sys-kernel/dracut: backport UKI fix w/ systemd-254

Fails to boot otherwise.

Signed-off-by: Sam James <sam@gentoo.org>

3 files changed, 353 insertions, 0 deletions

diff --git a/sys-kernel/dracut/dracut-059-r3.ebuild b/sys-kernel/dracut/dracut-059-r3.ebuild
new file mode 100644
index 000000000000..6d27123ec55b
--- /dev/null
+++ b/sys-kernel/dracut/dracut-059-r3.ebuild
@@ -0,0 +1,184 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit bash-completion-r1 linux-info optfeature systemd toolchain-funcs
+
+if [[ ${PV} == 9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/dracutdevs/dracut"
+else
+	if [[ "${PV}" != *_rc* ]]; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	fi
+	SRC_URI="https://github.com/dracutdevs/dracut/archive/refs/tags/${PV}.tar.gz -> ${P}.tar.gz"
+fi
+
+DESCRIPTION="Generic initramfs generation tool"
+HOMEPAGE="https://github.com/dracutdevs/dracut/wiki"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="selinux test"
+
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	app-arch/cpio
+	>=app-shells/bash-4.0:0
+	sys-apps/coreutils[xattr(-)]
+	>=sys-apps/kmod-23[tools]
+	|| (
+		>=sys-apps/sysvinit-2.87-r3
+		sys-apps/openrc[sysv-utils(-),selinux?]
+		sys-apps/systemd[sysv-utils]
+		sys-apps/s6-linux-init[sysv-utils(-)]
+	)
+	>=sys-apps/util-linux-2.21
+	virtual/pkgconfig
+	virtual/udev
+
+	elibc_musl? ( sys-libs/fts-standalone )
+	selinux? (
+		sec-policy/selinux-dracut
+		sys-libs/libselinux
+		sys-libs/libsepol
+	)
+"
+DEPEND="
+	>=sys-apps/kmod-23
+	elibc_musl? ( sys-libs/fts-standalone )
+"
+
+BDEPEND="
+	app-text/asciidoc
+	app-text/docbook-xml-dtd:4.5
+	>=app-text/docbook-xsl-stylesheets-1.75.2
+	>=dev-libs/libxslt-1.1.26
+	virtual/pkgconfig
+"
+
+QA_MULTILIB_PATHS="usr/lib/dracut/.*"
+
+PATCHES=(
+	"${FILESDIR}"/gentoo-ldconfig-paths-r1.patch
+	"${FILESDIR}"/gentoo-network-r1.patch
+	"${FILESDIR}"/059-uefi-split-usr.patch
+	"${FILESDIR}"/059-uki-systemd-254.patch
+	"${FILESDIR}"/059-gawk.patch
+)
+
+src_configure() {
+	local myconf=(
+		--prefix="${EPREFIX}/usr"
+		--sysconfdir="${EPREFIX}/etc"
+		--bashcompletiondir="$(get_bashcompdir)"
+		--systemdsystemunitdir="$(systemd_get_systemunitdir)"
+	)
+
+	tc-export CC PKG_CONFIG
+
+	echo ./configure "${myconf[@]}"
+	./configure "${myconf[@]}" || die
+
+	if [[ ${PV} != 9999 && ! -f dracut-version.sh ]] ; then
+		# Source tarball from github doesn't include this file
+		echo "DRACUT_VERSION=${PV}" > dracut-version.sh || die
+	fi
+}
+
+src_test() {
+	if [[ ${EUID} != 0 ]]; then
+		# Tests need root privileges, bug #298014
+		ewarn "Skipping tests: Not running as root."
+	elif [[ ! -w /dev/kvm ]]; then
+		ewarn "Skipping tests: Unable to access /dev/kvm."
+	else
+		emake -C test check
+	fi
+}
+
+src_install() {
+	local DOCS=(
+		AUTHORS
+		NEWS.md
+		README.md
+		docs/README.cross
+		docs/README.generic
+		docs/README.kernel
+		docs/SECURITY.md
+	)
+
+	default
+
+	docinto html
+	dodoc dracut.html
+}
+
+pkg_postinst() {
+	if linux-info_get_any_version && linux_config_exists; then
+		ewarn ""
+		ewarn "If the following test report contains a missing kernel"
+		ewarn "configuration option, you should reconfigure and rebuild your"
+		ewarn "kernel before booting image generated with this Dracut version."
