[Buildroot] Hybrid UEFI-Only CD-ROM image with systemd-boot

[Buildroot] Hybrid UEFI-Only CD-ROM image with systemd-boot

[Thomas Kindler]

Hi!

I'm using Buildroot 2024.05.2 to build a PREEMPT-RT system for an
UEFI-Only x86-64 industrial server PC.

I'm using systemd as the init system with systemd-boot as the bootloader.
The root file system is compiled into the linux kernel by using
BR2_TARGET_ROOTFS_INITRAMFS.

I generate an UEFI-Bootable usbstick.img containing a single efi-part.vfat
partition with the following contents:

$ tree efi-part --charset X
efi-part
|-- bzImage -> /home/myuser/os74000/output/images/bzImage
|-- EFI
|   |-- BOOT
|   |   |-- bootx64.efi
|   |   `-- memtest.efi -> /home/myuser/os74000/output/images/memtest.efi
|   |-- Linux
|   `-- systemd
|       `-- systemd-bootx64.efi ->
/home/myuser/os74000/output/target/usr/lib/systemd/boot/efi/systemd-bootx64.efi
|-- loader
|   |-- entries
|   |   |-- memtest.conf
|   |   `-- usbstick.conf
|   `-- loader.conf
`-- shellx64.efi ->
/home/myuser/os74000/buildroot-external/board/pc/shellx64.efi

7 directories, 8 files


This usbstick.img works great.


Unfortunately, one of our server-BMCs only supports virtual CD-ROM images.

Buildroot does not seem to have an official option to build those when
using systemd-boot. BR2_TARGET_ROOTFS_ISO9660 is only available when
isolinux is used.

So I do my own image generation following instructions from

https://wiki.syslinux.org/wiki/index.php?title=Isohybrid#UEFI

My post-image.sh contains these lines:


rm -f $BINARIES_DIR/*-cdrom.iso
mkdir -p $BINARIES_DIR/cdrom

cp $BINARIES_DIR/efi-part.vfat $BINARIES_DIR/cdrom
cp $BINARIES_DIR/syslinux/isolinux.bin $BINARIES_DIR/cdrom

xorriso -as mkisofs \
  -o $BINARIES_DIR/cdrom.iso \
  -isohybrid-mbr $HOST_DIR/usr/share/syslinux/isohdpfx.bin \
  -eltorito-catalog boot.cat \
  -eltorito-boot isolinux.bin -no-emul-boot -boot-load-size 4
-boot-info-table \
  -eltorito-alt-boot -e efi-part.vfat -no-emul-boot \
  -isohybrid-gpt-basdat \
  $BINARIES_DIR/cdrom


The resulting cdrom.iso image works fine when mounted as a (virtual) CD-ROM.

But it does not work correctly when dd-copied to an USB stick!

The partition table looks like this:

$ fdisk -l cdrom.iso
Disk cdrom.iso: 129 MiB, 135266304 bytes, 264192 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x3a388812

Device     Boot Start    End Sectors  Size Id Type
cdrom.iso1 *        0 264191  264192  129M  0 Empty
cdrom.iso2        136 262207  262072  128M ef EFI (FAT-12/16/32)


The UEFI-BIOS will actually load systemd-boot from such an USB stick.
And systemd-boot will load the bzImage.

BUT: systemd-boot does not set 
LoaderDevicePartUUID-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f, as it does when
booting from my normal usbstick.img.

This trips up my /sbin/init script, which has to decide if /boot has to be
mounted from /dev/sr0 + loop back mount of efi-part.vfat, or from the
given EFI var.


When inserting the dd-copied stick, it will show up as:

  /dev/sda1 - containing the useless CD-ROM contents as an ISO9660 file
system
  /dev/sda2 - what i actually need -- my EFI FAT partition contents!


So my questions are:

1) How can I get xorriso to generate an image with only the EFI partition?

- I can not use fdisk to remove partition 1, because it will "remove the
iso9660 signature" on write.

