main/systemd-boot: new aport (MR 4484)
EFI bootloader from systemd, with hacks to build it on Alpine/pmOS.
Cross compilation (using a meson cross file) is used for building
32-bit version on x86_64, for systems that have a 32-bit EFI. Everything
else assumes that the EFI arch matches the CPU arch.
Besides supporting all the archs we need, another major goal was to
minimize the number of changes to systemd's build system required to
build only the bootloader, so that maintaining/rebasing isn't *too*
painful...
I am adding this to the "main" category, because I don't think there's a
way to add it to Alpine. It requires cross compiling to x86 on x86_64
(to support 32-bit EFI on this arch), and Alpine doesn't support this.
It requires stuff in pmaports/cross.
--- Research notes ---
I started looking at all of this because I wanted to come up with a
single way to boot Linux via EFI, that supports all (or as many as possible)
devices in pmaports. I looked at quite a few different options, and have
some notes below about my observations and conclusions for each.
Of everything I looked at, systemd-boot was the clear winner that met
the most requirements ("pro" below) with the fewest downsides ("con"
below).
Using a Unified Kernel Image (UKI) was a close second place, however
systemd-boot can also support booting UKI images quite easily (while
also giving us more flexibility to boot other things easily too), so I
think it wins over UKI.
The capitalization (or lack thereof) of the "pro" and "con" markers
below is significant: "PRO" / "CON" are major pros or cons for each
point (e.g. a major downside that blocks using the option), and
"pro"/"con" are minor (e.g. a downside that I'm willing to overlook.)
---- Requirements ----
- Arch support:
- x86_64
- x86 (nice to have, but not sure if necessary...)
- armv7
- aarch64
- riscv64
- EFI support:
- support 32-bit EFI on x86_64 CPU (includes being able to build
32-bit .efi app on x86_64)
- Easy to configure
- Easy to maintain
- Any changes to the bootloader required to get it working in
pmOS
- Config for it
---- Evaluated options ----
------ grub ------
- (PRO) can target all required archs
- (CON) grub can't be installed in pmb chroot, it calls grub-install and
that fails due to something missing in /dev. Maybe this could be worked
around in pmb?
- (CON) grub-mkimage exe is integrated in grub package, grub-efi depends on
grub
- don't want to install all of grub just for 1 exe and/or the EFI modules
- downsides of installing all of grub is that I think it can mislead
users into thinking we use grub the "normal way". this might cause them
to have the wrong expectations and break pmOS boot on their
system
- have POC "fixing" this
- I'm not sure upstream Alpine will like this, it's ugly
- (CON) grub x86 EFI support for x86_64 is currently in pmaports, that's
pretty ugly.
- IMHO forking grub (or grub components) for this purpose signals
to me that grub is the wrong tool for this job
------- kernel's efistub -------
- (PRO) already included in the kernel, nothing else required
- (pro) initrd and dtb can be passed in the kernel cmdline...
however....
- (CON) kernel cmdline can only be set at compile time
- (con) not all kernels may have EFISTUB set?
- (con) can't do measured/secure boot
- (con) requires a fairly recent kernel on aarch w/ efi_zboot support
enabled since we compress the kernel
------- UKI -------
- (PRO) very simple, 1 file thing
- (PRO) supports adding dtb, setting kernel cmdline and so on
- (pro) can do measured/secure boot
- (CON) requires an EFI stub loader
- can't find a stub loader that meets all requirements (other than
the one from systemd-boot...)
- (con) requires efi-mkuki or dealing with objcopy directly (eww)
- (con) requires a fairly recent kernel on aarch w/ efi_zboot support
------- limine -------
- (PRO) easy to install/configure, already have boot-deploy and pmaports
patches
- (PRO) can be cross compiled easily
- evidence is in aports
- ...but I couldn't reproduce building aarch64 and riscv64 on x86_64
- (pro) can do measured/secure boot (I think?)
- (CON) doesn't target all required archs
- can't do "linux boot" on aarch64, only "chainload"
- what about using chainload everywhere?
- requires using efistub in kernel
- what about dtb= and upstream recommendation to not use it except for
debug?
- no kernel compression support on aarch64
- see efi-stub.txt kernel doc
- (CON) vendors libgcc to support cross compilation
- probably not a good idea to trust binaries produced in microsoft
github's CI for some random project
------- stubbyboot -------
- (PRO) a straight forward stub loader
- (pro) can do measured/secure boot
- (CON) doesn't target all required archs
- (CON) cross compiling doesn't work.
- gcc can't do 32-bit on x86_64 Alpine...
- gnu-efi-dev needs to be fixed to package both 32-bit and 64-bit on x86_64...
- have patch in ~/src/aports that kinda does it.. but needs to be
fixed/finished
- maybe limine-efi works with it?
- tried, but fails due to missing efilib.h in limine-efi
------- systemd-stub -------
- (PRO) another straight forward stub loader
- (PRO) many (many) people using it, as part of systemd-boot
- (pro) can do measured/secure boot
- (con) requires a fairly recent kernel on aarch w/ efi_zboot support
enabled since we compress the kernel
- (con) doesn't target all required archs
- but does claim to support most... missing armv7.. maybe it
works?
- (con) will end up maintaining some downstream patch to build it
- hopefully the patch (if I can even make a working one!) is not too
complex!
- (CON) can't be built outside of systemd's silly large build system.
- UPDATE: largely resolved this in pmaports
- was able to build for native arch!
- can't build 32-bit on x86_64, no gcc multilib support in Alpine...
Couldn't get clang to work properly, but maybe it can somehow...
- https://github.com/mintsuki/libgcc-binaries ? NO! (don't want
bootloader binaries that depend on code compiled by microsoft /
github...)
------- DIY stub / bootloader -----
- (PRO) **might** target all required archs and other meet
requirements
- (CON) lots of time required to learn, design, do, debug, test
- (CON) lots of time required to learn, design, do, debug, test
- (CON) lots of time required to learn, design, do, debug, test
- (CON) (get the hint yet???)
- (CON) written in C, probably (there's a rust EFI lib, lol...)
[ci:skip-build]: Already built successfully in CI
This commit is contained in:
Clayton Craft
Stefan Hansson
parent
160a73321d
commit
72bd769dcb
4 changed files with 286 additions and 0 deletions
|
|
@ -0,0 +1,67 @@
|
|||
From b96192f20a670c902279f905792333f556c0284e Mon Sep 17 00:00:00 2001
|
||||
From: Clayton Craft <clayton@craftyguy.net>
|
||||
Date: Fri, 6 Oct 2023 11:51:21 -0700
|
||||
Subject: [PATCH 1/2] meson: minimal configure for building systemd-boot
|
||||
|
||||
Notes:
|
||||
- toggling all ENABLED_* things off saves a ton of configure
|
||||
time
|
||||
- Removing capability.h, so that cross compiling doesn't fail
|
||||
because that header isn't installed
|
||||
- Set libcap and libmount to required=false, they aren't needed for
|
||||
building the bootloader, and they complicate cross compilation
|
||||
---
|
||||
meson.build | 16 +++++++++++-----
|
||||
1 file changed, 11 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/meson.build b/meson.build
|
||||
index 395eca1943..a227b1cef4 100644
|
||||
--- a/meson.build
|
||||
+++ b/meson.build
|
||||
@@ -775,9 +775,6 @@ conf.set('GPERF_LEN_TYPE', gperf_len_type,
|
||||
|
||||
############################################################
|
||||
|
||||
-if not cc.has_header('sys/capability.h')
|
||||
- error('POSIX caps headers not found')
|
||||
-endif
|
||||
foreach header : ['crypt.h',
|
||||
'linux/memfd.h',
|
||||
'linux/vm_sockets.h',
|
||||
@@ -1065,7 +1062,7 @@ if not libcrypt.found()
|
||||
# fallback to use find_library() if libcrypt is provided by glibc, e.g. for LibreELEC.
|
||||
libcrypt = cc.find_library('crypt')
|
||||
endif
|
||||
-libcap = dependency('libcap')
|
||||
+libcap = dependency('threads', required : false)
