[isar-cip-core][RFC][PATCH 00/10] Provide A/B snapshot support for persistent /var

[isar-cip-core][RFC][PATCH 00/10] Provide A/B snapshot support for persistent /var

[Jan Kiszka]

This is a first attempt to provide a pattern and reusable recipes for
saving and rolling back the persistent data during A/B updates. The
obvious approach is using a filesystem that supports snapshots and
linking those to the rootfs revision that is being booted. As first
implementation, we are using btrfs. While the current implementation is
built around btrfs, the concept should not. It may even work with
device mapper snapshots.

That said, the devil is always in the details. And even this "simple",
btrfs-only implementation took some rounds to find a logic that neither
piles up obsolete snapshots or deletes them prematurely. Still, careful
review is highly welcome, specifically of patch 3.

As we are currently having split /var and /home partitions, this does
not cover anything in home directories. However, this will automatically
change when [1] is addressed.

Jan

[1] https://gitlab.com/cip-project/cip-core/isar-cip-core/-/issues/123

Jan Kiszka (10):
  initramfs-crypt-hook: Add support for btrfs
  initramfs-crypt-hook: Bump revision
  initramfs: Add hook for managing /var in A/B fashion
  initramfs-overlay-hook: Optimize variable initialization
  initramfs-overlay-hook: Tune the parameter documentation
  initramfs-overlay-hook: Add awareness for abvar hook
  initramfs-overlay-hook: Bump revision
  swupdate: Make var filesystem type configurable for update images
  swupdate: Activate abvar initramfs hook when VAR_FS_TYPE is set to
    btrfs
  Enable A/B snapshot for /var on x86 and qemu-arm64

 classes/swupdate.bbclass                      |  1 +
 conf/machine/qemu-amd64.conf                  |  5 +-
 conf/machine/qemu-arm64.conf                  |  5 +-
 conf/machine/x86-uefi.conf                    |  5 +-
 kas/opt/ebg-swu.yml                           |  6 +-
 kas/opt/swupdate.yml                          |  1 +
 .../cip-core-initramfs/cip-core-initramfs.bb  |  3 +-
 .../files/local-bottom.tmpl                   | 86 +++++++++++++++++++
 .../initramfs-abvar-hook_0.1.bb               | 31 +++++++
 .../files/local-top-complete                  |  7 ++
 ...ook_0.5.bb => initramfs-crypt-hook_0.6.bb} |  6 ++
 .../files/local-bottom.tmpl                   | 10 ++-
 ...k_0.2.bb => initramfs-overlay-hook_0.3.bb} |  8 +-
 wic/bbb-efibootguard.wks.in                   |  2 +-
 wic/hihope-rzg2m-efibootguard.wks.in          |  2 +-
 wic/qemu-arm64-efibootguard-secureboot.wks.in |  2 +-
 wic/qemu-arm64-efibootguard.wks.in            |  2 +-
 wic/qemu-riscv64-efibootguard.wks.in          |  2 +-
 wic/x86-uefi-efibootguard-secureboot.wks.in   |  2 +-
 wic/x86-uefi-efibootguard.wks.in              |  2 +-
 20 files changed, 168 insertions(+), 20 deletions(-)
 create mode 100644 recipes-initramfs/initramfs-abvar-hook/files/local-bottom.tmpl
 create mode 100644 recipes-initramfs/initramfs-abvar-hook/initramfs-abvar-hook_0.1.bb
 rename recipes-initramfs/initramfs-crypt-hook/{initramfs-crypt-hook_0.5.bb => initramfs-crypt-hook_0.6.bb} (93%)
 rename recipes-initramfs/initramfs-overlay-hook/{initramfs-overlay-hook_0.2.bb => initramfs-overlay-hook_0.3.bb} (87%)

-- 
2.43.0

[isar-cip-core][RFC][PATCH 01/10] initramfs-crypt-hook: Add support for btrfs

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

Add the required bits to support reencryption of btrfs, thus resizing.
To avoid bloating the initramfs if this filesystem is not used, make it
opt-in.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 .../initramfs-crypt-hook/files/local-top-complete          | 7 +++++++
 .../initramfs-crypt-hook/initramfs-crypt-hook_0.5.bb       | 6 ++++++
 2 files changed, 13 insertions(+)

diff --git a/recipes-initramfs/initramfs-crypt-hook/files/local-top-complete b/recipes-initramfs/initramfs-crypt-hook/files/local-top-complete
index 8adc4e58..54b8a6e0 100644
--- a/recipes-initramfs/initramfs-crypt-hook/files/local-top-complete
+++ b/recipes-initramfs/initramfs-crypt-hook/files/local-top-complete
@@ -85,6 +85,13 @@ EOF
 			panic "reencryption of partition $1 cannot continue - resizing of the partition failed!"
 		fi
 		;;
+	btrfs)
+		mkdir /.mnt-tmp
+		mount -t btrfs "$1" /.mnt-tmp
+		btrfs filesystem resize "${reduced_size_in_kb}" /.mnt-tmp
+		umount /.mnt-tmp
+		rmdir /.mnt-tmp
+		;;
 	squashfs|swap|erofs|"")
 		[ "$debug" = "y" ] && echo "skip disk resize as it is not supported or unnecessary for fstype: '$partition_fstype'"
 		;;
diff --git a/recipes-initramfs/initramfs-crypt-hook/initramfs-crypt-hook_0.5.bb b/recipes-initramfs/initramfs-crypt-hook/initramfs-crypt-hook_0.5.bb
index 71ee44db..df335c9f 100644
--- a/recipes-initramfs/initramfs-crypt-hook/initramfs-crypt-hook_0.5.bb
+++ b/recipes-initramfs/initramfs-crypt-hook/initramfs-crypt-hook_0.5.bb
@@ -82,6 +82,8 @@ INITRAMFS_WATCHDOG_DEVICE ??= "/dev/watchdog"
 CRYPT_HASH_TYPE ??= "sha256"
 CRYPT_KEY_ALGORITHM ??= "ecc"
 CRYPT_ENCRYPTION_OPTIONAL ??= "false"
+# add support for btrfs encryption
+CRYPT_BTRFS_SUPPORT ??= "0"
 
 TEMPLATE_VARS += "CRYPT_PARTITIONS CRYPT_CREATE_FILE_SYSTEM_CMD \
     CRYPT_SETUP_TIMEOUT INITRAMFS_WATCHDOG_DEVICE CRYPT_HASH_TYPE \
@@ -92,6 +94,10 @@ OVERRIDES .= "${@':expand-on-crypt' if ':expand' in d.getVar('CRYPT_PARTITIONS')
 DEBIAN_DEPENDS:append:expand-on-crypt = ", fdisk, util-linux"
 HOOK_COPY_EXECS:append:expand-on-crypt = " sed sfdisk tail cut dd partx rm"
 
+OVERRIDES .= "${@':btrfs-support' if bb.utils.to_boolean(d.getVar('CRYPT_BTRFS_SUPPORT')) else ''}"
+DEBIAN_DEPENDS:append:btrfs-support = ", btrfs-progs"
+HOOK_COPY_EXECS:append:btrfs-support = " mkdir rmdir btrfs"
+
 do_install[cleandirs] += "${D}/usr/share/encrypt_partition"
 do_install:prepend() {
     install -m 0600 "${WORKDIR}/encrypt_partition.env" "${D}/usr/share/encrypt_partition/encrypt_partition.env"
-- 
2.43.0