2) Shouldn't xorriso generate a GPT table? fdisk says "Disklabel type: dos"

3) Why do I need isohdpfx.bin and isolinux.bin at all?!
I only want to support UEFI systems, and this seems to be legacy BIOS
related?


best regards,
-- 
Thomas Kindler <mail_buildroot@t-kindler.de>
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] Hybrid UEFI-Only CD-ROM image with systemd-boot

[Thomas Schmitt via buildroot]

Hi,

consider to Cc: bug-xorriso@gnu.org when asking xorriso questions.


> 1) How can I get xorriso to generate an image with only the EFI partition?

If all is in the EFI partition, you want GPT, and want to avoid nested
partitions, try with an appended partition attached to a minimal ISO with
a dummy file (here: README).

  # There is no need to have $BINARIES_DIR/cdrom

  echo "No payload data in this ISO 9660 filesystem" >README

  xorriso -as mkisofs \
      -o "$BINARIES_DIR"/cdrom.iso \
      -eltorito-catalog boot.cat \
      -appended_part_as_gpt \
      -partition_offset 16 \
      -append_partition 2 0xef "$BINARIES_DIR"/efi-part.vfat \
      -e --interval:appended_partition_2:all:: \
        -no-emul-boot \
      -no-pad \
      README

The resulting .iso then yields with fdisk -l something like:

  Disklabel type: gpt
  Disk identifier: 402F6C62-D96C-4257-B9A8-A4E20CD84888

  Device     Start   End Sectors Size Type
  cdrom.iso1    64   203     140  70K Microsoft basic data
  cdrom.iso2   204 20555   20352  10M EFI System

Partition 1 is mountable and represents the same ISO 9660 file tree
as the base device. (This comes at the expense of two superblocks
and two trees of directory records in the ISO.)

The EFI partition is outside of the ISO 9660 filesystem of partition 1.
Nevertheless the ISO 9660 filesystem of the base device claims the size
up to the end of partition 2.
So in the case of virtual CDROM, the EFI partition in its role as
El Torito boot image appears as hidden file of the CDROM's ISO 9660
filesystem.

  $ xorriso -indev cdrom.iso -report_el_torito plain
  ...
  El Torito catalog  : 49  1
  El Torito cat path : /boot.catalog
  El Torito images   :   N  Pltf  B   Emul  Ld_seg  Hdpt  Ldsiz         LBA
  El Torito boot img :   1  UEFI  y   none  0x0000  0x00  20352          51
  El Torito img blks :   1  5088


> 2) Shouldn't xorriso generate a GPT table? fdisk says "Disklabel type: dos"
>
> 3) Why do I need isohdpfx.bin and isolinux.bin at all?!
> I only want to support UEFI systems, and this seems to be legacy BIOS
> related?

You probably follow the Mac-less renarration of xorriso's implementation
of a Fedora isohybrid layout originally created by the ISOLINUX program
named "isohybrid":
  http://mjg59.dreamwidth.org/11285.html
  "Anatomy of a Fedora 17 ISO image"
  by Matthew Garret, May 2012

It works by an MBR partition table ("dos"), but also contains a GPT header
block (not announced by the MBR partition table). The GPT header has the
purpose to lure EFI firmwares which do not consider drives whithout GPT.
For some pre-EFI-but-already-x86 Macs there is an Apple Partition Map
with partitions pointing to the EFI image and a small HFS+ image.

Your xorriso run omits the production of the Apple partition map.
Debian uses a similar layout for its installation ISOs.
It yields good boot success but is hard to digest for partition editors.


Have a nice day :)

Thomas

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] Hybrid UEFI-Only CD-ROM image with systemd-boot

[Thomas Kindler]

On Thu, November 7, 2024 08:09, Thomas Schmitt via buildroot wrote:

Thanks for your great answer!

>
> consider to Cc: bug-xorriso@gnu.org when asking xorriso questions.
>

Can do - I'll CC this mail, so other people know that there's a xorriso
thread on the buildroot mailing list.

