feat: [NODE-1650] Resurrect dfinity.system kernel arg (#6072)

Bownairo · web-flow · commit e266e4926c7c · 2025-07-30T18:35:16.000Z
diff --git a/ic-os/bootloader/build-bootloader-tree.sh b/ic-os/bootloader/build-bootloader-tree.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # This builds the filesystem tree for the /boot hierarchy containing
-# the /grub and /boot/efi portions. From this, the grub and
+# the /boot/grub and /boot/efi portions. From this, the grub and
 # efi partitions of the disk image can be built.
 
 set -exo pipefail
@@ -37,8 +37,8 @@ sudo podman --root "${TMPFS}" build --iidfile "${TMPDIR}/iidfile" - <<<"
     FROM $BASE_IMAGE
     USER root:root
     RUN apt-get -y update && apt-get -y --no-install-recommends install grub-efi faketime
-    RUN mkdir -p /build/grub
-    RUN cp -r /usr/lib/grub/x86_64-efi /build/grub
+    RUN mkdir -p /build/boot/grub
+    RUN cp -r /usr/lib/grub/x86_64-efi /build/boot/grub
     RUN mkdir -p /build/boot/efi/EFI/Boot
     RUN grub-mkimage --version
     RUN apt list --installed | grep grub
@@ -55,4 +55,4 @@ IMAGE_ID=$(cut -d':' -f2 <"${TMPDIR}/iidfile")
 CONTAINER=$(sudo podman --root "${TMPFS}" run --network=host --cgroupns=host -d "${IMAGE_ID}")
 
