Hash mismatch when using /dev/mapper/inactive_crypt

[Primož Fišer]

Hi,

I have a weird issue when flashing to /dev/mapper/inactive_crypt.

In case I have:
images: (
{
filename = "customer-test-image-@@MACHINE@@.rootfs.ext4.verity";
device = "/dev/mapper/inactive_crypt";
type = "raw";
sha256 = "$swupdate_get_sha256(customer-test-image-@@MACHINE@@.rootfs.ext4.verity)";
installed-directly = true;
}

The flashing fails with:
[ERROR] : SWUPDATE failed [0] ERROR cpio_utils.c : hash_compare : 588 : HASH mismatch : c8a5d0ffa3ec3cc4c5a553e91d5d8c2fe600897e37b973c15a56385e5fe0fc0b <--> eeeed8e05172e27e8fb545ecaa3e37eb2c8e5f66f984e330adbd041e7c8bf003

If I manually inspect the .swu archive, I can see that the sha256sum is correct:

mkdir swu_extract
cd swu_extract
cpio -idmv < ../image.swu

sha256sum customer-test-image-machine.rootfs.ext4.verity
c8a5d0ffa3ec3cc4c5a553e91d5d8c2fe600897e37b973c15a56385e5fe0fc0b

However, if I try to flash to device = /dev/mmcblk0p3:
images: (
{
filename = "customer-test-image-@@MACHINE@@.rootfs.ext4.verity";
device = "/dev/mmcblk0p3";
type = "raw";
sha256 = "$swupdate_get_sha256(customer-test-image-@@MACHINE@@.rootfs.ext4.verity)";
installed-directly = true;
}
);

The flashing is successful.

So the only difference in those cases is the "device." One is raw eMMC partition and the other is dm-crypt mapper on top of it.

But isn't the sha256sum meant to be used as a check for the .swu image being corrupted not the checks on the target block device?

If I remove sha256 from sw-description, flashing is successful, but I lose the ability for verified images.

Last but not least, if I manually extract customer-test-image-machine.rootfs.ext4.verity and flash it directly to /dev/mapper/inactive_crypt it also works without any problem.

Any ideas?

Primoz

[ayoub...@googlemail.com]

something is defintely wrong in your setup, I would guess your encrypted device mapper is not open ?

I use something similar with no problems

[Primož Fišer]

Here is full output:

Verify sha256:

root@imx93-customer-gw:/data/swu_extract# cpio -idmv < ../customer-test-swupdate-image-imx93-customer-gw.rootfs.swu  
set-bootstate-slot1.sh
set-bootstate-slot2.sh
customer-test-image-imx93-customer-gw.rootfs.ext4.verity
imx-boot
fitImage-customer-image-initramfs-imx93-customer-gw-imx93-customer-gw
976335 blocks
root@imx93-customer-gw:/data/swu_extract# sha256sum customer-test-image-imx93-customer-gw.rootfs.ext4.verity
16025a1ef9649ce8affc676647730901c0129269a13d76879058ae45b46e267c
root@imx93-customer-gw:/swu_extract# cat sw-description | grep 16025a1ef9649ce8affc676647730901c0129269
                                        sha256 = "16025a1ef9649ce8affc676647730901c0129269a13d76879058ae45b46e267c";

SWUpdate error:

root@imx93-customer-gw:/swu_extract# swupdate -v -i /data/customer-test-swupdate-image-imx93-customer-gw.rootfs.swu -e stable,slot1
[TRACE] : SWUPDATE running :  [print_registered_bootloaders] : Registered bootloaders:
[TRACE] : SWUPDATE running :  [print_registered_bootloaders] :  none    loaded.
[INFO ] : SWUPDATE running :  [main] : Using default bootloader interface: none
[INFO ] : SWUPDATE running :  [print_registered_updatetypes] : Registered : Update Types
[INFO ] : SWUPDATE running :  [print_registered_updatetypes] :  Name:   default
[INFO ] : SWUPDATE running :  [print_registered_cryptolib] : Registered Crypto Providers:
[INFO ] : SWUPDATE running :  [print_registered_cryptolib] :    Provider for hash
[INFO ] : SWUPDATE running :  [print_registered_cryptolib] :            opensslSHA256*
[INFO ] : SWUPDATE running :  [print_registered_handlers] : Registered global handlers:
[INFO ] : SWUPDATE running :  [print_registered_handlers] :     dummy
[INFO ] : SWUPDATE running :  [print_registered_handlers] :     executor
[INFO ] : SWUPDATE running :  [print_registered_handlers] :     flash
[INFO ] : SWUPDATE running :  [print_registered_handlers] :     emmc_boot_toggle
[INFO ] : SWUPDATE running :  [print_registered_handlers] :     emmc_boot
[INFO ] : SWUPDATE running :  [print_registered_handlers] :     raw
[INFO ] : SWUPDATE running :  [print_registered_handlers] :     rawfile
[INFO ] : SWUPDATE running :  [print_registered_handlers] :     shellscript
[INFO ] : SWUPDATE running :  [print_registered_handlers] :     preinstall
[INFO ] : SWUPDATE running :  [print_registered_handlers] :     postinstall
[DEBUG] : SWUPDATE running :  [parse_image_selector] : Parsing selector: stable,slot1
[INFO ] : SWUPDATE running :  [main] : software set: stable mode: slot1
[DEBUG] : SWUPDATE running :  [read_module_settings] : No config settings found for module versions
[TRACE] : SWUPDATE running :  [network_initializer] : Main loop daemon
[TRACE] : SWUPDATE running :  [listener_create] : creating socket at /tmp/sockinstctrl
[TRACE] : SWUPDATE running :  [listener_create] : creating socket at /tmp/swupdateprog
[TRACE] : SWUPDATE running :  [network_thread] : Incoming network request: processing...
[INFO ] : SWUPDATE started :  Software Update started !
[TRACE] : SWUPDATE running :  [network_initializer] : Software update started
[TRACE] : SWUPDATE running :  [extract_file_to_tmp] : Found file
[TRACE] : SWUPDATE running :  [extract_file_to_tmp] :   filename sw-description
[TRACE] : SWUPDATE running :  [extract_file_to_tmp] :   size 2309
[DEBUG] : SWUPDATE running :  [parse_cfg] : Parsing config file /tmp/sw-description
[TRACE] : SWUPDATE running :  [get_common_fields] : Version 2026.04
[TRACE] : SWUPDATE running :  [get_common_fields] : Description customer test SWUpdate image
[TRACE] : SWUPDATE running :  [get_common_fields] : reboot_enabled 1
[TRACE] : SWUPDATE running :  [parser] : Hardware compatibility not found
[TRACE] : SWUPDATE running :  [_parse_files] : Found File: fitImage-customer-image-initramfs-imx93-customer-gw-imx93-customer-gw --> /fitImage (/dev/mmcblk0p1)
[TRACE] : SWUPDATE running :  [_parse_images] : Found Image: customer-test-image-imx93-customer-gw.rootfs.ext4.verity in device : /dev/mapper/inactive_crypt for handler raw
[TRACE] : SWUPDATE running :  [_parse_scripts] : Found Script: set-bootstate-slot1.sh
[TRACE] : SWUPDATE running :  [parse] : Number of found artifacts: 2
[TRACE] : SWUPDATE running :  [parse] : Number of scripts: 1
[TRACE] : SWUPDATE running :  [parse] : Number of steps to be run: 4
[DEBUG] : SWUPDATE running :  [preupdatecmd] : Running Pre-update command
[TRACE] : SWUPDATE running :  [extract_files] : Found file
[TRACE] : SWUPDATE running :  [extract_files] :         filename set-bootstate-slot1.sh
[TRACE] : SWUPDATE running :  [extract_files] :         size 210 required
[TRACE] : SWUPDATE running :  [extract_files] : Found file
[TRACE] : SWUPDATE running :  [extract_files] :         filename set-bootstate-slot2.sh
[TRACE] : SWUPDATE running :  [extract_files] :         size 210 Not required: skipping
[TRACE] : SWUPDATE running :  [extract_files] : Found file
[TRACE] : SWUPDATE running :  [extract_files] :         filename customer-test-image-imx93-customer-gw.rootfs.ext4.verity
[TRACE] : SWUPDATE running :  [extract_files] :         size 436244480 required
[TRACE] : SWUPDATE running :  [extract_files] : Found file
[TRACE] : SWUPDATE running :  [extract_files] :         filename imx-boot
[TRACE] : SWUPDATE running :  [extract_files] :         size 2136064 Not required: skipping
[TRACE] : SWUPDATE running :  [extract_files] : Found file
[TRACE] : SWUPDATE running :  [extract_files] :         filename fitImage-customer-image-initramfs-imx93-customer-gw-imx93-customer-gw
[TRACE] : SWUPDATE running :  [extract_files] :         size 61499170 required
[TRACE] : SWUPDATE running :  [extract_padding] : Expecting up to 512 padding bytes at end-of-file
[TRACE] : SWUPDATE running :  [network_initializer] : Valid image found: copying to FLASH
[INFO ] : SWUPDATE running :  Installation in progress
[TRACE] : SWUPDATE running :  [__run_cmd] : /tmp/scripts/set-bootstate-slot1.sh preinst  command returned 0
[TRACE] : SWUPDATE running :  [install_single_image] : Found installer for stream customer-test-image-imx93-customer-gw.rootfs.ext4.verity raw
[ERROR] : SWUPDATE failed [0] ERROR cpio_utils.c : hash_compare : 588 : HASH mismatch : 16025a1ef9649ce8affc676647730901c0129269a13d76879058ae45b46e267c <--> 7c5879f8641abcc3d7d7e04d6dbedf88cbc99e3c554e63138e91e
07c4cb42595
[TRACE] : SWUPDATE running :  [install_single_image] : Installer for raw not successful !
[ERROR] : SWUPDATE failed [1] Installation failed !
[TRACE] : SWUPDATE running :  [__run_cmd] : /tmp/scripts/set-bootstate-slot1.sh postfailure  command returned 0
[ERROR] : SWUPDATE failed [0] ERROR install_from_file.c : endupdate : 55 : SWUpdate *failed* !
[TRACE] : SWUPDATE running :  [unlink_sockets] : unlink socket /tmp/sockinstctrl
[TRACE] : SWUPDATE running :  [unlink_sockets] : unlink socket /tmp/swupdateprog  

