;
153+
let data_block_size = parse_uint_field("data_block_size")?;
154+
let hash_block_size = parse_uint_field("hash_block_size")?;
222155

223-
(data_blocks, data_block_size, hash_block_size)
224-
} else {
225-
(0, 0, 0)
226-
};
156+
if salt.is_empty() {
157+
return Err(io::Error::new(
158+
io::ErrorKind::InvalidData,
159+
"Missing kernel_verity_params salt",
160+
));
161+
}
162+
if data_blocks == 0 {
163+
return Err(io::Error::new(
164+
io::ErrorKind::InvalidData,
165+
"Invalid kernel_verity_params data_blocks: must be non-zero",
166+
));
167+
}
168+
if data_block_size == 0 {
169+
return Err(io::Error::new(
170+
io::ErrorKind::InvalidData,
171+
"Invalid kernel_verity_params data_block_size: must be non-zero",
172+
));
173+
}
174+
if hash_block_size == 0 {
175+
return Err(io::Error::new(
176+
io::ErrorKind::InvalidData,
177+
"Invalid kernel_verity_params hash_block_size: must be non-zero",
178+
));
179+
}
180+
if data_block_size % VERITY_BLOCK_SIZE_BYTES != 0 {
181+
return Err(io::Error::new(
182+
io::ErrorKind::InvalidData,
183+
format!(
184+
"Invalid kernel_verity_params data_block_size: must be multiple of {}",
185+
VERITY_BLOCK_SIZE_BYTES
186+
),
187+
));
188+
}
189+
if hash_block_size % VERITY_BLOCK_SIZE_BYTES != 0 {
190+
return Err(io::Error::new(
191+
io::ErrorKind::InvalidData,
192+
format!(
193+
"Invalid kernel_verity_params hash_block_size: must be multiple of {}",
194+
VERITY_BLOCK_SIZE_BYTES
195+
),
196+
));
197+
}
227198

228199
Ok(Some(KernelVerityParams {
229-
mode,
230200
root_hash,
231201
salt,
232202
data_blocks,

‎src/runtime-rs/config/configuration-qemu-tdx-runtime-rs.toml.in‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ valid_hypervisor_paths = @QEMUVALIDHYPERVISORPATHS@
7575
kernel_params = "@KERNELTDXPARAMS@"
7676

7777
# Optional dm-verity parameters (comma-separated key=value list):
78-
# mode=kernelinit|initramfs,root_hash=...,salt=...,data_blocks=...,data_block_size=...,hash_block_size=...
78+
# root_hash=...,salt=...,data_blocks=...,data_block_size=...,hash_block_size=...
7979
# These are used by the runtime to assemble dm-verity kernel params.
8080
kernel_verity_params = "@KERNELVERITYPARAMS@"
8181

‎src/runtime-rs/crates/hypervisor/src/kernel_param.rs‎

Lines changed: 30 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,7 @@ use crate::{
1111
VM_ROOTFS_ROOT_BLK, VM_ROOTFS_ROOT_PMEM,
1212
};
1313
use kata_types::config::LOG_VPORT_OPTION;
14-
use kata_types::config::hypervisor::{
15-
parse_kernel_verity_params, VERITY_BLOCK_SIZE_BYTES, VERITY_MODE_INITRAMFS,
16-
};
14+
use kata_types::config::hypervisor::{parse_kernel_verity_params, VERITY_BLOCK_SIZE_BYTES};
1715
use kata_types::fs::{
1816
VM_ROOTFS_FILESYSTEM_EROFS, VM_ROOTFS_FILESYSTEM_EXT4, VM_ROOTFS_FILESYSTEM_XFS,
1917
};
@@ -60,7 +58,6 @@ fn split_kernel_params(params_string: &str) -> Vec<String> {
6058
}
6159

6260
struct KernelVerityConfig {
63-
mode: String,
6461
root_hash: String,
6562
salt: String,
6663
data_blocks: u64,
@@ -73,7 +70,6 @@ fn new_kernel_verity_params(params_string: &str) -> Result<Option<KernelVerityCo
7370
.map_err(|err| anyhow!(err.to_string()))?;
7471

7572
Ok(cfg.map(|params| KernelVerityConfig {
76-
mode: params.mode,
7773
root_hash: params.root_hash,
7874
salt: params.salt,
7975
data_blocks: params.data_blocks,
@@ -203,14 +199,6 @@ impl KernelParams {
203199
None => return Ok(params),
204200
};
205201

206-
if cfg.mode == VERITY_MODE_INITRAMFS {
207-
params.append(&mut KernelParams::from_string(&format!(
208-
"rootfs_verity.scheme=dm-verity rootfs_verity.hash={}",
209-
cfg.root_hash
210-
)));
211-
return Ok(params);
212-
}
213-
214202
let (root_device, hash_device) = match rootfs_driver {
215203
VM_ROOTFS_DRIVER_PMEM => ("/dev/pmem0p1", "/dev/pmem0p2"),
216204
VM_ROOTFS_DRIVER_BLK | VM_ROOTFS_DRIVER_BLK_CCW | VM_ROOTFS_DRIVER_MMIO => {
@@ -495,18 +483,7 @@ mod tests {
495483
#[test]
496484
fn test_kernel_verity_params() -> Result<()> {
497485
let params = KernelParams::new_rootfs_kernel_params(
498-
"mode=initramfs,root_hash=abc",
499-
VM_ROOTFS_DRIVER_PMEM,
500-
VM_ROOTFS_FILESYSTEM_EXT4,
501-
)?;
502-
assert!(params
503-
.to_string()?
504-
.contains("rootfs_verity.scheme=dm-verity"));
505-
assert!(params.to_string()?.contains("rootfs_verity.hash=abc"));
506-
assert!(params.to_string()?.contains("root="));
507-
508-
let params = KernelParams::new_rootfs_kernel_params(
509-
"mode=kernelinit,root_hash=abc,salt=def,data_blocks=1,data_block_size=4096,hash_block_size=4096",
486+
"root_hash=abc,salt=def,data_blocks=1,data_block_size=4096,hash_block_size=4096",
510487
VM_ROOTFS_DRIVER_BLK,
511488
VM_ROOTFS_FILESYSTEM_EXT4,
512489
)?;
@@ -516,14 +493,41 @@ mod tests {
516493
assert!(params_string.contains("rootfstype=ext4"));
517494

518495
let err = KernelParams::new_rootfs_kernel_params(
519-
"mode=kernelinit,root_hash=abc,data_blocks=1,data_block_size=4096,hash_block_size=4096",
496+
"root_hash=abc,data_blocks=1,data_block_size=4096,hash_block_size=4096",
520497
VM_ROOTFS_DRIVER_BLK,
521498
VM_ROOTFS_FILESYSTEM_EXT4,
522499
)
523500
.err()
524501
.expect("expected missing salt error");
525502
assert!(format!("{err}").contains("Missing kernel_verity_params salt"));
526503

504+
let err = KernelParams::new_rootfs_kernel_params(
505+
"root_hash=abc,salt=def,data_block_size=4096,hash_block_size=4096",
506+
VM_ROOTFS_DRIVER_BLK,
507+
VM_ROOTFS_FILESYSTEM_EXT4,
508+
)
509+
.err()
510+
.expect("expected missing data_blocks error");
511+
assert!(format!("{err}").contains("Missing kernel_verity_params data_blocks"));
512+
513+
let err = KernelParams::new_rootfs_kernel_params(
514+
"root_hash=abc,salt=def,data_blocks=foo,data_block_size=4096,hash_block_size=4096",
515+
VM_ROOTFS_DRIVER_BLK,
516+
VM_ROOTFS_FILESYSTEM_EXT4,
517+
)
518+
.err()
519+
.expect("expected invalid data_blocks error");
520+
assert!(format!("{err}").contains("Invalid kernel_verity_params data_blocks"));
521+
522+
let err = KernelParams::new_rootfs_kernel_params(
523+
"root_hash=abc,salt=def,data_blocks=1,data_block_size=4096,hash_block_size=4096,badfield",
524+
VM_ROOTFS_DRIVER_BLK,
525+
VM_ROOTFS_FILESYSTEM_EXT4,
526+
)
527+
.err()
528+
.expect("expected invalid entry error");
529+
assert!(format!("{err}").contains("Invalid kernel_verity_params entry"));
530+
527531
Ok(())
528532
}
529533
}

