From 82e7a82825ccf2c9ab89ca89695d98eb389b226d Mon Sep 17 00:00:00 2001 From: Juan Yescas Date: Thu, 1 Aug 2024 10:35:05 -0700 Subject: [PATCH] 16kb: Config rw filesystem based on TARGET_RW_FILE_SYSTEM_TYPE The TARGET_RW_FILE_SYSTEM_TYPE will contain the rw filesystem to use. The rw filesystem for the devices can be f2fs or ext4. If TARGET_RW_FILE_SYSTEM_TYPE is not defined, the default fs will be f2fs. Bug: 356425337 Test: $ source build/envsetup.sh $ lunch [zumapro]-trunk_staging-userdebug $ m $ ./vendor/google/tools/flashall -w Flag: EXEMPT bugfix Change-Id: Ib087a06a98525ca449253dffce9df470a05432d3 --- conf/Android.bp | 110 +----------- conf/ext4/Android.bp | 164 ++++++++++++++++++ conf/ext4/fstab.rw.zumapro.ext4 | 5 + conf/f2fs/Android.bp | 164 ++++++++++++++++++ conf/f2fs/fstab.rw.zumapro.f2fs | 5 + ...{fstab.zumapro.in => fstab.zumapro.common} | 2 - device.mk | 8 + 7 files changed, 349 insertions(+), 109 deletions(-) create mode 100644 conf/ext4/Android.bp create mode 100644 conf/ext4/fstab.rw.zumapro.ext4 create mode 100644 conf/f2fs/Android.bp create mode 100644 conf/f2fs/fstab.rw.zumapro.f2fs rename conf/{fstab.zumapro.in => fstab.zumapro.common} (78%) diff --git a/conf/Android.bp b/conf/Android.bp index ef95c54..0185c98 100644 --- a/conf/Android.bp +++ b/conf/Android.bp @@ -14,16 +14,6 @@ * limitations under the License. */ -// By default this device uses hardware-wrapped keys for storage encryption, -// which is intended to offer increased security over the traditional method -// (software keys). However, hardware-wrapped keys aren't compatible with -// FIPS-140 certification of the encryption hardware, and hence we have to -// disable the use of them in FIPS mode. This requires having two fstab files: -// one for the default mode, and one for FIPS mode selectable via -// androidboot.fstab_suffix on the kernel command line. These fstabs should be -// identical with the exception of the encryption settings, so to keep them in -// sync the rules below generate them from a template file. - package { // See: http://go/android-license-faq // A large-scale-change added 'default_applicable_licenses' to import @@ -33,102 +23,8 @@ package { default_applicable_licenses: ["device_google_zumapro_license"], } -genrule { - name: "gen_fstab.zuma-hw-encrypt", - srcs: ["fstab.zumapro.in"], - out: ["fstab.zuma"], - cmd: "sed -e s/@fileencryption@/fileencryption=:aes-256-hctr2:inlinecrypt_optimized+wrappedkey_v0/" + - " -e s/@inlinecrypt@/inlinecrypt/ " + - " -e s/@metadata_encryption@/metadata_encryption=:wrappedkey_v0/ $(in) > $(out)", +filegroup { + name: "fstab.zumapro.common", + srcs: ["fstab.zumapro.common"], } -genrule { - name: "gen_fstab.zumapro-hw-encrypt", - srcs: ["fstab.zumapro.in"], - out: ["fstab.zumapro"], - cmd: "sed -e s/@fileencryption@/fileencryption=:aes-256-hctr2:inlinecrypt_optimized+wrappedkey_v0/" + - " -e s/@inlinecrypt@/inlinecrypt/ " + - " -e s/@metadata_encryption@/metadata_encryption=:wrappedkey_v0/ $(in) > $(out)", -} - -genrule { - name: "gen_fstab.zuma-sw-encrypt", - srcs: ["fstab.zumapro.in"], - out: ["fstab.zuma"], - cmd: "sed -e s/@fileencryption@/fileencryption=aes-256-xts:aes-256-hctr2/" + - " -e s/@inlinecrypt@// " + - " -e s/@metadata_encryption@/metadata_encryption=/ $(in) > $(out)", -} - -genrule { - name: "gen_fstab.zumapro-sw-encrypt", - srcs: ["fstab.zumapro.in"], - out: ["fstab.zumapro"], - cmd: "sed -e s/@fileencryption@/fileencryption=aes-256-xts:aes-256-hctr2/" + - " -e s/@inlinecrypt@// " + - " -e