6 files changed, 166 insertions, 32 deletions

diff --git a/meta/recipes-core/initrdscripts/initramfs-framework/finish b/meta/recipes-core/initrdscripts/initramfs-framework/finish
index 717383ebac..716c2f44af 100755
--- a/meta/recipes-core/initrdscripts/initramfs-framework/finish
+++ b/meta/recipes-core/initrdscripts/initramfs-framework/finish
@@ -12,15 +12,36 @@ finish_run() {
                         fatal "ERROR: There's no '/dev' on rootfs."
                 fi
 
+                # Unmount anything that was automounted by busybox via mdev-mount.sh.
+                # We're about to switch_root, and leaving anything mounted will prevent
+                # the next rootfs from modifying the block device.  Ignore ROOT_DISK,
+                # if it was set by setup-live, because it'll be mounted over loopback
+                # to ROOTFS_DIR.
+                local dev
+                for dev in /run/media/*; do
+                        if mountpoint -q "${dev}" && [ "${dev##*/}" != "${ROOT_DISK}" ]; then
+                                umount -f "${dev}" || debug "Failed to unmount ${dev}"
+                        fi
+                done
+
                 info "Switching root to '$ROOTFS_DIR'..."
 
+                debug "Moving basic mounts onto rootfs"
+                for dir in `awk '/\/dev.* \/run\/media/{print $2}' /proc/mounts`; do
+                        # Parse any OCT or HEX encoded chars such as spaces
+                        # in the mount points to actual ASCII chars
+                        dir=`printf $dir`
+                        mkdir -p "${ROOTFS_DIR}/media/${dir##*/}"
+                        mount -n --move "$dir" "${ROOTFS_DIR}/media/${dir##*/}"
+                done
+
                 debug "Moving /dev, /proc and /sys onto rootfs..."
                 mount --move /dev $ROOTFS_DIR/dev
                 mount --move /proc $ROOTFS_DIR/proc
                 mount --move /sys $ROOTFS_DIR/sys
 
                 cd $ROOTFS_DIR
-                exec switch_root -c /dev/console $ROOTFS_DIR ${bootparam_init:-/sbin/init}
+                exec switch_root $ROOTFS_DIR ${bootparam_init:-/sbin/init}
         else
                 debug "No rootfs has been set"
         fi
diff --git a/meta/recipes-core/initrdscripts/initramfs-framework/init b/meta/recipes-core/initrdscripts/initramfs-framework/init
index 567694aff7..a48b77e95e 100755
--- a/meta/recipes-core/initrdscripts/initramfs-framework/init
+++ b/meta/recipes-core/initrdscripts/initramfs-framework/init
@@ -54,20 +54,23 @@ debug() {
 }
 
 # Prints a message and start a endless loop
+# Force reboot if init_fatal_reboot bootparam is set
 fatal() {
-    echo $1 >/dev/console
-    echo >/dev/console
-
-    if [ -n "$bootparam_init_fatal_sh" ]; then
-        sh
-    else
-        while [ "true" ]; do
-                sleep 3600
-        done
-    fi
+        echo $1 >/dev/console
+        echo >/dev/console
+
+        if [ -n "$bootparam_init_fatal_reboot" ]; then
+                reboot -f
+        elif [ -n "$bootparam_init_fatal_sh" ]; then
+                sh
+        else
+                while [ "true" ]; do
+                        sleep 3600
+                done
+        fi
 }
 
-# Variables shared amoung modules
+# Variables shared among modules
 ROOTFS_DIR="/rootfs" # where to do the switch root
 MODULE_PRE_HOOKS=""  # functions to call before running each module
 MODULE_POST_HOOKS="" # functions to call after running each module
@@ -117,7 +120,7 @@ if grep -q devtmpfs /proc/filesystems; then
         mount -t devtmpfs devtmpfs /dev
 else
         if [ ! -d /dev ]; then
-                fatal "ERROR: /dev doesn't exist and kernel doesn't has devtmpfs enabled."
+                fatal "ERROR: /dev doesn't exist and kernel doesn't have devtmpfs enabled."
         fi
 fi
 
