Skip to content

Commit 8f5e816

Browse files
nikita-dubrovskiijlebon
nikita-dubrovskii
authored and
jlebon
committed
s390x: add secex image layout to osbuild manifest
1 parent e0bd7d4 commit 8f5e816

File tree

3 files changed

+284
-13
lines changed

3 files changed

+284
-13
lines changed

‎src/osbuild-manifests/coreos.osbuild.s390x.mpp.yaml

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,17 @@ mpp-vars:
1515
ppc_prep_size_mb: 4
1616
reserved_part_size_mb: 1
1717
efi_system_size_mb: 127
18+
se_size_mb: 200
1819
boot_size_mb: 384
20+
root_size_mb: 1800
21+
boot_verity_size_mb: 128
22+
root_verity_size_mb: 256
1923
sector_size: 512
2024
four_k_sector_size: 4096
2125
# Filesystem UUID and label definitions. These UUIDs
2226
# are looked for on boot and if found replaced with
2327
# a new random UUID to make each install unique.
28+
sd_fs_label: se
2429
boot_fs_uuid: 96d15588-3596-4b3c-adca-a2ff7279ea63
2530
boot_fs_label: boot
2631
root_fs_uuid: 910678ff-f77e-4a7d-8d53-86f2ac47a823
@@ -40,6 +45,8 @@ mpp-vars:
4045
# the host buildroot is the default if nothing is specified.
4146
# We're still defining it here in an attempt to be explicit.
4247
qemu_stage_buildroot: ""
48+
# IBM Secure Execution
49+
qemu_secex: $qemu_secex
4350
mpp-define-images:
4451
- id: image
4552
sector_size:
@@ -75,6 +82,40 @@ mpp-define-images:
7582
- name: root
7683
type: 0FC63DAF-8483-4772-8E79-3D69D8477DE4
7784
partnum: 4
85+
# Secure Execution image. It MUST contain same partitions as `image` plus 3 additional
86+
- id: image_secex
87+
sector_size:
88+
mpp-format-int: "{sector_size}"
89+
size:
90+
mpp-format-string: "{metal_image_size_mb * 1024 * 1024}"
91+
table:
92+
uuid: 00000000-0000-4000-a000-000000000001
93+
label: gpt
94+
partitions:
95+
- name: se
96+
type: 0FC63DAF-8483-4772-8E79-3D69D8477DE4
97+
partnum: 1
98+
size:
99+
mpp-format-int: "{se_size_mb * 1024 * 1024 / sector_size}"
100+
- name: boot
101+
type: 0FC63DAF-8483-4772-8E79-3D69D8477DE4
102+
partnum: 3
103+
size:
104+
mpp-format-int: "{boot_size_mb * 1024 * 1024 / sector_size}"
105+
- name: root
106+
type: 0FC63DAF-8483-4772-8E79-3D69D8477DE4
107+
partnum: 4
108+
size:
109+
mpp-format-int: "{root_size_mb * 1024 * 1024 / sector_size}"
110+
- name: boothash
111+
partnum: 5
112+
size:
113+
mpp-format-int: "{boot_verity_size_mb * 1024 * 1024 / sector_size}"
114+
- name: roothash
115+
type: B325BFBE-C7BE-4AB8-8357-139E652D2F6B
116+
partnum: 6
117+
size:
118+
mpp-format-int: "{root_verity_size_mb * 1024 * 1024 / sector_size}"
78119
pipelines:
79120
# If installing from container then let's pull the container file into a pipeline
80121
- name: oci-archive
@@ -148,6 +189,13 @@ pipelines:
148189
# filesystem by OSTree (boot -> .) that makes it so that /boot paths
149190
# will always work.
150191
bootprefix: true
192+
# If on s390x with secex then mkdir for filesytem labeled `se`, where `sdboot` image gets stored
193+
- mpp-if: qemu_secex != ''
194+
then:
195+
type: org.osbuild.mkdir
196+
options:
197+
paths:
198+
- path: /se
151199
- type: org.osbuild.ignition
152200
# Deploy via OSTree repo if specified, otherwise ociarchive or container.
153201
- mpp-if: ostree_repo != ''
@@ -475,6 +523,130 @@ pipelines:
475523
source: mount
476524
deployment:
477525