[isar-cip-core][RFC][PATCH 02/10] initramfs-crypt-hook: Bump revision

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

Recent commits modified the recipe in a way that justifies a bump.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 .../{initramfs-crypt-hook_0.5.bb => initramfs-crypt-hook_0.6.bb}  | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename recipes-initramfs/initramfs-crypt-hook/{initramfs-crypt-hook_0.5.bb => initramfs-crypt-hook_0.6.bb} (100%)

diff --git a/recipes-initramfs/initramfs-crypt-hook/initramfs-crypt-hook_0.5.bb b/recipes-initramfs/initramfs-crypt-hook/initramfs-crypt-hook_0.6.bb
similarity index 100%
rename from recipes-initramfs/initramfs-crypt-hook/initramfs-crypt-hook_0.5.bb
rename to recipes-initramfs/initramfs-crypt-hook/initramfs-crypt-hook_0.6.bb
-- 
2.43.0

[isar-cip-core][RFC][PATCH 03/10] initramfs: Add hook for managing /var in A/B fashion

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

This hook manages snapshots of the filesystem backing /var in an A/B
way, aligned with rootfs instances. That means when an new version is
first booted in testing mode (EFI Boot Guard ustate=2), a snapshot of
the current version is taken before that snapshot is mounted as /var.
On rollback, the previous version will still be available and will be
used again. After committing a new version, garbage collection of the
previous snapshot is happening on next boot.

This first version of the hook is written around EFI Boot Guard as A/B
boot manager and btrfs as mechanism (here in form of a filesystem) to
create and manage snapshots with low overhead. Other implementations
are imaginable and would only require small refactorings to enable them
as configurable alternatives.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 .../files/local-bottom.tmpl                   | 86 +++++++++++++++++++
 .../initramfs-abvar-hook_0.1.bb               | 31 +++++++
 2 files changed, 117 insertions(+)
 create mode 100644 recipes-initramfs/initramfs-abvar-hook/files/local-bottom.tmpl
 create mode 100644 recipes-initramfs/initramfs-abvar-hook/initramfs-abvar-hook_0.1.bb

diff --git a/recipes-initramfs/initramfs-abvar-hook/files/local-bottom.tmpl b/recipes-initramfs/initramfs-abvar-hook/files/local-bottom.tmpl
new file mode 100644
index 00000000..91b8d017
--- /dev/null
+++ b/recipes-initramfs/initramfs-abvar-hook/files/local-bottom.tmpl
@@ -0,0 +1,86 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens, 2025
+#
+# Authors:
+#  Jan Kiszka <jan.kiszka@siemens.com>
+#
+
+var_device="${INITRAMFS_VAR_DEVICE}"
+var_opts="${INITRAMFS_VAR_MOUNT_OPTIONS}"
+btrfs_mnt="/.var-btrfs"
+snap_prefix="abvar-"
+
+. "${rootmnt}/etc/os-release"
+
+get_default_subvolume()
+{
+	subvol=$(btrfs subvolume get-default "$1" | grep path || true)
+	echo "${subvol##*path }"
+}
+
+ustate_val=$(bg_printenv -c -r -o ustate)
+
+# when in testing state or on first boot, create new snapshot
+if [ "$ustate_val" = "USTATE=2" ] ||
+    ! mount -t btrfs -o "$var_opts,subvol=/$snap_prefix$IMAGE_UUID" \
+	"$var_device" "${rootmnt}/var" 2>/dev/null; then
+	log_begin_msg "Creating new /var snapshot for image $IMAGE_UUID"
+
+	mkdir "$btrfs_mnt"
+	mount -t btrfs -o subvol=/ "$var_device" "$btrfs_mnt"
+
+	# delete any dangling previous snapshot
+	btrfs subvolume delete "$btrfs_mnt/$snap_prefix$IMAGE_UUID" \
+		2>/dev/null || true
+
+	default_subvol=$(get_default_subvolume "$btrfs_mnt")
+	btrfs subvolume snapshot "$btrfs_mnt/$default_subvol" \
+		"$btrfs_mnt/$snap_prefix$IMAGE_UUID"
+
+	umount "$btrfs_mnt"
+	rmdir "$btrfs_mnt"
+
+	log_end_msg
+
+	mount -t btrfs -o "$var_opts,subvol=/$snap_prefix$IMAGE_UUID" \
+		"$var_device" "${rootmnt}/var"
+else
+	default_subvol=$(get_default_subvolume "${rootmnt}/var")
+fi
+
+active_entry=$(btrfs subvolume list -a "${rootmnt}/var" |
+	grep "<FS_TREE>/$snap_prefix$IMAGE_UUID")
+active_id="${active_entry#ID }"
+active_id="${active_id%% *}"
+
+# adjust default subvolume to the active one
+if [ "$default_subvol" != "$snap_prefix$IMAGE_UUID" ]; then
+	log_begin_msg "Adjusting /var subvolume default to $IMAGE_UUID"
+	btrfs subvolume set-default "$active_id" "${rootmnt}/var"
+	log_end_msg
+fi
+
+if [ "$(bg_printenv -c -r -o ustate)" != "USTATE=0" ]; then
+	# still testing the current version, skip cleanup
+	exit 0
+fi
+
+# get rid of obsolete snapshots, ie. everything but the active one
+log_begin_msg "Performing /var snapshot housekeeping"
+
+IFS="
+"
+for entry in $(btrfs subvolume list -aqu "${rootmnt}/var" |
+		grep "<FS_TREE>/$snap_prefix"); do
+	entry_id="${entry#ID }"
+	entry_id="${entry_id%% *}"
+
+	if [ "$entry_id" != "$active_id" ]; then
+		btrfs subvolume delete -i "$entry_id" "${rootmnt}/var"
+	fi
+done
+unset IFS
+
+log_end_msg
diff --git a/recipes-initramfs/initramfs-abvar-hook/initramfs-abvar-hook_0.1.bb b/recipes-initramfs/initramfs-abvar-hook/initramfs-abvar-hook_0.1.bb
new file mode 100644
index 00000000..c7b58243
--- /dev/null
+++ b/recipes-initramfs/initramfs-abvar-hook/initramfs-abvar-hook_0.1.bb
@@ -0,0 +1,31 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens, 2025
+#
+# Authors:
+#  Jan Kiszka <jan.kiszka@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+
+require recipes-initramfs/initramfs-hook/hook.inc
+
+SRC_URI += " \
+    file://local-bottom.tmpl"
+
+# override this to switch to UUID or PARTUUID based mounts
+INITRAMFS_VAR_DEVICE ??= "/dev/disk/by-label/var"
+
+INITRAMFS_VAR_MOUNT_OPTIONS ??= "defaults,nodev,nosuid,noexec"
+
+TEMPLATE_FILES += "local-bottom.tmpl"
+TEMPLATE_VARS += "\
+    INITRAMFS_VAR_DEVICE \
+    INITRAMFS_VAR_MOUNT_OPTIONS"
+
+HOOK_ADD_MODULES = "btrfs"
+HOOK_COPY_EXECS = "btrfs grep rmdir bg_printenv"
+
+DEBIAN_DEPENDS .= ", btrfs-progs, efibootguard"
+
+SCRIPT_PREREQ = "crypt"
-- 
2.43.0

[isar-cip-core][RFC][PATCH 04/10] initramfs-overlay-hook: Optimize variable initialization