 sudo podman --root "${TMPFS}" export "${CONTAINER}" | tar --strip-components=1 -C "${TMPDIR}" -x build
-tar cf "${OUT_FILE}" --sort=name --owner=root:0 --group=root:0 "--mtime=UTC 1970-01-01 00:00:00" -C "${TMPDIR}" boot grub
+tar cf "${OUT_FILE}" --sort=name --owner=root:0 --group=root:0 "--mtime=UTC 1970-01-01 00:00:00" -C "${TMPDIR}" boot
diff --git a/ic-os/bootloader/defs.bzl b/ic-os/bootloader/defs.bzl
@@ -19,11 +19,11 @@ def build_grub_partition(name, grub_config, visibility = None, tags = None):
         name = name,
         src = Label("//ic-os/bootloader:bootloader-tree.tar"),
         extra_files = {
-            grub_config: "/grub/grub.cfg:0644",
-            "//ic-os/bootloader:grubenv": "/grub/grubenv:0644",
+            grub_config: "/boot/grub/grub.cfg:0644",
+            "//ic-os/bootloader:grubenv": "/boot/grub/grubenv:0644",
         },
         partition_size = "100M",
-        subdir = "grub",
+        subdir = "boot/grub",
         target_compatible_with = [
             "@platforms//os:linux",
         ],
diff --git a/ic-os/bootloader/guestos_boot_args.template b/ic-os/bootloader/guestos_boot_args.template
@@ -5,5 +5,5 @@
 # the system will use SELinux and keep track of operations that would
 # be prohibited, but will only log but not actually deny them. This is
 # useful for debug and policy development.
-BOOT_ARGS_A="root=/dev/vda5 console=ttyS0 nomodeset security=selinux selinux=1 enforcing=1 root_hash=ROOT_HASH"
-BOOT_ARGS_B="root=/dev/vda8 console=ttyS0 nomodeset security=selinux selinux=1 enforcing=1 root_hash=ROOT_HASH"
+BOOT_ARGS_A="root=/dev/vda5 console=ttyS0 nomodeset dfinity.system=A security=selinux selinux=1 enforcing=1 root_hash=ROOT_HASH"
+BOOT_ARGS_B="root=/dev/vda8 console=ttyS0 nomodeset dfinity.system=B security=selinux selinux=1 enforcing=1 root_hash=ROOT_HASH"
diff --git a/ic-os/bootloader/hostos_boot_args.template b/ic-os/bootloader/hostos_boot_args.template
@@ -1,4 +1,4 @@
 # Kernel cmdline parameters for launching the HostOS.
 # BOOT_ARGS_A targets partition set "A" while BOOT_ARGS_B targets partition set "B"
-BOOT_ARGS_A="root=/dev/hostlvm/A_root console=ttyS0,115200 console=tty0 nomodeset video=1024x768 security=selinux selinux=1 enforcing=0"
-BOOT_ARGS_B="root=/dev/hostlvm/B_root console=ttyS0,115200 console=tty0 nomodeset video=1024x768 security=selinux selinux=1 enforcing=0"
+BOOT_ARGS_A="root=/dev/hostlvm/A_root console=ttyS0,115200 console=tty0 nomodeset video=1024x768 dfinity.system=A security=selinux selinux=1 enforcing=0"
+BOOT_ARGS_B="root=/dev/hostlvm/B_root console=ttyS0,115200 console=tty0 nomodeset video=1024x768 dfinity.system=B security=selinux selinux=1 enforcing=0"
diff --git a/ic-os/components/early-boot/fstab/fstab-guestos b/ic-os/components/early-boot/fstab/fstab-guestos
@@ -1,7 +1,7 @@
 /dev/rootfs /   ext4    ro,errors=remount-ro   0   1
 tmpfs    /tmp    tmpfs   defaults 0   2
 /dev/vda1   /boot/efi   vfat    defaults    0   2
-/dev/vda2   /grub  vfat    defaults    0   2
+/dev/vda2   /boot/grub  vfat    defaults    0   2
 /dev/vda3   /boot/config    ext4    defaults,sync    0   2
 /dev/mapper/var_crypt   /var  ext4    defaults    0   2
 /dev/mapper/store-shared--backup   /var/lib/ic/backup    ext4 defaults,context=system_u:object_r:ic_data_t:s0   0   2
diff --git a/ic-os/components/early-boot/fstab/fstab-hostos b/ic-os/components/early-boot/fstab/fstab-hostos
@@ -1,5 +1,5 @@
 /dev/rootfs /   ext4    ro,errors=remount-ro   0   1
 tmpfs    /tmp    tmpfs   defaults 0   2
 PARTUUID=f46600e3-d0e6-4258-9607-e64b13cf7595   /boot/efi   vfat    defaults    0   2
-PARTUUID=1a7c28b7-efe0-4f17-9230-678cf2df8db2   /grub  vfat    defaults    0   2
+PARTUUID=1a7c28b7-efe0-4f17-9230-678cf2df8db2   /boot/grub  vfat    defaults    0   2
 /dev/hostlvm/config   /boot/config    ext4    defaults,sync    0   2
diff --git a/ic-os/components/early-boot/fstab/fstab-setupos b/ic-os/components/early-boot/fstab/fstab-setupos
@@ -1,7 +1,7 @@
 PARTUUID=7c0a626e-e5ea-e543-b5c5-300eb8304db7 /   ext4    ro,errors=remount-ro    0   1
 tmpfs    /tmp    tmpfs   defaults 0   2
 PARTUUID=b78084e2-3363-1346-8c25-d426f26b8928   /boot/efi   vfat    defaults    0   2
-PARTUUID=6788e4cf-f456-104e-9a34-a2c58cfb0ee6   /grub  vfat    defaults    0   2
+PARTUUID=6788e4cf-f456-104e-9a34-a2c58cfb0ee6   /boot/grub  vfat    defaults    0   2
 PARTUUID=a5ba3816-beaa-d74d-993e-cfa5aa6ba1f6   /config    vfat    defaults    0   2
 PARTUUID=ddf618fe-7244-b446-a175-3296e6b9d02e   /boot    ext4    defaults,sync    0   2
 PARTUUID=e97bf7b1-9400-439f-93d0-13276111f989   /data    ext4    defaults,sync    0   2
diff --git a/ic-os/components/hostos-scripts/grub-upgrader/grub-upgrader.service b/ic-os/components/hostos-scripts/grub-upgrader/grub-upgrader.service
@@ -1,6 +1,6 @@
 [Unit]
 Description=Upgrade grub.cfg file
-RequiresMountsFor=/boot /grub
+RequiresMountsFor=/boot/grub
 
