mirror of
https://github.com/flatcar/scripts.git
synced 2025-09-23 14:41:31 +02:00
Merge pull request #34 from philips/remove-kernel-image-references
Remove kernel image references
This commit is contained in:
Brandon Philips
commit
3a0121360d
@ -89,14 +89,6 @@ DEFINE_boolean cleanup_dirs ${FLAGS_TRUE} \
|
||||
DEFINE_string boot_args "noinitrd" \
|
||||
"Additional boot arguments to pass to the commandline"
|
||||
|
||||
DEFINE_integer rootfs_size 720 \
|
||||
"rootfs filesystem size in MBs."
|
||||
# ceil(0.1 * rootfs_size) is a good minimum.
|
||||
DEFINE_integer rootfs_hash_pad 8 \
|
||||
"MBs reserved at the end of the rootfs image."
|
||||
|
||||
DEFINE_string rootfs_hash "/tmp/rootfs.hash" \
|
||||
"Path where the rootfs hash should be stored."
|
||||
# TODO(taysom): when we turn on boot cache, both verification and
|
||||
# bootcache should have their default be FLAGS_TRUE.
|
||||
DEFINE_boolean enable_rootfs_verification ${FLAGS_FALSE} \
|
||||
@ -227,74 +219,6 @@ make_image_bootable() {
|
||||
root_dev=$squashfs_img
|
||||
fi
|
||||
|
||||
# Builds the kernel partition image. The temporary files are kept around
|
||||
# so that we can perform a load_kernel_test later on the final image.
|
||||
${SCRIPTS_DIR}/build_kernel_image.sh \
|
||||
--arch="${FLAGS_arch}" \
|
||||
--to="${FLAGS_output_dir}/vmlinuz.image" \
|
||||
--hd_vblock="${FLAGS_output_dir}/vmlinuz_hd.vblock" \
|
||||
--vmlinuz="${FLAGS_rootfs_mountpoint}/boot/vmlinuz" \
|
||||
--working_dir="${FLAGS_output_dir}" \
|
||||
--boot_args="${FLAGS_boot_args}" \
|
||||
--keep_work \
|
||||
--rootfs_image=${root_dev} \
|
||||
--rootfs_hash=${FLAGS_rootfs_hash} \
|
||||
--verity_hash_alg=${FLAGS_verity_algorithm} \
|
||||
--verity_max_ios=${FLAGS_verity_max_ios} \
|
||||
--verity_error_behavior=${FLAGS_verity_error_behavior} \
|
||||
--verity_salt=${FLAGS_verity_salt} \
|
||||
--keys_dir="${FLAGS_keys_dir}" \
|
||||
--enable_serial="${FLAGS_enable_serial}" \
|
||||
${enable_rootfs_verification_flag} \
|
||||
${enable_bootcache_flag} \
|
||||
${use_dev_keys}
|
||||
|
||||
# Check the size of kernel image and issue warning when image size is
|
||||
# near the limit.
|
||||
local kernel_image_size=$(stat -c '%s' ${FLAGS_output_dir}/vmlinuz.image)
|
||||
info "Kernel image size is ${kernel_image_size} bytes."
|
||||
if [[ ${kernel_image_size} -gt $((16 * 1024 * 1024)) ]]; then
|
||||
die "Kernel image is larger than 16 MB."
|
||||
elif [[ ${kernel_image_size} -gt $((14 * 1024 * 1024)) ]]; then
|
||||
warn "Kernel image is larger than 14 MB. Limit is 16 MB."
|
||||
fi
|
||||
|
||||
local rootfs_hash_size=$(stat -c '%s' ${FLAGS_rootfs_hash})
|
||||
local rootfs_fs_size=$(get_filesystem_size ${FLAGS_image_type} ${NUM_ROOTFS_A})
|
||||
local rootfs_partition_size=$(get_partition_size ${FLAGS_image_type} ${NUM_ROOTFS_A})
|
||||
local rootfs_hash_pad=$(( rootfs_partition_size - rootfs_fs_size ))
|
||||
info "Appending rootfs.hash (${rootfs_hash_size} bytes) to the root fs"
|
||||
if [[ ${rootfs_hash_size} -gt ${rootfs_hash_pad} ]]
|
||||
then
|
||||
die "rootfs_partition_size - rootfs_fs_size is less than the needed " \
|
||||
"rootfs_hash_size (${rootfs_hash_size}), update your disk layout " \
|
||||
"configuration"
