[PATCH 0/2] Use native systemd-hwdb at rootfs time

[PATCH 0/2] Use native systemd-hwdb at rootfs time

[Ross Burton]

Hi,

Originally based on work by Daniel Turull but rewritten quite a lot - bugs are
all mine - this builds on top of the systemd patches I sent a few days ago to
build a native systemd-hwdb and then use that at rootfs time, instead of running
the target systemd-hwdb binary inside a qemu.

This needs pseudo master to work, so only works when pseudo has been upgraded.

Ross

Ross Burton (2):
  systemd-tools-native: add systemd-hwdb
  systemd: no need to use qemu for hwdb update

 .../systemd/systemd-tools-native_259.5.bb     | 27 +++++++++----
 ...oot-from-filenames-when-generating-h.patch | 40 +++++++++++++++++++
 meta/recipes-core/systemd/systemd_259.5.bb    |  6 +--
 scripts/postinst-intercepts/update_udev_hwdb  | 18 ++++-----
 4 files changed, 71 insertions(+), 20 deletions(-)
 create mode 100644 meta/recipes-core/systemd/systemd/0001-hwdb-strip-the-root-from-filenames-when-generating-h.patch

-- 
2.43.0

[PATCH 1/2] systemd-tools-native: add systemd-hwdb

[Ross Burton]

Also build systemd-hwdb so that we can generate hwdb.bin at rootfs time
with native code instead of using qemu-user. I've verified that the
hwdb.bin format is word-size and endian agnosic, so we don't need to use
qemu.

Add a patch so that source file names in the hwdb.bin have the rootfs
prefix stripped, so that build paths don't appear in the final image.

This does mean we have to hardcode prefix=/usr sysconfdir=/etc as the
target paths, but systemd effectively mandates these so hopefully this
is not a problem in the real world.

Partially based on work by Daniel Turull.

Signed-off-by: Ross Burton <ross.burton@arm.com>
---
 .../systemd/systemd-tools-native_259.5.bb     | 27 +++++++++----
 ...oot-from-filenames-when-generating-h.patch | 40 +++++++++++++++++++
 2 files changed, 60 insertions(+), 7 deletions(-)
 create mode 100644 meta/recipes-core/systemd/systemd/0001-hwdb-strip-the-root-from-filenames-when-generating-h.patch

diff --git a/meta/recipes-core/systemd/systemd-tools-native_259.5.bb b/meta/recipes-core/systemd/systemd-tools-native_259.5.bb
index d25e36ff3c0..744e874a1a2 100644
--- a/meta/recipes-core/systemd/systemd-tools-native_259.5.bb
+++ b/meta/recipes-core/systemd/systemd-tools-native_259.5.bb
@@ -4,6 +4,8 @@ require systemd.inc
 
 SUMMARY = "native tools from systemd"
 
+SRC_URI += "file://0001-hwdb-strip-the-root-from-filenames-when-generating-h.patch"
+
 # We don't actually need jinja to generate code, but it's checked for at configure time
 DEPENDS = "gperf-native python3-jinja2-native"
 
@@ -12,16 +14,27 @@ inherit pkgconfig meson native
 # Disable everything that is auto-detected by default
 EXTRA_OEMESON += "--auto-features disabled"
 
-# Link systemctl statically
-EXTRA_OEMESON += "-Dlink-systemctl-shared=false"
+# Link the binaries statically as we don't install libsystemd-shared.so
+EXTRA_OEMESON += "-Dlink-systemctl-shared=false -Dlink-udev-shared=false"
 
 # Ensure unused build paths are not in the binary
 EXTRA_OEMESON += "-Dsysvinit-path= -Dsysvrcnd-path="
 
-# Systemctl is supposed to operate on target, but the target sysroot is not
-# determined at run-time, but rather set during configure
-# More details are here https://github.com/systemd/systemd/issues/35897#issuecomment-2665405887
-EXTRA_OEMESON += "--sysconfdir ${sysconfdir_native}"
+# Target-absolute paths that satisfy both tools from one meson configure:
+#  - systemd-hwdb needs prefix=/usr so the compiled-in UDEVLIBEXECDIR
+#    (/usr/lib/udev) matches the target rootfs layout, letting
+#    "update --root $D --usr" find hwdb.d sources and write hwdb.bin there.
+#  - systemctl needs sysconfdir=/etc; it operates on the target rootfs but the
+#    sysroot is fixed at configure time rather than run time.
+#    See https://github.com/systemd/systemd/issues/35897#issuecomment-2665405887
+EXTRA_OEMESON += "--prefix /usr --sysconfdir /etc"
+# TODO libdir?
 
