-
Notifications
You must be signed in to change notification settings - Fork 52
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Jacob Weinstock <[email protected]>
- Loading branch information
1 parent
8c422ad
commit f88dbe3
Showing
20 changed files
with
488 additions
and
1,960 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,6 @@ | ||
| FROM linuxkit/alpine:e2391e0b164c57db9f6c4ae110ee84f766edc430 AS kernel-build | ||
| ARG BUILD_IMAGE | ||
| FROM ${BUILD_IMAGE} AS kernel-build | ||
| ARG BUILD_IMAGE | ||
| RUN apk add \ | ||
| argp-standalone \ | ||
| automake \ | ||
|
|
@@ -16,10 +18,12 @@ RUN apk add \ | |
| installkernel \ | ||
| kmod \ | ||
| elfutils-dev \ | ||
| libunwind-dev \ | ||
| linux-headers \ | ||
| mpc1-dev \ | ||
| mpfr-dev \ | ||
| ncurses-dev \ | ||
| openssl \ | ||
| openssl-dev \ | ||
| patch \ | ||
| rsync \ | ||
|
|
@@ -30,23 +34,18 @@ RUN apk add \ | |
| xz-dev \ | ||
| zlib-dev | ||
|
|
||
| # libunwind-dev pkg is missing for s390x for now. Only install on other arch | ||
| RUN [ $(uname -m) != s390x ] && apk add libunwind-dev || true | ||
|
|
||
| ARG KERNEL_VERSION | ||
| ARG KERNEL_SERIES | ||
| ARG EXTRA | ||
| ARG DEBUG | ||
|
|
||
| ENV WIREGUARD_VERSION=1.0.20200506 | ||
| ENV WIREGUARD_SHA256="98a99f2b825a82d57a7213e666f1ee4f7cc02bddb09bf4908b4b09447a8f121e" | ||
| ENV WIREGUARD_URL=https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${WIREGUARD_VERSION}.tar.xz | ||
|
|
||
| # We copy the entire directory. This copies some unneeded files, but | ||
| # allows us to check for the existence /patches-${KERNEL_SERIES} to | ||
| # build kernels without patches. | ||
| COPY / / | ||
|
|
||
| RUN mkdir -p /out/src | ||
|
|
||
| # Download and verify kernel | ||
| # PGP keys: 589DA6B1 ([email protected]) & 6092693E ([email protected]) & 00411886 ([email protected]) | ||
| RUN KERNEL_MAJOR=$(echo ${KERNEL_VERSION} | cut -d . -f 1) && \ | ||
|
|
@@ -60,19 +59,17 @@ RUN KERNEL_MAJOR=$(echo ${KERNEL_VERSION} | cut -d . -f 1) && \ | |
| KERNEL_SHA256=$(grep linux-${KERNEL_VERSION}.tar.xz sha256sums.asc | cut -d ' ' -f 1) && \ | ||
| [ -f linux-${KERNEL_VERSION}.tar.xz ] || curl -fsSLO ${KERNEL_SOURCE} && \ | ||
| echo "${KERNEL_SHA256} linux-${KERNEL_VERSION}.tar.xz" | sha256sum -c - && \ | ||
| xz -T 0 -d linux-${KERNEL_VERSION}.tar.xz && \ | ||
| xz -d linux-${KERNEL_VERSION}.tar.xz && \ | ||
| curl -fsSLO ${KERNEL_PGP2_SIGN} && \ | ||
| gpg2 --verify linux-${KERNEL_VERSION}.tar.sign linux-${KERNEL_VERSION}.tar && \ | ||
| cat linux-${KERNEL_VERSION}.tar | tar --absolute-names -x && mv /linux-${KERNEL_VERSION} /linux | ||
|
|
||
|
|
||
| RUN mkdir -p /out/src | ||
| cat linux-${KERNEL_VERSION}.tar | tar --absolute-names -x && mv /linux-${KERNEL_VERSION} /linux && \ | ||
| printf "KERNEL_SOURCE=${KERNEL_SOURCE}\n" > /out/kernel-source-info | ||