|
||||
|
||||
# On some architectures, libatomic is required. But on some installations,
|
||||
# it is found, but actual linking fails. So let's try to use it opportunistically.
|
||||
@@ -1179,7 +1176,7 @@ else
|
||||
endif
|
||||
|
||||
libmount = dependency('mount',
|
||||
- version : fuzzer_build ? '>= 0' : '>= 2.30')
|
||||
+ version : fuzzer_build ? '>= 0' : '>= 2.30', required : false)
|
||||
|
||||
want_libfdisk = get_option('fdisk')
|
||||
if want_libfdisk != 'false' and not skip_deps
|
||||
@@ -2164,6 +2161,15 @@ else
|
||||
endif
|
||||
conf.set10('ENABLE_UKIFY', want_ukify)
|
||||
|
||||
+foreach key : conf.keys()
|
||||
+ if key.startswith('ENABLE_')
|
||||
+ conf.set10(key, false)
|
||||
+ endif
|
||||
+endforeach
|
||||
+
|
||||
+conf.set10('ENABLE_EFI', true)
|
||||
+conf.set10('ENABLE_BOOTLOADER', true)
|
||||
+
|
||||
############################################################
|
||||
|
||||
elf2efi_lds = project_source_root / 'tools/elf2efi.lds'
|
||||
--
|
||||
2.40.1
|
||||
|
||||
90
main/systemd-boot/0002-fix-wchar-for-compiling-on-musl.patch
Normal file
90
main/systemd-boot/0002-fix-wchar-for-compiling-on-musl.patch
Normal file
|
|
@ -0,0 +1,90 @@
|
|||
From 1435bd3583935bd010b391c2436bfedb4bf31f63 Mon Sep 17 00:00:00 2001
|
||||
From: Clayton Craft <clayton@craftyguy.net>
|
||||
Date: Fri, 6 Oct 2023 08:30:52 -0700
|
||||
Subject: [PATCH 2/2] fix wchar for compiling on musl
|
||||
|
||||
---
|
||||
src/boot/efi/efi-string.c | 10 +++++-----
|
||||
src/boot/efi/efi.h | 5 ++---
|
||||
2 files changed, 7 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/src/boot/efi/efi-string.c b/src/boot/efi/efi-string.c
|
||||
index 4400591255..f630f628f8 100644
|
||||
--- a/src/boot/efi/efi-string.c
|
||||
+++ b/src/boot/efi/efi-string.c
|
||||
@@ -480,7 +480,7 @@ typedef struct {
|
||||
bool have_field_width;
|
||||
|
||||
const char *str;
|
||||
- const wchar_t *wstr;
|
||||
+ const uint16_t *wstr;
|
||||
|
||||
/* For numbers. */
|
||||
bool is_signed;
|
||||
@@ -541,7 +541,7 @@ static bool push_str(FormatContext *ctx, SpecifierContext *sp) {
|
||||
push_padding(ctx, ' ', sp->padded_len);
|
||||
|
||||
/* In userspace unit tests we cannot just memcpy() the wide string. */
|
||||
- if (sp->wstr && sizeof(wchar_t) == sizeof(char16_t)) {
|
||||
+ if (sp->wstr && sizeof(uint16_t) == sizeof(char16_t)) {
|
||||
memcpy(ctx->buf + ctx->n, sp->wstr, sp->len * sizeof(*sp->wstr));
|
||||
ctx->n += sp->len;
|
||||
} else
|
||||
@@ -633,7 +633,7 @@ static bool handle_format_specifier(FormatContext *ctx, SpecifierContext *sp) {
|
||||
* int in vararg functions, which is why we fetch only ints for any such types. The compiler would
|
||||
* otherwise warn about fetching smaller types. */
|
||||
assert_cc(sizeof(int) == 4);
|
||||
- assert_cc(sizeof(wchar_t) <= sizeof(int));
|
||||
+ assert_cc(sizeof(uint16_t) <= sizeof(int));
|
||||
assert_cc(sizeof(intmax_t) <= sizeof(long long));
|
||||
|
||||
assert(ctx);
|
||||
@@ -728,13 +728,13 @@ static bool handle_format_specifier(FormatContext *ctx, SpecifierContext *sp) {
|
||||
return push_str(ctx, sp);
|
||||
|
||||
case 'c':
|
||||
- sp->wstr = &(wchar_t){ va_arg(ctx->ap, int) };
|
||||
+ sp->wstr = &(uint16_t){ va_arg(ctx->ap, int) };
|
||||
sp->len = 1;
|
||||
return push_str(ctx, sp);
|
||||
|
||||
case 's':
|
||||
if (sp->long_arg) {
|
||||
- sp->wstr = va_arg(ctx->ap, const wchar_t *) ?: L"(null)";
|
||||
+ sp->wstr = va_arg(ctx->ap, const uint16_t *) ?: L"(null)";
|
||||