|
||||
fi
|
||||
# Unfortunately, mount_gpt_image uses mount and not losetup to create the
|
||||
# loop devices. This means that they are not the correct size. We have to
|
||||
# write directly to the image to append the hash tree data.
|
||||
local hash_offset="$(partoffset ${image} ${NUM_ROOTFS_A})"
|
||||
if [ $FLAGS_enable_squashfs -eq $FLAGS_TRUE ]; then
|
||||
rootfs_file_size=$(stat -c '%s' ${root_dev})
|
||||
hash_offset=$((hash_offset + (${rootfs_file_size} / 512)))
|
||||
else
|
||||
hash_offset=$((hash_offset + (${rootfs_fs_size} / 512)))
|
||||
fi
|
||||
sudo dd bs=512 \
|
||||
seek=${hash_offset} \
|
||||
if="${FLAGS_rootfs_hash}" \
|
||||
of="${image}" \
|
||||
conv=notrunc \
|
||||
status=none
|
||||
|
||||
# Move the verification block needed for the hard disk install to the
|
||||
# stateful partition. Mount stateful fs, copy file, and umount fs.
|
||||
# In original CL: http://codereview.chromium.org/2868044, this was done in
|
||||
# create_base_image(). However, it could break the build if it is a clean
|
||||
# build because vmlinuz_hd.vblock hasn't been created by build_kernel_image.sh
|
||||
sudo cp "${FLAGS_output_dir}/vmlinuz_hd.vblock" \
|
||||
"${FLAGS_statefulfs_mountpoint}"
|
||||
|
||||
# We should update the esp in place in the image.
|
||||
local bootloader_to="${image}"
|
||||
local esp_offset="$(partoffset ${image} ${NUM_ESP})"
|
||||
@ -311,10 +235,6 @@ make_image_bootable() {
|
||||
--vmlinuz="${FLAGS_rootfs_mountpoint}"/boot/vmlinuz \
|
||||
${bootloader_to_flags}
|
||||
|
||||
# We don't need to keep these files around anymore.
|
||||
sudo rm "${FLAGS_rootfs_hash}" "${FLAGS_output_dir}/vmlinuz.image" \
|
||||
"${FLAGS_output_dir}/vmlinuz_hd.vblock"
|
||||
|
||||
trap - EXIT
|
||||
${SCRIPTS_DIR}/mount_gpt_image.sh -u -r "${FLAGS_rootfs_mountpoint}" \
|
||||
-s "${FLAGS_statefulfs_mountpoint}"
|
||||
@ -350,7 +270,6 @@ command line parameters are correct"
|
||||
|
||||
# Store output and temporary files next to image.
|
||||
FLAGS_output_dir="${IMAGE_DIR}"
|
||||
FLAGS_rootfs_hash="${IMAGE_DIR}/rootfs.hash"
|
||||
FLAGS_rootfs_mountpoint="${IMAGE_DIR}/rootfs_dir"
|
||||
FLAGS_statefulfs_mountpoint="${IMAGE_DIR}/stateful_dir"
|
||||
FLAGS_espfs_mountpoint="${IMAGE_DIR}/esp"
|
||||
|
||||
@ -1,305 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
|
||||
# Use of this source code is governed by a BSD-style license that can be
|
||||
# found in the LICENSE file.
|
||||
|
||||
# Helper script that generates the signed kernel image
|
||||
|
||||
SCRIPT_ROOT=$(dirname $(readlink -f "$0"))
