2 * veritysetup - setup cryptographic volumes for dm-verity
4 * Copyright (C) 2012, Red Hat, Inc. All rights reserved.
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * version 2 as published by the Free Software Foundation.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
20 #define _FILE_OFFSET_BITS 64
31 #include <sys/types.h>
33 #include <sys/ioctl.h>
34 #include <sys/mount.h>
35 #include <arpa/inet.h>
38 #include "crypto_backend.h"
40 #define DEFAULT_BLOCK_SIZE 4096
41 #define DM_VERITY_MAX_LEVELS 63
43 #define DEFAULT_SALT_SIZE 32
44 #define MAX_SALT_SIZE 384
48 #define MODE_ACTIVATE 2
50 #define MAX_FORMAT_VERSION 1
53 static int use_superblock = 1;
55 static const char *dm_device;
56 static const char *data_device;
57 static const char *hash_device;
58 static const char *hash_algorithm = NULL;
59 static const char *root_hash;
61 static int version = -1;
62 static int data_block_size = 0;
63 static int hash_block_size = 0;
64 static char *data_blocks_string = NULL;
65 static long long data_blocks = 0;
66 static char *hash_start_string = NULL;
67 static long long hash_start = 0;
68 static const char *salt_string = NULL;
70 static FILE *data_file;
71 static FILE *hash_file;
73 static off_t data_file_blocks;
74 static off_t hash_file_blocks;
75 static off_t used_hash_blocks;
77 static char *root_hash_bytes;
78 static char *calculated_digest;
80 static char *salt_bytes;
81 static unsigned salt_size;
83 static unsigned digest_size;
84 static unsigned char digest_size_bits;
85 static unsigned char levels;
86 static unsigned char hash_per_block_bits;
88 static off_t hash_level_block[DM_VERITY_MAX_LEVELS];
89 static off_t hash_level_size[DM_VERITY_MAX_LEVELS];
91 static off_t superblock_position;
93 static int retval = 0;
95 static int opt_debug = 0;
100 uint8_t data_block_bits;
101 uint8_t hash_block_bits;
105 uint32_t data_blocks_hi;
106 uint32_t data_blocks_lo;
107 uint8_t algorithm[16];
108 uint8_t salt[MAX_SALT_SIZE];
112 #define DM_VERITY_SIGNATURE "verity\0\0"
113 #define DM_VERITY_VERSION 0
115 __attribute__((format(printf, 5, 6)))
116 void logger(struct crypt_device *cd, int level, const char *file,
117 int line, const char *format, ...)
122 va_start(argp, format);
124 if (vasprintf(&target, format, argp) > 0) {
126 printf("%s\n", target);
127 } else if (opt_debug)
128 printf("# %s\n", target);
135 __attribute__((__noreturn__))
136 static void help(poptContext popt_context,
137 enum poptCallbackReason reason,
138 struct poptOption *key,
142 if (!strcmp(key->longName, "help")) {
143 poptPrintHelp(popt_context, stdout, 0);
145 printf("veritysetup");
151 static struct poptOption popt_help_options[] = {
152 { NULL, 0, POPT_ARG_CALLBACK, help, 0, NULL, NULL },
153 { "help", 'h', POPT_ARG_NONE, NULL, 0, "Show help", NULL },
154 { "version", 0, POPT_ARG_NONE, NULL, 0, "Show version", NULL },
158 static struct poptOption popt_options[] = {
159 { NULL, '\0', POPT_ARG_INCLUDE_TABLE, popt_help_options, 0, NULL, NULL },
160 { "create", 'c', POPT_ARG_VAL, &mode, MODE_CREATE, "Create hash", NULL },
161 { "verify", 'v', POPT_ARG_VAL, &mode, MODE_VERIFY, "Verify integrity", NULL },
162 { "activate", 'a', POPT_ARG_VAL, &mode, MODE_ACTIVATE, "Activate the device", NULL },
163 { "no-superblock", 0, POPT_ARG_VAL, &use_superblock, 0, "Do not create/use superblock" },
164 { "format", 0, POPT_ARG_INT, &version, 0, "Format version (1 - normal format, 0 - original Chromium OS format)", "number" },
165 { "data-block-size", 0, POPT_ARG_INT, &data_block_size, 0, "Block size on the data device", "bytes" },
166 { "hash-block-size", 0, POPT_ARG_INT, &hash_block_size, 0, "Block size on the hash device", "bytes" },
167 { "data-blocks", 0, POPT_ARG_STRING, &data_blocks_string, 0, "The number of blocks in the data file", "blocks" },
168 { "hash-start", 0, POPT_ARG_STRING, &hash_start_string, 0, "Starting block on the hash device", "512-byte sectors" },
169 { "algorithm", 0, POPT_ARG_STRING, &hash_algorithm, 0, "Hash algorithm (default sha256)", "string" },
170 { "salt", 0, POPT_ARG_STRING, &salt_string, 0, "Salt", "hex string" },
174 __attribute__((__format__(__printf__, 1, 2), __noreturn__))
175 static void exit_err(const char *msg, ...)