-MESON_TARGET = "systemctl"
+MESON_TARGET = "systemctl systemd-hwdb"
 MESON_INSTALL_TAGS = "systemctl"
+
+do_install:append() {
+    # Can't install this with a tag "hwdb" also tries to install the hwdb
+    # itself, and there's no separate tag for systemd-hwdb.
+    install ${B}/systemd-hwdb ${D}${bindir}/systemd-hwdb
+}
diff --git a/meta/recipes-core/systemd/systemd/0001-hwdb-strip-the-root-from-filenames-when-generating-h.patch b/meta/recipes-core/systemd/systemd/0001-hwdb-strip-the-root-from-filenames-when-generating-h.patch
new file mode 100644
index 00000000000..f11199c553b
--- /dev/null
+++ b/meta/recipes-core/systemd/systemd/0001-hwdb-strip-the-root-from-filenames-when-generating-h.patch
@@ -0,0 +1,40 @@
+From 0031715c560e8138cc320f017a0a2c7160b1f7fe Mon Sep 17 00:00:00 2001
+From: Ross Burton <ross.burton@arm.com>
+Date: Fri, 17 Jul 2026 17:25:31 +0100
+Subject: [PATCH] hwdb: strip the root from filenames when generating hwdb.bin
+
+The modern hwdb.bin format contains the filenames of the input data that
+makes up the database.  This is useful but in offline builds where
+--root is used, the filenames are the full build paths including the
+specified root.  This introduces build paths and thus information
+leakage and non-reproducible data.
+
+Solve this by stripping the root prefix off the original path when
+passing to import_file.
+
+Upstream-Status: Backport [https://github.com/systemd/systemd/pull/43062]
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+---
+ src/shared/hwdb-util.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/shared/hwdb-util.c b/src/shared/hwdb-util.c
+index b42681a289..5386b4e9f4 100644
+--- a/src/shared/hwdb-util.c
++++ b/src/shared/hwdb-util.c
+@@ -632,9 +632,11 @@ int hwdb_update(const char *root, const char *hwdb_bin_dir, bool strict, bool co
+ 
+         FOREACH_ARRAY(i, files, n_files) {
+                 ConfFile *c = *i;
++                char *path_in_root;
+ 
+                 log_debug("Reading file \"%s\" -> \"%s\"", c->original_path, c->resolved_path);
+-                RET_GATHER(ret, import_file(trie, c->fd, c->original_path, file_priority++, compat));
++                path_in_root = path_startswith_full(c->original_path, empty_to_root(root), PATH_STARTSWITH_RETURN_LEADING_SLASH);
++                RET_GATHER(ret, import_file(trie, c->fd, path_in_root, file_priority++, compat));
+         }
+ 
+         strbuf_complete(trie->strings);
+-- 
+2.43.0
+
-- 
2.43.0

[PATCH 2/2] systemd: no need to use qemu for hwdb update

[Ross Burton]

Now that systemd-tools-native gives us a native systemd-hwdb, and the
database format is known to be hardware-agnostic, we can simply run
systemd-hwdb directly instead of running it inside qemu-user if we're
using systemd instead of eudev.

Signed-off-by: Ross Burton <ross.burton@arm.com>
---
 meta/recipes-core/systemd/systemd_259.5.bb   |  6 ++----
 scripts/postinst-intercepts/update_udev_hwdb | 18 +++++++++---------
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/meta/recipes-core/systemd/systemd_259.5.bb b/meta/recipes-core/systemd/systemd_259.5.bb
index 858605d9a4d..0bd67b56523 100644
--- a/meta/recipes-core/systemd/systemd_259.5.bb
+++ b/meta/recipes-core/systemd/systemd_259.5.bb
@@ -915,12 +915,10 @@ pkg_prerm:${PN}:libc-glibc () {
 	fi
 }
 
-PACKAGE_WRITE_DEPS += "qemuwrapper-cross"
-
 pkg_postinst:udev-hwdb () {
 	if test -n "$D"; then
-		$INTERCEPT_DIR/postinst_intercept update_udev_hwdb ${PKG} mlprefix=${MLPREFIX} binprefix=${MLPREFIX} \
-			rootlibexecdir="${nonarch_libdir}" PREFERRED_PROVIDER_udev="${PREFERRED_PROVIDER_udev}" base_bindir="${base_bindir}"
+		$INTERCEPT_DIR/postinst_intercept update_udev_hwdb ${PKG} mlprefix=${MLPREFIX} \
+			PREFERRED_PROVIDER_udev="${PREFERRED_PROVIDER_udev}"
 	else
 		systemd-hwdb update
 	fi
diff --git a/scripts/postinst-intercepts/update_udev_hwdb b/scripts/postinst-intercepts/update_udev_hwdb
index 8b3f5de791f..5b84adfe872 100644
--- a/scripts/postinst-intercepts/update_udev_hwdb
+++ b/scripts/postinst-intercepts/update_udev_hwdb
@@ -7,19 +7,19 @@ set -e
 
