mod_image_for_recovery: keep the stateful partition around.

mod_image_for_recovery.sh

 #!/bin/bash
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # This script modifies a base image to act as a recovery installer.
 # If no kernel image is supplied, it will build a devkeys signed recovery
 # kernel.  Alternatively, a signed recovery kernel can be used to
 # create a Chromium OS recovery image.
 
 # Load common constants.  This should be the first executable line.
 # The path to common.sh should be relative to your script's location.
 . "$(dirname "$0")/common.sh"
 
 # Load functions and constants for chromeos-install
 . "$(dirname "$0")/chromeos-common.sh"
 
 # For update_partition_table
 . "$(dirname "$0")/resize_stateful_partition.sh"
 
 
 # We need to be in the chroot to emerge test packages.
 assert_inside_chroot
 
 get_default_board
 
 DEFINE_string board "$DEFAULT_BOARD" "Board for which the image was built" b
 DEFINE_integer statefulfs_sectors 4096 \
-  "Number of sectors to use for the stateful filesystem"
+  "Number of sectors to use for the stateful filesystem when minimizing"
 # Skips the build steps and just does the kernel swap.
 DEFINE_string kernel_image "" \
     "Path to a pre-built recovery kernel"
 DEFINE_string kernel_outfile "" \
     "Filename and path to emit the kernel outfile to. \
 If empty, emits to IMAGE_DIR."
 DEFINE_string image "" "Path to the image to use"
 DEFINE_string to "" \
     "Path to the image to create. If empty, defaults to \
 IMAGE_DIR/recovery_image.bin."
 DEFINE_boolean kernel_image_only $FLAGS_FALSE \
     "Emit the recovery kernel image only"
 DEFINE_boolean sync_keys $FLAGS_TRUE \
     "Update the kernel to be installed with the vblock from stateful"
+DEFINE_boolean minimize_image $FLAGS_TRUE \
+    "Decides if the original image is used or a minimal recovery image is \
+created."
+DEFINE_boolean modify_in_place $FLAGS_FALSE \
+    "Modifies the source image in place. This cannot be used with \
+--minimize_image."
 DEFINE_integer jobs -1 \
     "How many packages to build in parallel at maximum." j
 DEFINE_string build_root "/build" \
     "The root location for board sysroots."
 
 DEFINE_string rootfs_hash "/tmp/rootfs.hash" \
   "Path where the rootfs hash should be stored."
 
+DEFINE_boolean verbose $FLAGS_FALSE \
+    "Log all commands to stdout." v
+
 # Keep in sync with build_image.
 DEFINE_string keys_dir "/usr/share/vboot/devkeys" \
   "Directory containing the signing keys."
 
 # Parse command line
 FLAGS "$@" || exit 1
 eval set -- "${FLAGS_ARGV}"
 
+if [ $FLAGS_verbose -eq $FLAGS_FALSE ]; then
+  exec 2>/dev/null
+  # Redirecting to stdout instead of stderr since
+  # we silence  stderr above.
+  die() {
+    echo -e "${V_BOLD_RED}ERROR  : $1${V_VIDOFF}"
+    exit 1
+  }
+fi
+set -x  # Make debugging with -v easy.
+
 EMERGE_CMD="emerge"
 EMERGE_BOARD_CMD="emerge-${FLAGS_board}"
 
 # No board, no default and no image set then we can't find the image
 if [ -z $FLAGS_image ] && [ -z $FLAGS_board ] ; then
   setup_board_warning
   die "mod_image_for_recovery failed.  No board set and no image set"
 fi
 
 # We have a board name but no image set.  Use image at default location
@@ skipping 100 matching lines @@
   # chromeos-recovery interfaces are the same.  It allows for the signer
   # to just compute the new hash and update the kernel command line during
   # recovery image generation.  (Alternately, it means an image can be created,
   # modified for recovery, then passed to a signer which can then sign both
   # partitions appropriately without needing any external dependencies.)
   local kern_offset=$(partoffset "$FLAGS_image" 2)
   local kern_size=$(partsize "$FLAGS_image" 2)
   local kern_tmp=$(mktemp)
   local kern_hash=
 
-  dd if="$FLAGS_image" bs=512 count=$kern_size skip=$kern_offset of="$kern_tmp"
+  dd if="$FLAGS_image" bs=512 count=$kern_size \
+     skip=$kern_offset of="$kern_tmp" 1>&2
   # We're going to use the real signing block.
   if [ $FLAGS_sync_keys -eq $FLAGS_TRUE ]; then
-    dd if="$INSTALL_VBLOCK" of="$kern_tmp" conv=notrunc
+    dd if="$INSTALL_VBLOCK" of="$kern_tmp" conv=notrunc 1>&2
   fi
   local kern_hash=$(sha1sum "$kern_tmp" | cut -f1 -d' ')
   rm "$kern_tmp"
 
   # TODO(wad) add FLAGS_boot_args support too.
   ${SCRIPTS_DIR}/build_kernel_image.sh \
     --arch="${ARCH}" \
     --to="$RECOVERY_KERNEL_IMAGE" \
     --hd_vblock="$RECOVERY_KERNEL_VBLOCK" \
     --vmlinuz="$vmlinuz" \
     --working_dir="${IMAGE_DIR}" \
     --boot_args="panic=60 cros_recovery kern_b_hash=$kern_hash" \
     --keep_work \
     --rootfs_image=${root_dev} \
     --rootfs_hash=${FLAGS_rootfs_hash} \
     --root=${cros_root} \
     --keys_dir="${FLAGS_keys_dir}" \
     --nouse_dev_keys \
-    ${verity_args}
+    ${verity_args} 1>&2
   sudo rm "$FLAGS_rootfs_hash"
   sudo losetup -d "$root_dev"
   trap - RETURN
 
   # Update the EFI System Partition configuration so that the kern_hash check
   # passes.
   local efi_dev=$(sudo losetup -f)
   local efi_offset=$(partoffset "$FLAGS_image" 12)
   local efi_size=$(partsize "$FLAGS_image" 12)
 
@@ skipping 15 matching lines @@
   sudo losetup -d "$efi_dev"
   rmdir "$efi_dir"
   trap - EXIT
 }
 
 install_recovery_kernel() {
   local kern_a_offset=$(partoffset "$RECOVERY_IMAGE" 2)
   local kern_a_size=$(partsize "$RECOVERY_IMAGE" 2)
   local kern_b_offset=$(partoffset "$RECOVERY_IMAGE" 4)
   local kern_b_size=$(partsize "$RECOVERY_IMAGE" 4)
+
+  if [ $kern_b_size -eq 1 ]; then
+    echo "Image was created with no KERN-B partition reserved!" 1>&2
+    echo "Cannot proceed." 1>&2
+    return 1
+  fi
+
   # Backup original kernel to KERN-B
   dd if="$RECOVERY_IMAGE" of="$RECOVERY_IMAGE" bs=512 \
      count=$kern_a_size \
      skip=$kern_a_offset \
      seek=$kern_b_offset \
      conv=notrunc
 
   # We're going to use the real signing block.
   if [ $FLAGS_sync_keys -eq $FLAGS_TRUE ]; then
     dd if="$INSTALL_VBLOCK" of="$RECOVERY_IMAGE" bs=512 \
@@ skipping 21 matching lines @@
   rmdir "$esp_mnt"
   set -e
   if [ $failed -eq 1 ]; then
     echo "Failed to copy recovery kernel to ESP"
     return 1
   fi
   return 0
 }
 
 maybe_resize_stateful() {
+  # If we're not minimizing, then just copy and go.
+  if [ $FLAGS_minimize_image -eq $FLAGS_FALSE ]; then
+    if [ "$FLAGS_image" != "$RECOVERY_IMAGE" ]; then
+      cp "$FLAGS_image" "$RECOVERY_IMAGE"
+    fi
+    return 0
+  fi
+
   # Rebuild the image with a 1 sector stateful partition
   local err=0
   local small_stateful=$(mktemp)
   dd if=/dev/zero of="$small_stateful" bs=512 \
-    count=${FLAGS_statefulfs_sectors}
+    count=${FLAGS_statefulfs_sectors} 1>&2
   trap "rm $small_stateful" RETURN
   # Don't bother with ext3 for such a small image.
-  /sbin/mkfs.ext2 -F -b 4096 "$small_stateful"
+  /sbin/mkfs.ext2 -F -b 4096 "$small_stateful" 1>&2
 