>> [..]
>> 1) How can I get xorriso to generate an image with only the EFI
>> partition?
>
> If all is in the EFI partition, you want GPT, and want to avoid nested
> partitions, try with an appended partition attached to a minimal ISO with a
> dummy file (here: README).
>
> # There is no need to have $BINARIES_DIR/cdrom
>
>
> echo "No payload data in this ISO 9660 filesystem" >README
>
> xorriso -as mkisofs \ -o "$BINARIES_DIR"/cdrom.iso \
> -eltorito-catalog boot.cat \
> -appended_part_as_gpt \
> -partition_offset 16 \
> -append_partition 2 0xef "$BINARIES_DIR"/efi-part.vfat \
> -e --interval:appended_partition_2:all:: \
> -no-emul-boot \
> -no-pad \
> README
>
>
> The resulting .iso then yields with fdisk -l something like:
>
>
> Disklabel type: gpt
> Disk identifier: 402F6C62-D96C-4257-B9A8-A4E20CD84888
>
>
> Device     Start   End Sectors Size Type
> cdrom.iso1    64   203     140  70K Microsoft basic data
> cdrom.iso2   204 20555   20352  10M EFI System
>
>

Is there a way to generate only one partition?
That way it would look like a normal USB stick.

As a workaround I use sgdisk:

# Remove partition 1, swap 1 and 2, rename to "esp", print
#
sgdisk -d1 -r1:2 -c1:esp -p $BINARIES_DIR/cdrom.iso


But a xorriso-only solution would be best.


best regards,
-- 
Thomas Kindler <mail_buildroot@t-kindler.de>

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] Hybrid UEFI-Only CD-ROM image with systemd-boot

[Thomas Schmitt via buildroot]

Hi,

Thomas Kindler wrote:
> Is there a way to generate only one partition?

Not with GPT.
The man page promises this to happen with -append_partition 1 for MBR
partitions. But this does not work with GPT partitions.
man 1 xorriso:

  -append_partition partition_number type_code disk_path
      ...
      With MBR:
      partition_number may be 1 to 4. Number 1 will put the whole  ISO
      image  into  the unclaimed space before partition 1.
      ...
      GPT can be forced by
        -boot_image "any" "appended_part_as=gpt"
      partition_number may  be  1  to  8.  But  other  than  with  MBR
      partitions it is not guaranteed that the resulting GPT partition
      will have this number.
      More important than the desired partition number  will  be  that
      the resulting ISO filesystem is covered gaplessly with GPT table
      and its partitions and that the  partitions  in  the  table  are
      sorted  by block address.

(-boot_image "any" "appended_part_as=gpt" is in the native command set of
 xorriso the equivalent of -as "mkisofs" option -appended_part_as_gpt.)

Experiments:

  xorriso -as mkisofs \ -o "$BINARIES_DIR"/cdrom.iso \
  -eltorito-catalog boot.cat \
  -appended_part_as_gpt \
  -partition_offset 16 \
  -append_partition 1 0xef "$BINARIES_DIR"/efi-part.vfat \
  -e --interval:appended_partition_1:all:: \
  -no-emul-boot \
  -no-pad \
  README

still yields with fdisk:

  Disklabel type: gpt
  Disk identifier: 02ACD30B-A5C2-47E6-8273-DA83B6BF77AA

  Device     Start   End Sectors Size Type
  cdrom.iso1    64   139      76  38K Microsoft basic data
  cdrom.iso2   140 20491   20352  10M EFI System

If i omit option -appended_part_as_gpt i get:

  Disklabel type: dos
  Disk identifier: 0x00000000

  Device     Boot Start   End Sectors Size Id Type
  cdrom.iso1        140 20491   20352  10M ef EFI (FAT-12/16/32)


I will investigate whether the GPT partition number can be forced to
the number given by the user. But i am not optimistic about this.
The rule of having gapless GPT stems from work done for grub-mkrescue
over a decade ago. I would have to find out whether this demand of
Vladimir Serbinko is purely esthetic or has a hard reason.


Have a nice day :)

Thomas

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot