Repository navigation
composefs: Use an XBOOTLDR partition with systemd-boot - #2573
Open
krissedout wants to merge 2 commits into
Open
krissedout wants to merge 2 commits into
krissedout wants to merge 2 commits into
Conversation
Prep for writing composefs boot entries to an Extended Boot Loader Partition next to the ESP. Only VFAT partitions count, since the firmware has to read what's on them; an ext4 /boot that's typed as XBOOTLDR for GRUB is left alone. Assisted-by: AI Signed-off-by: Kristof Imeri <kristof@lanth.me>
The Boot Loader Specification lets systemd-boot read Type bootc-dev#1 entries and UKIs from an Extended Boot Loader Partition (XBOOTLDR) on the ESP's disk. The composefs backend always wrote them to the ESP, which doesn't work when the ESP is small. That's the usual case next to Windows: its ESP is often 100 MB, a UKI with a full initramfs can be bigger than that, and composefs keeps the booted, staged and rollback ones side by side. With systemd-boot, use a VFAT XBOOTLDR partition next to the ESP when there is one for UKIs, BLS entries and their kernels and initramfs images, when installing, upgrading and in BootedStorage, which rollback, finalize and GC go through. When booted, that's the partition next to the ESP named by LoaderDevicePartUUID. The bootloader and loader.conf, which systemd-boot only reads from the ESP, stay there. GRUB keeps its own /boot handling, and grub-cc is left alone since it's unclear whether it reads XBOOTLDR. The new tmt test splits the VM's ESP into a 100 MiB ESP and an XBOOTLDR partition, then switches, upgrades and rolls back. Assisted-by: AI Signed-off-by: Kristof Imeri <kristof@lanth.me>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Boot Loader Specification lets systemd-boot read Type #1 entries and UKIs from an Extended Boot Loader Partition (XBOOTLDR) on the ESP's disk. The composefs backend always writes them to the ESP, which doesn't work when the ESP is small. That's the usual case when installing next to Windows: its ESP is often 100 MB, a UKI with a full initramfs can be bigger than that, and composefs keeps the booted, staged and rollback ones side by side.
With systemd-boot, bootc now looks for a VFAT XBOOTLDR partition next to the ESP and, if there is one, puts the UKIs, BLS entries and their kernels and initramfs images there: on install, on upgrade, and through BootedStorage for rollback, finalize and GC. When booted, it uses the XBOOTLDR partition next to the ESP named by LoaderDevicePartUUID. The boot loader and loader.conf, which systemd-boot only reads from the ESP, stay on the ESP. Systems without an XBOOTLDR partition behave as before. GRUB keeps its own /boot handling, and grub-cc is left alone since I couldn't confirm it reads XBOOTLDR. Only VFAT partitions are used, so an ext4 /boot typed as XBOOTLDR for GRUB keeps working as it does now.
We use this in Luft, a bootc-based desktop that boots sealed UKIs through shim and systemd-boot, where we've carried it as a patch on 1.16.13. There it's been tested with Secure Boot on: installing with bootc install to-filesystem next to a Windows-style 100 MB ESP with a 2 GB XBOOTLDR partition, booting, upgrading and rolling back. The ESP only gets the boot loader, and Windows' files on it are untouched.
On this branch, just validate and just unit-tests pass, including a table-driven test for the XBOOTLDR lookup. The new tmt test, test-61-composefs-xbootldr, shrinks the VM's ESP to 100 MiB, puts a VFAT XBOOTLDR partition in the space that frees, moves bootc's entries there, then switches, upgrades and rolls back. It checks that the entries and binaries are on the XBOOTLDR partition, that GC keeps exactly what the entries refer to, and that bootc writes nothing to the ESP. It passes with systemd-boot for both BLS entries and unsealed UKIs on centos-bootc stream10, and skips itself with GRUB. My libvirt has no storage driver, so rather than through just test-tmt I ran the same script stage by stage in a qemu VM installed with bcvk to-disk.
Out of scope: bootc install to-disk doesn't create an XBOOTLDR partition, so this is for install to-filesystem setups where the installer lays out the disk. bootctl install still only gets the ESP, without --boot-path, since bootc writes the entries itself.
Assisted-by: AI
I reviewed and tested the changes myself.