 [Service]
 Type=oneshot
diff --git a/ic-os/components/hostos-scripts/grub-upgrader/grub-upgrader.sh b/ic-os/components/hostos-scripts/grub-upgrader/grub-upgrader.sh
@@ -2,10 +2,10 @@
 set -euo pipefail
 
 SRC="/boot/grub.cfg"
-DST="/grub/grub.cfg"
+DST="/boot/grub/grub.cfg"
 
 read_boot_state() {
-    local grubenv_file="/grub/grubenv"
+    local grubenv_file="/boot/grub/grubenv"
 
     if [ ! -f "${grubenv_file}" ]; then
         echo "Grubenv file ${grubenv_file} not found. Cannot determine boot cycle state." >&2
diff --git a/ic-os/components/monitoring/grub-version/grub-version.service b/ic-os/components/monitoring/grub-version/grub-version.service
@@ -1,6 +1,7 @@
 [Unit]
 Description=Grub version
 Before=node_exporter.service
+RequiresMountsFor=/boot/grub
 
 [Service]
 Type=oneshot
diff --git a/ic-os/components/monitoring/grub-version/grub-version.sh b/ic-os/components/monitoring/grub-version/grub-version.sh
@@ -5,7 +5,7 @@ set -e
 source /opt/ic/bin/logging.sh
 source /opt/ic/bin/metrics.sh
 
-GRUB_CONFIG_FILE="/grub/grub.cfg"
+GRUB_CONFIG_FILE="/boot/grub/grub.cfg"
 BOOTX64_EFI_FILE="/boot/efi/EFI/Boot/bootx64.efi"
 
 function update_grub_config_version_metric() {
diff --git a/ic-os/components/upgrade/manageboot/manageboot.sh b/ic-os/components/upgrade/manageboot/manageboot.sh
@@ -66,7 +66,7 @@ usage() {
 Usage:
   manageboot.sh [ -f grubenvfile] system_type action
 
-  -f specify alternative grubenv file (defaults to /grub/grubenv).
+  -f specify alternative grubenv file (defaults to /boot/grub/grubenv).
      Primarily useful for testing
 
   Arguments:
@@ -127,7 +127,7 @@ if [ $(id -u) != 0 ]; then
 fi
 
 # Parsing options first
-GRUBENV_FILE=/grub/grubenv
+GRUBENV_FILE=/boot/grub/grubenv
 while getopts ":f:" OPT; do
     case "${OPT}" in
         f)
diff --git a/ic-os/components/upgrade/systemd-generators/guestos/mount-generator b/ic-os/components/upgrade/systemd-generators/guestos/mount-generator
@@ -20,7 +20,14 @@
 
 UNIT_DIR="$1"
 
-source /opt/ic/bin/grub.sh
+function get_boot_arg_value() {
+    local ARGNAME="$1"
+    for ARG in $(cat /proc/cmdline); do
+        echo "$ARG" | while IFS='=' read KEY VALUE; do
+            if [ "$ARGNAME" == "$KEY" ]; then echo "$VALUE"; fi
+        done
+    done
+}
 
 function make_requires() {
     mkdir -p "${UNIT_DIR}"/$1.requires
@@ -84,15 +91,12 @@ function make_var_cryptsetup() {
     echo "ExecStop=/lib/systemd/systemd-cryptsetup detach var_crypt"
 }
 
-# Read current state
-mount /grub
-read_grubenv "/grub/grubenv"
-umount /grub
-CURRENT_SYSTEM="${boot_alternative}"
+CURRENT_SYSTEM=$(get_boot_arg_value dfinity.system)
 
 make_boot_mount "$CURRENT_SYSTEM" >"$UNIT_DIR"/boot.mount
 make_requires localfs.target boot.mount
 make_requires boot-efi.mount boot.mount
+make_requires boot-grub.mount boot.mount
 
 make_var_cryptsetup "$CURRENT_SYSTEM" >"$UNIT_DIR"/systemd-cryptsetup@var_crypt.service
 make_requires dev-mapper-var_crypt.device systemd-cryptsetup@var_crypt.service
diff --git a/ic-os/components/upgrade/systemd-generators/hostos/mount-generator b/ic-os/components/upgrade/systemd-generators/hostos/mount-generator
@@ -20,7 +20,14 @@
 