   # If it exists, we need to copy the vblock over to stateful
   # This is the real vblock and not the recovery vblock.
   local new_stateful_mnt=$(mktemp -d)
 
   set +e
   sudo mount -o loop $small_stateful $new_stateful_mnt
   sudo cp "$INSTALL_VBLOCK" "$new_stateful_mnt/vmlinuz_hd.vblock"
   sudo mkdir "$new_stateful_mnt/var"
   sudo umount -d "$new_stateful_mnt"
   rmdir "$new_stateful_mnt"
   set -e
 
   # Create a recovery image of the right size
   # TODO(wad) Make the developer script case create a custom GPT with
   # just the kernel image and stateful.
-  update_partition_table "$FLAGS_image" "$small_stateful" 4096 "$RECOVERY_IMAGE"
+  update_partition_table "$FLAGS_image" "$small_stateful" 4096 \
+                         "$RECOVERY_IMAGE" 1>&2
   return $err
 }
 
+cleanup() {
+  set +e
+  if [ "$FLAGS_image" != "$RECOVERY_IMAGE" ]; then
+    rm "$RECOVERY_IMAGE"
+  fi
+  rm "$INSTALL_VBLOCK"
+}
+
 # main process begins here.
 
-# Make sure this is really what the user wants, before nuking the device
-echo "Creating recovery image ${FLAGS_to} from ${FLAGS_image} . . . "
-
 set -e
 set -u
 
 IMAGE_DIR="$(dirname "$FLAGS_image")"
 IMAGE_NAME="$(basename "$FLAGS_image")"
 RECOVERY_IMAGE="${FLAGS_to:-$IMAGE_DIR/recovery_image.bin}"
 RECOVERY_KERNEL_IMAGE=\
 "${FLAGS_kernel_outfile:-${IMAGE_DIR}/recovery_vmlinuz.image}"
 RECOVERY_KERNEL_VBLOCK="${RECOVERY_KERNEL_IMAGE}.vblock"
 STATEFUL_DIR="$IMAGE_DIR/stateful_partition"
 SCRIPTS_DIR=$(dirname "$0")
 
 # Mounts gpt image and sets up var, /usr/local and symlinks.
 # If there's a dev payload, mount stateful
 #  offset=$(partoffset "${FLAGS_from}/${filename}" 1)
 #  sudo mount ${ro_flag} -o loop,offset=$(( offset * 512 )) \
 #    "${FLAGS_from}/${filename}" "${FLAGS_stateful_mountpt}"
 # If not, resize stateful to 1 sector.
 #
 
 if [ $FLAGS_kernel_image_only -eq $FLAGS_TRUE -a \
      -n "$FLAGS_kernel_image" ]; then
   die "Cannot use --kernel_image_only with --kernel_image"
 fi
 
+if [ $FLAGS_modify_in_place -eq $FLAGS_TRUE ]; then
+  if [ $FLAGS_minimize_image -eq $FLAGS_TRUE ]; then
+    die "Cannot use --modify_in_place and --minimize_image together."
+  fi
+  RECOVERY_IMAGE="${FLAGS_image}"
+fi
+
+echo "Creating recovery image from ${FLAGS_image}"
+
 INSTALL_VBLOCK=$(get_install_vblock)
 if [ -z "$INSTALL_VBLOCK" ]; then
   die "Could not copy the vblock from stateful."
 fi
 
 if [ -z "$FLAGS_kernel_image" ]; then
   emerge_recovery_kernel
   create_recovery_kernel_image
+  echo "Recovery kernel created at $RECOVERY_KERNEL_IMAGE"
 else
   RECOVERY_KERNEL_IMAGE="$FLAGS_kernel_image"
 fi
-echo "Kernel emitted: $RECOVERY_KERNEL_IMAGE."
 
 if [ $FLAGS_kernel_image_only -eq $FLAGS_TRUE ]; then
   echo "Kernel emitted. Stopping there."
   rm "$INSTALL_VBLOCK"
   exit 0
 fi
 
-rm "$RECOVERY_IMAGE" || true  # Start fresh :)
+if [ $FLAGS_modify_in_place -eq $FLAGS_FALSE ]; then
+  rm "$RECOVERY_IMAGE" || true  # Start fresh :)
+fi
 
-trap "rm \"$RECOVERY_IMAGE\" && rm \"$INSTALL_VBLOCK\"" EXIT
+trap cleanup EXIT
 
-maybe_resize_stateful  # Also copies the image
+maybe_resize_stateful  # Also copies the image if needed.
 
 install_recovery_kernel
 
+echo "Recovery image created at $RECOVERY_IMAGE"
 print_time_elapsed
 trap - EXIT