+		ewarn ""
+
+		local CONFIG_CHECK="~BLK_DEV_INITRD ~DEVTMPFS"
+
+		# Kernel configuration options descriptions:
+		local ERROR_DEVTMPFS='CONFIG_DEVTMPFS: "Maintain a devtmpfs filesystem to mount at /dev" '
+		ERROR_DEVTMPFS+='is missing and REQUIRED'
+		local ERROR_BLK_DEV_INITRD='CONFIG_BLK_DEV_INITRD: "Initial RAM filesystem and RAM disk '
+		ERROR_BLK_DEV_INITRD+='(initramfs/initrd) support" is missing and REQUIRED'
+
+		check_extra_config
+		echo
+	else
+		ewarn ""
+		ewarn "Your kernel configuration couldn't be checked."
+		ewarn "Please check manually if following options are enabled:"
+		ewarn ""
+		ewarn "  CONFIG_BLK_DEV_INITRD"
+		ewarn "  CONFIG_DEVTMPFS"
+		ewarn ""
+	fi
+
+	optfeature "Networking support" net-misc/networkmanager
+	optfeature "Legacy networking support" net-misc/curl "net-misc/dhcp[client]" \
+		sys-apps/iproute2 "net-misc/iputils[arping]"
+	optfeature "Scan for Btrfs on block devices"  sys-fs/btrfs-progs
+	optfeature "Load kernel modules and drop this privilege for real init" \
+		sys-libs/libcap
+	optfeature "Support CIFS" net-fs/cifs-utils
+	optfeature "Decrypt devices encrypted with cryptsetup/LUKS" \
+		"sys-fs/cryptsetup[-static-libs]"
+	optfeature "Support for GPG-encrypted keys for crypt module" \
+		app-crypt/gnupg
+	optfeature \
+		"Allows use of dash instead of default bash (on your own risk)" \
+		app-shells/dash
+	optfeature \
+		"Allows use of busybox instead of default bash (on your own risk)" \
+		sys-apps/busybox
+	optfeature "Support iSCSI" sys-block/open-iscsi
+	optfeature "Support Logical Volume Manager" sys-fs/lvm2[lvm]
+	optfeature "Support MD devices, also known as software RAID devices" \
+		sys-fs/mdadm sys-fs/dmraid
+	optfeature "Support Device Mapper multipathing" sys-fs/multipath-tools
+	optfeature "Plymouth boot splash"  '>=sys-boot/plymouth-0.8.5-r5'
+	optfeature "Support network block devices" sys-block/nbd
+	optfeature "Support NFS" net-fs/nfs-utils net-nds/rpcbind
+	optfeature \
+		"Install ssh and scp along with config files and specified keys" \
+		virtual/openssh
+	optfeature "Enable logging with rsyslog" app-admin/rsyslog
+	optfeature "Support Squashfs" sys-fs/squashfs-tools
+	optfeature "Support TPM 2.0 TSS" app-crypt/tpm2-tools
+	optfeature "Support Bluetooth (experimental)" net-wireless/bluez
+	optfeature "Support BIOS-given device names" sys-apps/biosdevname
+	optfeature "Support network NVMe" sys-apps/nvme-cli
+	optfeature \
+		"Enable rngd service to help generating entropy early during boot" \
+		sys-apps/rng-tools
+}
diff --git a/sys-kernel/dracut/files/059-gawk.patch b/sys-kernel/dracut/files/059-gawk.patch
new file mode 100644
index 000000000000..5f1da79bb24a
--- /dev/null
+++ b/sys-kernel/dracut/files/059-gawk.patch
@@ -0,0 +1,35 @@
+https://github.com/dracutdevs/dracut/pull/2436
+
+From 77214c229dadd1441f0d6243221ceed0708cbfcf Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Thu, 20 Jul 2023 04:36:01 +0100
+Subject: [PATCH] fix(dracut.sh): use gawk for strtonum
+
+strtonum is a gawkism and is not available in all awks, e.g. mawk. Use gawk
+to avoid failure.