‎src/runtime/config/configuration-qemu-coco-dev.toml.in‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ valid_hypervisor_paths = @QEMUVALIDHYPERVISORPATHS@
5353
kernel_params = "@KERNELQEMUCOCODEVPARAMS@"
5454

5555
# Optional dm-verity parameters (comma-separated key=value list):
56-
# mode=kernelinit|initramfs,root_hash=...,salt=...,data_blocks=...,data_block_size=...,hash_block_size=...
56+
# root_hash=...,salt=...,data_blocks=...,data_block_size=...,hash_block_size=...
5757
# These are used by the runtime to assemble dm-verity kernel params.
5858
kernel_verity_params = "@KERNELVERITYPARAMS@"
5959

‎src/runtime/config/configuration-qemu-nvidia-gpu-snp.toml.in‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ snp_guest_policy = 196608
9393
kernel_params = "@KERNELPARAMS_NV@"
9494

9595
# Optional dm-verity parameters (comma-separated key=value list):
96-
# mode=kernelinit|initramfs,root_hash=...,salt=...,data_blocks=...,data_block_size=...,hash_block_size=...
96+
# root_hash=...,salt=...,data_blocks=...,data_block_size=...,hash_block_size=...
9797
# These are used by the runtime to assemble dm-verity kernel params.
9898
kernel_verity_params = "@KERNELVERITYPARAMS_CONFIDENTIAL_NV@"
9999

‎src/runtime/config/configuration-qemu-nvidia-gpu-tdx.toml.in‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ valid_hypervisor_paths = @QEMUTDXEXPERIMENTALVALIDHYPERVISORPATHS@
7070
kernel_params = "@KERNELPARAMS_NV@"
7171

7272
# Optional dm-verity parameters (comma-separated key=value list):
73-
# mode=kernelinit|initramfs,root_hash=...,salt=...,data_blocks=...,data_block_size=...,hash_block_size=...
73+
# root_hash=...,salt=...,data_blocks=...,data_block_size=...,hash_block_size=...
7474
# These are used by the runtime to assemble dm-verity kernel params.
7575
kernel_verity_params = "@KERNELVERITYPARAMS_CONFIDENTIAL_NV@"
7676

‎src/runtime/config/configuration-qemu-nvidia-gpu.toml.in‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ valid_hypervisor_paths = @QEMUVALIDHYPERVISORPATHS@
5252
kernel_params = "@KERNELPARAMS_NV@"
5353

5454
# Optional dm-verity parameters (comma-separated key=value list):
55-
# mode=kernelinit|initramfs,root_hash=...,salt=...,data_blocks=...,data_block_size=...,hash_block_size=...
55+
# root_hash=...,salt=...,data_blocks=...,data_block_size=...,hash_block_size=...
5656
# These are used by the runtime to assemble dm-verity kernel params.
5757
kernel_verity_params = "@KERNELVERITYPARAMS_NV@"
5858

‎src/runtime/config/configuration-qemu-tdx.toml.in‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ valid_hypervisor_paths = @QEMUVALIDHYPERVISORPATHS@
6969
kernel_params = "@KERNELTDXPARAMS@"
7070

7171
# Optional dm-verity parameters (comma-separated key=value list):
72-
# mode=kernelinit|initramfs,root_hash=...,salt=...,data_blocks=...,data_block_size=...,hash_block_size=...
72+
# root_hash=...,salt=...,data_blocks=...,data_block_size=...,hash_block_size=...
7373
# These are used by the runtime to assemble dm-verity kernel params.
7474
kernel_verity_params = "@KERNELVERITYPARAMS@"
7575

0 commit comments

Comments
 (0)