From ee526678c3fb6a3d9fed65e3ca35da20479d1baa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= Date: Sat, 29 Mar 2025 03:29:47 +0100 Subject: [PATCH 1/6] rpm: allow BR: systemd-mini on openSUSE OpenSUSE has special variant of systemd package for build environment, called systemd-mini, and it conflicts with the full systemd package. Allow using that too. Theoretically systemd-mini has Provides: systemd, but for some reason it isn't enough. QubesOS/qubes-issues#6567 --- rpm_spec/qubes-utils.spec.in | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/rpm_spec/qubes-utils.spec.in b/rpm_spec/qubes-utils.spec.in index 7e16c80..250e613 100644 --- a/rpm_spec/qubes-utils.spec.in +++ b/rpm_spec/qubes-utils.spec.in @@ -14,7 +14,11 @@ Requires: GraphicsMagick Requires: python%{python3_pkgversion}-qubesimgconverter Requires: (%{name}-selinux if selinux-policy) %{?systemd_requires} +%if 0%{?is_opensuse} +BuildRequires: (systemd or systemd-mini) +%else BuildRequires: systemd +%endif BuildRequires: python%{python3_pkgversion}-setuptools BuildRequires: python3-rpm-macros # for meminfo-writer From 68fdbd9a30ab440c212cf96c213d16f044ba302f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= Date: Sat, 29 Mar 2025 04:31:16 +0100 Subject: [PATCH 2/6] rpm: relax regex in %files Do try to match paths exactly as they get built on Fedora. Especially, on openSUSE the version of the package and the version of the python module differ slightly (package can have extra suffix). QubesOS/qubes-issues#6567 --- rpm_spec/qubes-utils.spec.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rpm_spec/qubes-utils.spec.in b/rpm_spec/qubes-utils.spec.in index 250e613..a6eb213 100644 --- a/rpm_spec/qubes-utils.spec.in +++ b/rpm_spec/qubes-utils.spec.in @@ -148,7 +148,7 @@ rm -rf $RPM_BUILD_ROOT %{python3_sitelib}/qubesimgconverter/imggen.py %{python3_sitelib}/qubesimgconverter/test.py %{python3_sitelib}/qubesimgconverter/test_integ.py -%{python3_sitelib}/qubesimgconverter-%{version}-py?.[0-9]*.egg-info +%{python3_sitelib}/qubesimgconverter-*.egg-info %{python3_sitelib}/qubesimgconverter/__pycache__ %files libs From 0cb070825cac251738b63b48b5fd30c3e5792da0 Mon Sep 17 00:00:00 2001 From: Saswat Padhi Date: Sun, 4 May 2025 23:48:10 -0700 Subject: [PATCH 3/6] Add gptfix and swapon to Arch Linux initramfs --- archlinux/PKGBUILD-initcpio-install.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/archlinux/PKGBUILD-initcpio-install.sh b/archlinux/PKGBUILD-initcpio-install.sh index 598052a..703b04a 100644 --- a/archlinux/PKGBUILD-initcpio-install.sh +++ b/archlinux/PKGBUILD-initcpio-install.sh @@ -5,7 +5,9 @@ build() { add_module "xen-blkfront" add_binary "/usr/bin/sfdisk" add_binary "/usr/bin/mkswap" + add_binary "/usr/bin/swapon" add_binary "/usr/bin/dmsetup" + add_binary "/usr/bin/gptfix" add_binary "/usr/lib/qubes/qubes_cow_setup.sh" add_runscript From d1af3f7775933b3856affab6e811779841b2f742 Mon Sep 17 00:00:00 2001 From: Saswat Padhi Date: Sun, 25 May 2025 13:25:26 -0700 Subject: [PATCH 4/6] Fix the order of mkinitcpio hooks As documented on ArchWiki [1], the `lvm2` hook must appear after the `block` and before the `filesystems` hook. Otherwise, LVM might attempt to activate logical volumes before the underlying block devices are available. [1]: https://wiki.archlinux.org/title/Install_Arch_Linux_on_LVM#Adding_mkinitcpio_hooks --- archlinux/PKGBUILD-qubes-vm-kernel-support.install | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/archlinux/PKGBUILD-qubes-vm-kernel-support.install b/archlinux/PKGBUILD-qubes-vm-kernel-support.install index a70b643..1afb8b4 100644 --- a/archlinux/PKGBUILD-qubes-vm-kernel-support.install +++ b/archlinux/PKGBUILD-qubes-vm-kernel-support.install @@ -22,7 +22,7 @@ $end" if [[ ! -s /etc/default/grub ]]; then echo >> /etc/default/grub fi - sed -Ei 's/^(HOOKS=[("])base/\1lvm2 qubes base/' /etc/mkinitcpio.conf + sed -Ei '/^HOOKS=/ s/(block)/\1 lvm2 qubes/' /etc/mkinitcpio.conf echo 'Adding qubes required hooks to /etc/default/grub' sed -Ei "/^$begin\$/,/^$end\$/{ \$c$combined @@ -41,7 +41,7 @@ post_upgrade () { post_remove () { local begin='### BEGIN QUBES HOOKS ###' end='### END QUBES HOOKS ###' echo 'Removing qubes required hooks from mkinitcpio.conf' - sed -Ei 's/^(HOOKS=[("])lvm2 qubes base/\1base/' /etc/mkinitcpio.conf + sed -Ei '/^HOOKS=/ s/(block) lvm2 qubes/\1/' /etc/mkinitcpio.conf echo 'Removing qubes required hooks from /etc/default/grub' sed -Ei "/^$begin\$/,/^$end\$/d" /etc/default/grub grub-mkconfig -o /boot/grub/grub.cfg From 2a2533dfdd4a4014c9b3da3b935f20289edc71cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= Date: Thu, 29 May 2025 04:40:20 +0200 Subject: [PATCH 5/6] archlinux: include scrub_pages initrd hook Sync initramfs on Arch with other distros. See 456fe99 "Disable scrubbing memory pages during initial balloon down" for description what this hook does. --- archlinux/PKGBUILD-initcpio-hook.sh | 3 ++- archlinux/PKGBUILD-initcpio-install.sh | 5 ++++- archlinux/PKGBUILD.in | 1 + 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/archlinux/PKGBUILD-initcpio-hook.sh b/archlinux/PKGBUILD-initcpio-hook.sh index 6713940..bcc55dc 100644 --- a/archlinux/PKGBUILD-initcpio-hook.sh +++ b/archlinux/PKGBUILD-initcpio-hook.sh @@ -4,6 +4,7 @@ run_earlyhook() { msg "Starting Qubes copy on write setup script" + /usr/lib/qubes/scrub_pages.sh /usr/lib/qubes/qubes_cow_setup.sh -} \ No newline at end of file +} diff --git a/archlinux/PKGBUILD-initcpio-install.sh b/archlinux/PKGBUILD-initcpio-install.sh index 703b04a..cbadc5b 100644 --- a/archlinux/PKGBUILD-initcpio-install.sh +++ b/archlinux/PKGBUILD-initcpio-install.sh @@ -8,10 +8,13 @@ build() { add_binary "/usr/bin/swapon" add_binary "/usr/bin/dmsetup" add_binary "/usr/bin/gptfix" + add_binary "/usr/lib/qubes/scrub_pages.sh" add_binary "/usr/lib/qubes/qubes_cow_setup.sh" add_runscript - + + # Mark it's safe to add scrub_pages=0 to the kernel cmdline now + echo 1 > /var/lib/qubes/initramfs-updated } help() { diff --git a/archlinux/PKGBUILD.in b/archlinux/PKGBUILD.in index 00d6633..bc92596 100644 --- a/archlinux/PKGBUILD.in +++ b/archlinux/PKGBUILD.in @@ -61,6 +61,7 @@ package_qubes-vm-kernel-support() { install -m 611 "${srcdir}/${_pkgnvr}/archlinux/PKGBUILD-initcpio-install.sh" "${pkgdir}/usr/lib/initcpio/install/qubes" install -m 611 "${srcdir}/${_pkgnvr}/archlinux/PKGBUILD-initcpio-hook.sh" "${pkgdir}/usr/lib/initcpio/hooks/qubes" install -m 755 "${srcdir}/${_pkgnvr}/dracut/full-dmroot/qubes_cow_setup.sh" "${pkgdir}/usr/lib/qubes/qubes_cow_setup.sh" + install -m 755 "${srcdir}/${_pkgnvr}/dracut/xen-balloon-scrub-pages/scrub_pages.sh" "${pkgdir}/usr/lib/qubes/scrub_pages.sh" install -m 0644 "${srcdir}/${_pkgnvr}/grub/grub.qubes-kernel-vm-support" "${pkgdir}/etc/default/grub.qubes-kernel-vm-support" make install-gptfix SBINDIR=/usr/bin "DESTDIR=$pkgdir" } From 5886a77cf79be2ba4b686733f7a8ee13ad2fde47 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= Date: Thu, 29 May 2025 11:19:18 +0200 Subject: [PATCH 6/6] archlinux/initcpio: add required modules directly ... instead of depending on lvm2 hook. The latter tries to pull in several more files that aren't needed (like lvm2 configs and udev rules) or even installed. --- archlinux/PKGBUILD-initcpio-install.sh | 4 ++++ archlinux/PKGBUILD-qubes-vm-kernel-support.install | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/archlinux/PKGBUILD-initcpio-install.sh b/archlinux/PKGBUILD-initcpio-install.sh index cbadc5b..6fcc5c5 100644 --- a/archlinux/PKGBUILD-initcpio-install.sh +++ b/archlinux/PKGBUILD-initcpio-install.sh @@ -10,6 +10,10 @@ build() { add_binary "/usr/bin/gptfix" add_binary "/usr/lib/qubes/scrub_pages.sh" add_binary "/usr/lib/qubes/qubes_cow_setup.sh" + + map add_module \ + 'dm-mod' \ + 'dm-snapshot' add_runscript diff --git a/archlinux/PKGBUILD-qubes-vm-kernel-support.install b/archlinux/PKGBUILD-qubes-vm-kernel-support.install index 1afb8b4..f99ac64 100644 --- a/archlinux/PKGBUILD-qubes-vm-kernel-support.install +++ b/archlinux/PKGBUILD-qubes-vm-kernel-support.install @@ -22,7 +22,7 @@ $end" if [[ ! -s /etc/default/grub ]]; then echo >> /etc/default/grub fi - sed -Ei '/^HOOKS=/ s/(block)/\1 lvm2 qubes/' /etc/mkinitcpio.conf + sed -Ei '/^HOOKS=/ s/(block)/\1 qubes/' /etc/mkinitcpio.conf echo 'Adding qubes required hooks to /etc/default/grub' sed -Ei "/^$begin\$/,/^$end\$/{ \$c$combined @@ -41,7 +41,7 @@ post_upgrade () { post_remove () { local begin='### BEGIN QUBES HOOKS ###' end='### END QUBES HOOKS ###' echo 'Removing qubes required hooks from mkinitcpio.conf' - sed -Ei '/^HOOKS=/ s/(block) lvm2 qubes/\1/' /etc/mkinitcpio.conf + sed -Ei '/^HOOKS=/ s/(block) (lvm2 )?qubes/\1/' /etc/mkinitcpio.conf echo 'Removing qubes required hooks from /etc/default/grub' sed -Ei "/^$begin\$/,/^$end\$/d" /etc/default/grub grub-mkconfig -o /boot/grub/grub.cfg