|
|
||
| WORKDIR /tmp | ||
| # Download Intel ucode, create a CPIO archive for it, and keep it in the build context | ||
| # so the firmware can also be referenced with CONFIG_EXTRA_FIRMWARE | ||
| ENV UCODE_REPO=https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files | ||
| ENV UCODE_COMMIT=microcode-20191115 | ||
| ENV UCODE_COMMIT=microcode-20210608 | ||
| RUN set -e && \ | ||
| if [ $(uname -m) == x86_64 ]; then \ | ||
| git clone ${UCODE_REPO} ucode && \ | ||
|
|
@@ -105,27 +102,17 @@ RUN set -e && \ | |
| done; \ | ||
| fi | ||
|
|
||
|
|
||
|
|
||
| # Save kernel source | ||
| RUN tar cJf /out/src/linux.tar.xz /linux | ||
| RUN XZ_DEFAULTS="-T0" tar cJf /out/src/linux.tar.xz /linux | ||
|
|
||
| # Kernel config | ||
| # The s390x defconfig moved with 5.2.x | ||
| RUN case $(uname -m) in \ | ||
| x86_64) \ | ||
| KERNEL_DEF_CONF=/linux/arch/x86/configs/x86_64_defconfig; \ | ||
| ;; \ | ||
| aarch64) \ | ||
| KERNEL_DEF_CONF=/linux/arch/arm64/configs/defconfig; \ | ||
| ;; \ | ||
| s390x) \ | ||
| if [ -f /linux/arch/s390/defconfig ]; then \ | ||
| KERNEL_DEF_CONF=/linux/arch/s390/defconfig; \ | ||
| else \ | ||
| KERNEL_DEF_CONF=/linux/arch/s390/configs/defconfig; \ | ||
| fi; \ | ||
| ;; \ | ||
| esac && \ | ||
| cp /config-${KERNEL_SERIES}-$(uname -m) ${KERNEL_DEF_CONF}; \ | ||
| if [ -n "${EXTRA}" ] && [ -f "/config-${KERNEL_SERIES}-$(uname -m)${EXTRA}" ]; then \ | ||
|
|
@@ -142,41 +129,20 @@ RUN case $(uname -m) in \ | |
|
|
||
|
|
||
| # Kernel | ||
| RUN case $(uname -m) in \ | ||
| s390x) \ | ||
| KCFLAGS="-fno-pie -fPIC"; \ | ||
| ;; \ | ||
| *) \ | ||
| KCFLAGS="-fno-pie"; \ | ||
| ;; \ | ||
| esac && \ | ||
| make -j "$(getconf _NPROCESSORS_ONLN)" KCFLAGS="$KCFLAGS" && \ | ||
| RUN make -j "$(getconf _NPROCESSORS_ONLN)" KCFLAGS="-fno-pie" && \ | ||
| case $(uname -m) in \ | ||
| x86_64) \ | ||
| cp arch/x86_64/boot/bzImage /out/kernel; \ | ||
| ;; \ | ||
| aarch64) \ | ||
| cp arch/arm64/boot/Image /out/kernel; \ | ||
| ;; \ | ||
| s390x) \ | ||
| cp arch/s390/boot/bzImage /out/kernel; \ | ||
| cp arch/arm64/boot/Image.gz /out/kernel; \ | ||
| ;; \ | ||
| esac && \ | ||
| cp System.map /out && \ | ||
| ([ -n "${DEBUG}" ] && cp vmlinux /out || true) | ||
|
|
||
| # WireGuard (skip kernels which have it in tree) | ||
| RUN if [ ! -d /linux/drivers/net/wireguard ]; then \ | ||
| curl -fsSL -o /wireguard.tar.xz "${WIREGUARD_URL}" && \ | ||
| echo "${WIREGUARD_SHA256} /wireguard.tar.xz" | sha256sum -c - && \ | ||
| cp /wireguard.tar.xz /out/src/ && \ | ||
| tar -C / --one-top-level=wireguard --strip-components=2 -xJf /wireguard.tar.xz "wireguard-linux-compat-${WIREGUARD_VERSION}/src" && \ | ||
| make -j "$(getconf _NPROCESSORS_ONLN)" M="/wireguard" modules; \ | ||
| fi | ||
|
|
||
| # Modules and Device Tree binaries | ||