sp->len = wcsnlen(sp->wstr, sp->len);
|
||||
} else {
|
||||
sp->str = va_arg(ctx->ap, const char *) ?: "(null)";
|
||||
diff --git a/src/boot/efi/efi.h b/src/boot/efi/efi.h
|
||||
index 5c34668383..a0b48e7a96 100644
|
||||
--- a/src/boot/efi/efi.h
|
||||
+++ b/src/boot/efi/efi.h
|
||||
@@ -10,7 +10,7 @@
|
||||
|
||||
#if SD_BOOT
|
||||
/* uchar.h/wchar.h are not suitable for freestanding environments. */
|
||||
-typedef __WCHAR_TYPE__ wchar_t;
|
||||
+typedef __WCHAR_TYPE__ uint16_t;
|
||||
typedef __CHAR16_TYPE__ char16_t;
|
||||
typedef __CHAR32_TYPE__ char32_t;
|
||||
|
||||
@@ -21,7 +21,7 @@ assert_cc(sizeof(uint8_t) == 1);
|
||||
assert_cc(sizeof(uint16_t) == 2);
|
||||
assert_cc(sizeof(uint32_t) == 4);
|
||||
assert_cc(sizeof(uint64_t) == 8);
|
||||
-assert_cc(sizeof(wchar_t) == 2);
|
||||
+assert_cc(sizeof(uint16_t) == 2);
|
||||
assert_cc(sizeof(char16_t) == 2);
|
||||
assert_cc(sizeof(char32_t) == 4);
|
||||
assert_cc(sizeof(size_t) == sizeof(void *));
|
||||
@@ -32,7 +32,6 @@ assert_cc(sizeof(size_t) == sizeof(uintptr_t));
|
||||
# endif
|
||||
#else
|
||||
# include <uchar.h>
|
||||
-# include <wchar.h>
|
||||
#endif
|
||||
|
||||
/* We use size_t/ssize_t to represent UEFI UINTN/INTN. */
|
||||
--
|
||||
2.40.1
|
||||
|
||||
118
main/systemd-boot/APKBUILD
Normal file
118
main/systemd-boot/APKBUILD
Normal file
|
|
@ -0,0 +1,118 @@
|
|||
# Contributor: Clayton Craft <clayton@craftyguy.net>
|
||||
# Maintainer: Clayton Craft <clayton@craftyguy.net>
|
||||
#
|
||||
# Notes:
|
||||
# - Builds / packages *only* the EFI boot manager and stub loader, and any
|
||||
# useful apps for managing those things.
|
||||
# - The goal with the systemd patch and this package is *NOT* to create the
|
||||
# fastest build possible (e.g. by hacking up meson a bunch).
|
||||
# - The goal is to create the smallest diff from upstream so that rebasing
|
||||
# this is as easy as possible.
|
||||
# - If you can figure out how to have both, great!!! Otherwise, installing
|
||||
# some extra build-time junk and waiting for a long meson configure step
|
||||
# is an acceptable price to pay for not having to rebase a bunch of stuff.
|
||||
#
|
||||
pkgname=systemd-boot
|
||||
pkgver=254
|
||||
pkgrel=0
|
||||
pkgdesc="systemd's EFI boot manager and stub"
|
||||
url="https://systemd.io/"
|
||||
# TODO:
|
||||
# armv7: untested
|
||||
# riscv64: untested
|
||||
# x86: untested (and unnecessary?)
|
||||
arch="x86_64 aarch64"
|
||||
license="GPL-2.0-only"
|
||||
# Some of these are just to satisfy systemd's meson config, and aren't actually
|
||||
# used for building the boot manager or stub...
|
||||
makedepends="
|
||||
bash
|
||||
coreutils
|
||||
gperf
|
||||
meson
|
||||
py3-elftools
|
||||
py3-jinja2
|
||||
"
|
||||
source="
|
||||
systemd-$pkgver.tar.gz::https://github.com/systemd/systemd/archive/refs/tags/v$pkgver.tar.gz
|
||||
0001-meson-minimal-configure-for-building-systemd-boot.patch
|
||||
0002-fix-wchar-for-compiling-on-musl.patch
|
||||
cross-x86.meson
|
||||
"
|
||||
options="!check" # no tests
|
||||
subpackages="ukify"
|
||||
# TODO: cross-native fails on, e.g. aarch64, elf2efi gets an "unknown section
|
||||
# with name '' " ...
|
||||
# Maybe because meson thinks(?) the linker doesn't support norelro? It does
|
||||
# when building the default way!
|
||||
# Using meson cross files is a lot faster! But the whole thing is pretty small,
|
||||
# so, meh.
|
||||
# options="!check pmb:cross-native" # no tests
|
||||
builddir="$srcdir/systemd-$pkgver"