I simply have no idea how would device = /dev/mapper/inactive_crypt in sw-description have impact on the sha256sum?

BR,
Primoz

V V tor., 7. jul. 2026 ob 12:57 je oseba 'ayoub...@googlemail.com' via swupdate <swup...@googlegroups.com> napisala:

--
You received this message because you are subscribed to a topic in the Google Groups "swupdate" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/swupdate/v39HFdUO4qM/unsubscribe.
To unsubscribe from this group and all its topics, send an email to swupdate+u...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/swupdate/d666ec27-f487-44ea-993b-dc16a5182f2fn%40googlegroups.com.

[ayoub...@googlemail.com]

this is defintely not an issue related to swupdate:

test it this way :

dd if=/patht/to/customer-test-image-imx93-customer-gw.rootfs.ext4.verity of=/dev/mapper/inactive_crypt bs=1M

and try then to mount it:

mount /dev/mapper/inactive_crypt /mnt

[Primož Fišer]

Hi,

As a workaround, I now do exactly this:

      {
         filename = "customer-test-image-@@MACHINE@@.rootfs.ext4.verity";
         path = "/data/swu-rootfs.ext4.verity";
         sha256 = "$swupdate_get_sha256(customer-test-image-@@MACHINE@@.rootfs.ext4.verity)";
      },

and install the image via the script's postinst function like so:

      dd if=/data/swu-rootfs.ext4.verity of=/dev/mapper/inactive_crypt bs=16K conv=fsync 

And it works just fine! 

After rebooting, I can successfully boot into the flashed slot.

I am puzzled why it doesn't work with the original concept.

V V tor., 7. jul. 2026 ob 13:27 je oseba 'ayoub...@googlemail.com' via swupdate <swup...@googlegroups.com> napisala:

To view this discussion visit https://groups.google.com/d/msgid/swupdate/18a86bcf-8e5d-4960-9787-d2c4ef6237e6n%40googlegroups.com.

[Stefano Babic]

Hi Primož,

On 7/8/26 08:01, Primož Fišer wrote:
> Hi,
>
> As a workaround, I now do exactly this:
>
>       {
>          filename = "customer-test-image-@@MACHINE@@.rootfs.ext4.verity";
>          path = "/data/swu-rootfs.ext4.verity";
>          sha256 = "$swupdate_get_sha256(customer-test-image-
> @@MACHINE@@.rootfs.ext4.verity)";
>       },
>
> and install the image via the script's postinst function like so:
>
>       dd if=/data/swu-rootfs.ext4.verity of=/dev/mapper/inactive_crypt
> bs=16K conv=fsync
>
> And it works just fine!
>
> After rebooting, I can successfully boot into the flashed slot.
>
> I am puzzled why it doesn't work with the original concept.
>

I read the logs and I am not sure about the cause, but definitely it is
related to something in the environment or your update concept. Which is
the reason for set-bootstate-slot1.sh and are you sure this is not
changing the behavior ? Do you have cryptsetup commands there ?

From SWUpdate point of view, there is no difference to write into the
underlying mmc block device or into the device mapper. They are both
block devices and the same handler is used ("raw"). My feeling is that
you are doing something with cryptsetup in the preinst, and as Ayoub
suggested, dm-mapper is not ready when SWUpdate starts to write. Think
about that, while with scripts you are adding implicitly pauses, this
does not happen with SWUpdate and it starts to write.

And again, as already said a lot of times on the ML: do not use shell
scripts but Lua hooks. You are using a pre-install shell script. This is
part of the SWU, and it can be at any place in the SWU itself. Even at
the end. It is not mandatory to package the script before the artifacts.
That means: SWUpdate installs *FIRST* all artifacts with the
"installed-directly" flag set, and then it will run scripts (also
pre-inst script, that aren't pre- anymore) after that. It cannot do in
another way, the stream is coming and artifact must be installed as it
comes.

So your pre-inst is running after SWUpdate has already started to write
into inactive_crypt, and then fails (maybe because you are setting the
dm-mapper).

Your concept is wrong.

- do not use shell script - SWUpdate can determine automatically where
rootfs is mounted, see "getroot". This can be called inside Lua hooks as
swupdate.getroot()

- set up just once the encrypted partitions when you are booting, that
is both active and inactive dm-mapper.

- if you still need something to be done before installing, use
"embedded-script" inside sw-description and add a hook to the image.

Best regards,
Stefano Babic

>
>
> V V tor., 7. jul. 2026 ob 13:27 je oseba 'ayoub...@googlemail.com

> <mailto:ayoub...@googlemail.com>' via swupdate
> <swup...@googlegroups.com <mailto:swup...@googlegroups.com>> napisala:

>
> this is defintely not an issue related to swupdate:
>
> test it this way :
>
> dd if=/patht/to/customer-test-image-imx93-customer-
> gw.rootfs.ext4.verity of=/dev/mapper/inactive_crypt bs=1M
>
> and try then to mount it:
>
> mount /dev/mapper/inactive_crypt /mnt
>
>
>
> On Tuesday, July 7, 2026 at 1:22:44 PM UTC+2 Primož Fišer wrote:
>
> Here is full output:
>

> _Verify sha256:_
>
> root@imx93-customer-gw:/data/swu_extract# cpio -idmv < ../
> customer-test-swupdate-image-imx93-customer-gw.rootfs.swu
> set-bootstate-slot1.sh
> set-bootstate-slot2.sh
> customer-test-image-imx93-customer-gw.rootfs.ext4.verity
> imx-boot
> fitImage-customer-image-initramfs-imx93-customer-gw-imx93-
> customer-gw