179 vfprintf(stderr, msg, args);
185 __attribute__((__noreturn__))
186 static void stream_err(FILE *f, const char *msg)
191 } else if (feof(f)) {
192 exit_err("eof on %s", msg);
194 exit_err("unknown error on %s", msg);
198 static void *xmalloc(size_t s)
200 void *ptr = malloc(!s ? 1 : s);
201 if (!ptr) exit_err("out of memory");
205 static char *xstrdup(const char *str)
207 return strcpy(xmalloc(strlen(str) + 1), str);
210 static char *xprint(unsigned long long num)
212 size_t s = snprintf(NULL, 0, "%llu", num);
213 char *p = xmalloc(s + 1);
214 snprintf(p, s + 1, "%llu", num);
218 static char *xhexprint(char *bytes, size_t len)
221 char *p = xmalloc(len * 2 + 1);
223 for (i = 0; i < len; i++)
224 snprintf(p + i * 2, 3, "%02x", bytes[i]);
228 static off_t get_size(FILE *f, const char *name)
240 if (S_ISREG(st.st_mode)) {
242 } else if (S_ISBLK(st.st_mode)) {
243 unsigned long long size64;
244 unsigned long sizeul;
245 if (!ioctl(h, BLKGETSIZE64, &size64)) {
247 if ((off_t)size64 < 0 || (off_t)size64 != size64) {
249 exit_err("%s: device size overflow", name);
253 if (!ioctl(h, BLKGETSIZE, &sizeul)) {
254 size64 = (unsigned long long)sizeul * 512;
255 if (size64 / 512 != sizeul) goto size_overflow;
258 perror("BLKGETSIZE");
261 exit_err("%s is not a file or a block device", name);
263 return -1; /* never reached, shut up warning */
266 static void block_fseek(FILE *f, off_t block, int block_size)
268 unsigned long long pos = (unsigned long long)block * block_size;
269 if (pos / block_size != block ||
272 exit_err("seek position overflow");
273 if (fseeko(f, pos, SEEK_SET)) {
279 static off_t verity_position_at_level(off_t block, int level)
281 return block >> (level * hash_per_block_bits);
284 static void calculate_positions(void)
286 unsigned long long hash_position;
289 digest_size_bits = 0;
290 while (1 << digest_size_bits < digest_size)
292 hash_per_block_bits = 0;
293 while (((hash_block_size / digest_size) >> hash_per_block_bits) > 1)
294 hash_per_block_bits++;
295 if (!hash_per_block_bits)
296 exit_err("at least two hashes must fit in a hash file block");
299 if (data_file_blocks) {
300 while (hash_per_block_bits * levels < 64 &&
301 (unsigned long long)(data_file_blocks - 1) >>
302 (hash_per_block_bits * levels))
306 if (levels > DM_VERITY_MAX_LEVELS)
307 exit_err("too many tree levels");
309 hash_position = hash_start * 512 / hash_block_size;
310 for (i = levels - 1; i >= 0; i--) {
312 hash_level_block[i] = hash_position;
313 s = verity_position_at_level(data_file_blocks, i);
314 s = (s >> hash_per_block_bits) +
315 !!(s & ((1 << hash_per_block_bits) - 1));
316 hash_level_size[i] = s;
317 if (hash_position + s < hash_position ||
318 (off_t)(hash_position + s) < 0 ||
319 (off_t)(hash_position + s) != hash_position + s)
320 exit_err("hash device offset overflow");
323 used_hash_blocks = hash_position;
326 static void create_or_verify_zero(FILE *wr, char *left_block, unsigned left_bytes)
329 if (mode != MODE_CREATE) {
331 if (fread(left_block, left_bytes, 1, wr) != 1)
332 stream_err(wr, "read");
333 for (x = 0; x < left_bytes; x++) if (left_block[x]) {
335 fprintf(stderr, "spare area is not zeroed at position %lld\n", (long long)ftello(wr) - left_bytes);
338 if (fwrite(left_block, left_bytes, 1, wr) != 1)
339 stream_err(wr, "write");
344 static void create_or_verify_stream(FILE *rd, FILE *wr, int block_size, off_t blocks)
346 char *left_block = xmalloc(hash_block_size);
