[参考译文] AM62L：创建安全文件系统期间内核崩溃

https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1645012/am62l-kernel-crash-during-the-creation-of-secure-filesystem

器件型号： AM62L

请参阅旧主题： https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1641521/am62l-am62l-secure-boot-keywriter-lite

接下来、我们将尝试保护文件系统的安全、因为我们在下面的链接中  

https://software-dl.ti.com/processor-sdk-linux/esd/AM62LX/11_02_08_02/exports/docs/linux/Foundational_Components / System_Security / Auth_boot.html

目前、我们有 P1 (rootfs)、 P2 (rootfs ) 和 P3 (datafs) eMMC 分区方案、并且电路板上仅提供 USB DFU 和 eMMC 引导模式。

请找到下面的日志,使用,我们已经创建了.hash 文件,并将其放在 P3 分区,因为我们没有额外的分区。

root@am62lxx-evm:~# mkdir /old_mnt
root@am62lxx-evm:~# mount /dev/mmcblk0p1 /old_mnt                                                                                                                                                                  
[   55.388613] EXT4-fs (mmcblk0p1): mounted filesystem f7067c97-aee1-4ea1-b5fd-7b68ecc8a599 r/w with ordered data mode. Quota mode: none.
root@am62lxx-evm:~# cryptsetup luksFormat /dev/mmcblk0p2 --key-file=/home/pass_key --batch-mode                                                                                                                    
root@am62lxx-evm:~# cryptsetup luksOpen /dev/mmcblk0p2 crypt_root --key-file=/home/pass_key                                                                                                                        
root@am62lxx-evm:~# cryptsetup -v status crypt_root
/dev/mapper/crypt_root is active.
  type:    LUKS1
  cipher:  aes-xts-plain64
  keysize: 512 bits
  key location: dm-crypt
  device:  /dev/mmcblk0p2
  sector size:  512
  offset:  4096 sectors
  size:    4190208 sectors
  mode:    read/write
Command successful.
root@am62lxx-evm:~# cryptsetup luksDump /dev/mmcblk0p2                                                                                                                                                             
LUKS header information for /dev/mmcblk0p2

Version:        1
Cipher name:    aes
Cipher mode:    xts-plain64
Hash spec:      sha256
Payload offset: 4096
MK bits:        512
MK digest:      17 db 68 29 a4 2c 4c 2d d9 aa 24 70 47 12 d3 d2 79 d2 ec 61 
MK salt:        0c eb ac 18 aa 6c 28 4b e4 c5 8f d1 fa 5b 21 3f 
                51 1e cd a4 67 ca 02 6b 90 17 32 01 4c 28 0c 3d 
MK iterations:  22692
UUID:           111847ab-cfc5-4a69-a90a-0fead7bd0535

Key Slot 0: ENABLED
        Iterations:             363080
        Salt:                   0e 64 e4 d8 28 ae e0 ea 97 b9 b5 f6 46 45 4a c1 
                                92 b4 82 d9 26 09 d0 86 71 51 e1 69 d0 55 19 5c 
        Key material offset:    8
        AF stripes:             4000
Key Slot 1: DISABLED
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED
root@am62lxx-evm:~# mkfs.ext4 /dev/mapper/crypt_root
mke2fs 1.47.0 (5-Feb-2023)
Creating filesystem with 523776 4k blocks and 131072 inodes
Filesystem UUID: 972ef60e-7583-4c14-8da6-0debfe244cfd
Superblock backups stored on blocks: 
        32768, 98304, 163840, 229376, 294912

Allocating group tables: done                            
Writing inode tables: done                            
Creating journal (8192 blocks): done
Writing superblocks and filesystem accounting information: done 

root@am62lxx-evm:~# mkfs.ext4 /dev/mapper/crypt_root
mke2fs 1.47.0 (5-Feb-2023)
/dev/mapper/crypt_root contains a ext4 file system
        created on Thu May 29 18:50:02 2025
Proceed anyway? (y,N) y
Creating filesystem with 523776 4k blocks and 131072 inodes
Filesystem UUID: 2abe3070-b79f-4c82-b90c-7d4be9bbe5f7
Superblock backups stored on blocks: 
        32768, 98304, 163840, 229376, 294912

Allocating group tables: done                            
Writing inode tables: done                            
Creating journal (8192 blocks): done
Writing superblocks and filesystem accounting information: done 

root@am62lxx-evm:~# mount /dev/mapper/crypt_root /mnt
[  123.516522] EXT4-fs (dm-0): mounted filesystem 2abe3070-b79f-4c82-b90c-7d4be9bbe5f7 r/w with ordered data mode. Quota mode: none.
root@am62lxx-evm:~# cp -ar /old_mnt/. /mnt
root@am62lxx-evm:~# sync
root@am62lxx-evm:~# umount /mnt
[  200.706389] EXT4-fs (dm-0): unmounting filesystem 2abe3070-b79f-4c82-b90c-7d4be9bbe5f7.
root@am62lxx-evm:~# veritysetup format /dev/mapper/crypt_root ver.hash      
VERITY header information for ver.hash
UUID:                   c57eee25-6ae2-4060-ae64-5f5e62c7b28d
Hash type:              1
Data blocks:            523776
Data block size:        4096
Hash blocks:            4125
Hash block size:        4096
Hash algorithm:         sha256
Salt:                   cd9db64878c65fa8ae09b0b59095f903ab781482fe7d9f9d63cbca3a7cac6888
Root hash:              85a11d07a423552a34ddb3196f11110f8967c74d46dc07da35553e97af9c32f5
Hash device size:       16900096 [bytes]
root@am62lxx-evm:~# 