+
+Fixes: f32e95bcadbc5158843530407adc1e7b700561b1
+Signed-off-by: Sam James <sam@gentoo.org>
+--- a/dracut-functions.sh
++++ b/dracut-functions.sh
+@@ -1047,7 +1047,7 @@ pe_file_format() {
+     if [[ $# -eq 1 ]]; then
+         local magic
+         magic=$(objdump -p "$1" \
+-            | awk '{if ($1 == "Magic"){print strtonum("0x"$2)}}')
++            | gawk '{if ($1 == "Magic"){print strtonum("0x"$2)}}')
+         magic=$(printf "0x%x" "$magic")
+         # 0x10b (PE32), 0x20b (PE32+)
+         [[ $magic == 0x20b || $magic == 0x10b ]] && return 0
+--- a/dracut.sh
++++ b/dracut.sh
+@@ -2467,7 +2467,7 @@ if [[ $uefi == yes ]]; then
+         fi
+     fi
+ 
+-    offs=$(objdump -h "$uefi_stub" 2> /dev/null | awk 'NF==7 {size=strtonum("0x"$3);\
++    offs=$(objdump -h "$uefi_stub" 2> /dev/null | gawk 'NF==7 {size=strtonum("0x"$3);\
+                 offset=strtonum("0x"$4)} END {print size + offset}')
+     if [[ $offs -eq 0 ]]; then
+         dfatal "Failed to get the size of $uefi_stub to create UEFI image file"
+
diff --git a/sys-kernel/dracut/files/059-uki-systemd-254.patch b/sys-kernel/dracut/files/059-uki-systemd-254.patch
new file mode 100644
index 000000000000..e8b52480d030
--- /dev/null
+++ b/sys-kernel/dracut/files/059-uki-systemd-254.patch
@@ -0,0 +1,134 @@
+https://github.com/dracutdevs/dracut/issues/2431
+https://github.com/dracutdevs/dracut/commit/f32e95bcadbc5158843530407adc1e7b700561b1
+
+From f32e95bcadbc5158843530407adc1e7b700561b1 Mon Sep 17 00:00:00 2001
+From: Valentin Lefebvre <valentin.lefebvre@suse.com>
+Date: Mon, 13 Mar 2023 12:06:13 +0100
+Subject: [PATCH] fix(dracut.sh): use dynamically uefi's sections offset
+
+* Uefi section are creating by `objcopy` with hardcoded sections
+offset. This commit allow to have the correct offset between
+each part of the efi file, needed to create an UKI. Offsets
+are simply calculated so no sections overlap, as recommended
+in  https://wiki.archlinux.org/title/Unified_kernel_image#Manually
+Moreover, efi stub file's header is parsed to apply the correct
+offsets according the section alignment factor.
+* Remove EFI_SECTION_VMA_INITRD, no need anymore as initrd
+section offset dynamically calculated
+
+Fixes dracutdevs#2275
+
+Signed-off-by: Valentin Lefebvre <valentin.lefebvre@suse.com>
+--- a/dracut-functions.sh
++++ b/dracut-functions.sh
+@@ -1023,3 +1023,26 @@ get_dev_module() {
+     fi
+     echo "$dev_drivers"
+ }
++
++# Check if file is in PE format
++pe_file_format() {
++    if [[ $# -eq 1 ]]; then
++        local magic
++        magic=$(objdump -p "$1" \
++            | awk '{if ($1 == "Magic"){print strtonum("0x"$2)}}')
++        magic=$(printf "0x%x" "$magic")
++        # 0x10b (PE32), 0x20b (PE32+)
++        [[ $magic == 0x20b || $magic == 0x10b ]] && return 0
++    fi
++    return 1
++}
++
++# Get the sectionAlignment data from the PE header
++pe_get_section_align() {
++    local align_hex
++    [[ $# -ne "1" ]] && return 1
++    [[ $(pe_file_format "$1") -eq 1 ]] && return 1
++    align_hex=$(objdump -p "$1" \
++        | awk '{if ($1 == "SectionAlignment"){print $2}}')
++    echo "$((16#$align_hex))"
++}
+--- a/dracut.sh
++++ b/dracut.sh
+@@ -1506,7 +1506,6 @@ if [[ ! $print_cmdline ]]; then
+             exit 1
+         fi
+         unset EFI_MACHINE_TYPE_NAME
+-        EFI_SECTION_VMA_INITRD=0x3000000
+         case "${DRACUT_ARCH:-$(uname -m)}" in
+             x86_64)
+                 EFI_MACHINE_TYPE_NAME=x64
+@@ -1516,8 +1515,6 @@ if [[ ! $print_cmdline ]]; then
+                 ;;
+             aarch64)
+                 EFI_MACHINE_TYPE_NAME=aa64
+-                # aarch64 kernels are uncompressed and thus larger, so we need a bigger gap between vma sections
+-                EFI_SECTION_VMA_INITRD=0x4000000
+                 ;;
