Re: [cip-dev][isar-cip-core][PATCH v2 00/12] Add darcut initramfs for CIP Core

[Quirin Gylstorff <quirin.gylstorff@siemens.com>]

On 10/26/26 4:44 AM, Jan Kiszka wrote:
> On 19.10.26 18:25, Quirin Gylstorff wrote:
>> This series adds the necessary recipes and configuration to build a
>> dracut initramfs for CIP Core. The initramfs is used to boot the system
>> with a read-only root filesystem, and provides support for features
>> such as dm-verity, factory reset, and watchdog.
>>
>> The code for these dracut modules will be stored in a a separate
>> repository the make the maintenance easier. The repository is located
>> for the RFC at
>> https://gitlab.com/cip-playground/embedded-dracut-modules.
>>
>> I will use force push on this repository until the development is
>> settled.
>>
>> It only supports Debian trixie and later, as it uses systemd for the initramfs.
>>
>> I tested it only with the isar-cip-core build it should also work with
>> downsteam layers. Please test it and report any issues.
>>
>> Changes since RFC:
>> - Added a patch to load the watchdog drivers early in the initramfs
>>    this is needed to load the iTCO_wdt driver for kernels if the watchdog driver
>>    is not built in.
>> - Allow verity based rootfs with secure boot disabled. This allows to drop abrootfs
>>    for systems with dracut based initramfs. Also in case abortfs_root=y
>>    is set together with dracut the wic plugin will automatically generate the verity
>>    based kernel commandline.
>> - wic drop adding panic=5 to cmdline if dracut is used.
>>
>>
>> Quirin Gylstorff (12):
>>    swupdate: add RO_ROOTFS_VERITY to select a dm-verity rootfs
>>    efibootguard-boot: emit systemd verity cmdline for dracut
>>    wic: select the A/B rootfs image via WIC_ROOTFS_IMAGE_TYPE
>>    embedded-dracut-modules: add recipe
>>    dracut-config-cip-*: add build configuration packages
>>    factory-reset-helper-efi: use systemd FactoryReset variable with
>>      dracut
>>    cip-core-initramfs-dracut: add dracut initramfs
>>    watchdog: use the rootfs systemd watchdog timeout in the dracut initrd
>>    Kconfig: add option to generate initramfs with dracut
>>    read-only-rootfs: check dracut verity and secure boot settings
>>    doc: document dracut initramfs
>>    cip-core-initramfs-dracut: load watchdog drivers early via force
>>      drivers
>>
>>   Kconfig                                       |  15 +++
>>   classes-recipe/dracut-cip-config.bbclass      |  54 +++++++++
>>   classes-recipe/read-only-rootfs.bbclass       |  25 +++-
>>   classes-recipe/swupdate.bbclass               |   3 +-
>>   conf/distro/cip-core-common.inc               |   8 ++
>>   conf/machine/qemu-amd64.conf                  |   3 +
>>   doc/README.dracut.md                          | 111 ++++++++++++++++++
>>   doc/README.factory-reset.md                   |  46 ++++++++
>>   doc/README.secureboot.md                      |  10 +-
>>   ...acut-module-add-DRACUT_FORCE_DRIVERS.patch | 107 +++++++++++++++++
>>   kas-cip.yml                                   |   4 +
>>   kas/opt/dracut.yml                            |  17 +++
>>   kas/opt/ebg-secure-boot-snakeoil.yml          |   3 +-
>>   recipes-core/customizations/common.inc        |   7 +-
>>   .../customizations/files/99-watchdog.conf     |   6 -
>>   .../files/99-watchdog.conf.tmpl               |   6 +
>>   recipes-core/images/swupdate.inc              |   1 +
>>   .../cip-core-initramfs-dracut.bb              |  46 ++++++++
>>   .../cip-core-initramfs/cip-core-initramfs.bb  |   4 +-
>>   .../dracut-cip-force-drivers_0.1.bb           |  17 +++
>>   .../dracut-config-cip-crypt_0.1.bb            |  86 ++++++++++++++
>>   .../dracut-config-cip-crypt/files/postinst    |  10 ++
>>   .../dracut-config-cip-factory-reset_0.1.bb    |  49 ++++++++
>>   .../dracut-config-cip-overlay_0.1.bb          |  44 +++++++
>>   .../dracut-config-cip-verity_0.1.bb           |  23 ++++
>>   .../dracut-config-cip-watchdog_0.1.bb         |  30 +++++
>>   .../embedded-dracut-modules_0.1.bb            |  21 ++++
>>   .../factory-reset-helper-efi_0.1.bb           |   5 +-
>>   .../wic/plugins/source/efibootguard-boot.py   |  67 ++++++++++-
>>   wic/bbb-efibootguard.wks.in                   |   2 +-
>>   wic/beaglev-fire-efibootguard.wks.in          |   2 +-
>>   wic/de0-nano-soc-efibootguard.wks.in          |   2 +-
>>   wic/hihope-rzg2m-efibootguard.wks.in          |   2 +-
>>   wic/qemu-arm64-efibootguard-secureboot.wks.in |   2 +-
>>   wic/qemu-arm64-efibootguard.wks.in            |   2 +-
>>   wic/qemu-riscv64-efibootguard.wks.in          |   2 +-
>>   wic/rzt2h-evk-efibootguard.wks.in             |   2 +-
>>   ...i-am62px-sk-efibootguard-secureboot.wks.in |   2 +-
>>   wic/ti-am62px-sk-efibootguard.wks.in          |   2 +-
>>   wic/x86-uefi-efibootguard-secureboot.wks.in   |   2 +-
>>   wic/x86-uefi-efibootguard.wks.in              |   2 +-
>>   41 files changed, 811 insertions(+), 41 deletions(-)
>>   create mode 100644 classes-recipe/dracut-cip-config.bbclass
>>   create mode 100644 doc/README.dracut.md
>>   create mode 100644 isar-patches/0001-dracut-module-add-DRACUT_FORCE_DRIVERS.patch
>>   create mode 100644 kas/opt/dracut.yml
>>   delete mode 100644 recipes-core/customizations/files/99-watchdog.conf
>>   create mode 100644 recipes-core/customizations/files/99-watchdog.conf.tmpl
>>   create mode 100644 recipes-initramfs/cip-core-initramfs-dracut/cip-core-initramfs-dracut.bb
>>   create mode 100644 recipes-initramfs/dracut-cip-force-drivers/dracut-cip-force-drivers_0.1.bb
>>   create mode 100644 recipes-initramfs/dracut-config-cip-crypt/dracut-config-cip-crypt_0.1.bb
>>   create mode 100644 recipes-initramfs/dracut-config-cip-crypt/files/postinst
>>   create mode 100644 recipes-initramfs/dracut-config-cip-factory-reset/dracut-config-cip-factory-reset_0.1.bb
>>   create mode 100644 recipes-initramfs/dracut-config-cip-overlay/dracut-config-cip-overlay_0.1.bb
>>   create mode 100644 recipes-initramfs/dracut-config-cip-verity/dracut-config-cip-verity_0.1.bb
>>   create mode 100644 recipes-initramfs/dracut-config-cip-watchdog/dracut-config-cip-watchdog_0.1.bb
>>   create mode 100644 recipes-initramfs/embedded-dracut-modules/embedded-dracut-modules_0.1.bb
>>
> 
> Should I wait for v3 to review, or are you waiting for me to review
> before creating a v3? :)

If you have time you can review the v2 ;-D. I would like to have some 
feed back for the v3 - especially if somebody tested it with out me 
helping.

Quirin
> 
> Jan
>