 case "${PREFERRED_PROVIDER_udev}" in
 	systemd)
-		UDEV_EXTRA_ARGS="--usr"
-		UDEVLIBDIR="${rootlibexecdir}"
-		UDEVADM="${base_bindir}/udevadm"
+		echo Updating HWDB with native systemd-hwdb...
+		systemd-hwdb update --root $D --usr
 		;;
 
 	*)
-		UDEV_EXTRA_ARGS=""
+		echo Updating HWDB with udevadm...
+
 		UDEVLIBDIR="${sysconfdir}"
 		UDEVADM="${bindir}/udevadm"
+
+		rm -f $D${UDEVLIBDIR}/udev/hwdb.bin
+		PSEUDO_UNLOAD=1 ${binprefix}qemuwrapper -L $D $D${UDEVADM} hwdb --update --root $D ||
+			PSEUDO_UNLOAD=1 qemuwrapper -L $D $D${UDEVADM} hwdb --update --root $D
+		chown root:root $D${UDEVLIBDIR}/udev/hwdb.bin
 		;;
 esac
-
-rm -f $D${UDEVLIBDIR}/udev/hwdb.bin
-PSEUDO_UNLOAD=1 ${binprefix}qemuwrapper -L $D $D${UDEVADM} hwdb --update --root $D ${UDEV_EXTRA_ARGS} ||
-	PSEUDO_UNLOAD=1 qemuwrapper -L $D $D${UDEVADM} hwdb --update --root $D ${UDEV_EXTRA_ARGS}
-chown root:root $D${UDEVLIBDIR}/udev/hwdb.bin
-- 
2.43.0

Re: [OE-core] [PATCH 2/2] systemd: no need to use qemu for hwdb update

[Mathieu Dubois-Briand]

On Tue Jul 21, 2026 at 6:15 PM CEST, Ross Burton via lists.openembedded.org wrote:
> Now that systemd-tools-native gives us a native systemd-hwdb, and the
> database format is known to be hardware-agnostic, we can simply run
> systemd-hwdb directly instead of running it inside qemu-user if we're
> using systemd instead of eudev.
>
> Signed-off-by: Ross Burton <ross.burton@arm.com>
> ---

Hi Ross,

Thanks for your patch.

It looks like we have postinstall failures:
ERROR: core-image-full-cmdline-1.0-r0 do_rootfs: The postinstall intercept hook 'update_udev_hwdb' failed, details in /srv/pokybuild/yocto-worker/genericarm64-alt/build/build/tmp/work/genericarm64-poky-linux/core-image-full-cmdline/1.0/temp/log.do_rootfs

I don't see more logs so far, but it does seem to happen on most build
configurations.

https://autobuilder.yoctoproject.org/valkyrie/#/builders/9/builds/4148
https://autobuilder.yoctoproject.org/valkyrie/#/builders/10/builds/4165
https://autobuilder.yoctoproject.org/valkyrie/#/builders/22/builds/4190
...

Can you have a look at the issue?

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [OE-core] [PATCH 2/2] systemd: no need to use qemu for hwdb update

[Ross Burton]

On 22 Jul 2026, at 06:41, Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> wrote:
> 
> On Tue Jul 21, 2026 at 6:15 PM CEST, Ross Burton via lists.openembedded.org wrote:
>> Now that systemd-tools-native gives us a native systemd-hwdb, and the
>> database format is known to be hardware-agnostic, we can simply run
>> systemd-hwdb directly instead of running it inside qemu-user if we're
>> using systemd instead of eudev.
>> 
>> Signed-off-by: Ross Burton <ross.burton@arm.com>
>> ---
> 
> Hi Ross,
> 
> Thanks for your patch.
> 
> It looks like we have postinstall failures:
> ERROR: core-image-full-cmdline-1.0-r0 do_rootfs: The postinstall intercept hook 'update_udev_hwdb' failed, details in /srv/pokybuild/yocto-worker/genericarm64-alt/build/build/tmp/work/genericarm64-poky-linux/core-image-full-cmdline/1.0/temp/log.do_rootfs

I should have pinged you directly, these patches rely on a pseudo update.  I sent these before the pseudo update for review and so the systemd update can be rebased.

I’ll check the fails to make sure they’re what I expect, but sorry for breaking your build!

Ross