Skip to content

Commit b6098a2

Browse files
nalindnalind
committed
internal/mkcw/embed: cross-compile using Go
Use the Go toolchain to cross-compile the "This image is designed to be run as a confidential workload using libkrun." entrypoint that we add to confidential workload images. It's bigger than it was before, but easier to port and can be built from source every time when desired. Signed-off-by: Nalin Dahyabhai <[email protected]>
1 parent d0235c9 commit b6098a2

File tree

12 files changed

+111
-20
lines changed

12 files changed

+111
-20
lines changed

‎Makefile‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -66,16 +66,31 @@ bin/buildah: $(SOURCES) internal/mkcw/embed/entrypoint_amd64.gz
6666
$(GO_BUILD) $(BUILDAH_LDFLAGS) $(GO_GCFLAGS) "$(GOGCFLAGS)" -o $@ $(BUILDFLAGS) ./cmd/buildah
6767
test -z "${SELINUXOPT}" || chcon --verbose -t $(SELINUXTYPE) $@
6868

69-
ifneq ($(shell $(AS) --version | grep x86_64),)
7069
internal/mkcw/embed/entrypoint_amd64.gz: internal/mkcw/embed/entrypoint_amd64
7170
gzip -k9nf $^
71+
internal/mkcw/embed/entrypoint_arm64.gz: internal/mkcw/embed/entrypoint_arm64
72+
gzip -k9nf $^
73+
internal/mkcw/embed/entrypoint_ppc64le.gz: internal/mkcw/embed/entrypoint_ppc64le
74+
gzip -k9nf $^
75+
internal/mkcw/embed/entrypoint_s390x.gz: internal/mkcw/embed/entrypoint_s390x
76+
gzip -k9nf $^
7277

73-
internal/mkcw/embed/entrypoint_amd64: internal/mkcw/embed/entrypoint_amd64.s
78+
ifneq ($(shell $(AS) --version | grep -E 'x86_64-([^-]+-)?linux'),)
79+
internal/mkcw/embed/entrypoint_amd64: internal/mkcw/embed/asm/entrypoint_amd64.s
7480
$(AS) -o $(patsubst %.s,%.o,$^) $^
7581
$(LD) -o $@ $(patsubst %.s,%.o,$^)
7682
$(STRIP) $@
83+
else
84+
internal/mkcw/embed/entrypoint_amd64: internal/mkcw/embed/entrypoint_amd64.s internal/mkcw/embed/entrypoint.go
85+
GOOS=linux GOARCH=amd64 $(GO) build -ldflags "-E _start -s" -o $@ ./internal/mkcw/embed
7786
endif
7887

88+
internal/mkcw/embed/entrypoint_arm64: internal/mkcw/embed/entrypoint_arm64.s internal/mkcw/embed/entrypoint.go
89+
GOOS=linux GOARCH=arm64 $(GO) build -ldflags "-E _start -s" -o $@ ./internal/mkcw/embed
90+
internal/mkcw/embed/entrypoint_ppc64le: internal/mkcw/embed/entrypoint_ppc64le.s internal/mkcw/embed/entrypoint.go
91+
GOOS=linux GOARCH=ppc64le $(GO) build -ldflags "-E _start -s" -o $@ ./internal/mkcw/embed
92+
internal/mkcw/embed/entrypoint_s390x: internal/mkcw/embed/entrypoint_s390x.s internal/mkcw/embed/entrypoint.go
93+
GOOS=linux GOARCH=s390x $(GO) build -ldflags "-E _start -s" -o $@ ./internal/mkcw/embed
7994

8095
.PHONY: buildah
8196
buildah: bin/buildah
@@ -88,7 +103,7 @@ FREEBSD_CROSS_TARGETS := $(filter bin/buildah.freebsd.%,$(ALL_CROSS_TARGETS))
88103
.PHONY: cross
89104
cross: $(LINUX_CROSS_TARGETS) $(DARWIN_CROSS_TARGETS) $(WINDOWS_CROSS_TARGETS) $(FREEBSD_CROSS_TARGETS)
90105

91-
bin/buildah.%: $(SOURCES)
106+
bin/buildah.%: $(SOURCES) internal/mkcw/embed/entrypoint_amd64.gz
92107
mkdir -p ./bin
93108
GOOS=$(word 2,$(subst ., ,$@)) GOARCH=$(word 3,$(subst ., ,$@)) $(GO_BUILD) $(BUILDAH_LDFLAGS) -o $@ -tags "containers_image_openpgp" ./cmd/buildah
94109

@@ -118,7 +133,7 @@ bin/passwd: tests/passwd/passwd.go
118133

119134
.PHONY: clean
120135
clean:
121-
$(RM) -r bin tests/testreport/testreport tests/conformance/testdata/mount-targets/true
136+
$(RM) -r bin tests/testreport/testreport tests/conformance/testdata/mount-targets/true internal/mkcw/embed/entrypoint_amd64 internal/mkcw/embed/entrypoint_arm64 internal/mkcw/embed/entrypoint_ppc64le internal/mkcw/embed/entrypoint_s390x internal/mkcw/embed/*.gz internal/mkcw/embed/asm/*.o
122137
$(MAKE) -C docs clean
123138

124139
.PHONY: docs

‎internal/mkcw/embed/asm/doc.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
If we have a toolchain for the target that can handle plain assembly, build with that.