+             *)
+                 dfatal "Architecture '${DRACUT_ARCH:-$(uname -m)}' not supported to create a UEFI executable"
+@@ -2467,29 +2464,57 @@ if [[ $uefi == yes ]]; then
+         fi
+     fi
+ 
++    offs=$(objdump -h "$uefi_stub" 2> /dev/null | awk 'NF==7 {size=strtonum("0x"$3);\
++                offset=strtonum("0x"$4)} END {print size + offset}')
++    if [[ $offs -eq 0 ]]; then
++        dfatal "Failed to get the size of $uefi_stub to create UEFI image file"
++        exit 1
++    fi
++    align=$(pe_get_section_align "$uefi_stub")
++    if [[ $? -eq 1 ]]; then
++        dfatal "Failed to get the sectionAlignment of the stub PE header to create the UEFI image file"
++        exit 1
++    fi
++    offs=$((offs + "$align" - offs % "$align"))
++    [[ -s $dracutsysrootdir/usr/lib/os-release ]] && uefi_osrelease="$dracutsysrootdir/usr/lib/os-release"
++    [[ -s $dracutsysrootdir/etc/os-release ]] && uefi_osrelease="$dracutsysrootdir/etc/os-release"
++    [[ -s $uefi_osrelease ]] \
++        && uefi_osrelease_offs=${offs} \
++        && offs=$((offs + $(stat -Lc%s "$uefi_osrelease"))) \
++        && offs=$((offs + "$align" - offs % "$align"))
++
+     if [[ $kernel_cmdline ]] || [[ $hostonly_cmdline == yes && -e "${uefi_outdir}/cmdline.txt" ]]; then
+         echo -ne "\x00" >> "$uefi_outdir/cmdline.txt"
+         dinfo "Using UEFI kernel cmdline:"
+         dinfo "$(tr -d '\000' < "$uefi_outdir/cmdline.txt")"
+         uefi_cmdline="${uefi_outdir}/cmdline.txt"
++        uefi_cmdline_offs=${offs}
++        offs=$((offs + $(stat -Lc%s "$uefi_cmdline")))
++        offs=$((offs + "$align" - offs % "$align"))
+     else
+         unset uefi_cmdline
+     fi
+ 
+-    [[ -s $dracutsysrootdir/usr/lib/os-release ]] && uefi_osrelease="$dracutsysrootdir/usr/lib/os-release"
+-    [[ -s $dracutsysrootdir/etc/os-release ]] && uefi_osrelease="$dracutsysrootdir/etc/os-release"
+     if [[ -s ${dracutsysrootdir}${uefi_splash_image} ]]; then
+         uefi_splash_image="${dracutsysrootdir}${uefi_splash_image}"
++        uefi_splash_offs=${offs}
++        offs=$((offs + $(stat -Lc%s "$uefi_splash_image")))
++        offs=$((offs + "$align" - offs % "$align"))
+     else
+         unset uefi_splash_image
+     fi
+ 
++    uefi_linux_offs="${offs}"
++    offs=$((offs + $(stat -Lc%s "$kernel_image")))
++    offs=$((offs + "$align" - offs % "$align"))
++    uefi_initrd_offs="${offs}"
++
+     if objcopy \
+-        ${uefi_osrelease:+--add-section .osrel="$uefi_osrelease" --change-section-vma .osrel=0x20000} \
+-        ${uefi_cmdline:+--add-section .cmdline="$uefi_cmdline" --change-section-vma .cmdline=0x30000} \
+-        ${uefi_splash_image:+--add-section .splash="$uefi_splash_image" --change-section-vma .splash=0x40000} \
+-        --add-section .linux="$kernel_image" --change-section-vma .linux=0x2000000 \
+-        --add-section .initrd="${DRACUT_TMPDIR}/initramfs.img" --change-section-vma .initrd="${EFI_SECTION_VMA_INITRD}" \
++        ${uefi_osrelease:+--add-section .osrel="$uefi_osrelease" --change-section-vma .osrel=$(printf 0x%x "$uefi_osrelease_offs")} \
++        ${uefi_cmdline:+--add-section .cmdline="$uefi_cmdline" --change-section-vma .cmdline=$(printf 0x%x "$uefi_cmdline_offs")} \
++        ${uefi_splash_image:+--add-section .splash="$uefi_splash_image" --change-section-vma .splash=$(printf 0x%x "$uefi_splash_offs")} \
++        --add-section .linux="$kernel_image" --change-section-vma .linux="$(printf 0x%x "$uefi_linux_offs")" \
++        --add-section .initrd="${DRACUT_TMPDIR}/initramfs.img" --change-section-vma .initrd="$(printf 0x%x "$uefi_initrd_offs")" \
+         "$uefi_stub" "${uefi_outdir}/linux.efi"; then
+         if [[ -n ${uefi_secureboot_key} && -n ${uefi_secureboot_cert} ]]; then
+             if sbsign \