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

Move some variables that are only relevant if the storage filesystem
was not mounted yet into the respective branch. This specifically avoids
to uselessly retrieve the filesystem type of the storage.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 .../initramfs-overlay-hook/files/local-bottom.tmpl     | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/recipes-initramfs/initramfs-overlay-hook/files/local-bottom.tmpl b/recipes-initramfs/initramfs-overlay-hook/files/local-bottom.tmpl
index f829a9bb..1087c3f7 100644
--- a/recipes-initramfs/initramfs-overlay-hook/files/local-bottom.tmpl
+++ b/recipes-initramfs/initramfs-overlay-hook/files/local-bottom.tmpl
@@ -8,17 +8,19 @@
 #  Quirin Gylstorff <quirin.gylstorff@siemens.com>
 #
 
-ovl_partition_device="${INITRAMFS_OVERLAY_STORAGE_DEVICE}"
 ovl_storage_path="${INITRAMFS_OVERLAY_STORAGE_PATH}"
 ovl_lower_dirs="${INITRAMFS_OVERLAY_PATHS}"
-ovl_mount_option="${INITRAMFS_OVERLAY_MOUNT_OPTION}"
-ovl_recovery_script="/scripts/${INITRAMFS_OVERLAY_RECOVERY_SCRIPT}"
 
 root_mount_storage=${rootmnt}${ovl_storage_path}
 storage_mount_point="$(echo "${ovl_storage_path}" | awk -F/ '{print FS$2}' )"
-partition_fstype=$(get_fstype "${ovl_partition_device}")
 
 if ! mountpoint -q "${rootmnt}${storage_mount_point}"; then
+	ovl_partition_device="${INITRAMFS_OVERLAY_STORAGE_DEVICE}"
+	ovl_mount_option="${INITRAMFS_OVERLAY_MOUNT_OPTION}"
+	ovl_recovery_script="/scripts/${INITRAMFS_OVERLAY_RECOVERY_SCRIPT}"
+
+	partition_fstype=$(get_fstype "${ovl_partition_device}")
+
 	case $partition_fstype in
 	ext*)
 		e2fsck -p -f "$ovl_partition_device"
-- 
2.43.0

[isar-cip-core][RFC][PATCH 05/10] initramfs-overlay-hook: Tune the parameter documentation

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 .../initramfs-overlay-hook/initramfs-overlay-hook_0.2.bb    | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/recipes-initramfs/initramfs-overlay-hook/initramfs-overlay-hook_0.2.bb b/recipes-initramfs/initramfs-overlay-hook/initramfs-overlay-hook_0.2.bb
index 4e2e2922..ec7f85b6 100644
--- a/recipes-initramfs/initramfs-overlay-hook/initramfs-overlay-hook_0.2.bb
+++ b/recipes-initramfs/initramfs-overlay-hook/initramfs-overlay-hook_0.2.bb
@@ -25,12 +25,14 @@ INITRAMFS_OVERLAY_PATHS ??= "/etc"
 
 # The variable INITRAMFS_OVERLAY_STORAGE_PATH designates the path were the
 # changes to the overlayed directory are stored (upper dir). The initramfs
-# also mounts the first directory after root to the
-# INITRAMFS_OVERLAY_STORAGE_DEVICE.
+# hook also mounts the first directory after root to
+# INITRAMFS_OVERLAY_STORAGE_DEVICE if it is not mounted yet.
 INITRAMFS_OVERLAY_STORAGE_PATH ??= "/var/local"
 
 # override this to switch to UUID or PARTUUID based mounts
 INITRAMFS_OVERLAY_STORAGE_DEVICE ??= "/dev/disk/by-label/var"
+
+# options to use for mounting INITRAMFS_OVERLAY_STORAGE_DEVICE
 INITRAMFS_OVERLAY_MOUNT_OPTION ??= "defaults,nodev,nosuid,noexec"
 
 TEMPLATE_FILES += "local-bottom.tmpl"
-- 
2.43.0

[isar-cip-core][RFC][PATCH 06/10] initramfs-overlay-hook: Add awareness for abvar hook

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

If the abvar hook is used to mount and manage snapshots for it, overlay
mounting has to wait for it.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 .../initramfs-overlay-hook/initramfs-overlay-hook_0.2.bb        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/recipes-initramfs/initramfs-overlay-hook/initramfs-overlay-hook_0.2.bb b/recipes-initramfs/initramfs-overlay-hook/initramfs-overlay-hook_0.2.bb
index ec7f85b6..073fe070 100644
--- a/recipes-initramfs/initramfs-overlay-hook/initramfs-overlay-hook_0.2.bb
+++ b/recipes-initramfs/initramfs-overlay-hook/initramfs-overlay-hook_0.2.bb
@@ -47,7 +47,7 @@ DEBIAN_DEPENDS .= ", awk, coreutils, util-linux"
 HOOK_ADD_MODULES = "overlay"
 HOOK_COPY_EXECS = "mountpoint awk e2fsck mke2fs"
 
-SCRIPT_PREREQ="crypt"
+SCRIPT_PREREQ = "crypt abvar"
 
 do_install:append() {
     install -m 0755 "${WORKDIR}/${INITRAMFS_OVERLAY_RECOVERY_SCRIPT}" \
-- 
2.43.0

[isar-cip-core][RFC][PATCH 07/10] initramfs-overlay-hook: Bump revision

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

We changed the recipe in the last commits, acknowledge that.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 ...nitramfs-overlay-hook_0.2.bb => initramfs-overlay-hook_0.3.bb} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename recipes-initramfs/initramfs-overlay-hook/{initramfs-overlay-hook_0.2.bb => initramfs-overlay-hook_0.3.bb} (100%)

diff --git a/recipes-initramfs/initramfs-overlay-hook/initramfs-overlay-hook_0.2.bb b/recipes-initramfs/initramfs-overlay-hook/initramfs-overlay-hook_0.3.bb
similarity index 100%
rename from recipes-initramfs/initramfs-overlay-hook/initramfs-overlay-hook_0.2.bb
rename to recipes-initramfs/initramfs-overlay-hook/initramfs-overlay-hook_0.3.bb
-- 
2.43.0

[isar-cip-core][RFC][PATCH 08/10] swupdate: Make var filesystem type configurable for update images

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

This allows to switch to var filesystem type to something else than ext4
which will be needed when enabling A/V snapshots for it. Default remains
ext4.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 classes/swupdate.bbclass                      | 1 +
 kas/opt/swupdate.yml                          | 1 +
 wic/bbb-efibootguard.wks.in                   | 2 +-
 wic/hihope-rzg2m-efibootguard.wks.in          | 2 +-
 wic/qemu-arm64-efibootguard-secureboot.wks.in | 2 +-
 wic/qemu-arm64-efibootguard.wks.in            | 2 +-
 wic/qemu-riscv64-efibootguard.wks.in          | 2 +-
 wic/x86-uefi-efibootguard-secureboot.wks.in   | 2 +-
 wic/x86-uefi-efibootguard.wks.in              | 2 +-
 9 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/classes/swupdate.bbclass b/classes/swupdate.bbclass
index 05291ee9..213a8ffb 100644
--- a/classes/swupdate.bbclass
+++ b/classes/swupdate.bbclass
@@ -61,6 +61,7 @@ IMAGE_TEMPLATE_VARS:swu = " \
     TARGET_IMAGE_UUID \
     ABROOTFS_PART_UUID_A \
     ABROOTFS_PART_UUID_B \
+    VAR_FS_TYPE \
     SWU_HW_COMPAT_NODE \
     SWU_COMPRESSION_NODE \
     SWU_VERSION \
diff --git a/kas/opt/swupdate.yml b/kas/opt/swupdate.yml
index 38dc3907..c5c5a56a 100644
--- a/kas/opt/swupdate.yml
+++ b/kas/opt/swupdate.yml
@@ -29,6 +29,7 @@ local_conf_header:
     INITRAMFS_INSTALL:append = " initramfs-${RO_ROOTFS_TYPE}-hook"
     ABROOTFS_PART_UUID_A ?= "fedcba98-7654-3210-cafe-5e0710000001"
     ABROOTFS_PART_UUID_B ?= "fedcba98-7654-3210-cafe-5e0710000002"
+    VAR_FS_TYPE ??= "ext4"
     PREFERRED_PROVIDER_swupdate-certificates-key ??= "swupdate-certificates-key-snakeoil"
     PREFERRED_PROVIDER_swupdate-certificates ??= "swupdate-certificates-snakeoil"
     PREFERRED_PROVIDER_swupdate-signer ??= "swupdate-signer-cms"
diff --git a/wic/bbb-efibootguard.wks.in b/wic/bbb-efibootguard.wks.in
index e6c3e158..6effa523 100644
--- a/wic/bbb-efibootguard.wks.in
+++ b/wic/bbb-efibootguard.wks.in
@@ -16,6 +16,6 @@ part --source empty --align 1024 --fixed-size 1G --uuid "${ABROOTFS_PART_UUID_B}
 
 # home and var are extra partitions
 part /home --source rootfs --change-directory=home --fstype=ext4 --label home --align 1024  --size 1G --fsuuid 1f55d66a-40d8-11ee-be56-0242ac120002
-part /var --fstype=ext4 --label var --align 1024  --size 2G --fsuuid 96be3374-4258-11ee-be56-0242ac120002
+part /var --fstype=${VAR_FS_TYPE} --label var --align 1024  --size 2G --fsuuid 96be3374-4258-11ee-be56-0242ac120002
 
 bootloader --ptable gpt --append="rootwait console=ttyO0,115200 omap_wdt.early_enable=1 omap_wdt.nowayout=1 watchdog.handle_boot_enabled=0"
diff --git a/wic/hihope-rzg2m-efibootguard.wks.in b/wic/hihope-rzg2m-efibootguard.wks.in
index fb3f090a..2305262f 100644
--- a/wic/hihope-rzg2m-efibootguard.wks.in
+++ b/wic/hihope-rzg2m-efibootguard.wks.in
@@ -9,6 +9,6 @@ part --source empty --align 1024 --fixed-size 1G --uuid "${ABROOTFS_PART_UUID_B}
 # home and var are extra partitions
 
 part /home --source rootfs --change-directory=home --fstype=ext4 --label home --align 1024  --size 1G --extra-space=100M --fsuuid 1f55d66a-40d8-11ee-be56-0242ac120002
-part /var --fstype=ext4 --label var --align 1024 --fixed-size 2G --fsuuid 96be3374-4258-11ee-be56-0242ac120002
+part /var --fstype=${VAR_FS_TYPE} --label var --align 1024 --fixed-size 2G --fsuuid 96be3374-4258-11ee-be56-0242ac120002
 
 bootloader --ptable gpt --append="console=tty0 console=ttySC0,115200 rootwait earlyprintk"
diff --git a/wic/qemu-arm64-efibootguard-secureboot.wks.in b/wic/qemu-arm64-efibootguard-secureboot.wks.in
index 00d627d0..98398e67 100644
--- a/wic/qemu-arm64-efibootguard-secureboot.wks.in
+++ b/wic/qemu-arm64-efibootguard-secureboot.wks.in
@@ -5,6 +5,6 @@ part --source empty --align 1024 --fixed-size 1G --uuid "${ABROOTFS_PART_UUID_B}
 
 # home and var are extra partitions
 part /home --source rootfs --change-directory=home --fstype=ext4 --label home --align 1024 --size 1G --fsuuid 1f55d66a-40d8-11ee-be56-0242ac120002
-part /var  --fstype=ext4 --label var  --align 1024 --fixed-size 2G --fsuuid 96be3374-4258-11ee-be56-0242ac120002
+part /var  --fstype=${VAR_FS_TYPE} --label var  --align 1024 --fixed-size 2G --fsuuid 96be3374-4258-11ee-be56-0242ac120002
 
 bootloader --ptable gpt --append="panic=5"
diff --git a/wic/qemu-arm64-efibootguard.wks.in b/wic/qemu-arm64-efibootguard.wks.in
index 17434d15..bf0bb82b 100644
--- a/wic/qemu-arm64-efibootguard.wks.in
+++ b/wic/qemu-arm64-efibootguard.wks.in
@@ -8,6 +8,6 @@ part --source empty --align 1024 --fixed-size 1G --uuid "${ABROOTFS_PART_UUID_B}
 
 # home and var are extra partitions
 part /home --source rootfs --change-directory=home --fstype=ext4 --label home --align 1024  --size 1G --fsuuid 1f55d66a-40d8-11ee-be56-0242ac120002
-part /var --fstype=ext4 --label var --align 1024 --fixed-size 2G --fsuuid 96be3374-4258-11ee-be56-0242ac120002
+part /var --fstype=${VAR_FS_TYPE} --label var --align 1024 --fixed-size 2G --fsuuid 96be3374-4258-11ee-be56-0242ac120002
 
 bootloader --ptable gpt
diff --git a/wic/qemu-riscv64-efibootguard.wks.in b/wic/qemu-riscv64-efibootguard.wks.in
index 1a2291e3..2acb2f9a 100644
--- a/wic/qemu-riscv64-efibootguard.wks.in
+++ b/wic/qemu-riscv64-efibootguard.wks.in
@@ -8,6 +8,6 @@ part --source empty --align 1024 --fixed-size 1G --uuid "${ABROOTFS_PART_UUID_B}
 
 # home and var are extra partitions
 part /home --source rootfs --change-directory=home --fstype=ext4 --label home --align 1024  --size 1G --fsuuid 1f55d66a-40d8-11ee-be56-0242ac120002
-part /var --fstype=ext4 --label var --align 1024  --fixed-size 2G --fsuuid 96be3374-4258-11ee-be56-0242ac120002
+part /var --fstype=${VAR_FS_TYPE} --label var --align 1024  --fixed-size 2G --fsuuid 96be3374-4258-11ee-be56-0242ac120002
 
 bootloader --ptable gpt
diff --git a/wic/x86-uefi-efibootguard-secureboot.wks.in b/wic/x86-uefi-efibootguard-secureboot.wks.in
index 0f4d6374..fe0f7cc5 100644
--- a/wic/x86-uefi-efibootguard-secureboot.wks.in
+++ b/wic/x86-uefi-efibootguard-secureboot.wks.in
@@ -5,6 +5,6 @@ part --source empty --align 1024 --fixed-size 1G --uuid "${ABROOTFS_PART_UUID_B}
 
 # home and var are extra partitions
 part /home --source rootfs --change-directory=home --fstype=ext4 --label home --align 1024 --size 1G --fsuuid 1f55d66a-40d8-11ee-be56-0242ac120002
-part /var  --fstype=ext4 --label var  --align 1024 --fixed-size 2G --fsuuid 96be3374-4258-11ee-be56-0242ac120002
+part /var  --fstype=${VAR_FS_TYPE} --label var --align 1024 --fixed-size 2G --fsuuid 96be3374-4258-11ee-be56-0242ac120002
 
 bootloader --ptable gpt --append="console=tty0 console=ttyS0,115200 rootwait earlyprintk watchdog.handle_boot_enabled=0 iTCO_wdt.nowayout=1 panic=5"
diff --git a/wic/x86-uefi-efibootguard.wks.in b/wic/x86-uefi-efibootguard.wks.in
index 9d344f8a..5eab54cf 100644
--- a/wic/x86-uefi-efibootguard.wks.in
+++ b/wic/x86-uefi-efibootguard.wks.in
@@ -9,6 +9,6 @@ part --source empty --align 1024 --fixed-size 1G --uuid "${ABROOTFS_PART_UUID_B}
 # home and var are extra partitions
 
 part /home --source rootfs --change-directory=home --fstype=ext4 --label home --align 1024  --size 1G --extra-space=100M --fsuuid 1f55d66a-40d8-11ee-be56-0242ac120002
-part /var --fstype=ext4 --label var --align 1024 --fixed-size 2G --fsuuid 96be3374-4258-11ee-be56-0242ac120002
+part /var --fstype=${VAR_FS_TYPE} --label var --align 1024 --fixed-size 2G --fsuuid 96be3374-4258-11ee-be56-0242ac120002
 
 bootloader --ptable gpt --append="console=tty0 console=ttyS0,115200 rootwait earlyprintk watchdog.handle_boot_enabled=0 iTCO_wdt.nowayout=1 "
-- 
2.43.0

[isar-cip-core][RFC][PATCH 09/10] swupdate: Activate abvar initramfs hook when VAR_FS_TYPE is set to btrfs

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

This enables to control whether an swupdate target image uses A/B
snapshots for /var by setting VAR_FS_TYPE to btrfs. While we will switch
many of our own targets soon, not all are compatible or tested yet and
some downstream users may want to continue without snapshots.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 kas/opt/ebg-swu.yml                                        | 6 +++++-
 recipes-initramfs/cip-core-initramfs/cip-core-initramfs.bb | 3 ++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/kas/opt/ebg-swu.yml b/kas/opt/ebg-swu.yml
index 61a8eeef..9084cea1 100644
--- a/kas/opt/ebg-swu.yml
+++ b/kas/opt/ebg-swu.yml
@@ -1,7 +1,7 @@
 #
 # CIP Core, generic profile
 #
-# Copyright (c) Siemens AG, 2021-2022
+# Copyright (c) Siemens AG, 2021-2025
 #
 # Authors:
 #  Quirin Gylstorff <quirin.gylstorff@siemens.com>
@@ -33,3 +33,7 @@ local_conf_header:
     IMAGER_BUILD_DEPS:append:qemu-arm64 = " u-boot-qemu-arm64"
     IMAGER_BUILD_DEPS:append:qemu-arm = " u-boot-qemu-arm"
     IMAGER_BUILD_DEPS:append:qemu-riscv64 = " opensbi-qemu-riscv64"
+  ab-persistency: |
+    OVERRIDES .= "${@':abvar' if d.getVar('VAR_FS_TYPE') == 'btrfs' else ''}"
+    CRYPT_BTRFS_SUPPORT:abvar = "1"
+    IMAGE_PREINSTALL:append:abvar = " btrfs-progs"
diff --git a/recipes-initramfs/cip-core-initramfs/cip-core-initramfs.bb b/recipes-initramfs/cip-core-initramfs/cip-core-initramfs.bb
index 0e4cf743..e6eb34c6 100644
--- a/recipes-initramfs/cip-core-initramfs/cip-core-initramfs.bb
+++ b/recipes-initramfs/cip-core-initramfs/cip-core-initramfs.bb
@@ -1,7 +1,7 @@
 #
 # CIP Core, generic profile
 #
-# Copyright (c) Siemens AG, 2021 - 2023
+# Copyright (c) Siemens AG, 2021 - 2025
 #
 # Authors:
 #  Quirin Gylstorff <quirin.gylstorff@siemens.com>
@@ -15,4 +15,5 @@ INITRAMFS_INSTALL += " \
     initramfs-overlay-hook \
     "
 
+INITRAMFS_INSTALL:append:abvar = " initramfs-abvar-hook"
 INITRAMFS_INSTALL:append:encrypt-partitions = " initramfs-crypt-hook"
-- 
2.43.0

[isar-cip-core][RFC][PATCH 10/10] Enable A/B snapshot for /var on x86 and qemu-arm64

[Jan Kiszka]

From: Jan Kiszka <jan.kiszka@siemens.com>

Other targets still need testing, some even kernel config tuning.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
---
 conf/machine/qemu-amd64.conf | 5 ++++-
 conf/machine/qemu-arm64.conf | 5 ++++-
 conf/machine/x86-uefi.conf   | 5 +++--
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/conf/machine/qemu-amd64.conf b/conf/machine/qemu-amd64.conf
index d7866468..5244c86a 100644
--- a/conf/machine/qemu-amd64.conf
+++ b/conf/machine/qemu-amd64.conf
@@ -1,7 +1,7 @@
 #
 # CIP Core, generic profile
 #
-# Copyright (c) Siemens AG, 2019-2024
+# Copyright (c) Siemens AG, 2019-2025
 #
 # SPDX-License-Identifier: MIT
 #
@@ -11,3 +11,6 @@ DISTRO_ARCH = "amd64"
 IMAGE_FSTYPES ?= "ext4"
 USE_CIP_KERNEL_CONFIG = "1"
 KERNEL_DEFCONFIG = "cip-kernel-config/${KERNEL_DEFCONFIG_VERSION}/x86/cip_merged_defconfig"
+
+IMAGER_INSTALL:wic += "btrfs-progs"
+VAR_FS_TYPE = "btrfs"
diff --git a/conf/machine/qemu-arm64.conf b/conf/machine/qemu-arm64.conf
index a2c5e53e..49323a11 100644
--- a/conf/machine/qemu-arm64.conf
+++ b/conf/machine/qemu-arm64.conf
@@ -1,7 +1,7 @@
 #
 # CIP Core, generic profile
 #
-# Copyright (c) Siemens AG, 2019
+# Copyright (c) Siemens AG, 2019-2025
 #
 # SPDX-License-Identifier: MIT
 #
@@ -16,3 +16,6 @@ KERNEL_DEFCONFIG ?= "cip-kernel-config/${KERNEL_DEFCONFIG_VERSION}/arm64/cip_mer
 WDOG_TIMEOUT = "0"
 
 PREFERRED_PROVIDER_u-boot-${MACHINE} = "u-boot-qemu-arm64"
+
+IMAGER_INSTALL:wic += "btrfs-progs"
+VAR_FS_TYPE = "btrfs"
diff --git a/conf/machine/x86-uefi.conf b/conf/machine/x86-uefi.conf
index 33f82b16..0a69ea82 100644
--- a/conf/machine/x86-uefi.conf
+++ b/conf/machine/x86-uefi.conf
@@ -1,7 +1,7 @@
 #
 # CIP Core, generic profile
 #
-# Copyright (c) Siemens AG, 2019-2024
+# Copyright (c) Siemens AG, 2019-2025
 #
 # SPDX-License-Identifier: MIT
 #
@@ -10,6 +10,7 @@ DISTRO_ARCH = "amd64"
 
 IMAGE_FSTYPES ?= "wic"
 WKS_FILE ?= "x86_64-generic.wks"
-IMAGER_INSTALL:wic += "${GRUB_BOOTLOADER_INSTALL}"
+IMAGER_INSTALL:wic += "${GRUB_BOOTLOADER_INSTALL} btrfs-progs"
+VAR_FS_TYPE = "btrfs"
 USE_CIP_KERNEL_CONFIG = "1"
 KERNEL_DEFCONFIG = "cip-kernel-config/${KERNEL_DEFCONFIG_VERSION}/x86/cip_merged_defconfig"
-- 
2.43.0

Re: [isar-cip-core][RFC][PATCH 10/10] Enable A/B snapshot for /var on x86 and qemu-arm64

[MOESSBAUER, Felix]

On Thu, 2025-01-30 at 10:39 +0100, Jan Kiszka wrote:
> From: Jan Kiszka <jan.kiszka@siemens.com>
> 
> Other targets still need testing, some even kernel config tuning.

Hi,

do we have a target that uses docker / podman? The containers are
usually stored on /var and this is not necessarily compatible with
BTRFS OOTB. In general, docker does not play nicely with a COW
filesystem. That's one of the reasons the docker-btrfs driver was
invented. However, I'm unsure how that works together with our A/B
logic.

For details, please also see
https://docs.docker.com/engine/storage/drivers/btrfs-driver/

Best regards,
Felix

> 
> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
> ---
>  conf/machine/qemu-amd64.conf | 5 ++++-
>  conf/machine/qemu-arm64.conf | 5 ++++-
>  conf/machine/x86-uefi.conf   | 5 +++--
>  3 files changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/conf/machine/qemu-amd64.conf b/conf/machine/qemu-
> amd64.conf
> index d7866468..5244c86a 100644
> --- a/conf/machine/qemu-amd64.conf
> +++ b/conf/machine/qemu-amd64.conf
> @@ -1,7 +1,7 @@
>  #
>  # CIP Core, generic profile
>  #
> -# Copyright (c) Siemens AG, 2019-2024
> +# Copyright (c) Siemens AG, 2019-2025
>  #
>  # SPDX-License-Identifier: MIT
>  #
> @@ -11,3 +11,6 @@ DISTRO_ARCH = "amd64"
>  IMAGE_FSTYPES ?= "ext4"
>  USE_CIP_KERNEL_CONFIG = "1"
>  KERNEL_DEFCONFIG = "cip-kernel-
> config/${KERNEL_DEFCONFIG_VERSION}/x86/cip_merged_defconfig"
> +
> +IMAGER_INSTALL:wic += "btrfs-progs"
> +VAR_FS_TYPE = "btrfs"
> diff --git a/conf/machine/qemu-arm64.conf b/conf/machine/qemu-
> arm64.conf
> index a2c5e53e..49323a11 100644
> --- a/conf/machine/qemu-arm64.conf
> +++ b/conf/machine/qemu-arm64.conf
> @@ -1,7 +1,7 @@
>  #
>  # CIP Core, generic profile
>  #
> -# Copyright (c) Siemens AG, 2019
> +# Copyright (c) Siemens AG, 2019-2025
>  #
>  # SPDX-License-Identifier: MIT
>  #
> @@ -16,3 +16,6 @@ KERNEL_DEFCONFIG ?= "cip-kernel-
> config/${KERNEL_DEFCONFIG_VERSION}/arm64/cip_mer
>  WDOG_TIMEOUT = "0"
>  
>  PREFERRED_PROVIDER_u-boot-${MACHINE} = "u-boot-qemu-arm64"
> +
> +IMAGER_INSTALL:wic += "btrfs-progs"
> +VAR_FS_TYPE = "btrfs"
> diff --git a/conf/machine/x86-uefi.conf b/conf/machine/x86-uefi.conf
> index 33f82b16..0a69ea82 100644
> --- a/conf/machine/x86-uefi.conf
> +++ b/conf/machine/x86-uefi.conf
> @@ -1,7 +1,7 @@
>  #
>  # CIP Core, generic profile
>  #
> -# Copyright (c) Siemens AG, 2019-2024
> +# Copyright (c) Siemens AG, 2019-2025
>  #
>  # SPDX-License-Identifier: MIT
>  #
> @@ -10,6 +10,7 @@ DISTRO_ARCH = "amd64"
>  
>  IMAGE_FSTYPES ?= "wic"
>  WKS_FILE ?= "x86_64-generic.wks"
> -IMAGER_INSTALL:wic += "${GRUB_BOOTLOADER_INSTALL}"
> +IMAGER_INSTALL:wic += "${GRUB_BOOTLOADER_INSTALL} btrfs-progs"
> +VAR_FS_TYPE = "btrfs"
>  USE_CIP_KERNEL_CONFIG = "1"
>  KERNEL_DEFCONFIG = "cip-kernel-
> config/${KERNEL_DEFCONFIG_VERSION}/x86/cip_merged_defconfig"

-- 
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

Re: [isar-cip-core][RFC][PATCH 10/10] Enable A/B snapshot for /var on x86 and qemu-arm64

[Jan Kiszka]

On 30.01.25 15:06, Moessbauer, Felix (FT RPD CED OES-DE) wrote:
> On Thu, 2025-01-30 at 10:39 +0100, Jan Kiszka wrote:
>> From: Jan Kiszka <jan.kiszka@siemens.com>
>>
>> Other targets still need testing, some even kernel config tuning.
> 
> Hi,
> 
> do we have a target that uses docker / podman? The containers are
> usually stored on /var and this is not necessarily compatible with
> BTRFS OOTB. In general, docker does not play nicely with a COW
> filesystem. That's one of the reasons the docker-btrfs driver was
> invented. However, I'm unsure how that works together with our A/B
> logic.
> 
> For details, please also see
> https://docs.docker.com/engine/storage/drivers/btrfs-driver/
> 

Yes, there is more to think about when it comes to production use. E.g.,
you may also not want to rollback your logs in /var/log on failed
updates. That pattern we may address later on by creating a carveout
from var on a separate partition again.

In the end, this here is just a proposal that may need further tuning
when further requirements need to be fulfilled.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

Re: [isar-cip-core][RFC][PATCH 03/10] initramfs: Add hook for managing /var in A/B fashion

[Jan Kiszka]