 UNIT_DIR="$1"
 
-source /opt/ic/bin/grub.sh
+function get_boot_arg_value() {
+    local ARGNAME="$1"
+    for ARG in $(cat /proc/cmdline); do
+        echo "$ARG" | while IFS='=' read KEY VALUE; do
+            if [ "$ARGNAME" == "$KEY" ]; then echo "$VALUE"; fi
+        done
+    done
+}
 
 function make_requires() {
     mkdir -p "${UNIT_DIR}"/$1.requires
@@ -85,15 +92,12 @@ function make_var_mount() {
     echo "Options=defaults"
 }
 
-# Read current state
-mount /grub
-read_grubenv "/grub/grubenv"
-umount /grub
-CURRENT_SYSTEM="${boot_alternative}"
+CURRENT_SYSTEM=$(get_boot_arg_value dfinity.system)
 
 make_boot_mount "$CURRENT_SYSTEM" >"$UNIT_DIR"/boot.mount
 make_requires localfs.target boot.mount
 make_requires boot-efi.mount boot.mount
+make_requires boot-grub.mount boot.mount
 
 make_var_setup "$CURRENT_SYSTEM" >"$UNIT_DIR"/var-setup.service
 make_var_mount "$CURRENT_SYSTEM" >"$UNIT_DIR"/var.mount
diff --git a/ic-os/guestos/context/Dockerfile b/ic-os/guestos/context/Dockerfile
@@ -20,7 +20,7 @@ USER root:root
 
 RUN mkdir -p /boot/config \
              /boot/efi \
-             /grub
+             /boot/grub
 COPY etc /etc
 
 # Deactivate motd, it tries creating $HOME/.cache/motd.legal-displayed,
diff --git a/ic-os/guestos/docs/Boot.adoc b/ic-os/guestos/docs/Boot.adoc
@@ -74,7 +74,7 @@ for description of partition layout). The mount description for +/boot+ is there
 not held in +/etc/fstab+ but is generated by the shell script
 +/etc/systemd/system-generators/mount-generator+.
 
-Afterwards, the first three partitions are mounted as +/boot/efi+, +/grub+
+Afterwards, the first three partitions are mounted as +/boot/efi+, +/boot/grub+
 and +/boot/config+, respectively. The +config+ partition is
 used as (small) store for data that is preserved across upgrades
 and is available at early boot time already.
diff --git a/ic-os/guestos/docs/SELinux-Build.adoc b/ic-os/guestos/docs/SELinux-Build.adoc
@@ -46,7 +46,7 @@ managed dynamically at runtime:
   of the system and is wiped on upgrades. It is labeled once
   initially on creation
 
-* +/grub+, +/boot/efi+ are labeled as per their filesystem type (vfat);
+* +/boot/grub+, +/boot/efi+ are labeled as per their filesystem type (vfat);
   this is then accounted for in the policy
 
 * persistent data stores are labeled per file using +restorecon+
diff --git a/ic-os/hostos/context/Dockerfile b/ic-os/hostos/context/Dockerfile
@@ -17,7 +17,7 @@ USER root:root
 
 RUN mkdir -p /boot/config \
              /boot/efi \
-             /grub
+             /boot/grub
 COPY etc /etc
 
 # Deactivate motd, it tries creating $HOME/.cache/motd.legal-displayed,
diff --git a/ic-os/setupos/context/Dockerfile b/ic-os/setupos/context/Dockerfile
@@ -18,7 +18,7 @@ USER root:root
 RUN mkdir -p /config \
              /data \
              /boot/efi \
-             /grub
+             /boot/grub
 COPY etc /etc
 
 # Deactivate motd, it tries creating $HOME/.cache/motd.legal-displayed,