|
||||
. "${SCRIPT_ROOT}/common.sh" || exit 1
|
||||
|
||||
# Flags.
|
||||
DEFINE_string arch "x86" \
|
||||
"The boot architecture: arm, x86, or amd64. (Default: x86)"
|
||||
DEFINE_string to "/tmp/vmlinuz.image" \
|
||||
"The path to the kernel image to be created. (Default: /tmp/vmlinuz.image)"
|
||||
DEFINE_string hd_vblock "/tmp/vmlinuz_hd.vblock" \
|
||||
"The path to the installed kernel's vblock (Default: /tmp/vmlinuz_hd.vblock)"
|
||||
DEFINE_string vmlinuz "vmlinuz" \
|
||||
"The path to the kernel (Default: vmlinuz)"
|
||||
DEFINE_string working_dir "/tmp/vmlinuz.working" \
|
||||
"Working directory for in-progress files. (Default: /tmp/vmlinuz.working)"
|
||||
DEFINE_boolean keep_work ${FLAGS_FALSE} \
|
||||
"Keep temporary files (*.keyblock, *.vbpubk). (Default: false)"
|
||||
DEFINE_string keys_dir "${SRC_ROOT}/platform/vboot_reference/tests/testkeys" \
|
||||
"Directory with the RSA signing keys. (Defaults to test keys)"
|
||||
DEFINE_boolean use_dev_keys ${FLAGS_FALSE} \
|
||||
"Use developer keys for signing. (Default: false)"
|
||||
# Note, to enable verified boot, the caller would manually pass:
|
||||
# --boot_args='dm="... %U+1 %U+1 ..." \
|
||||
# --root=/dev/dm-0
|
||||
DEFINE_string boot_args "noinitrd" \
|
||||
"Additional boot arguments to pass to the commandline (Default: noinitrd)"
|
||||
# If provided, will automatically add verified boot arguments.
|
||||
DEFINE_string rootfs_image "" \
|
||||
"Optional path to the rootfs device or image.(Default: \"\")"
|
||||
DEFINE_string rootfs_hash "" \
|
||||
"Optional path to output the rootfs hash to. (Default: \"\")"
|
||||
DEFINE_integer verity_error_behavior 3 \
|
||||
"Verified boot error behavior [0: I/O errors, 1: reboot, 2: nothing] \
|
||||
(Default: 3)"
|
||||
DEFINE_integer verity_max_ios -1 \
|
||||
"Optional number of outstanding I/O operations. (Default: -1)"
|
||||
DEFINE_string verity_hash_alg "sha1" \
|
||||
"Cryptographic hash algorithm used for dm-verity. (Default: sha1)"
|
||||
DEFINE_string verity_salt "" \
|
||||
"Salt to use for rootfs hash (Default: \"\")"
|
||||
DEFINE_boolean enable_rootfs_verification ${FLAGS_TRUE} \
|
||||
"Enable kernel-based root fs integrity checking. (Default: true)"
|
||||
DEFINE_boolean enable_bootcache ${FLAGS_FALSE} \
|
||||
"Enable boot cache to accelerate booting. (Default: false)"
|
||||
DEFINE_string enable_serial "" \
|
||||
"Enable serial port for printks. Example values: ttyS0"
|
||||
|
||||
# Parse flags
|
||||
FLAGS "$@" || exit 1
|
||||
eval set -- "${FLAGS_ARGV}"
|
||||
|
||||
# Die on error
|
||||
switch_to_strict_mode
|
||||
|
||||
rootdigest() {
|
||||
local digest=${table#*root_hexdigest=}
|
||||
echo ${digest% salt*}
|
||||
}
|
||||
|
||||
salt() {
|
||||
local salt=${table#*salt=}
|
||||
echo ${salt%}
|
||||
}
|
||||
|
||||
hashstart() {
|
||||
local hash=${table#*hashstart=}
|
||||
echo ${hash% alg*}
|
||||
}
|
||||
|
||||
# Estimate of sectors used by verity
|
||||
# (num blocks) * 32 (bytes per hash) * 2 (overhead) / 512 (bytes per sector)
|
||||
veritysize() {
|
||||
echo $((root_fs_blocks * 32 * 2 / 512))
|
||||
}
|
||||
|
||||
device_mapper_args=
|
||||
# Even with a rootfs_image, root= is not changed unless specified.
|
||||
if [[ -n "${FLAGS_rootfs_image}" && -n "${FLAGS_rootfs_hash}" ]]; then
|
||||
# Gets the number of blocks. 4096 byte blocks _are_ expected.
|
||||
if [ -f "${FLAGS_rootfs_image}" ]; then
|
||||
root_fs_block_sz=4096
|
||||
root_fs_sz=$(stat -c '%s' ${FLAGS_rootfs_image})
|
||||
root_fs_blocks=$((root_fs_sz / ${root_fs_block_sz}))
|
||||
else
|
||||
root_fs_blocks=$(sudo dumpe2fs "${FLAGS_rootfs_image}" 2> /dev/null |
|
||||
grep "Block count" |
|
||||
tr -d ' ' |
|
||||
cut -f2 -d:)
|
||||
root_fs_block_sz=$(sudo dumpe2fs "${FLAGS_rootfs_image}" 2> /dev/null |
|
||||
grep "Block size" |
|
||||
tr -d ' ' |
|
||||
cut -f2 -d:)
|
||||
fi
|
||||
|
||||
info "rootfs is ${root_fs_blocks} blocks of ${root_fs_block_sz} bytes"
|
||||
if [[ ${root_fs_block_sz} -ne 4096 ]]; then
|
||||
error "Root file system blocks are not 4k!"
|
||||
fi
|
||||
|
||||
info "Generating root fs hash tree (salt '${FLAGS_verity_salt}')."
|
||||
# Runs as sudo in case the image is a block device.
|
||||
# First argument to verity is reserved/unused and MUST be 0
|
||||
table=$(sudo verity mode=create \
|
||||
alg=${FLAGS_verity_hash_alg} \
|
||||
payload=${FLAGS_rootfs_image} \
|
||||
payload_blocks=${root_fs_blocks} \
|
||||
hashtree=${FLAGS_rootfs_hash} \
|
||||
salt=${FLAGS_verity_salt})
|
||||
if [[ -f "${FLAGS_rootfs_hash}" ]]; then
|
||||
sudo chmod a+r "${FLAGS_rootfs_hash}"
|
||||
fi
|
||||
# Don't claim the root device unless verity is enabled.
|
||||
# Doing so will claim /dev/sdDP out from under the system.
|
||||
if [[ ${FLAGS_enable_rootfs_verification} -eq ${FLAGS_TRUE} ]]; then
|
||||
if [[ ${FLAGS_enable_bootcache} -eq ${FLAGS_TRUE} ]]; then
|
||||
base_root='254:0' # major:minor numbers for /dev/dm-0
|
||||
else
|
||||
base_root='%U+1' # kern_guid + 1
|
||||
fi
|
||||
table=${table//HASH_DEV/${base_root}}
|
||||
table=${table//ROOT_DEV/${base_root}}
|
||||
fi
|
||||
verity_dev="vroot none ro 1,${table}"
|
||||
if [[ ${FLAGS_enable_bootcache} -eq ${FLAGS_TRUE} ]]; then
|
||||
signature=$(rootdigest)
|
||||
cachestart=$(($(hashstart) + $(veritysize)))
|
||||
size_limit=512
|
||||
max_trace=20000
|
||||
max_pages=100000
|
||||
bootcache_args="%U+1 ${cachestart} ${signature} ${size_limit}"
|
||||
bootcache_args="${bootcache_args} ${max_trace} ${max_pages}"
|
||||
bootcache_dev="vboot none ro 1,0 ${cachestart} bootcache ${bootcache_args}"
|
||||
device_mapper_args="dm=\"2 ${bootcache_dev}, ${verity_dev}\""
|
||||
else
|
||||
device_mapper_args="dm=\"1 ${verity_dev}\""
|
||||
fi
|
||||
info "device mapper configuration: ${device_mapper_args}"
|
||||
fi
|
||||
|
||||
mkdir -p "${FLAGS_working_dir}"
|
||||
|
||||
# Only let dm-verity block if rootfs verification is configured.
|
||||
# By default, we use a firmware enumerated value, but it isn't reliable for
|
||||
# production use. If +%d can be added upstream, then we can use:
|
||||
# root_dev=PARTUID=uuid+1
|
||||
dev_wait=0
|
||||
root_dev="PARTUUID=%U/PARTNROFF=1"
|
||||
if [[ ${FLAGS_enable_rootfs_verification} -eq ${FLAGS_TRUE} ]]; then
|
||||
dev_wait=1
|
||||
if [[ ${FLAGS_enable_bootcache} -eq ${FLAGS_TRUE} ]]; then
|
||||
root_dev=/dev/dm-1
|
||||
else
|
||||
root_dev=/dev/dm-0
|
||||
fi
|
||||
else
|
||||
if [[ ${FLAGS_enable_bootcache} -eq ${FLAGS_TRUE} ]]; then
|
||||
die "Having bootcache without verity is not supported"
|
||||
fi
|
||||
fi
|
||||
|
||||
cat <<EOF > "${FLAGS_working_dir}/boot.config"
|
||||
root=${root_dev}
|
||||
rootwait
|
||||
ro
|
||||
dm_verity.error_behavior=${FLAGS_verity_error_behavior}
|
||||
dm_verity.max_bios=${FLAGS_verity_max_ios}
|
||||
dm_verity.dev_wait=${dev_wait}
|
||||
${device_mapper_args}
|
||||
${FLAGS_boot_args}
|
||||
vt.global_cursor_default=0
|
||||
kern_guid=%U
|
||||
EOF
|
||||
|
||||
WORK="${WORK} ${FLAGS_working_dir}/boot.config"
|
||||
info "Emitted cross-platform boot params to ${FLAGS_working_dir}/boot.config"
|
||||
|
||||
# Add common boot options first.
|
||||
config="${FLAGS_working_dir}/config.txt"
|
||||
if [[ -n ${FLAGS_enable_serial} ]]; then
|
||||
console=${FLAGS_enable_serial}
|
||||
if [[ ${console} != *,* ]]; then
|
||||
console+=",115200n8"
|
||||
fi
|
||||
cat <<EOF > "${config}"
|
||||
console=${console}
|
||||
earlyprintk=${console}
|
||||
console=tty1
|
||||
EOF
|
||||
else
|
||||
cat <<EOF > "${config}"
|
||||
console=
|
||||
EOF
|
||||
fi
|
||||
|
||||
cat <<EOF - "${FLAGS_working_dir}/boot.config" >> "${config}"
|
||||
loglevel=7
|
||||
init=/sbin/init
|
||||
cros_secure
|
||||
EOF
|
||||
|
||||
if [[ "${FLAGS_arch}" = "x86" || "${FLAGS_arch}" = "amd64" ]]; then
|
||||
# Legacy BIOS will use the kernel in the rootfs (via syslinux), as will
|
||||
# standard EFI BIOS (via grub, from the EFI System Partition). Chrome OS
|
||||
# BIOS will use a separate signed kernel partition, which we'll create now.
|
||||
cat <<EOF >> "${FLAGS_working_dir}/config.txt"
|
||||
add_efi_memmap
|
||||
boot=local
|
||||
noresume
|
||||
noswap
|
||||
i915.modeset=1
|
||||
tpm_tis.force=1
|
||||
tpm_tis.interrupts=0
|
||||
nmi_watchdog=panic,lapic
|
||||
EOF
|
||||
WORK="${WORK} ${FLAGS_working_dir}/config.txt"
|
||||
|
||||
bootloader_path="/lib64/bootstub/bootstub.efi"
|
||||
kernel_image="${FLAGS_vmlinuz}"
|
||||
elif [[ "${FLAGS_arch}" = "arm" ]]; then
|
||||
WORK="${WORK} ${FLAGS_working_dir}/config.txt"
|
||||
|
||||
# arm does not need/have a bootloader in kernel partition
|
||||
dd if="/dev/zero" of="${FLAGS_working_dir}/bootloader.bin" bs=512 count=1
|
||||
WORK="${WORK} ${FLAGS_working_dir}/bootloader.bin"
|
||||
|
||||
bootloader_path="${FLAGS_working_dir}/bootloader.bin"
|
||||
kernel_image="${FLAGS_vmlinuz/vmlinuz/vmlinux.uimg}"
|
||||
else
|
||||
error "Unknown arch: ${FLAGS_arch}"
|
||||
fi
|
||||
|
||||
# We sign the image with the recovery_key, because this is what goes onto the
|
||||
# USB key. We can only boot from the USB drive in recovery mode.
|
||||
# For dev install shim, we need to use the installer keyblock instead of
|
||||
# the recovery keyblock because of the difference in flags.
|
||||
if [ ${FLAGS_use_dev_keys} -eq ${FLAGS_TRUE} ]; then
|
||||
USB_KEYBLOCK=installer_kernel.keyblock
|
||||
info "DEBUG: use dev install signing key"
|
||||
else
|
||||
USB_KEYBLOCK=recovery_kernel.keyblock
|
||||
info "DEBUG: use recovery signing key"
|
||||
fi
|
||||
|
||||
# Create and sign the kernel blob
|
||||
vbutil_kernel \
|
||||
--pack "${FLAGS_to}" \
|
||||
--keyblock "${FLAGS_keys_dir}/${USB_KEYBLOCK}" \
|
||||
--signprivate "${FLAGS_keys_dir}/recovery_kernel_data_key.vbprivk" \
|
||||
--version 1 \
|
||||
--config "${FLAGS_working_dir}/config.txt" \
|
||||
--bootloader "${bootloader_path}" \
|
||||
--vmlinuz "${kernel_image}" \
|
||||
--arch "${FLAGS_arch}"
|
||||
|
||||
# And verify it.
|
||||
vbutil_kernel \
|
||||
--verify "${FLAGS_to}" \
|
||||
--signpubkey "${FLAGS_keys_dir}/recovery_key.vbpubk"
|
||||
|
||||
|
||||
# Now we re-sign the same image using the normal keys. This is the kernel
|
||||
# image that is put on the hard disk by the installer. Note: To save space on
|
||||
# the USB image, we're only emitting the new verfication block, and the
|
||||
# installer just replaces that part of the hard disk's kernel partition.
|
||||
vbutil_kernel \
|
||||
--repack "${FLAGS_hd_vblock}" \
|
||||
--vblockonly \
|
||||
--keyblock "${FLAGS_keys_dir}/kernel.keyblock" \
|
||||
--signprivate "${FLAGS_keys_dir}/kernel_data_key.vbprivk" \
|
||||
--oldblob "${FLAGS_to}"
|
||||
|
||||
|
||||
# To verify it, we have to replace the vblock from the original image.
|
||||
tempfile=$(mktemp)
|
||||
trap "rm -f $tempfile" EXIT
|
||||
cat "${FLAGS_hd_vblock}" > $tempfile
|
||||
dd if="${FLAGS_to}" bs=65536 skip=1 >> $tempfile
|
||||
|
||||
vbutil_kernel \
|
||||
--verify $tempfile \
|
||||
--signpubkey "${FLAGS_keys_dir}/kernel_subkey.vbpubk"
|
||||
|
||||
rm -f $tempfile
|
||||
trap - EXIT
|
||||
|
||||
set +e # cleanup failure is a-ok
|
||||
|
||||
if [[ ${FLAGS_keep_work} -eq ${FLAGS_FALSE} ]]; then
|
||||
info "Cleaning up temporary files: ${WORK}"
|
||||
rm ${WORK}
|
||||
rmdir ${FLAGS_working_dir}
|
||||
fi
|
||||
|
||||
info "Kernel partition image emitted: ${FLAGS_to}"
|
||||
|
||||
if [[ -f ${FLAGS_rootfs_hash} ]]; then
|
||||
info "Root filesystem hash emitted: ${FLAGS_rootfs_hash}"
|
||||
fi
|
||||
@ -21,16 +21,12 @@ DEFINE_string board "$DEFAULT_BOARD" \
|
||||
b
|
||||
DEFINE_integer statefulfs_sectors 4096 \
|
||||
"number of sectors in stateful filesystem when minimizing"
|
||||
DEFINE_string kernel_image "" \
|
||||
"path to a pre-built recovery kernel"
|
||||
DEFINE_string kernel_outfile "" \
|
||||
"emit recovery kernel to path/file ($RECOVERY_KERNEL_NAME if empty)"
|
||||
DEFINE_string image "" \
|
||||
"source image to use ($CHROMEOS_IMAGE_NAME if empty)"
|
||||
DEFINE_string to "" \
|
||||
"emit recovery image to path/file ($CHROMEOS_RECOVERY_IMAGE_NAME if empty)"
|
||||
DEFINE_boolean kernel_image_only $FLAGS_FALSE \
|
||||
"only emit recovery kernel"
|
||||
DEFINE_boolean sync_keys $FLAGS_TRUE \
|
||||
"update install kernel with the vblock from stateful"
|
||||
DEFINE_boolean minimize_image $FLAGS_TRUE \
|
||||
@ -92,143 +88,6 @@ get_install_vblock() {
|
||||
echo "$out"
|
||||
}
|
||||
|
||||
create_recovery_kernel_image() {
|
||||
local sysroot="$FACTORY_ROOT"
|
||||
local vmlinuz="$sysroot/boot/vmlinuz"
|
||||
local root_offset=$(partoffset "${RECOVERY_IMAGE}" 3)
|
||||
local root_size=$(partsize "${RECOVERY_IMAGE}" 3)