我们还为引导修改 initramfs 的 init 文件、

# Fix ownership
chown root:root /bin/mount.util-linux

# Mount virtual filesystems
mount -t devtmpfs none /dev
mount -t proc none /proc
mount -t sysfs none /sys

# Mount partition containing verity.hash
mkdir -p /verity
mount /dev/mmcblk0p3 /verity

# Open encrypted rootfs
cryptsetup luksOpen \
    --key-file=/home/pass_key \
    /dev/mmcblk0p2 \
    crypt_root

# Open dm-verity mapping
veritysetup open \
    /dev/mapper/crypt_root \
    verity_root \
    --root-hash-file /verity/ver.hash \
    85a11d07a423552a34ddb3196f11110f8967c74d46dc07da35553e97af9c32f5

# Mount verified rootfs
mount -o ro /dev/mapper/verity_root /mnt

# Optional cleanup
umount /verity

# Switch to verified rootfs
exec switch_root /mnt /sbin/init

从它引导时、内核会出现紧急情况、您可以在以下日志中看到

[    1.791770] am65-cpsw-nuss 8000000.ethernet: initializing am65 cpsw nuss version 0x6BA00103, cpsw version 0x6BA80103 Ports: 3 quirks:00000006
[    1.804668] am65-cpsw-nuss 8000000.ethernet: /bus@f0000/ethernet@8000000/ethernet-ports/port@1 read phy-mode err -22
[    1.815403] am65-cpsw-nuss 8000000.ethernet: probe with driver am65-cpsw-nuss failed with error -22
[    1.831633] mmc0: CQHCI version 5.10
[    1.831692] input: gpio-keys as /devices/platform/gpio-keys/input/input0
[    1.838232] mmc2: CQHCI version 5.10
[    1.842866] clk: Disabling unused clocks
[    1.856074] PM: genpd: Disabling unused power domains
[    1.861625] ALSA device list:
[    1.864647]   No soundcards found.
[    1.868142] Warning: unable to open an initial console.
[    1.889455] mmc0: SDHCI controller on fa10000.mmc [fa10000.mmc] using ADMA 64-bit
[    1.904031] mmc2: SDHCI controller on fa20000.mmc [fa20000.mmc] using ADMA 64-bit
[    1.916888] sdhci-am654 fa20000.mmc: card claims to support voltages below defined range
[    1.932581] Freeing unused kernel memory: 28672K
[    1.937453] Run /init as init process
[    1.946523] mmc2: new high speed SDIO card at address 0001
[    1.949956] mmc0: new HS200 MMC card at address 0001
[    1.958805] mmcblk0: mmc0:0001 IS008G 7.30 GiB
[    1.967358]  mmcblk0: p1 p2 p3
[    1.971425] mmcblk0boot0: mmc0:0001 IS008G 4.00 MiB
[    1.977938] mmcblk0boot1: mmc0:0001 IS008G 4.00 MiB
[    1.984332] mmcblk0rpmb: mmc0:0001 IS008G 4.00 MiB, chardev (239:0)
[    7.126453] EXT4-fs (mmcblk0p3): mounted filesystem cba1d45b-891e-48c6-b739-af652390f887 r/w with ordered data mode. Quota mode: none.
[    9.300359] EXT4-fs (mmcblk0p3): unmounting filesystem cba1d45b-891e-48c6-b739-af652390f887.
[    9.319321] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100
[    9.326995] CPU: 0 UID: 0 PID: 1 Comm: switch_root Not tainted 6.12.57-havnam #1
[    9.334383] Hardware name: Texas Instruments AM62L3 Evaluation Module (DT)
[    9.341242] Call trace:
[    9.343678]  dump_backtrace+0x90/0xe8
[    9.347348]  show_stack+0x18/0x24
[    9.350657]  dump_stack_lvl+0x34/0x8c
[    9.354314]  dump_stack+0x18/0x24
[    9.357621]  panic+0x390/0x3a4
[    9.360672]  do_exit+0x824/0x8f8
[    9.363894]  do_group_exit+0x34/0x90
[    9.367462]  pid_child_should_wake+0x0/0x60
[    9.371636]  invoke_syscall+0x48/0x10c
[    9.375379]  el0_svc_common.constprop.0+0x40/0xe0
[    9.380074]  do_el0_svc+0x1c/0x28
[    9.383382]  el0_svc+0x28/0x98
[    9.386431]  el0t_64_sync_handler+0x120/0x12c
[    9.390780]  el0t_64_sync+0x190/0x194
[    9.394436] SMP: stopping secondary CPUs
[    9.398355] Kernel Offset: disabled
[    9.401832] CPU features: 0x00,00000080,00200000,4200420b
[    9.407219] Memory Limit: none
[    9.410267] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100 ]---

是否需要更新任何步骤？

谢谢、

达尔米克