diff --git a/meta/recipes-core/initrdscripts/initramfs-framework/nfsrootfs b/meta/recipes-core/initrdscripts/initramfs-framework/nfsrootfs
index e67ee4c25d..30555aef55 100644
--- a/meta/recipes-core/initrdscripts/initramfs-framework/nfsrootfs
+++ b/meta/recipes-core/initrdscripts/initramfs-framework/nfsrootfs
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 nfsrootfs_enabled() {
-        if [ ${bootparam_root} != "/dev/nfs" ] || [ -z ${bootparam_nfsroot} ]; then
+        if [ "${bootparam_root}" != "/dev/nfs" ] || [ -z ${bootparam_nfsroot} ]; then
                 return 1
         fi
         return 0
diff --git a/meta/recipes-core/initrdscripts/initramfs-framework/overlayroot b/meta/recipes-core/initrdscripts/initramfs-framework/overlayroot
new file mode 100644
index 0000000000..0d41432878
--- /dev/null
+++ b/meta/recipes-core/initrdscripts/initramfs-framework/overlayroot
@@ -0,0 +1,118 @@
+#!/bin/sh
+
+# SPDX-License-Identifier: MIT
+#
+# Copyright 2022 (C), Microsoft Corporation
+
+# Simple initramfs module intended to mount a read-write (RW)
+# overlayfs on top of /, keeping the original root filesystem
+# as read-only (RO), free from modifications by the user.
+#
+# NOTE: The read-only IMAGE_FEATURE is not required for this to work
+#
+# This script is based on the overlay-etc.bbclass, which sets up
+# an overlay on top of the /etc directory, but in this case allows
+# accessing the original, unmodified rootfs at /rofs after boot.
+#
+# It relies on the initramfs-module-rootfs to mount the original
+# root filesystem, and requires 'overlayrootrwdev=<foo>' to be passed as a
+# kernel parameter, specifying the device/partition intended to
+# use as RW.
+# Mount options of the RW device can be tweaked with 'overlayrootfstype='
+# (defaults to 'ext4') and 'overlayrootfsflags=' ('defaults').
+#
+# This module needs to be executed after the initramfs-module-rootfs
+# since it relies on it to mount the filesystem at initramfs startup
+# but before the finish module which normally switches root.
+# After overlayroot is executed the usual boot flow continues from
+# the real init process.
+#
+# If something goes wrong while running this module, the rootfs
+# is still mounted RO (with no overlay) and the finish module is
+# executed to continue booting normally.
+#
+# It also has a dependency on overlayfs being enabled in the
+# running kernel via KERNEL_FEATURES (kmeta) or any other means.
+
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+
+# We get OLDROOT from the rootfs module
+OLDROOT="/rootfs"
+
+NEWROOT="${RWMOUNT}/root"
+RWMOUNT="/overlay"
+ROMOUNT="${RWMOUNT}/rofs"
+UPPER_DIR="${RWMOUNT}/upper"
+WORK_DIR="${RWMOUNT}/work"
+
+MODULES_DIR=/init.d
+
+# Something went wrong, make sure / is mounted as read only anyway.
+exit_gracefully() {
+    echo $1 >/dev/console
+    echo >/dev/console
+    echo "OverlayRoot mounting failed, starting system as read-only" >/dev/console
+    echo >/dev/console
+
+    # The following is borrowed from rootfs-postcommands.bbclass
+    # This basically looks at the real rootfs mounting options and
+    # replaces them with "ro"
+
+    # Tweak the mount option and fs_passno for rootfs in fstab
+    if [ -f ${OLDROOT}/etc/fstab ]; then
+        sed -i -e '/^[#[:space:]]*\/dev\/root/{s/defaults/ro/;s/\([[:space:]]*[[:digit:]]\)\([[:space:]]*\)[[:digit:]]$/\1\20/}' ${OLDROOT}/etc/fstab
+    fi
+
+    # Tweak the "mount -o remount,rw /" command in busybox-inittab inittab
+    if [ -f ${OLDROOT}/etc/inittab ]; then
+        sed -i 's|/bin/mount -o remount,rw /|/bin/mount -o remount,ro /|' ${OLDROOT}/etc/inittab
+    fi
+
+    # Continue as if the overlayroot module didn't exist to continue booting
+    . $MODULES_DIR/99-finish
+    eval "finish_run"
+}
+
+# migrate legacy parameter
+if [ ! -z "$bootparam_rootrw" ]; then
+    bootparam_overlayrootrwdev="$bootparam_rootrw"
+fi
+
+if [ -z "$bootparam_overlayrootrwdev" ]; then
+    exit_gracefully "overlayrootrwdev= kernel parameter doesn't exist and its required to mount the overlayfs"
+fi
+
+mkdir -p ${RWMOUNT}
+
+# Mount RW device
+if mount -n -t ${bootparam_overlayrootfstype:-ext4} -o ${bootparam_overlayrootfsflags:-defaults} ${bootparam_overlayrootrwdev} ${RWMOUNT}
+then
+    # Set up overlay directories
+    mkdir -p ${UPPER_DIR}
+    mkdir -p ${WORK_DIR}
+    mkdir -p ${NEWROOT}
+    mkdir -p ${ROMOUNT}
+
+    # Remount OLDROOT as read-only
+    mount -o bind ${OLDROOT} ${ROMOUNT}
+    mount -o remount,ro ${ROMOUNT}
+
+    # Mount RW overlay
+    mount -t overlay overlay -o lowerdir=${ROMOUNT},upperdir=${UPPER_DIR},workdir=${WORK_DIR} ${NEWROOT} || exit_gracefully "initramfs-overlayroot: Mounting overlay failed"
+else
+    exit_gracefully "initramfs-overlayroot: Mounting RW device failed"
+fi
+
+# Set up filesystems on overlay
+mkdir -p ${NEWROOT}/proc
+mkdir -p ${NEWROOT}/dev
+mkdir -p ${NEWROOT}/sys
+mkdir -p ${NEWROOT}/rofs
+
+mount -n --move ${ROMOUNT} ${NEWROOT}/rofs
+mount -n --move /proc ${NEWROOT}/proc
+mount -n --move /sys ${NEWROOT}/sys
+mount -n --move /dev ${NEWROOT}/dev
+
+exec chroot ${NEWROOT}/ ${bootparam_init:-/sbin/init} || exit_gracefully "Couldn't chroot into overlay"
diff --git a/meta/recipes-core/initrdscripts/initramfs-framework/rootfs b/meta/recipes-core/initrdscripts/initramfs-framework/rootfs
index ee24e82af3..df0cbfb091 100644
--- a/meta/recipes-core/initrdscripts/initramfs-framework/rootfs
+++ b/meta/recipes-core/initrdscripts/initramfs-framework/rootfs
@@ -24,29 +24,20 @@ rootfs_run() {
                         if [ "`echo ${bootparam_root} | cut -c1-5`" = "UUID=" ]; then
                                 root_uuid=`echo $bootparam_root | cut -c6-`
                                 bootparam_root="/dev/disk/by-uuid/$root_uuid"
-                        fi
-
-                        if [ "`echo ${bootparam_root} | cut -c1-9`" = "PARTUUID=" ]; then
+                        elif [ "`echo ${bootparam_root} | cut -c1-9`" = "PARTUUID=" ]; then
                                 root_partuuid=`echo $bootparam_root | cut -c10-`
                                 bootparam_root="/dev/disk/by-partuuid/$root_partuuid"
-                        fi
-
-                        if [ "`echo ${bootparam_root} | cut -c1-10`" = "PARTLABEL=" ]; then
-                                root_partlabel=`echo $bootparam_root | cut -c11-`
-                                bootparam_root="/dev/disk/by-partlabel/$root_partlabel"
-                        fi
-
-                        if [ "`echo ${bootparam_root} | cut -c1-10`" = "PARTLABEL=" ]; then
+                        elif [ "`echo ${bootparam_root} | cut -c1-10`" = "PARTLABEL=" ]; then
                                 root_partlabel=`echo $bootparam_root | cut -c11-`
                                 bootparam_root="/dev/disk/by-partlabel/$root_partlabel"
-                        fi
-
-                        if [ "`echo ${bootparam_root} | cut -c1-6`" = "LABEL=" ]; then
+                        elif [ "`echo ${bootparam_root} | cut -c1-6`" = "LABEL=" ]; then
                                 root_label=`echo $bootparam_root | cut -c7-`
                                 bootparam_root="/dev/disk/by-label/$root_label"
+                        elif echo "${bootparam_root}" | grep -q '^ubi[0-9]\+:'; then
+                                bootparam_rootfstype="ubifs"
                         fi
 