347 char *data_buffer = xmalloc(block_size);
348 char *read_digest = mode != MODE_CREATE ? xmalloc(digest_size) : NULL;
349 off_t blocks_to_write = (blocks >> hash_per_block_bits) +
350 !!(blocks & ((1 << hash_per_block_bits) - 1));
351 struct crypt_hash *ctx = NULL;
353 if (crypt_hash_init(&ctx, hash_algorithm))
354 exit_err("hash_init failed");
356 memset(left_block, 0, hash_block_size);
357 while (blocks_to_write--) {
359 unsigned left_bytes = hash_block_size;
360 for (x = 0; x < 1 << hash_per_block_bits; x++) {
364 if (fread(data_buffer, block_size, 1, rd) != 1)
365 stream_err(rd, "read");
367 if (crypt_hash_write(ctx, salt_bytes, salt_size))
368 exit_err("hash_write failed");
370 if (crypt_hash_write(ctx, data_buffer, block_size))
371 exit_err("hash_write failed");
373 if (crypt_hash_write(ctx, salt_bytes, salt_size))
374 exit_err("hash_write failed");
376 if (crypt_hash_final(ctx, calculated_digest, digest_size))
377 exit_err("hash_final failed");
380 if (mode != MODE_CREATE) {
381 if (fread(read_digest, digest_size, 1, wr) != 1)
382 stream_err(wr, "read");
383 if (memcmp(read_digest, calculated_digest, digest_size)) {
385 fprintf(stderr, "verification failed at position %lld in %s file\n", (long long)ftello(rd) - block_size, rd == data_file ? "data" : "metadata");
388 if (fwrite(calculated_digest, digest_size, 1, wr) != 1)
389 stream_err(wr, "write");
392 left_bytes -= digest_size;
394 create_or_verify_zero(wr, left_block, (1 << digest_size_bits) - digest_size);
395 left_bytes -= 1 << digest_size_bits;
399 create_or_verify_zero(wr, left_block, left_bytes);
401 if (mode == MODE_CREATE && wr) {
407 stream_err(wr, "write");
410 crypt_hash_destroy(ctx);
413 if (mode != MODE_CREATE)
417 static char **make_target_line(void)
419 const int line_elements = 14;
420 char **line = xmalloc(line_elements * sizeof(char *));
422 char *algorithm_copy = xstrdup(hash_algorithm);
423 /* transform ripemdXXX to rmdXXX */
424 if (!strncmp(algorithm_copy, "ripemd", 6))
425 memmove(algorithm_copy + 1, algorithm_copy + 4, strlen(algorithm_copy + 4) + 1);
426 if (!strcmp(algorithm_copy, "whirlpool"))
427 strcpy(algorithm_copy, "wp512");
428 line[i++] = xstrdup("0");
429 line[i++] = xprint((unsigned long long)data_file_blocks * data_block_size / 512);
430 line[i++] = xstrdup("verity");
431 line[i++] = xprint(version);
432 line[i++] = xstrdup(data_device);
433 line[i++] = xstrdup(hash_device);
434 line[i++] = xprint(data_block_size);
435 line[i++] = xprint(hash_block_size);
436 line[i++] = xprint(data_file_blocks);
437 line[i++] = xprint(hash_start * 512 / hash_block_size);
438 line[i++] = algorithm_copy;
439 line[i++] = xhexprint(calculated_digest, digest_size);
440 line[i++] = !salt_size ? xstrdup("-") : xhexprint(salt_bytes, salt_size);
442 if (i > line_elements)
443 exit_err("INTERNAL ERROR: insufficient array size");
447 static void free_target_line(char **line)
450 for (i = 0; line[i]; i++)
455 static void create_or_verify(void)
459 memset(calculated_digest, 0, digest_size);
460 if (mode != MODE_ACTIVATE)
461 for (i = 0; i < levels; i++) {
462 block_fseek(hash_file, hash_level_block[i], hash_block_size);
464 block_fseek(data_file, 0, data_block_size);
465 create_or_verify_stream(data_file, hash_file, data_block_size, data_file_blocks);
467 FILE *hash_file_2 = fopen(hash_device, "r");
472 block_fseek(hash_file_2, hash_level_block[i - 1], hash_block_size);
473 create_or_verify_stream(hash_file_2, hash_file, hash_block_size, hash_level_size[i - 1]);
479 block_fseek(hash_file, hash_level_block[levels - 1], hash_block_size);
480 create_or_verify_stream(hash_file, NULL, hash_block_size, 1);
482 block_fseek(data_file, 0, data_block_size);
483 create_or_verify_stream(data_file, NULL, data_block_size, data_file_blocks);
486 if (mode != MODE_CREATE) {
487 if (memcmp(calculated_digest, root_hash_bytes, digest_size)) {
488 fprintf(stderr, "verification failed in the root block\n");
491 if (!retval && mode == MODE_VERIFY)
492 fprintf(stderr, "hash successfully verified\n");
496 if (fsync(fileno(hash_file))) {
500 printf("hash device size: %llu\n", (unsigned long long)used_hash_blocks * hash_block_size);
501 printf("data block size %u, hash block size %u, %u tree levels\n", data_block_size, hash_block_size, levels);
503 p = xhexprint(salt_bytes, salt_size);
506 printf("salt: %s\n", p);
508 p = xhexprint(calculated_digest, digest_size);
509 printf("root hash: %s\n", p);
511 printf("target line:");
512 target_line = make_target_line();
513 for (i = 0; target_line[i]; i++)
514 printf(" %s", target_line[i]);
515 free_target_line(target_line);
520 __attribute__((__noreturn__))
521 static void activate(void)
526 char **target_line = make_target_line();
527 for (i = 0; target_line[i]; i++) {
530 len += strlen(target_line[i]);
532 table_arg = xmalloc(len);
534 for (i = 0; target_line[i]; i++) {
536 strcat(table_arg, " ");
537 strcat(table_arg, target_line[i]);
539 free_target_line(target_line);
540 execlp("dmsetup", "dmsetup", "-r", "create", dm_device, "--table", table_arg, NULL);
545 static void get_hex(const char *string, char **result, size_t len, const char *description)
547 size_t rl = strlen(string);
549 if (strspn(string, "0123456789ABCDEFabcdef") != rl)
550 exit_err("invalid %s", description);
552 exit_err("invalid length of %s", description);
553 *result = xmalloc(len);
554 memset(*result, 0, len);
555 for (u = 0; u < rl; u++) {
556 unsigned char c = (string[u] & 15) + (string[u] > '9' ? 9 : 0);
557 (*result)[u / 2] |= c << (((u & 1) ^ 1) << 2);
561 static struct superblock superblock;
563 static void load_superblock(void)
565 long long sb_data_blocks;
567 block_fseek(hash_file, superblock_position, 1);
568 if (fread(&superblock, sizeof(struct superblock), 1, hash_file) != 1)
569 stream_err(hash_file, "read");
570 if (memcmp(superblock.signature, DM_VERITY_SIGNATURE, sizeof(superblock.signature)))
571 exit_err("superblock not found on the hash device");
572 if (superblock.version > MAX_FORMAT_VERSION)
573 exit_err("unknown version");
574 if (superblock.data_block_bits < 9 || superblock.data_block_bits >= 31)
575 exit_err("invalid data_block_bits in the superblock");
576 if (superblock.hash_block_bits < 9 || superblock.hash_block_bits >= 31)
577 exit_err("invalid data_block_bits in the superblock");
578 sb_data_blocks = ((unsigned long long)ntohl(superblock.data_blocks_hi) << 31 << 1) | ntohl(superblock.data_blocks_lo);
579 if (sb_data_blocks < 0 || (off_t)sb_data_blocks < 0 || (off_t)sb_data_blocks != sb_data_blocks)
580 exit_err("invalid data blocks in the superblock");
581 if (!memchr(superblock.algorithm, 0, sizeof(superblock.algorithm)))
582 exit_err("invalid hash algorithm in the superblock");
583 if (ntohs(superblock.salt_size) > MAX_SALT_SIZE)
584 exit_err("invalid salt_size in the superblock");
587 version = superblock.version;
589 if (version != superblock.version)
590 exit_err("version (%d) does not match superblock value (%d)", version, superblock.version);
593 if (!data_block_size) {
594 data_block_size = 1 << superblock.data_block_bits;
596 if (data_block_size != 1 << superblock.data_block_bits)
597 exit_err("data block size (%d) does not match superblock value (%d)", data_block_size, 1 << superblock.data_block_bits);
600 if (!hash_block_size) {
601 hash_block_size = 1 << superblock.hash_block_bits;
603 if (hash_block_size != 1 << superblock.hash_block_bits)
604 exit_err("hash block size (%d) does not match superblock value (%d)", hash_block_size, 1 << superblock.hash_block_bits);
607 if (!data_blocks_string) {
608 data_blocks = sb_data_blocks;
609 data_blocks_string = (char *)"";
611 if (data_blocks != sb_data_blocks)
612 exit_err("data blocks (%lld) does not match superblock value (%lld)", data_blocks, sb_data_blocks);
615 if (!hash_algorithm) {
616 hash_algorithm = (char *)superblock.algorithm;
618 if (strcmp(hash_algorithm, (char *)superblock.algorithm))
619 exit_err("hash algorithm (%s) does not match superblock value (%s)", hash_algorithm, superblock.algorithm);
623 salt_size = ntohs(superblock.salt_size);
624 salt_bytes = xmalloc(salt_size);
625 memcpy(salt_bytes, superblock.salt, salt_size);
627 if (salt_size != ntohs(superblock.salt_size) ||
628 memcmp(salt_bytes, superblock.salt, salt_size))
629 exit_err("salt does not match superblock value");
633 static void save_superblock(void)
635 memset(&superblock, 0, sizeof(struct superblock));
637 memcpy(&superblock.signature, DM_VERITY_SIGNATURE, sizeof(superblock.signature));
638 superblock.version = version;
639 superblock.data_block_bits = ffs(data_block_size) - 1;
640 superblock.hash_block_bits = ffs(hash_block_size) - 1;
641 superblock.salt_size = htons(salt_size);
642 superblock.data_blocks_hi = htonl(data_file_blocks >> 31 >> 1);
643 superblock.data_blocks_lo = htonl(data_file_blocks & 0xFFFFFFFF);
644 strncpy((char *)superblock.algorithm, hash_algorithm, sizeof superblock.algorithm);
645 memcpy(superblock.salt, salt_bytes, salt_size);
647 block_fseek(hash_file, superblock_position, 1);
648 if (fwrite(&superblock, sizeof(struct superblock), 1, hash_file) != 1)
649 stream_err(hash_file, "write");
652 int main(int argc, const char **argv)
654 poptContext popt_context;
659 if (sizeof(struct superblock) != 512)
660 exit_err("INTERNAL ERROR: bad superblock size %ld", (long)sizeof(struct superblock));
662 popt_context = poptGetContext("verity", argc, argv, popt_options, 0);
664 poptSetOtherOptionHelp(popt_context, "[-c | -v | -a] [<device name> if activating] <data device> <hash device> [<root hash> if activating or verifying] [OPTION...]");
667 poptPrintHelp(popt_context, stdout, 0);
671 r = poptGetNextOpt(popt_context);
673 exit_err("bad option %s", poptBadOption(popt_context, 0));
676 exit_err("verify, create or activate mode not specified");
678 if (mode == MODE_ACTIVATE) {
679 dm_device = poptGetArg(popt_context);
681 exit_err("device name is missing");
682 if (!*dm_device || strchr(dm_device, '/'))
683 exit_err("invalid device name to activate");
686 data_device = poptGetArg(popt_context);
688 exit_err("data device is missing");
690 hash_device = poptGetArg(popt_context);
692 exit_err("metadata device is missing");
694 if (mode != MODE_CREATE) {
695 root_hash = poptGetArg(popt_context);
697 exit_err("root hash not specified");
700 s = poptGetArg(popt_context);
702 exit_err("extra argument %s", s);
704 data_file = fopen(data_device, "r");
710 hash_file = fopen(hash_device, mode != MODE_CREATE ? "r" : "r+");
711 if (!hash_file && errno == ENOENT && mode == MODE_CREATE)
712 hash_file = fopen(hash_device, "w+");
718 if (data_blocks_string) {
719 data_blocks = strtoll(data_blocks_string, &end, 10);
720 if (!*data_blocks_string || *end)
721 exit_err("invalid number of data blocks");
724 if (hash_start_string) {
725 hash_start = strtoll(hash_start_string, &end, 10);
726 if (!*hash_start_string || *end)
727 exit_err("invalid hash start");
730 if (hash_start < 0 ||
731 (unsigned long long)hash_start * 512 / 512 != hash_start ||
732 (off_t)(hash_start * 512) < 0 ||
733 (off_t)(hash_start * 512) != hash_start * 512) exit_err("invalid hash start");
735 if (salt_string || !use_superblock) {
736 if (!salt_string || !strcmp(salt_string, "-"))
738 salt_size = strlen(salt_string) / 2;
739 if (salt_size > MAX_SALT_SIZE)
740 exit_err("too long salt (max %d bytes)", MAX_SALT_SIZE);
741 get_hex(salt_string, &salt_bytes, salt_size, "salt");
744 if (use_superblock) {
745 superblock_position = hash_start * 512;
746 if (mode != MODE_CREATE)
751 version = MAX_FORMAT_VERSION;
752 if (version < 0 || version > MAX_FORMAT_VERSION)
753 exit_err("invalid format version");
755 if (!data_block_size)
756 data_block_size = DEFAULT_BLOCK_SIZE;
757 if (!hash_block_size)
758 hash_block_size = data_block_size;
760 if (data_block_size < 512 || (data_block_size & (data_block_size - 1)) || data_block_size >= 1U << 31)
761 exit_err("invalid data block size");
763 if (hash_block_size < 512 || (hash_block_size & (hash_block_size - 1)) || hash_block_size >= 1U << 31)
764 exit_err("invalid hash block size");
766 if (data_blocks < 0 || (off_t)data_blocks < 0 || (off_t)data_blocks != data_blocks)
767 exit_err("invalid number of data blocks");
769 data_file_blocks = get_size(data_file, data_device) / data_block_size;
770 hash_file_blocks = get_size(hash_file, hash_device) / hash_block_size;
772 if (data_file_blocks < data_blocks)
773 exit_err("data file is too small");
774 if (data_blocks_string)
775 data_file_blocks = data_blocks;
777 if (use_superblock) {
778 hash_start = hash_start + (sizeof(struct superblock) + 511) / 512;
779 hash_start = (hash_start + (hash_block_size / 512 - 1)) & ~(long long)(hash_block_size / 512 - 1);
782 if ((unsigned long long)hash_start * 512 % hash_block_size)
783 exit_err("hash start not aligned on block size");
786 hash_algorithm = "sha256";
787 if (strlen(hash_algorithm) >= sizeof(superblock.algorithm) && use_superblock)
788 exit_err("hash algorithm name is too long");
790 if (crypt_backend_init(NULL))
791 exit_err("cannot initialize crypto backend");
793 digest_size = crypt_hash_size(hash_algorithm);
794 if (!digest_size) exit_err("hash algorithm %s not found", hash_algorithm);
797 salt_size = DEFAULT_SALT_SIZE;
798 salt_bytes = xmalloc(salt_size);
799 if (crypt_backend_rng(salt_bytes, salt_size, CRYPT_RND_SALT, 0))
800 exit_err("rng failed");
803 calculated_digest = xmalloc(digest_size);
805 if (mode != MODE_CREATE) {
806 get_hex(root_hash, &root_hash_bytes, digest_size, "root_hash");
809 calculate_positions();
813 if (use_superblock) {
814 if (mode == MODE_CREATE)
821 if (mode == MODE_ACTIVATE && !retval)
825 free(calculated_digest);
826 if (mode != MODE_CREATE)
827 free(root_hash_bytes);
828 poptFreeContext(popt_context);