For using #QEMU in #CI generating ephemeral #SSH key pair is one option but after playing for a while with that option I realised that you can create named pipes:
mkfifo tty.{in,out}
And then pass -serial pipe:tty
to QEMU. After this commands can be emitted to tty.in
and the output can be read from tty.out
.
I think this a quite good strategy when having to orchestrate headless QEMU instances without any high-level infrastructure, such as libvirt
.
I packed swtpm
for the #QEMU build so it does not have to be installed to the system:
https://github.com/jarkkojs/tpmdd-buildroot-external
start-qemu.sh
will automatically setup shenanigans so that swtpm
will work as TPM emulation host for QEMU.
After build there’s three options:
output/build/images/start-qemu.sh
output/build/images/start-qemu.sh --tpm-crb
output/build/images/start-qemu.sh --tpm1
Right, and neither QEMU needs to be installed to the host. I’m trying to sort of construct this in a way that it would become as CI friendly as possible so that this could be in addition used as a CI workload for keyutils
.
My new (WiP) orchestrator for building test image for testing my #kernel tree is fully implemented with GNU make:
# SPDX-License-Identifier: MIT
ROOT := $(dir $(abspath $(firstword $(MAKEFILE_LIST))))
BUILDROOT_VERSION := 2023.11
OUTPUT := $(ROOT)output
BUILDROOT_URL := https://buildroot.org/downloads/buildroot-$(BUILDROOT_VERSION).tar.gz
EXTERNAL_URL := https://github.com/jarkkojs/tpmdd-buildroot-external/tarball/main
define make-buildroot
make -C "$(OUTPUT)/buildroot" BR2_EXTERNAL="$(OUTPUT)/external" O="$(OUTPUT)/build" $(1)
endef
define download-package
mkdir -p $(2)
curl -sL "$(1)" | tar -zxv -C "$(2)" --strip-components=1
endef
all: buildroot
.PHONY: buildroot
buildroot: $(OUTPUT)/download-stamp
$(call make-buildroot,tpmdd_qemu_x86_64_defconfig)
$(call make-buildroot,all)
.PHONY: buildroot-menuconfig
buildroot-menuconfig: $(OUTPUT)/download-stamp
$(call make-buildroot,tpmdd_qemu_x86_64_defconfig)
$(call make-buildroot,menuconfig)
$(call make-buildroot,savedefconfig)
.PHONY: linux-menuconfig
linux-menuconfig: $(OUTPUT)/download-stamp
$(call make-buildroot,tpmdd_qemu_x86_64_defconfig)
$(call make-buildroot,linux-menuconfig)
$(call make-buildroot,linux-savedefconfig)
$(OUTPUT)/download-stamp:
$(call download-package,"$(BUILDROOT_URL)","$(OUTPUT)/buildroot")
$(call download-package,"$(EXTERNAL_URL)","$(OUTPUT)/external")
touch $@
.PHONY: clean
clean:
rm -rf "$(OUTPUT)"
It is pretty robust structure because I can e.g. easily add packages (like maybe host swtpm) in a robust manner to buildroot.
To test latest linux-tpmdd
changes:
git clone https://github.com/jarkkojs/test-tpmdd
cd test-tpmdd
make
Then:
output/images/start-qemu.sh --swtpm
output/images/start-qemu.sh --swtpm --tpm-crb
output/images/start-qemu.sh --swtpm --tpm1
Tools for testing (more in future):
keyutils
for testing keyring and trusted keys/usr/lib/kselftests/run_selftests.sh
Requires swtpm
to be installed (but not QEMU, it will build one).
Linus might be willing to drop support for i486-class machines[1] from the #Linux #kernel.
No, nobody asked for that directly; he brought that up in a discussion himself: https://lore.kernel.org/all/CAHk-%3DwhESMW2v0cd0Ye%2BAnV0Hp9j%2BMm4BO2xJo93eQcC1xghUA@mail.gmail.com/ #LinuxKernel
[1] and a couple of processors which _claimed_ to be Pentium class, but weren't
Scumm Bar 3D technique explained and open-sourced! ⌨️🗒️📺
Apologies it took so long and thank you to everyone chasing me to make this follow-up ❤️🔥
RVX Projector:
https://github.com/mausimus/rvx-projector