| RUN make INSTALL_MOD_PATH=/tmp/kernel-modules modules_install && \ | ||
| make INSTALL_MOD_PATH=/tmp/kernel-modules M="/wireguard" modules_install && \ | ||
| ( DVER=$(basename $(find /tmp/kernel-modules/lib/modules/ -mindepth 1 -maxdepth 1)) && \ | ||
| cd /tmp/kernel-modules/lib/modules/$DVER && \ | ||
| rm build source && \ | ||
|
|
@@ -208,8 +174,7 @@ RUN DVER=$(basename $(find /tmp/kernel-modules/lib/modules/ -mindepth 1 -maxdept | |
| tar cf - -T - | (cd $dir; tar xf -) && \ | ||
| ( cd /tmp && tar cf /out/kernel-dev.tar usr/src ) | ||
|
|
||
| RUN printf "KERNEL_SOURCE=${KERNEL_SOURCE}\n" > /out/kernel-source-info | ||
|
|
||
| RUN printf "${BUILD_IMAGE}" > /out/kernel-builder | ||
|
|
||
| FROM scratch | ||
| ENTRYPOINT [] | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| # syntax=docker/dockerfile:1.3-labs | ||
|
|
||
| ARG BUILD_IMAGE | ||
|
|
||
| FROM ${BUILD_IMAGE} AS kernel-build | ||
| ARG KERNEL_VERSIONS | ||
| ARG TARGETARCH | ||
|
|
||
| RUN apk add \ | ||
| argp-standalone \ | ||
| bison \ | ||
| build-base \ | ||
| curl \ | ||
| diffutils \ | ||
| flex \ | ||
| gmp-dev \ | ||
| libarchive-tools \ | ||
| mpc1-dev \ | ||
| mpfr-dev \ | ||
| ncurses-dev \ | ||
| patch \ | ||
| xz | ||
|
|
||
| COPY / / | ||
|
|
||
| # Unpack kernels (download if not present) | ||
| RUN <<EOF | ||
| set -e | ||
| for VERSION in ${KERNEL_VERSIONS}; do | ||
| MAJOR=$(echo ${VERSION} | cut -d . -f 1) | ||
| MAJOR=v${MAJOR}.x | ||
| echo "Downloading/Unpacking $VERSION" | ||
| KERNEL_SOURCE=https://www.kernel.org/pub/linux/kernel/${MAJOR}/linux-${VERSION}.tar.xz | ||
| if [ ! -f sources/linux-${VERSION}.tar.xz ] ; then | ||
| curl -fSLo sources/linux-${VERSION}.tar.xz --create-dirs ${KERNEL_SOURCE} | ||
| fi | ||
| bsdtar xf sources/linux-${VERSION}.tar.xz | ||
| done | ||
| EOF | ||
|
|
||
| # Apply patches to all kernels and move config files into place | ||
| RUN <<EOF | ||
| set -e | ||
| for VERSION in ${KERNEL_VERSIONS}; do | ||
| SERIES=${VERSION%.*}.x | ||
| echo "Patching $VERSION $SERIES" | ||
| cd /linux-${VERSION} | ||
| if [ -d /patches-${SERIES} ]; then | ||
| for patch in /patches-${SERIES}/*.patch; do | ||
| echo "Applying $patch" | ||
| patch -t -F0 -N -u -p1 < "$patch" | ||
| done | ||
| fi | ||
| if [ ${TARGETARCH} = "amd64" ] ; then | ||
| cp /config-${SERIES}-x86_64 .config | ||
| ARCH=x86 make oldconfig | ||
| ls | ||
| elif [ ${TARGETARCH} = "arm64" ] ; then | ||
| cp /config-${SERIES}-aarch64 .config | ||
| ARCH=arm64 make oldconfig | ||
| fi | ||
| done | ||
| EOF | ||
|
|
||
| ENTRYPOINT ["/bin/sh"] | ||
|
|
||
| FROM scratch | ||
| ARG KERNEL_VERSIONS | ||
| ARG TARGETARCH | ||
| WORKDIR / | ||
| COPY --from=kernel-build /linux-${KERNEL_VERSIONS}/.config config-${KERNEL_VERSIONS}-$TARGETARCH |
Oops, something went wrong.