-                        if [ -e "$bootparam_root" ]; then
+                        if [ -e "$bootparam_root" ] || [ -n "$bootparam_rootfstype" ]; then
                                 flags=""
                                 if [ -n "$bootparam_ro" ] && ! echo "$bootparam_rootflags" | grep -w -q "ro"; then
                                         if [  -n "$bootparam_rootflags" ]; then
@@ -60,6 +51,7 @@ rootfs_run() {
                                 if [ -n "$bootparam_rootfstype" ]; then
                                         flags="$flags -t$bootparam_rootfstype"
                                 fi
+                                debug "mount $flags $bootparam_root $ROOTFS_DIR"
                                 mount $flags $bootparam_root $ROOTFS_DIR
                                 if mountpoint -q $ROOTFS_DIR; then
                                         break
@@ -67,10 +59,10 @@ rootfs_run() {
                                         # It is unlikely to change, but keep trying anyway.
                                         # Perhaps we pick a different device next time.
                                         umount $ROOTFS_DIR
-                                        fi
                                 fi
+                        fi
                 fi
-                debug "Sleeping for $delay second(s) to wait root to settle..."
+                debug "Sleeping for $delay second(s) to wait for root to settle..."
                 sleep $delay
                 C=$(( $C + 1 ))
         done
diff --git a/meta/recipes-core/initrdscripts/initramfs-framework/setup-live b/meta/recipes-core/initrdscripts/initramfs-framework/setup-live
index 4c79f41285..7e92f93322 100644
--- a/meta/recipes-core/initrdscripts/initramfs-framework/setup-live
+++ b/meta/recipes-core/initrdscripts/initramfs-framework/setup-live
@@ -1,4 +1,4 @@
-#/bin/sh
+#!/bin/sh
 # Copyright (C) 2011 O.S. Systems Software LTDA.
 # Licensed on MIT