‎internal/mkcw/embed/asm/entrypoint_amd64.s‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
.section .rodata.1,"aMS",@progbits,1
2+
msg:
3+
.string "This image is designed to be run as a confidential workload using libkrun.\n"
4+
.section .text._start,"ax",@progbits
5+
.globl _start
6+
.type _start,@function
7+
_start:
8+
movq $1, %rax # write
9+
movq $2, %rdi # fd=stderr_fileno
10+
movq $msg, %rsi # message
11+
movq $75, %rdx # length
12+
syscall
13+
movq $60, %rax # exit
14+
movq $1, %rdi # status=1
15+
syscall
16+
.section .note.GNU-stack,"",@progbits

‎internal/mkcw/embed/check.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env bash
2+
expected="This image is designed to be run as a confidential workload using libkrun."
3+
cd $(dirname ${BASH_SOURCE[0]})
4+
for GOARCH in amd64 arm64 ppc64le s390x ; do
5+
make -C ../../.. internal/mkcw/embed/entrypoint_$GOARCH
6+
case $GOARCH in
7+
amd64) QEMUARCH=x86_64;;
8+
arm64) QEMUARCH=aarch64;;
9+
ppc64le|s390x) QEMUARCH=$GOARCH;;
10+
esac
11+
actual="$(qemu-$QEMUARCH ./entrypoint_$GOARCH 2>&1)"
12+
if test "$actual" != "$expected" ; then
13+
echo unexpected error from entrypoint_$GOARCH: "$actual"
14+
exit 1
15+
fi
16+
done

‎internal/mkcw/embed/doc.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
// Supplying our own _start that just writes the message and exits avoids
2+
// pulling in the proper standard library, which produces a smaller binary, but
3+
// we still end up pulling in the language runtime.
4+
package main

‎internal/mkcw/embed/entrypoint.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
package main

‎internal/mkcw/embed/entrypoint_amd64.gz‎

-13 Bytes
Binary file not shown.

‎internal/mkcw/embed/entrypoint_amd64.s‎

Lines changed: 13 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,13 @@
1-
.section .rodata.1,"aMS",@progbits,1
2-
msg:
3-
.string "This image is designed to be run as a confidential workload using libkrun.\n"
4-
.section .text._start,"ax",@progbits
5-
.globl _start
6-
.type _start,@function
7-
_start:
8-
movq $1, %rax # write
9-
movq $2, %rdi # fd=stderr_fileno
10-
movq $msg, %rsi # message
11-
movq $75, %rdx # length
12-
syscall
13-
movq $60, %rax # exit
14-
movq $1, %rdi # status=1
15-
syscall
16-
.section .note.GNU-stack,"",@progbits
1+
DATA msg+0(SB)/75, $"This image is designed to be run as a confidential workload using libkrun.\n"
2+
3+
GLOBL msg(SB),8,$75
4+
5+
TEXT _start(SB),8-0,$0
6+
MOVQ $1, AX // syscall=write
7+
MOVQ $2, DI // descriptor=2
8+
MOVQ $msg(SB), SI // buffer (msg) address
9+
MOVQ $75, DX // buffer (msg) length
10+
SYSCALL
11+
MOVQ $60, AX // syscall=exit
12+
MOVQ $1, DI // status=1
13+
SYSCALL

‎internal/mkcw/embed/entrypoint_arm64.s‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
DATA msg+0(SB)/75, $"This image is designed to be run as a confidential workload using libkrun.\n"
2+
3+
GLOBL msg(SB),8,$75
4+
5+
TEXT _start(SB),8-0,$0
6+
MOVD $64, R8 // syscall=write
7+
MOVD $2, R0 // descriptor=2
8+
MOVD $msg(SB), R1 // buffer (msg) address
9+
MOVD $75, R2 // buffer (msg) length
10+
SVC
11+
MOVD $93, R8 // syscall=exit
12+
MOVD $1, R0 // status=1
13+
SVC

‎internal/mkcw/embed/entrypoint_ppc64le.s‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
DATA msg+0(SB)/75, $"This image is designed to be run as a confidential workload using libkrun.\n"
2+
3+
GLOBL msg(SB),8,$75
4+
5+
TEXT _start(SB),8-0,$0
6+
MOVD $4, R0 // syscall=write
7+
MOVD $2, R3 // descriptor=2
8+
MOVD $msg(SB), R4 // buffer (msg) address
9+
MOVD $75, R5 // buffer (msg) length
10+
SYSCALL
11+
MOVD $1, R0 // syscall=exit
12+
MOVD $1, R3 // status=1
13+
SYSCALL

0 commit comments

Comments
 (0)