s/@metadata_encryption@/metadata_encryption=/ $(in) > $(out)", -} - -genrule { - name: "gen_fstab.zuma-no-encrypt", - srcs: ["fstab.zumapro.in"], - out: ["fstab.zuma"], - cmd: "sed -e s/@fileencryption@//" + - " -e s/@inlinecrypt@// " + - " -e s/@metadata_encryption@// $(in) > $(out)", -} - -genrule { - name: "gen_fstab.zumapro-no-encrypt", - srcs: ["fstab.zumapro.in"], - out: ["fstab.zumapro"], - cmd: "sed -e s/@fileencryption@//" + - " -e s/@inlinecrypt@// " + - " -e s/@metadata_encryption@// $(in) > $(out)", -} - -genrule { - name: "gen_fstab.zuma-fips", - srcs: ["fstab.zumapro.in"], - out: ["fstab.zuma-fips"], - cmd: "sed -e s/@fileencryption@/fileencryption=aes-256-xts/" + - " -e s/@inlinecrypt@/inlinecrypt/ " + - " -e s/@metadata_encryption@/metadata_encryption=aes-256-xts/ $(in) > $(out)", -} - -genrule { - name: "gen_fstab.zumapro-fips", - srcs: ["fstab.zumapro.in"], - out: ["fstab.zumapro-fips"], - cmd: "sed -e s/@fileencryption@/fileencryption=aes-256-xts/" + - " -e s/@inlinecrypt@/inlinecrypt/ " + - " -e s/@metadata_encryption@/metadata_encryption=aes-256-xts/ $(in) > $(out)", -} - -prebuilt_etc { - name: "fstab.zuma", - src: ":gen_fstab.zuma-hw-encrypt", - vendor: true, - vendor_ramdisk_available: true, -} - -prebuilt_etc { - name: "fstab.zumapro", - src: ":gen_fstab.zumapro-hw-encrypt", - vendor: true, - vendor_ramdisk_available: true, -} - -prebuilt_etc { - name: "fstab.zuma-fips", - src: ":gen_fstab.zuma-fips", - vendor: true, - vendor_ramdisk_available: true, -} - -prebuilt_etc { - name: "fstab.zumapro-fips", - src: ":gen_fstab.zumapro-fips", - vendor: true, - vendor_ramdisk_available: true, -} diff --git a/conf/ext4/Android.bp b/conf/ext4/Android.bp new file mode 100644 index 0000000..0a2cc96 --- /dev/null +++ b/conf/ext4/Android.bp @@ -0,0 +1,164 @@ +/* + * Copyright (C) 2024 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +// By default this device uses hardware-wrapped keys for storage encryption, +// which is intended to offer increased security over the traditional method +// (software keys). However, hardware-wrapped keys aren't compatible with +// FIPS-140 certification of the encryption hardware, and hence we have to +// disable the use of them in FIPS mode. This requires having two fstab files: +// one for the default mode, and one for FIPS mode selectable via +// androidboot.fstab_suffix on the kernel command line. These fstabs should be +// identical with the exception of the encryption settings, so to keep them in +// sync the rules below generate them from a template file. + +soong_namespace { + imports: [ + "device/google/zumapro", + ], +} + +package { + // See: http://go/android-license-faq + // A large-scale-change added 'default_applicable_licenses' to import + // all of the 'license_kinds' from "device_google_zumapro_license" + // to get the below license kinds: + // SPDX-license-identifier-Apache-2.0 + default_applicable_licenses: ["device_google_zumapro_license"], +} + +genrule { + name: "gen_fstab.zuma-hw-encrypt", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.ext4", + ], + out: ["fstab.zuma"], + cmd: "sed -e s/@fileencryption@/fileencryption=:aes-256-hctr2:inlinecrypt_optimized+wrappedkey_v0/" + + " -e s/@inlinecrypt@/inlinecrypt/ " + + " -e s/@metadata_encryption@/metadata_encryption=:wrappedkey_v0/ $(in) > $(out)", +} + +genrule { + name: "gen_fstab.zumapro-hw-encrypt", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.ext4", + ], + out: ["fstab.zumapro"], + cmd: "sed -e