Re: [PATCH 1/2] host/rootfs: use initramfs in "make run"

José Pekkarinen
2022-09-08T11:41:30Z

[-- Attachment #1: Type: text/plain, Size: 4750 bytes --]

On Thu, Sep 1, 2022 at 1:47 PM Alyssa Ross <hi@alyssa.is> wrote:

> This will allow us to stop compiling e.g. the virtio-blk module into
> the kernel, because it will be loaded by the initramfs.
>
> This introduces some duplication between the rootfs and initramfs's
> Makefiles. I don't think it's worth the effort at the moment to try
> to reduce that, because it would come at the expense of additional
> complexity in the Makefiles. We can revisit this later if we want to.
>
> Signed-off-by: Alyssa Ross <hi@alyssa.is>
>

Tested-by: José Pekkarinen <jose.pekkarinen@unikie.com>

> ---
> host/rootfs/Makefile | 32 ++++++++++++++++++++++++++++----
> host/rootfs/shell.nix | 10 ++++++++--
> 2 files changed, 36 insertions(+), 6 deletions(-)
>
> diff --git a/host/rootfs/Makefile b/host/rootfs/Makefile
> index 41cf87c..31f76d2 100644
> --- a/host/rootfs/Makefile
> +++ b/host/rootfs/Makefile
> @@ -6,6 +6,9 @@
> # QEMU_KVM = qemu-system-x86_64 -enable-kvm.
> QEMU_KVM = qemu-kvm
>
> +SCRIPTS = ../../scripts
> +VERITYSETUP = veritysetup
> +
> # tar2ext4 will leave half a filesystem behind if it's interrupted
> # half way through.
> build/rootfs.ext4: build/rootfs.tar
> @@ -116,16 +119,37 @@ clean:
> rm -rf build
> .PHONY: clean
>
> -run: build/rootfs.ext4 $(EXT_FS)
> +# veritysetup format produces two files, but Make only (portably)
> +# supports one output per rule, so we combine the two outputs then
> +# define two more rules to separate them again.
> +build/rootfs.verity: build/rootfs.ext4
> + $(VERITYSETUP) format build/rootfs.ext4
> build/rootfs.verity.superblock.tmp \
> + | awk -F ':[[:blank:]]*' '$$1 == "Root hash" {print $$2;
> exit}' \
> + > build/rootfs.verity.roothash.tmp
> + cat build/rootfs.verity.roothash.tmp
> build/rootfs.verity.superblock.tmp \
> + > $@
> + rm build/rootfs.verity.roothash.tmp
> build/rootfs.verity.superblock.tmp
> +build/rootfs.verity.roothash: build/rootfs.verity
> + head -n 1 build/rootfs.verity > $@
> +build/rootfs.verity.superblock: build/rootfs.verity
> + tail -n +2 build/rootfs.verity > $@
> +
> +build/live.img: $(SCRIPTS)/format-uuid.sh $(SCRIPTS)/make-gpt.sh
> build/rootfs.verity.superblock build/rootfs.verity.roothash
> build/rootfs.ext4
> + $(SCRIPTS)/make-gpt.sh $@.tmp \
> +
> build/rootfs.verity.superblock:2c7357ed-ebd2-46d9-aec1-23d437ec2bf5:$$($(SCRIPTS)/format-uuid.sh
> "$$(dd if=build/rootfs.verity.roothash bs=32 skip=1 count=1 status=none)") \
> +
> build/rootfs.ext4:4f68bce3-e8cd-4db1-96e7-fbcaf984b709:$$($(SCRIPTS)/format-uuid.sh
> "$$(head -c 32 build/rootfs.verity.roothash)")
> + mv $@.tmp $@
> +
> +run: build/live.img $(EXT_FS) build/rootfs.verity.roothash
> $(QEMU_KVM) -cpu host -m 2G \
> - -machine q35,kernel=$(KERNEL),kernel-irqchip=split \
> + -machine
> q35,kernel=$(KERNEL),kernel-irqchip=split,initrd=$(INITRAMFS) \
> -display gtk,gl=on \
> -qmp unix:vmm.sock,server,nowait \
> -monitor vc \
> -parallel none \
> - -drive file=build/rootfs.ext4,if=virtio,format=raw,readonly=on
> \
> + -drive file=build/live.img,if=virtio,format=raw,readonly=on \
> -drive file=$(EXT_FS),if=virtio,format=raw,readonly=on \
> - -append "console=ttyS0 root=/dev/vda ext=/dev/vdb
> intel_iommu=on" \
> + -append "console=ttyS0 roothash=$$(<
> build/rootfs.verity.roothash) ext=/dev/vdb intel_iommu=on" \
> -device intel-iommu,intremap=on \
> -device virtio-vga-gl \
> -device vhost-vsock-pci,guest-cid=3
> diff --git a/host/rootfs/shell.nix b/host/rootfs/shell.nix
> index 3b2310f..fe9df1b 100644
> --- a/host/rootfs/shell.nix
> +++ b/host/rootfs/shell.nix
> @@ -1,18 +1,24 @@
> # SPDX-License-Identifier: MIT
> # SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
> +# SPDX-FileCopyrightText: 2022 Unikie
>
> { pkgs ? import <nixpkgs> {} }:
>
> +let
> + rootfs = import ./. { inherit pkgs; };
> +in
> +
> with pkgs;
>
> -(import ./. { inherit pkgs; }).overrideAttrs (
> +rootfs.overrideAttrs (
> { passthru ? {}, nativeBuildInputs ? [], ... }:
>
> {
> nativeBuildInputs = nativeBuildInputs ++ [
> - jq netcat qemu_kvm reuse util-linux
> + cryptsetup jq netcat qemu_kvm reuse util-linux
> ];
>
> EXT_FS = pkgsStatic.callPackage ../initramfs/extfs.nix { inherit pkgs;
> };
> + INITRAMFS = import ../initramfs { inherit pkgs rootfs; };
> KERNEL =
> "${passthru.kernel}/${stdenv.hostPlatform.linux-kernel.target}";
> })
> --
> 2.37.1
>
>

--

José.

[-- Attachment #2: Type: text/html, Size: 6068 bytes --]