1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
| | # SPDX-License-Identifier: EUPL-1.2+
# SPDX-FileCopyrightText: 2021-2025 Alyssa Ross <hi@alyssa.is>
.POSIX:
include ../../lib/common.mk
DTBS ?= build/empty
dest = build/live.img
$(dest): ../../scripts/format-uuid.sh ../../scripts/make-gpt.sh ../../scripts/sfdisk-field.awk build/boot.fat build/rootfs.verity.superblock build/rootfs.verity.roothash $(ROOT_FS)
../../scripts/make-gpt.sh $@.tmp \
build/boot.fat:c12a7328-f81f-11d2-ba4b-00a0c93ec93b \
build/rootfs.verity.superblock:verity:$$(../../scripts/format-uuid.sh "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \
$(ROOT_FS):root:$$(../../scripts/format-uuid.sh "$$(head -c 32 build/rootfs.verity.roothash)")
mv $@.tmp $@
build/empty:
mkdir -p $@
build/spectrum.efi: build/rootfs.verity.roothash $(DTBS) $(KERNEL) $(INITRAMFS)
{ \
printf "[UKI]\nDeviceTreeAuto=" && \
find $(DTBS) -name '*.dtb' -print0 | tr '\0' ' ' ;\
} | $(UKIFY) build \
--output $@ \
--config /dev/stdin \
--linux $(KERNEL) \
--initrd $(INITRAMFS) \
--os-release $$'NAME="Spectrum"\n' \
--cmdline "ro intel_iommu=on roothash=$$(cat build/rootfs.verity.roothash)"
build/boot.fat: $(SYSTEMD_BOOT_EFI) build/spectrum.efi
$(TRUNCATE) -s 440401920 $@
$(MKFS_FAT) $@
$(MMD) -i $@ ::/EFI ::/EFI/BOOT ::/EFI/Linux
$(MCOPY) -i $@ build/spectrum.efi ::/EFI/Linux
$(MCOPY) -i $@ $(SYSTEMD_BOOT_EFI) ::/EFI/BOOT/$(EFINAME)
# veritysetup format produces two files, but Make only (portably)
# supports one output per rule, so we combine the two outputs then
# define two more rules to separate them again.
build/rootfs.verity: $(ROOT_FS)
mkdir -p build
$(VERITYSETUP) format $(ROOT_FS) build/rootfs.verity.superblock.tmp \
| awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2; exit}' \
> build/rootfs.verity.roothash.tmp
cat build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp \
> $@
rm build/rootfs.verity.roothash.tmp build/rootfs.verity.superblock.tmp
build/rootfs.verity.roothash: build/rootfs.verity
head -n 1 build/rootfs.verity > $@
build/rootfs.verity.superblock: build/rootfs.verity
tail -n +2 build/rootfs.verity > $@
clean:
rm -rf build
.PHONY: clean
run: $(dest)
@../../scripts/run-qemu.sh -m 4G \
-machine virtualization=on \
-cpu max \
-device virtio-keyboard \
-device virtio-mouse \
-device virtio-gpu \
-parallel none \
-vga none \
-device qemu-xhci \
-device usb-storage,drive=drive1,removable=true \
-drive file=$(OVMF_CODE),format=raw,if=pflash,readonly=true \
-drive file=$(dest),id=drive1,format=raw,if=none,readonly=true
.PHONY: run
|