|
||||
|
||||
local enable_rootfs_verification_flag=--noenable_rootfs_verification
|
||||
if grep -q enable_rootfs_verification "${IMAGE_DIR}/boot.desc"; then
|
||||
enable_rootfs_verification_flag=--enable_rootfs_verification
|
||||
fi
|
||||
|
||||
# Tie the installed recovery kernel to the final kernel. If we don't
|
||||
# do this, a normal recovery image could be used to drop an unsigned
|
||||
# kernel on without a key-change check.
|
||||
# Doing this here means that the kernel and initramfs creation can
|
||||
# be done independently from the image to be modified as long as the
|
||||
# chromeos-recovery interfaces are the same. It allows for the signer
|
||||
# to just compute the new hash and update the kernel command line during
|
||||
# recovery image generation. (Alternately, it means an image can be created,
|
||||
# modified for recovery, then passed to a signer which can then sign both
|
||||
# partitions appropriately without needing any external dependencies.)
|
||||
local kern_offset=$(partoffset "${RECOVERY_IMAGE}" 2)
|
||||
local kern_size=$(partsize "${RECOVERY_IMAGE}" 2)
|
||||
local kern_tmp=$(mktemp)
|
||||
local kern_hash=
|
||||
|
||||
dd if="${RECOVERY_IMAGE}" bs=512 count=$kern_size \
|
||||
skip=$kern_offset of="$kern_tmp" 1>&2
|
||||
# We're going to use the real signing block.
|
||||
if [ $FLAGS_sync_keys -eq $FLAGS_TRUE ]; then
|
||||
dd if="$INSTALL_VBLOCK" of="$kern_tmp" conv=notrunc 1>&2
|
||||
fi
|
||||
local kern_hash=$(sha1sum "$kern_tmp" | cut -f1 -d' ')
|
||||
rm "$kern_tmp"
|
||||
|
||||
# TODO(wad) add FLAGS_boot_args support too.
|
||||
${SCRIPTS_DIR}/build_kernel_image.sh \
|
||||
--arch="${ARCH}" \
|
||||
--to="$RECOVERY_KERNEL_IMAGE" \
|
||||
--hd_vblock="$RECOVERY_KERNEL_VBLOCK" \
|
||||
--vmlinuz="$vmlinuz" \
|
||||
--working_dir="${IMAGE_DIR}" \
|
||||
--boot_args="noinitrd panic=60 cros_recovery kern_b_hash=$kern_hash" \
|
||||
--keep_work \
|
||||
--keys_dir="${FLAGS_keys_dir}" \
|
||||
${enable_rootfs_verification_flag} \
|
||||
--nouse_dev_keys 1>&2 || failboat "build_kernel_image"
|
||||
#sudo mount | sed 's/^/16651 /'
|
||||
#sudo losetup -a | sed 's/^/16651 /'
|
||||
trap - RETURN
|
||||
|
||||
# Update the EFI System Partition configuration so that the kern_hash check
|
||||
# passes.
|
||||
local block_size=$(get_block_size)
|
||||
|
||||
local efi_offset=$(partoffset "${RECOVERY_IMAGE}" 12)
|
||||
local efi_size=$(partsize "${RECOVERY_IMAGE}" 12)
|
||||
local efi_offset_bytes=$(( $efi_offset * $block_size ))
|
||||
local efi_size_bytes=$(( $efi_size * $block_size ))
|
||||
|
||||
local efi_dir=$(mktemp -d)
|
||||
sudo mount -o loop,offset=${efi_offset_bytes},sizelimit=${efi_size_bytes} \
|
||||
"${RECOVERY_IMAGE}" "${efi_dir}"
|
||||
|
||||
sudo sed -i -e "s/cros_legacy/cros_legacy kern_b_hash=$kern_hash/g" \
|
||||
"$efi_dir/syslinux/usb.A.cfg" || true
|
||||
# This will leave the hash in the kernel for all boots, but that should be
|
||||
# safe.
|
||||
sudo sed -i -e "s/cros_efi/cros_efi kern_b_hash=$kern_hash/g" \
|
||||
"$efi_dir/efi/boot/grub.cfg" || true
|
||||
safe_umount "$efi_dir"
|
||||
rmdir "$efi_dir"
|
||||
trap - EXIT
|
||||
}
|
||||
|
||||
install_recovery_kernel() {
|
||||
local kern_a_offset=$(partoffset "$RECOVERY_IMAGE" 2)
|
||||
local kern_a_size=$(partsize "$RECOVERY_IMAGE" 2)
|
||||
local kern_b_offset=$(partoffset "$RECOVERY_IMAGE" 4)
|
||||
local kern_b_size=$(partsize "$RECOVERY_IMAGE" 4)
|
||||
|
||||
if [ $kern_b_size -eq 1 ]; then
|
||||
echo "Image was created with no KERN-B partition reserved!" 1>&2
|
||||
echo "Cannot proceed." 1>&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Backup original kernel to KERN-B