> 976335 blocks
> root@imx93-customer-gw:/data/swu_extract# sha256sum customer-
> test-image-imx93-customer-gw.rootfs.ext4.verity

> *16025a1ef9649ce8affc676647730901c0129269a13d76879058ae45b46e267c*

> root@imx93-customer-gw:/swu_extract# cat sw-description | grep
> 16025a1ef9649ce8affc676647730901c0129269
>                                         sha256 =

> "*16025a1ef9649ce8affc676647730901c0129269a13d76879058ae45b46e267c*";
>
> _SWUpdate error:_

> *16025a1ef9649ce8affc676647730901c0129269a13d76879058ae45b46e267c* <--> 7c5879f8641abcc3d7d7e04d6dbedf88cbc99e3c554e63138e91e

> 07c4cb42595
> [TRACE] : SWUPDATE running :  [install_single_image] : Installer
> for raw not successful !
> [ERROR] : SWUPDATE failed [1] Installation failed !
> [TRACE] : SWUPDATE running :  [__run_cmd] : /tmp/scripts/set-
> bootstate-slot1.sh postfailure  command returned 0
> [ERROR] : SWUPDATE failed [0] ERROR install_from_file.c :
> endupdate : 55 : SWUpdate *failed* !
> [TRACE] : SWUPDATE running :  [unlink_sockets] : unlink socket /
> tmp/sockinstctrl
> [TRACE] : SWUPDATE running :  [unlink_sockets] : unlink socket /

> tmp/swupdateprog

> <https://groups.google.com/d/topic/swupdate/v39HFdUO4qM/
> unsubscribe>.

> To unsubscribe from this group and all its topics, send an
> email to swupdate+u...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/
> msgid/swupdate/d666ec27-f487-44ea-993b-

> dc16a5182f2fn%40googlegroups.com <https://groups.google.com/
> d/msgid/swupdate/d666ec27-f487-44ea-993b-
> dc16a5182f2fn%40googlegroups.com?
> utm_medium=email&utm_source=footer>.

>
> --
> You received this message because you are subscribed to a topic in
> the Google Groups "swupdate" group.
> To unsubscribe from this topic, visit https://groups.google.com/d/

> topic/swupdate/v39HFdUO4qM/unsubscribe <https://groups.google.com/d/
> topic/swupdate/v39HFdUO4qM/unsubscribe>.

> To unsubscribe from this group and all its topics, send an email to
> swupdate+u...@googlegroups.com

> <mailto:swupdate+u...@googlegroups.com>.

> To view this discussion visit https://groups.google.com/d/msgid/

> swupdate/18a86bcf-8e5d-4960-9787-d2c4ef6237e6n%40googlegroups.com
> <https://groups.google.com/d/msgid/swupdate/18a86bcf-8e5d-4960-9787-
> d2c4ef6237e6n%40googlegroups.com?utm_medium=email&utm_source=footer>.
>
> --
> You received this message because you are subscribed to the Google
> Groups "swupdate" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to swupdate+u...@googlegroups.com
> <mailto:swupdate+u...@googlegroups.com>.

> To view this discussion visit https://groups.google.com/d/msgid/

> swupdate/CAP4a-mmSNJozpQer6%2B1G4Hmgu0i-
> VPS5WPELx6YiY_R_eJDy_w%40mail.gmail.com <https://groups.google.com/d/
> msgid/swupdate/CAP4a-mmSNJozpQer6%2B1G4Hmgu0i-
> VPS5WPELx6YiY_R_eJDy_w%40mail.gmail.com?utm_medium=email&utm_source=footer>.



--
_______________________________________________________________________
Nabla Software Engineering GmbH
Hirschstr. 111A | 86156 Augsburg | Tel: +49 821 45592596
Geschäftsführer : Stefano Babic | HRB 40522 Augsburg
E-Mail: sba...@nabladev.com