Feature Request: Create variants of the same kernel

andreyv / sbupdate

Generate and sign kernel images for UEFI Secure Boot on Arch Linux

GNU General Public License v3.0

225 stars 20 forks source link

Feature Request: Create variants of the same kernel #16

Closed pschichtel closed 4 years ago

pschichtel commented 4 years ago

I'd like to build different signed EFI executables based on the same kernel image. The use case comes from the fact, that I'm directly booting Linux' EFISTUB without any bootloader in between. I'd like to have variants of my linux-signed.efi, that have different commandlines (e.g. to boot into systemd's emergency.target) or different initrds (e.g. without autodetect for broader hardware support). Currently I can only specify a cmdline per linux* package.

andreyv commented 4 years ago

Support for multiple initramfs is already there, see 479eb88175ca8683eb251492b6d1ecf9e9a392d7 and the INITRD example in the config.

pschichtel commented 4 years ago

Yep I'm aware that I can customize the initrd per kernel image, but I can't have variants of the same kernel image with different variants.

What I would propose as a backwards-compatible change:

Decouple the <name> of the entries from vmlinuz filenames and add an option KERNEL[<name>]="<vmlinuz name>", that defaults to <name>. That way I could describe my EFI executables as such:

CMDLINE[linux]="quiet"
KERNEL[linux-fallback]="linux"
INITRD[linux-fallback]="/boot/initramfs-linux-fallback.img" # (could default to /boot/initramfs-${KERNEL[linux-fallback]})

CMDLINE[linux-lts]="quiet"
KERNEL[linux-lts-fallback]="linux-lts-fallback"

KERNEL[linux-emergency]="linux"
CMDLINE[linux-emergency]="systemd.unit=emergency.target"

pschichtel commented 4 years ago

I'm working in a fork on an implementation of this.

andreyv commented 4 years ago

I'm not sure how useful such feature would be w.r.t. command lines:

If the boot fails, you are automatically dropped into the emergency shell
Failing that, you can temporarily disable secure boot and boot with custom command line, either setting it in firmware or in your EFI shell (a bootloader is not required)
Finally, the same can be done from Arch ISO
There is also an issue of size duplication

With that being said, I like the idea of kernel variants better than having INITRD[<NAME>] be an array like it is currently. I'm working on necessary changes to map kernel versions to kernel names properly (better than e7de1fb31ac6795ef1e1746e5780f84c948f999d), and it may be possible to add such a feature with relatively small code changes.

andreyv commented 4 years ago

WIP is in 7a8df1ae4e819106a22198623585e625216ff7ab (not in master yet). Now you can do

CONFIGS[linux]="linux linux-fallback"

and it will even automatically select the corresponding initramfs for each variant.

pschichtel commented 4 years ago

My kernel cmdlines are very simpified. I main kernel uses available fastboot features, hibernation and is completely silent (except for the LUKS passphrase entry). All other configurations are various fallback configurations that disable various subsets of features in the commandline and possibly use different initcpio profiles. The emergency shell boot has been useful in the past with broken graphics drivers and gnome bugs, where the system would boot "normally", but end up getting stuck due to various bugs. That is why I explicitly setup such a setup to be able to quickly analyze the problem.

I do always carry a archiso with me, but still being able to quickly reboot into another kernel is more convenient. Size has never been an issue for me. I usually allocate 1G for my EFI partitions.

I'll have a look at your feature.

pschichtel commented 4 years ago

Late feedback: I tried your new CONFIGS option and I was able to implement my setup without issues. Also I think you implementation is cleaner and it is backwards compatible. So win-win. Thanks!