|
||||
dd if="$RECOVERY_IMAGE" of="$RECOVERY_IMAGE" bs=512 \
|
||||
count=$kern_a_size \
|
||||
skip=$kern_a_offset \
|
||||
seek=$kern_b_offset \
|
||||
conv=notrunc
|
||||
|
||||
# We're going to use the real signing block.
|
||||
if [ $FLAGS_sync_keys -eq $FLAGS_TRUE ]; then
|
||||
dd if="$INSTALL_VBLOCK" of="$RECOVERY_IMAGE" bs=512 \
|
||||
seek=$kern_b_offset \
|
||||
conv=notrunc
|
||||
fi
|
||||
|
||||
# Install the recovery kernel as primary.
|
||||
dd if="$RECOVERY_KERNEL_IMAGE" of="$RECOVERY_IMAGE" bs=512 \
|
||||
seek=$kern_a_offset \
|
||||
count=$kern_a_size \
|
||||
conv=notrunc
|
||||
|
||||
# Set the 'Success' flag to 1 (to prevent the firmware from updating
|
||||
# the 'Tries' flag).
|
||||
sudo $GPT add -i 2 -S 1 "$RECOVERY_IMAGE"
|
||||
|
||||
# Repeat for the legacy bioses.
|
||||
# Replace vmlinuz.A with the recovery version we built.
|
||||
# TODO(wad): Extract the $RECOVERY_KERNEL_IMAGE and grab vmlinuz from there.
|
||||
local sysroot="$FACTORY_ROOT"
|
||||
local vmlinuz="$sysroot/boot/vmlinuz"
|
||||
local failed=0
|
||||
|
||||
if [ "$ARCH" = "x86" ]; then
|
||||
# There is no syslinux on ARM, so this copy only makes sense for x86.
|
||||
set +e
|
||||
local esp_offset=$(partoffset "$RECOVERY_IMAGE" 12)
|
||||
local esp_mnt=$(mktemp -d)
|
||||
sudo mount -o loop,offset=$((esp_offset * 512)) "$RECOVERY_IMAGE" "$esp_mnt"
|
||||
sudo cp "$vmlinuz" "$esp_mnt/syslinux/vmlinuz.A" || failed=1
|
||||
safe_umount "$esp_mnt"
|
||||
rmdir "$esp_mnt"
|
||||
switch_to_strict_mode
|
||||
fi
|
||||
|
||||
if [ $failed -eq 1 ]; then
|
||||
echo "Failed to copy recovery kernel to ESP"
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
maybe_resize_stateful() {
|
||||
# If we're not minimizing, then just copy and go.
|
||||
if [ $FLAGS_minimize_image -eq $FLAGS_FALSE ]; then
|
||||
@ -307,11 +166,6 @@ SCRIPTS_DIR=${SCRIPT_ROOT}
|
||||
# If not, resize stateful to 1 sector.
|
||||
#
|
||||
|
||||
if [ $FLAGS_kernel_image_only -eq $FLAGS_TRUE -a \
|
||||
-n "$FLAGS_kernel_image" ]; then
|
||||
die_notrace "Cannot use --kernel_image_only with --kernel_image"
|
||||
fi
|
||||
|
||||
if [ $FLAGS_modify_in_place -eq $FLAGS_TRUE ]; then
|
||||
if [ $FLAGS_minimize_image -eq $FLAGS_TRUE ]; then
|
||||
die_notrace "Cannot use --modify_in_place and --minimize_image together."
|
||||
@ -334,19 +188,6 @@ RECOVERY_KERNEL_FLAGS="fbconsole initramfs vfat tpm i2cdev"
|
||||
USE="${RECOVERY_KERNEL_FLAGS}" emerge_custom_kernel "$FACTORY_ROOT" ||
|
||||
failboat "Cannot emerge custom kernel"
|
||||
|
||||
if [ -z "$FLAGS_kernel_image" ]; then
|
||||
create_recovery_kernel_image
|
||||
echo "Recovery kernel created at $RECOVERY_KERNEL_IMAGE"
|
||||
else
|
||||
RECOVERY_KERNEL_IMAGE="$FLAGS_kernel_image"
|
||||
fi
|
||||
|
||||
if [ $FLAGS_kernel_image_only -eq $FLAGS_TRUE ]; then
|
||||
echo "Kernel emitted. Stopping there."
|
||||
rm "$INSTALL_VBLOCK"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
trap cleanup EXIT
|
||||
|
||||
maybe_resize_stateful # Also copies the image if needed.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user