default: true
526+
# IBM Secure Execution (secex) image has special layout
527+
- name: raw-secex-image
528+
build:
529+
mpp-format-string: '{buildroot}'
530+
stages:
531+
- type: org.osbuild.truncate
532+
options:
533+
filename: disk.img
534+
size:
535+
mpp-format-string: '{image_secex.size}'
536+
- type: org.osbuild.sfdisk
537+
devices:
538+
device:
539+
type: org.osbuild.loopback
540+
options:
541+
filename: disk.img
542+
options:
543+
mpp-format-json: '{image_secex.layout}'
544+
- type: org.osbuild.mkfs.ext4
545+
devices:
546+
device:
547+
type: org.osbuild.loopback
548+
options:
549+
filename: disk.img
550+
start:
551+
mpp-format-int: '{image_secex.layout[''se''].start}'
552+
size:
553+
mpp-format-int: '{image_secex.layout[''se''].size}'
554+
lock: true
555+
options:
556+
uuid: random
557+
label:
558+
mpp-format-string: '{sd_fs_label}'
559+
- type: org.osbuild.mkfs.ext4
560+
devices:
561+
device:
562+
type: org.osbuild.loopback
563+
options:
564+
filename: disk.img
565+
start:
566+
mpp-format-int: '{image_secex.layout[''boot''].start}'
567+
size:
568+
mpp-format-int: '{image_secex.layout[''boot''].size}'
569+
lock: true
570+
options:
571+
uuid:
572+
mpp-format-string: '{boot_fs_uuid}'
573+
label:
574+
mpp-format-string: '{boot_fs_label}'
575+
# Set manually the metadata_csum_seed ext4 option otherwise changing the
576+
# filesystem UUID while it's mounted doesn't work. Can remove this when
577+
# metadata_csum_seed is default in RHEL, which can be checked by looking
578+
# in /etc/mke2fs.conf.
579+
metadata_csum_seed: true
580+
- type: org.osbuild.mkfs.xfs
581+
devices:
582+
device:
583+
type: org.osbuild.loopback
584+
options:
585+
filename: disk.img
586+
start:
587+
mpp-format-int: '{image_secex.layout[''root''].start}'
588+
size:
589+
mpp-format-int: '{image_secex.layout[''root''].size}'
590+
lock: true
591+
options:
592+
uuid:
593+
mpp-format-string: '{root_fs_uuid}'
594+
label:
595+
mpp-format-string: '{root_fs_label}'
596+
- type: org.osbuild.copy
597+
inputs:
598+
tree:
599+
type: org.osbuild.tree
600+
origin: org.osbuild.pipeline
601+
references:
602+
- name:tree
603+
options:
604+
paths:
605+
- from: input://tree/
606+
to: mount://root/
607+
devices:
608+
disk:
609+
type: org.osbuild.loopback
610+
options:
611+
filename: disk.img
612+
partscan: true
613+
mounts:
614+
- name: root
615+
type: org.osbuild.xfs
616+
source: disk
617+
partition:
618+
mpp-format-int: '{image_secex.layout[''root''].partnum}'
619+
target: /
620+
- name: boot
621+
type: org.osbuild.ext4
622+
source: disk
623+
partition:
624+
mpp-format-int: '{image_secex.layout[''boot''].partnum}'
625+
target: /boot
626+
- type: org.osbuild.chattr
627+
options:
628+
items:
629+
mount://root/:
630+
immutable: true
631+
devices:
632+
disk:
633+
type: org.osbuild.loopback
634+
options:
635+
filename: disk.img
636+
partscan: true
637+
mounts:
638+
- name: root
639+
type: org.osbuild.xfs
640+
source: disk
641+
partition:
642+
mpp-format-int: '{image_secex.layout[''root''].partnum}'
643+
target: /
644+
- name: ostree.deployment
645+
type: org.osbuild.ostree.deployment
646+
options:
647+
source: mount
648+
deployment:
649+
default: true
478650
- mpp-import-pipelines:
479651
path: platform.metal.ipp.yaml
480652
- mpp-import-pipelines:

‎src/osbuild-manifests/platform.qemu.ipp.yaml

Lines changed: 101 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,31 @@ pipelines:
55
build:
66
mpp-format-string: '{buildroot}'
77
stages:
8-
- type: org.osbuild.copy
9-
inputs:
10-
tree:
11-
type: org.osbuild.tree
12-
origin: org.osbuild.pipeline
13-
references:
14-
- name:raw-image
15-
options:
16-
paths:
17-
- from: input://tree/disk.img
18-
to: tree:///disk.img
8+
- mpp-if: qemu_secex == ''
9+
then:
10+
type: org.osbuild.copy
11+
inputs:
12+
tree:
13+
type: org.osbuild.tree
14+
origin: org.osbuild.pipeline
15+
references:
16+
- name:raw-image
17+
options:
18+
paths:
19+
- from: input://tree/disk.img
20+
to: tree:///disk.img
21+
else:
22+
type: org.osbuild.copy
23+
inputs:
24+
tree:
25+
type: org.osbuild.tree
26+
origin: org.osbuild.pipeline
27+
references:
28+
- name:raw-secex-image
29+
options:
30+
paths:
31+
- from: input://tree/disk.img
32+
to: tree:///disk.img
1933
# Increase the size to the cloud image size
2034
- type: org.osbuild.truncate
2135
options:
@@ -50,9 +64,9 @@ pipelines:
5064
partition:
5165
mpp-format-int: '{image.layout[''boot''].partnum}'
5266
target: /boot
53-
# If on s390x then run zipl, which must run after the kernel
67+
# If on s390x without secex then run zipl, which must run after the kernel
5468
# arguments get finalized in the coreos.platform stage above
55-
- mpp-if: arch == 's390x'
69+
- mpp-if: arch == 's390x' and qemu_secex == ''
5670
then:
5771
type: org.osbuild.zipl.inst
5872
options:
@@ -80,6 +94,52 @@ pipelines:
8094
partition:
8195
mpp-format-int: '{image.layout[''boot''].partnum}'
8296
target: /boot
97+
# If on s390x with secex then setup dm-verity for 'boot'
98+
- mpp-if: arch == 's390x' and qemu_secex != ''
99+
then:
100+
type: org.osbuild.dmverity
101+
options:
102+
root_hash_file: "bootfs_hash"
103+
devices:
104+
data_device:
105+
type: org.osbuild.loopback
106+
options:
107+
filename: disk.img
108+
start:
109+
mpp-format-int: '{image_secex.layout[''boot''].start}'
110+
size:
111+
mpp-format-int: '{image_secex.layout[''boot''].size}'
112+
hash_device:
113+
type: org.osbuild.loopback
114+
options:
115+
filename: disk.img
116+
start:
117+
mpp-format-int: '{image_secex.layout[''boothash''].start}'
118+
size:
119+
mpp-format-int: '{image_secex.layout[''boothash''].size}'
120+
# If on s390x with secex then setup dm-verity for 'root'
121+
- mpp-if: arch == 's390x' and qemu_secex != ''
122+
then:
123+
type: org.osbuild.dmverity
124+
options:
125+
root_hash_file: "rootfs_hash"
126+
devices:
127+
data_device:
128+
type: org.osbuild.loopback
129+
options:
130+
filename: disk.img
131+
start:
132+
mpp-format-int: '{image_secex.layout[''root''].start}'
133+
size:
134+
mpp-format-int: '{image_secex.layout[''root''].size}'
135+
hash_device:
136+
type: org.osbuild.loopback
137+
options:
138+
filename: disk.img
139+
start:
140+
mpp-format-int: '{image_secex.layout[''roothash''].start}'
141+
size:
142+
mpp-format-int: '{image_secex.layout[''roothash''].size}'
83143
- name: qemu
84144
build:
85145
mpp-format-string: '{qemu_stage_buildroot}'
@@ -99,3 +159,31 @@ pipelines:
99159
type: qcow2
100160
compression: false
101161
compat: '1.1'
162+
# If on s390x with secex then export hash for 'boot'
163+
- mpp-if: arch == 's390x' and qemu_secex != ''
164+
then:
165+
type: org.osbuild.copy
166+
inputs:
167+
tree:
168+
type: org.osbuild.tree
169+
origin: org.osbuild.pipeline
170+
references:
171+
- name:raw-qemu-image
172+
options:
173+
paths:
174+
- from: input://tree/bootfs_hash
175+
to: tree:///bootfs_hash
176+
# If on s390x with secex then export hash for 'root'
177+
- mpp-if: arch == 's390x' and qemu_secex != ''
178+
then:
179+
type: org.osbuild.copy
180+
inputs:
181+
tree:
182+
type: org.osbuild.tree
183+
origin: org.osbuild.pipeline
184+
references:
185+
- name:raw-qemu-image
186+
options:
187+
paths:
188+
- from: input://tree/rootfs_hash
189+
to: tree:///rootfs_hash

‎src/runvm-osbuild

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ Options:
1111
--help: show this help
1212
--mpp: the path to the OSBuild mpp.yaml file
1313
--filepath: where to write the created image file
14+
--secex: Build qemu-secex image
1415
1516
You probably don't want to run this script by hand. This script is
1617
run as part of 'coreos-assembler build'.
@@ -31,6 +32,7 @@ getconfig_def() {
3132
jq -re .\""$k"\"//\""${default}"\" < "${config}"
3233
}
3334

35+
secex=""
3436
while [ $# -gt 0 ];
3537
do
3638
flag="${1}"; shift;
@@ -39,6 +41,7 @@ do
3941
--help) usage; exit;;
4042
--mpp) mppyaml="${1}"; shift;;
4143
--filepath) filepath="${1}"; shift;;
44+
--secex) secex="${1}"; shift;;
4245
*) echo "${flag} is not understood."; usage; exit 10;;
4346
esac;
4447
done
@@ -97,6 +100,7 @@ osbuild-mpp \
97100
-D extra_kargs=\""${extra_kargs}"\" \
98101
-D metal_image_size_mb="${metal_image_size_mb}" \
99102
-D cloud_image_size_mb="${cloud_image_size_mb}" \
103+
-D qemu_secex=\""${secex}"\" \
100104
"${mppyaml}" "${processed_json}"
101105

102106
# Build the image
@@ -114,4 +118,11 @@ osbuild \
114118
# from the cache qcow2 so we don't cache it.
115119
mv "${outdir}/${platform}/${filename}" "${filepath}"
116120

121+
# In case of IBM Secure Execution there are more artifacts
122+
if [ -n "${secex}" ]; then
123+
dir=$(dirname "${filepath}")
124+
mv "${outdir}/${platform}/bootfs_hash" "${dir}"
125+
mv "${outdir}/${platform}/rootfs_hash" "${dir}"
126+
fi
127+
117128
rm -f "${processed_json}"

0 commit comments

Comments
 (0)