|
||||
|
||||
case "$CARCH" in
|
||||
# TODO: This doesn't work locally, pmboostrap's depends parser doesn't
|
||||
# evaluate/consider shell stuff...
|
||||
x86_64)
|
||||
makedepends="$makedepends gcc-x86 musl-dev-x86"
|
||||
;;
|
||||
esac
|
||||
|
||||
build() {
|
||||
abuild-meson \
|
||||
-Dsbat-distro="postmarketOS" \
|
||||
-Dsbat-distro-pkgname="$pkgname" \
|
||||
-Dsbat-distro-summary="postmarketOS" \
|
||||
-Dsbat-distro-url="postmarketos.org" \
|
||||
-Dsbat-distro-version="$pkgver" \
|
||||
. output
|
||||
meson compile -C output systemd-boot
|
||||
|
||||
# Some x86_64 systems have 32-bit EFI, so cross compile the bootloader for
|
||||
# 32-bit when building for this CARCH
|
||||
# TODO: this should use systemd/meson.build's ability to cross-compile
|
||||
# (setting meson "efi_arch_alt"). The check for that currently fails
|
||||
# because the linker can't find the i586/32-bit stuff. Setting
|
||||
# LIBRARY_PATH=/usr/lib/gcc/i586-alpine-linux-musl didn't work.
|
||||
if [ "$CARCH" == "x86_64" ]; then
|
||||
abuild-meson \
|
||||
-Dsbat-distro="postmarketOS" \
|
||||
-Dsbat-distro-pkgname="$pkgname" \
|
||||
-Dsbat-distro-summary="postmarketOS" \
|
||||
-Dsbat-distro-url="postmarketos.org" \
|
||||
-Dsbat-distro-version="$pkgver" \
|
||||
--cross-file "$srcdir"/cross-x86.meson \
|
||||
. output.32
|
||||
meson compile -C output.32 systemd-boot
|
||||
fi
|
||||
}
|
||||
|
||||
package() {
|
||||
mkdir -p "$pkgdir"/usr/lib/systemd/boot/efi
|
||||
|
||||
mv output/src/boot/efi/linux*.efi.stub \
|
||||
"$pkgdir"/usr/lib/systemd/boot/efi/
|
||||
mv output/src/boot/efi/systemd*.efi \
|
||||
"$pkgdir"/usr/lib/systemd/boot/efi/
|
||||
|
||||
if [ "$CARCH" == "x86_64" ]; then
|
||||
mv output.32/src/boot/efi/linux*.efi.stub \
|
||||
"$pkgdir"/usr/lib/systemd/boot/efi/
|
||||
mv output.32/src/boot/efi/systemd*.efi \
|
||||
"$pkgdir"/usr/lib/systemd/boot/efi/
|
||||
fi
|
||||
}
|
||||
|
||||
ukify() {
|
||||
depends="binutils py3-pefile"
|
||||
|
||||
install -Dm755 "$builddir"/src/ukify/ukify.py \
|
||||
"$subpkgdir"/usr/bin/ukify
|
||||
}
|
||||
|
||||
sha512sums="
|
||||
84b4d16980fe2e64d5c3c95b9b4fbaad1076f368f493fdd745cbafbe7ce825293384f5fa0b6360ba8188da23c4575e87402fb666a3b71f84ff8b323aba0c07ff systemd-254.tar.gz
|
||||
e97835fa20b99ae8553b2140a14ed7da14de1e18e98f39718edba64b960a92cc9edcbf89b16bdd6c20ac1566a9c5b9e6203898e104c0312e1aae9b300b116c27 0001-meson-minimal-configure-for-building-systemd-boot.patch
|
||||
c666b42f37a5710138ebc880c5defa8b5d0645ff78eb1ec685068d7219626af285a64bee78bb9460e31de1ca293c6c051a59a97e58b4335ad2c85a7424518763 0002-fix-wchar-for-compiling-on-musl.patch
|
||||
ad54e2c7e7a21bfa9b5f9e8db1b6af6a6d78a3e5dfe2dafcec77488f6224865ab4d4c8a8c8ee1c54c99d1741361e9fb3a51e5d36bcbc7a1c3fdcc4d0c1672132 cross-x86.meson
|
||||
"
|
||||
11
main/systemd-boot/cross-x86.meson
Normal file
11
main/systemd-boot/cross-x86.meson
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
[binaries]
|
||||
c = 'i586-alpine-linux-musl-gcc'
|
||||
ar = 'i586-alpine-linux-musl-ar'
|
||||
strip = 'i586-alpine-linux-musl-strip'
|
||||
ld = 'i586-alpine-linux-musl-ld'
|
||||
|
||||
[host_machine]
|
||||
system = 'linux'
|
||||
cpu_family = 'x86'
|
||||
cpu = 'i586'
|
||||
endian = 'little'
|
||||
Loading…
Reference in a new issue