On 30.01.25 10:39, Jan Kiszka wrote:
> From: Jan Kiszka <jan.kiszka@siemens.com>
> 
> This hook manages snapshots of the filesystem backing /var in an A/B
> way, aligned with rootfs instances. That means when an new version is
> first booted in testing mode (EFI Boot Guard ustate=2), a snapshot of
> the current version is taken before that snapshot is mounted as /var.
> On rollback, the previous version will still be available and will be
> used again. After committing a new version, garbage collection of the
> previous snapshot is happening on next boot.
> 
> This first version of the hook is written around EFI Boot Guard as A/B
> boot manager and btrfs as mechanism (here in form of a filesystem) to
> create and manage snapshots with low overhead. Other implementations
> are imaginable and would only require small refactorings to enable them
> as configurable alternatives.
> 
> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
> ---
>  .../files/local-bottom.tmpl                   | 86 +++++++++++++++++++
>  .../initramfs-abvar-hook_0.1.bb               | 31 +++++++
>  2 files changed, 117 insertions(+)
>  create mode 100644 recipes-initramfs/initramfs-abvar-hook/files/local-bottom.tmpl
>  create mode 100644 recipes-initramfs/initramfs-abvar-hook/initramfs-abvar-hook_0.1.bb
> 
> diff --git a/recipes-initramfs/initramfs-abvar-hook/files/local-bottom.tmpl b/recipes-initramfs/initramfs-abvar-hook/files/local-bottom.tmpl
> new file mode 100644
> index 00000000..91b8d017
> --- /dev/null
> +++ b/recipes-initramfs/initramfs-abvar-hook/files/local-bottom.tmpl
> @@ -0,0 +1,86 @@
> +#
> +# CIP Core, generic profile
> +#
> +# Copyright (c) Siemens, 2025
> +#
> +# Authors:
> +#  Jan Kiszka <jan.kiszka@siemens.com>
> +#
> +
> +var_device="${INITRAMFS_VAR_DEVICE}"
> +var_opts="${INITRAMFS_VAR_MOUNT_OPTIONS}"
> +btrfs_mnt="/.var-btrfs"
> +snap_prefix="abvar-"
> +
> +. "${rootmnt}/etc/os-release"
> +
> +get_default_subvolume()
> +{
> +	subvol=$(btrfs subvolume get-default "$1" | grep path || true)
> +	echo "${subvol##*path }"
> +}
> +
> +ustate_val=$(bg_printenv -c -r -o ustate)
> +
> +# when in testing state or on first boot, create new snapshot
> +if [ "$ustate_val" = "USTATE=2" ] ||
> +    ! mount -t btrfs -o "$var_opts,subvol=/$snap_prefix$IMAGE_UUID" \
> +	"$var_device" "${rootmnt}/var" 2>/dev/null; then
> +	log_begin_msg "Creating new /var snapshot for image $IMAGE_UUID"
> +
> +	mkdir "$btrfs_mnt"
> +	mount -t btrfs -o subvol=/ "$var_device" "$btrfs_mnt"
> +
> +	# delete any dangling previous snapshot
> +	btrfs subvolume delete "$btrfs_mnt/$snap_prefix$IMAGE_UUID" \
> +		2>/dev/null || true
> +
> +	default_subvol=$(get_default_subvolume "$btrfs_mnt")
> +	btrfs subvolume snapshot "$btrfs_mnt/$default_subvol" \
> +		"$btrfs_mnt/$snap_prefix$IMAGE_UUID"
> +
> +	umount "$btrfs_mnt"
> +	rmdir "$btrfs_mnt"
> +
> +	log_end_msg
> +
> +	mount -t btrfs -o "$var_opts,subvol=/$snap_prefix$IMAGE_UUID" \
> +		"$var_device" "${rootmnt}/var"
> +else
> +	default_subvol=$(get_default_subvolume "${rootmnt}/var")
> +fi
> +
> +active_entry=$(btrfs subvolume list -a "${rootmnt}/var" |
> +	grep "<FS_TREE>/$snap_prefix$IMAGE_UUID")
> +active_id="${active_entry#ID }"
> +active_id="${active_id%% *}"
> +
> +# adjust default subvolume to the active one
> +if [ "$default_subvol" != "$snap_prefix$IMAGE_UUID" ]; then
> +	log_begin_msg "Adjusting /var subvolume default to $IMAGE_UUID"
> +	btrfs subvolume set-default "$active_id" "${rootmnt}/var"
> +	log_end_msg
> +fi
> +
> +if [ "$(bg_printenv -c -r -o ustate)" != "USTATE=0" ]; then
> +	# still testing the current version, skip cleanup
> +	exit 0
> +fi
> +
> +# get rid of obsolete snapshots, ie. everything but the active one
> +log_begin_msg "Performing /var snapshot housekeeping"
> +
> +IFS="
> +"
> +for entry in $(btrfs subvolume list -aqu "${rootmnt}/var" |
> +		grep "<FS_TREE>/$snap_prefix"); do
> +	entry_id="${entry#ID }"
> +	entry_id="${entry_id%% *}"
> +
> +	if [ "$entry_id" != "$active_id" ]; then
> +		btrfs subvolume delete -i "$entry_id" "${rootmnt}/var"
> +	fi
> +done
> +unset IFS
> +
> +log_end_msg
> diff --git a/recipes-initramfs/initramfs-abvar-hook/initramfs-abvar-hook_0.1.bb b/recipes-initramfs/initramfs-abvar-hook/initramfs-abvar-hook_0.1.bb
> new file mode 100644
> index 00000000..c7b58243
> --- /dev/null
> +++ b/recipes-initramfs/initramfs-abvar-hook/initramfs-abvar-hook_0.1.bb
> @@ -0,0 +1,31 @@
> +#
> +# CIP Core, generic profile
> +#
> +# Copyright (c) Siemens, 2025
> +#
> +# Authors:
> +#  Jan Kiszka <jan.kiszka@siemens.com>
> +#
> +# SPDX-License-Identifier: MIT
> +
> +require recipes-initramfs/initramfs-hook/hook.inc
> +
> +SRC_URI += " \
> +    file://local-bottom.tmpl"
> +
> +# override this to switch to UUID or PARTUUID based mounts
> +INITRAMFS_VAR_DEVICE ??= "/dev/disk/by-label/var"
> +
> +INITRAMFS_VAR_MOUNT_OPTIONS ??= "defaults,nodev,nosuid,noexec"
> +
> +TEMPLATE_FILES += "local-bottom.tmpl"
> +TEMPLATE_VARS += "\
> +    INITRAMFS_VAR_DEVICE \
> +    INITRAMFS_VAR_MOUNT_OPTIONS"
> +
> +HOOK_ADD_MODULES = "btrfs"
> +HOOK_COPY_EXECS = "btrfs grep rmdir bg_printenv"
> +
> +DEBIAN_DEPENDS .= ", btrfs-progs, efibootguard"
> +
> +SCRIPT_PREREQ = "crypt"

This prereq is actually wrong because crypt tries to mount the partition
as well, but that would happen without the logic of this hook. Happens
to work because crypt pushes itself to the end of the list and wins so far.

We generally do not need to wait on crypt bottom because also the top
script unlocks the partition AND updates by-xxx links as well. We just
need to use only those for the abvar hook. Next version should therefore
enforce the usage of labels or fs UUIDs.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

Re: [isar-cip-core][RFC][PATCH 00/10] Provide A/B snapshot support for persistent /var

[Jan Kiszka]

On 30.01.25 10:39, Jan Kiszka wrote:
> This is a first attempt to provide a pattern and reusable recipes for
> saving and rolling back the persistent data during A/B updates. The
> obvious approach is using a filesystem that supports snapshots and
> linking those to the rootfs revision that is being booted. As first
> implementation, we are using btrfs. While the current implementation is
> built around btrfs, the concept should not. It may even work with
> device mapper snapshots.
> 
> That said, the devil is always in the details. And even this "simple",
> btrfs-only implementation took some rounds to find a logic that neither
> piles up obsolete snapshots or deletes them prematurely. Still, careful
> review is highly welcome, specifically of patch 3.
> 
> As we are currently having split /var and /home partitions, this does
> not cover anything in home directories. However, this will automatically
> change when [1] is addressed.
> 

Forgot to mention some todos (which are related):
 - handling of filesystem errors, likely by resetting to factory state
   (blank /var)
 - enabling factory reset via explicit requests

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

Re: [isar-cip-core][RFC][PATCH 00/10] Provide A/B snapshot support for persistent /var

[Jan Kiszka]