s/@fileencryption@/fileencryption=:aes-256-hctr2:inlinecrypt_optimized+wrappedkey_v0/" + + " -e s/@inlinecrypt@/inlinecrypt/ " + + " -e s/@metadata_encryption@/metadata_encryption=:wrappedkey_v0/ $(in) > $(out)", +} + +genrule { + name: "gen_fstab.zuma-sw-encrypt", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.ext4", + ], + out: ["fstab.zuma"], + cmd: "sed -e s/@fileencryption@/fileencryption=aes-256-xts:aes-256-hctr2/" + + " -e s/@inlinecrypt@// " + + " -e s/@metadata_encryption@/metadata_encryption=/ $(in) > $(out)", +} + +genrule { + name: "gen_fstab.zumapro-sw-encrypt", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.ext4", + ], + out: ["fstab.zumapro"], + cmd: "sed -e s/@fileencryption@/fileencryption=aes-256-xts:aes-256-hctr2/" + + " -e s/@inlinecrypt@// " + + " -e s/@metadata_encryption@/metadata_encryption=/ $(in) > $(out)", +} + +genrule { + name: "gen_fstab.zuma-no-encrypt", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.ext4", + ], + out: ["fstab.zuma"], + cmd: "sed -e s/@fileencryption@//" + + " -e s/@inlinecrypt@// " + + " -e s/@metadata_encryption@// $(in) > $(out)", +} + +genrule { + name: "gen_fstab.zumapro-no-encrypt", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.ext4", + ], + out: ["fstab.zumapro"], + cmd: "sed -e s/@fileencryption@//" + + " -e s/@inlinecrypt@// " + + " -e s/@metadata_encryption@// $(in) > $(out)", +} + +genrule { + name: "gen_fstab.zuma-fips", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.ext4", + ], + out: ["fstab.zuma-fips"], + cmd: "sed -e s/@fileencryption@/fileencryption=aes-256-xts/" + + " -e s/@inlinecrypt@/inlinecrypt/ " + + " -e s/@metadata_encryption@/metadata_encryption=aes-256-xts/ $(in) > $(out)", +} + +genrule { + name: "gen_fstab.zumapro-fips", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.ext4", + ], + out: ["fstab.zumapro-fips"], + cmd: "sed -e s/@fileencryption@/fileencryption=aes-256-xts/" + + " -e s/@inlinecrypt@/inlinecrypt/ " + + " -e s/@metadata_encryption@/metadata_encryption=aes-256-xts/ $(in) > $(out)", +} + +prebuilt_etc { + name: "fstab.zuma", + src: ":gen_fstab.zuma-hw-encrypt", + vendor: true, + vendor_ramdisk_available: true, +} + +prebuilt_etc { + name: "fstab.zumapro", + src: ":gen_fstab.zumapro-hw-encrypt", + vendor: true, + vendor_ramdisk_available: true, +} + +prebuilt_etc { + name: "fstab.zuma-fips", + src: ":gen_fstab.zuma-fips", + vendor: true, + vendor_ramdisk_available: true, +} + +prebuilt_etc { + name: "fstab.zumapro-fips", + src: ":gen_fstab.zumapro-fips", + vendor: true, + vendor_ramdisk_available: true, +} diff --git a/conf/ext4/fstab.rw.zumapro.ext4 b/conf/ext4/fstab.rw.zumapro.ext4 new file mode 100644 index 0000000..b548c13 --- /dev/null +++ b/conf/ext4/fstab.rw.zumapro.ext4 @@ -0,0 +1,5 @@ +# Android fstab file for /data and /metadata partitions. +# +# +/dev/block/platform/13200000.ufs/by-name/metadata /metadata ext4 noatime,nosuid,nodev,sync wait,check,formattable,first_stage_mount +/dev/block/platform/13200000.ufs/by-name/userdata /data ext4 noatime,nosuid,nodev latemount,wait,check,quota,formattable,sysfs_path=/dev/sys/block/bootdevice,reservedsize=128M,readahead_size_kb=128 diff --git a/conf/f2fs/Android.bp b/conf/f2fs/Android.bp new file mode 100644 index 0000000..bcaf11d --- /dev/null +++ b/conf/f2fs/Android.bp @@ -0,0 +1,164 @@ +/* + * Copyright (C) 2024 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +// By default this device uses hardware-wrapped keys for storage encryption, +// which is intended to offer increased security over the traditional method +// (software keys). However, hardware-wrapped keys aren't compatible with +// FIPS-140 certification of the encryption hardware, and hence we have to +// disable the use of them in FIPS mode. This requires having two fstab files: +// one for the default mode, and one for FIPS mode selectable via +// androidboot.fstab_suffix on the kernel command line. These fstabs should be +// identical with the exception of the encryption settings, so to keep them in +// sync the rules below generate them from a template file. + +soong_namespace { + imports: [ + "device/google/zumapro", + ], +} + +package { + // See: http://go/android-license-faq + // A large-scale-change added 'default_applicable_licenses' to import + // all of the 'license_kinds' from "device_google_zumapro_license" + // to get the below license kinds: + // SPDX-license-identifier-Apache-2.0 + default_applicable_licenses: ["device_google_zumapro_license"], +} + +genrule { + name: "gen_fstab.zuma-hw-encrypt", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.f2fs", + ], + out: ["fstab.zuma"], + cmd: "sed -e s/@fileencryption@/fileencryption=:aes-256-hctr2:inlinecrypt_optimized+wrappedkey_v0/" + + " -e s/@inlinecrypt@/inlinecrypt/ " + + " -e s/@metadata_encryption@/metadata_encryption=:wrappedkey_v0/ $(in) > $(out)", +} + +genrule { + name: "gen_fstab.zumapro-hw-encrypt", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.f2fs", + ], + out: ["fstab.zumapro"], + cmd: "sed -e s/@fileencryption@/fileencryption=:aes-256-hctr2:inlinecrypt_optimized+wrappedkey_v0/" + + " -e s/@inlinecrypt@/inlinecrypt/ " + + " -e s/@metadata_encryption@/metadata_encryption=:wrappedkey_v0/ $(in) > $(out)", +} + +genrule { + name: "gen_fstab.zuma-sw-encrypt", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.f2fs", + ], + out: ["fstab.zuma"], + cmd: "sed -e s/@fileencryption@/fileencryption=aes-256-xts:aes-256-hctr2/" + + " -e s/@inlinecrypt@// " + + " -e s/@metadata_encryption@/metadata_encryption=/ $(in) > $(out)", +} + +genrule { + name: "gen_fstab.zumapro-sw-encrypt", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.f2fs", + ], + out: ["fstab.zumapro"], + cmd: "sed -e s/@fileencryption@/fileencryption=aes-256-xts:aes-256-hctr2/" + + " -e s/@inlinecrypt@// " + + " -e s/@metadata_encryption@/metadata_encryption=/ $(in) > $(out)", +} + +genrule { + name: "gen_fstab.zuma-no-encrypt", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.f2fs", + ], + out: ["fstab.zuma"], + cmd: "sed -e s/@fileencryption@//" + + " -e s/@inlinecrypt@// " + + " -e s/@metadata_encryption@// $(in) > $(out)", +} + +genrule { + name: "gen_fstab.zumapro-no-encrypt", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.f2fs", + ], + out: ["fstab.zumapro"], + cmd: "sed -e s/@fileencryption@//" + + " -e s/@inlinecrypt@// " + + " -e s/@metadata_encryption@// $(in) > $(out)", +} + +genrule { + name: "gen_fstab.zuma-fips", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.f2fs", + ], + out: ["fstab.zuma-fips"], + cmd: "sed -e s/@fileencryption@/fileencryption=aes-256-xts/" + + " -e s/@inlinecrypt@/inlinecrypt/ " + + " -e s/@metadata_encryption@/metadata_encryption=aes-256-xts/ $(in) > $(out)", +} + +genrule { + name: "gen_fstab.zumapro-fips", + srcs: [ + ":fstab.zumapro.common", + "fstab.rw.zumapro.f2fs", + ], + out: ["fstab.zumapro-fips"], + cmd: "sed -e s/@fileencryption@/fileencryption=aes-256-xts/" + + " -e s/@inlinecrypt@/inlinecrypt/ " + + " -e s/@metadata_encryption@/metadata_encryption=aes-256-xts/ $(in) > $(out)", +} + +prebuilt_etc { + name: "fstab.zuma", + src: ":gen_fstab.zuma-hw-encrypt", + vendor: true, + vendor_ramdisk_available: true, +} + +prebuilt_etc { + name: "fstab.zumapro", + src: ":gen_fstab.zumapro-hw-encrypt", + vendor: true, + vendor_ramdisk_available: true, +} + +prebuilt_etc { + name: "fstab.zuma-fips", + src: ":gen_fstab.zuma-fips", + vendor: true, + vendor_ramdisk_available: true, +} + +prebuilt_etc { + name: "fstab.zumapro-fips", + src: ":gen_fstab.zumapro-fips", + vendor: true, + vendor_ramdisk_available: true, +} diff --git a/conf/f2fs/fstab.rw.zumapro.f2fs b/conf/f2fs/fstab.rw.zumapro.f2fs new file mode 100644 index 0000000..77ec4d5 --- /dev/null +++ b/conf/f2fs/fstab.rw.zumapro.f2fs @@ -0,0 +1,5 @@ +# Android fstab file for /data and /metadata partitions. +# +# +/dev/block/platform/13200000.ufs/by-name/metadata /metadata f2fs noatime,nosuid,nodev,sync wait,check,formattable,first_stage_mount +/dev/block/platform/13200000.ufs/by-name/userdata /data f2fs noatime,nosuid,nodev,discard,reserve_root=32768,resgid=1065,fsync_mode=nobarrier,compress_extension=apk,compress_extension=so,compress_extension=vdex,compress_extension=odex,@inlinecrypt@,atgc,checkpoint_merge,compress_cache latemount,wait,check,quota,formattable,sysfs_path=/dev/sys/block/bootdevice,checkpoint=fs,reservedsize=128M,fscompress,readahead_size_kb=128,@fileencryption@,@metadata_encryption@,keydirectory=/metadata/vold/metadata_encryption,device=zoned:/dev/block/by-name/zoned_device diff --git a/conf/fstab.zumapro.in b/conf/fstab.zumapro.common similarity index 78% rename from conf/fstab.zumapro.in rename to conf/fstab.zumapro.common index bcb0c2f..a5521b7 100644 --- a/conf/fstab.zumapro.in +++ b/conf/fstab.zumapro.common @@ -15,8 +15,6 @@ vendor_dlkm /vendor_dlkm /dev/block/platform/13200000.ufs/by-name/boot /boot emmc defaults slotselect,avb=boot,first_stage_mount /dev/block/platform/13200000.ufs/by-name/init_boot /init_boot emmc defaults slotselect,avb=init_boot,first_stage_mount /dev/block/platform/13200000.ufs/by-name/misc /misc emmc defaults wait -/dev/block/platform/13200000.ufs/by-name/metadata /metadata f2fs noatime,nosuid,nodev,sync wait,check,formattable,first_stage_mount #/dev/block/platform/13200000.ufs/by-name/pvmfw /pvmfw emmc defaults wait,slotselect,avb=pvmfw,first_stage_mount -/dev/block/platform/13200000.ufs/by-name/userdata /data f2fs noatime,nosuid,nodev,discard,reserve_root=32768,resgid=1065,fsync_mode=nobarrier,compress_extension=apk,compress_extension=so,compress_extension=vdex,compress_extension=odex,@inlinecrypt@,atgc,checkpoint_merge,compress_cache latemount,wait,check,quota,formattable,sysfs_path=/dev/sys/block/bootdevice,checkpoint=fs,reservedsize=128M,fscompress,readahead_size_kb=128,@fileencryption@,@metadata_encryption@,keydirectory=/metadata/vold/metadata_encryption,device=zoned:/dev/block/by-name/zoned_device /dev/block/platform/13200000.ufs/by-name/vbmeta /vbmeta emmc defaults slotselect,first_stage_mount /devices/platform/11210000.usb* auto vfat defaults voldmanaged=usb:auto diff --git a/device.mk b/device.mk index 425b888..cc9fa53 100644 --- a/device.mk +++ b/device.mk @@ -454,6 +454,14 @@ PRODUCT_COPY_FILES += \ device/google/zumapro/conf/init.recovery.device.rc:$(TARGET_COPY_OUT_RECOVERY)/root/init.recovery.zuma.rc # Fstab files +ifeq (ext4,$(TARGET_RW_FILE_SYSTEM_TYPE)) +PRODUCT_SOONG_NAMESPACES += \ + device/google/zumapro/conf/ext4 +else +PRODUCT_SOONG_NAMESPACES += \ + device/google/zumapro/conf/f2fs +endif + PRODUCT_PACKAGES += \ fstab.zuma \ fstab.zumapro \