overlayfs refuse to use R/O upperdir. Since dmroot is properly set
already, it's ok to mount it R/W.
But remount it later R/O, to not confuse startup scripts.
FixesQubesOS/qubes-issues#5087
(cherry picked from commit 84188910cf)
If overlay fs is available, use it for /lib/modules. This way the whole
/lib/modules will be writable and changes (like extra modules) will
persist in TemplateVM/StandaloneVM.
In practice, this will allow to conveniently build in-vm kernel modules,
even for dom0-provided kernels.
QubesOS/qubes-issues#2908
This will allow dkms to skip u2mfn module install if one is already
shipped with the kernel package - which is the case for kernels
delivered through dom0.
Make the version high enough to be considered newer than dkms package.
Sadly, it does not prevent module build. And the build fails becaue of
mismatching compiler version (kernel headers include gcc plugins).
Skip the build by setting BUILD_EXCLUSIVE_KERNEL in dkms.conf. Ideally,
we'd set some value indicating "don't build on kernel *qubes*", but
this variable does not support negation. So, set this variable to a
dummy value after manually checking $kernelver variable.
FixesQubesOS/qubes-issues#4963
Rebuild initramfs on package upgrade (already done for Debian
previously) and store 1 into /var/lib/qubes/initramfs-updated. Then,
only add xen_scrub_pages=0 kernel option if
/var/lib/qubes/initramfs-updated is there (with "1" or greater number).
This way, if initramfs rebuild doesn't happen for any reason,
xen_scrub_pages=0 will not be added.
Fixes 456fe99 "Disable scrubbing memory pages during initial balloon down"
QubesOS/qubes-issues#1963
Phase out /proc/xen usage. Relevant device files are available in
/dev/xen. Dom0 check can be replaced with uuid check - dom0 have
well-known value of all-0.
QubesOS/qubes-issues#2540
Starting with Linux 4.18, there is new device node for issuing
hypercalls from user space - /dev/xen/hypercall (partially duplicating
functionality of /dev/xen/privcmd). New Xen tools (4.12) make use of it,
so make it available for them. Otherwise such tools will fail the
operation (there is no fallback to privcmd on EACCESS).
Indicate when the dracut "qubes-vm-simple" module supports (re-)enabling
xen_scrub_pages option. This means the kernel can be safely booted with
xen_scrub_pages=0.
QubesOS/qubes-issues#1963
Don't try to dereference "Root filesytem" partlabel symlink, unless it's
really present (not only directory for it).
Also, use udevadm settle for waiting for /dev/xvda, instead of naive
wait sleep loop.
Balloon driver scrub memory page before giving it back to the
hypervisor. Normally this is a good thing, to avoid leaking VM's memory
data into Xen and other domains. But during initial startup when maxmem
is bigger than initial memory, on HVM and PVH, Populate-on-Demand (PoD) is in use.
This means every page on initial balloon down needs to be first mapped
by Xen into VM's memory (as it wasn't populated before - and in fact
didn't have any data), scrubbed by the kernel and then given back to
Xen. This is great waste of time. Such operation with default settings
(initial memory 400M, maxmem 4000M) can take few seconds, delaying every
VM startup (including DispVM). In extreme situation, when running inside
nested virtualization, the effect is much worse.
Avoid this problem by disabling memory scrubbing during initial boot,
and re-enable it as soon as user space kicks in - in initramfs, before
mounting root filesystem, to be sure it's enabled before memory contains
any kind of secrets.
This commit handle only one case - when kernel in managed by the VM
itself. It is critical to enable initramfs module whenever
xen_scrub_pages=0 kernel option is given, so make them depend on the
same condition and ship them in the same package.
FixesQubesOS/qubes-issues#1963
Recently some applications ships with large icons like 1024x1024
(Signal-desktop for example). To not degrade any fancy HiDPI 8K
experience, allow for that, instead of downscaling.
The max icon size is only anti-DoS protection anyway.
Don't rely on python -> python2 symlink and default %{python_*} macros.
Add explicit BR: gcc (default build env for fc29 doesn't have it
anymore).
QubesOS/qubes-issues#4223
qubes-vm@.service would already cause this ordering, but not every user
has any autostart=True VMs.
Also needed to maybe f*x QubesOS/qubes-issues#3149 at some point.
When root device is available read-write (TemplateVM/StandaloneVM), its
mounted directly, instead of using device-mapper layer. But
/dev/mapper/dmroot still needs to exists (it is pointed from
/etc/fstab), otherwise various tools, including grub-mkconfig get
confused.
Create a symlink using udev rule. It is already done in initramfs, and
in case of Fedora that udev rule/symlink survive switching to
non-initramfs udev, but not on Debian. So, add appropriate udev rules
file.
FixesQubesOS/qubes-issues#3178
The script call is quite expensive (it does multiple things, including
checking device-mapper, qubesdb etc). Don't call it for devices we (or
else) already excluded earlier.
This is the most relevant for dom0, where udev "change" event is
triggered quite often, for multiple LVM volumes - all excluded, because
being VM's disks.
* qubesos/pr/33:
drop busybox dependance
centos: fix python packages names
Remove busybox as it is not provided in RHEL7 anymore
Fix python3 package names with respect to CentOS for consistency with python34 names
Reduce code duplication by moving parsing of "QUBESRPC" magic command to
one place.
Call qubes-rpc-multiplexer directly with execve(), to avoid string
expansions in its parameters.