On 30.01.25 10:39, Jan Kiszka wrote:
> This is a first attempt to provide a pattern and reusable recipes for
> saving and rolling back the persistent data during A/B updates. The
> obvious approach is using a filesystem that supports snapshots and
> linking those to the rootfs revision that is being booted. As first
> implementation, we are using btrfs. While the current implementation is
> built around btrfs, the concept should not. It may even work with
> device mapper snapshots.
> 
> That said, the devil is always in the details. And even this "simple",
> btrfs-only implementation took some rounds to find a logic that neither
> piles up obsolete snapshots or deletes them prematurely. Still, careful
> review is highly welcome, specifically of patch 3.
> 
> As we are currently having split /var and /home partitions, this does
> not cover anything in home directories. However, this will automatically
> change when [1] is addressed.
> 
> Jan
> 
> [1] https://gitlab.com/cip-project/cip-core/isar-cip-core/-/issues/123
> 
> Jan Kiszka (10):
>   initramfs-crypt-hook: Add support for btrfs
>   initramfs-crypt-hook: Bump revision
>   initramfs: Add hook for managing /var in A/B fashion
>   initramfs-overlay-hook: Optimize variable initialization
>   initramfs-overlay-hook: Tune the parameter documentation
>   initramfs-overlay-hook: Add awareness for abvar hook
>   initramfs-overlay-hook: Bump revision
>   swupdate: Make var filesystem type configurable for update images
>   swupdate: Activate abvar initramfs hook when VAR_FS_TYPE is set to
>     btrfs
>   Enable A/B snapshot for /var on x86 and qemu-arm64
> 
>  classes/swupdate.bbclass                      |  1 +
>  conf/machine/qemu-amd64.conf                  |  5 +-
>  conf/machine/qemu-arm64.conf                  |  5 +-
>  conf/machine/x86-uefi.conf                    |  5 +-
>  kas/opt/ebg-swu.yml                           |  6 +-
>  kas/opt/swupdate.yml                          |  1 +
>  .../cip-core-initramfs/cip-core-initramfs.bb  |  3 +-
>  .../files/local-bottom.tmpl                   | 86 +++++++++++++++++++
>  .../initramfs-abvar-hook_0.1.bb               | 31 +++++++
>  .../files/local-top-complete                  |  7 ++
>  ...ook_0.5.bb => initramfs-crypt-hook_0.6.bb} |  6 ++
>  .../files/local-bottom.tmpl                   | 10 ++-
>  ...k_0.2.bb => initramfs-overlay-hook_0.3.bb} |  8 +-
>  wic/bbb-efibootguard.wks.in                   |  2 +-
>  wic/hihope-rzg2m-efibootguard.wks.in          |  2 +-
>  wic/qemu-arm64-efibootguard-secureboot.wks.in |  2 +-
>  wic/qemu-arm64-efibootguard.wks.in            |  2 +-
>  wic/qemu-riscv64-efibootguard.wks.in          |  2 +-
>  wic/x86-uefi-efibootguard-secureboot.wks.in   |  2 +-
>  wic/x86-uefi-efibootguard.wks.in              |  2 +-
>  20 files changed, 168 insertions(+), 20 deletions(-)
>  create mode 100644 recipes-initramfs/initramfs-abvar-hook/files/local-bottom.tmpl
>  create mode 100644 recipes-initramfs/initramfs-abvar-hook/initramfs-abvar-hook_0.1.bb
>  rename recipes-initramfs/initramfs-crypt-hook/{initramfs-crypt-hook_0.5.bb => initramfs-crypt-hook_0.6.bb} (93%)
>  rename recipes-initramfs/initramfs-overlay-hook/{initramfs-overlay-hook_0.2.bb => initramfs-overlay-hook_0.3.bb} (87%)
> 

Patch 1 and 2 look ready enough to me now while the rest needs a bit
more time. Therefore, I will keep the first two in next and push the
others into a wip/abvar staging branch so that we can move forward with
other pending patches.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

Re: [isar-cip-core][RFC][PATCH 00/10] Provide A/B snapshot support for persistent /var

[Jan Kiszka]

On 03.02.25 18:17, Jan Kiszka wrote:
> On 30.01.25 10:39, Jan Kiszka wrote:
>> This is a first attempt to provide a pattern and reusable recipes for
>> saving and rolling back the persistent data during A/B updates. The
>> obvious approach is using a filesystem that supports snapshots and
>> linking those to the rootfs revision that is being booted. As first
>> implementation, we are using btrfs. While the current implementation is
>> built around btrfs, the concept should not. It may even work with
>> device mapper snapshots.
>>
>> That said, the devil is always in the details. And even this "simple",
>> btrfs-only implementation took some rounds to find a logic that neither
>> piles up obsolete snapshots or deletes them prematurely. Still, careful
>> review is highly welcome, specifically of patch 3.
>>
>> As we are currently having split /var and /home partitions, this does
>> not cover anything in home directories. However, this will automatically
>> change when [1] is addressed.
>>
>> Jan
>>
>> [1] https://gitlab.com/cip-project/cip-core/isar-cip-core/-/issues/123
>>
>> Jan Kiszka (10):
>>   initramfs-crypt-hook: Add support for btrfs
>>   initramfs-crypt-hook: Bump revision
>>   initramfs: Add hook for managing /var in A/B fashion
>>   initramfs-overlay-hook: Optimize variable initialization
>>   initramfs-overlay-hook: Tune the parameter documentation
>>   initramfs-overlay-hook: Add awareness for abvar hook
>>   initramfs-overlay-hook: Bump revision
>>   swupdate: Make var filesystem type configurable for update images
>>   swupdate: Activate abvar initramfs hook when VAR_FS_TYPE is set to
>>     btrfs
>>   Enable A/B snapshot for /var on x86 and qemu-arm64
>>
>>  classes/swupdate.bbclass                      |  1 +
>>  conf/machine/qemu-amd64.conf                  |  5 +-
>>  conf/machine/qemu-arm64.conf                  |  5 +-
>>  conf/machine/x86-uefi.conf                    |  5 +-
>>  kas/opt/ebg-swu.yml                           |  6 +-
>>  kas/opt/swupdate.yml                          |  1 +
>>  .../cip-core-initramfs/cip-core-initramfs.bb  |  3 +-
>>  .../files/local-bottom.tmpl                   | 86 +++++++++++++++++++
>>  .../initramfs-abvar-hook_0.1.bb               | 31 +++++++
>>  .../files/local-top-complete                  |  7 ++
>>  ...ook_0.5.bb => initramfs-crypt-hook_0.6.bb} |  6 ++
>>  .../files/local-bottom.tmpl                   | 10 ++-
>>  ...k_0.2.bb => initramfs-overlay-hook_0.3.bb} |  8 +-
>>  wic/bbb-efibootguard.wks.in                   |  2 +-
>>  wic/hihope-rzg2m-efibootguard.wks.in          |  2 +-
>>  wic/qemu-arm64-efibootguard-secureboot.wks.in |  2 +-
>>  wic/qemu-arm64-efibootguard.wks.in            |  2 +-
>>  wic/qemu-riscv64-efibootguard.wks.in          |  2 +-
>>  wic/x86-uefi-efibootguard-secureboot.wks.in   |  2 +-
>>  wic/x86-uefi-efibootguard.wks.in              |  2 +-
>>  20 files changed, 168 insertions(+), 20 deletions(-)
>>  create mode 100644 recipes-initramfs/initramfs-abvar-hook/files/local-bottom.tmpl
>>  create mode 100644 recipes-initramfs/initramfs-abvar-hook/initramfs-abvar-hook_0.1.bb
>>  rename recipes-initramfs/initramfs-crypt-hook/{initramfs-crypt-hook_0.5.bb => initramfs-crypt-hook_0.6.bb} (93%)
>>  rename recipes-initramfs/initramfs-overlay-hook/{initramfs-overlay-hook_0.2.bb => initramfs-overlay-hook_0.3.bb} (87%)
>>
> 
> Patch 1 and 2 look ready enough to me now while the rest needs a bit
> more time. Therefore, I will keep the first two in next and push the
> others into a wip/abvar staging branch so that we can move forward with
> other pending patches.
> 

Actually, patches 4, 5 and 7 fall into the same category and are kept in
next, too. Makes:

- initramfs-crypt-hook: Add support for btrfs
- initramfs-crypt-hook: Bump revision
- initramfs-overlay-hook: Optimize variable initialization
- initramfs-overlay-hook: Tune the parameter documentation
- initramfs-overlay-hook: Add awareness for abvar hook
- initramfs-overlay-hook: Bump revision

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center