sort out bootloader stuff

* packer.conf
+ don't need to pass bootloader
+ pass kernel_mods/kernel_opts
+ use_env_var_file to get around problems with ENV var contents (new execute_command, too)
* profiles/base/1
+ add kernel_modules/options
* scripts/resolve-profile.py.in
+ fold()
- strips quotes from complex keys
- include separator char at beginning of fmt
- different dicts use different separators
+ svcs dict -> scalar
- make vars clearer
- ' ' separator between levels
* setup-ami.sh
+ no longer need to 'tr' REPOS, PKGS, SVCS
+ detect bootloader to use
- when 'grub-efi' is bootloader, partition target device w/small EFI partition, format vfat, install_grub_efi() untested yet
+ merge setup_extlinux into install_extlinux

4 files changed, 131 insertions, 61 deletions

diff --git a/packer.conf b/packer.conf
index ecd5b81..513f093 100644
--- a/packer.conf
+++ b/packer.conf
@@ -71,12 +71,14 @@ provisioners = [
       "APK_TOOLS_SHA256={{user `apk_tools_sha256`}}"
       "ALPINE_KEYS={{user `alpine_keys`}}"
       "ALPINE_KEYS_SHA256={{user `alpine_keys_sha256`}}"
-      "BOOTLOADER={{user `bootloader`}}"
       "REPOS={{user `repos`}}"
       "PKGS={{user `pkgs`}}"
       "SVCS={{user `svcs`}}"
+      "KERNEL_MODS={{user `kernel_modules`}}"
+      "KERNEL_OPTS={{user `kernel_options`}}"
     ]
-    execute_command = "sudo sh -c '{{ .Vars }} {{ .Path }}'"
+    use_env_var_file = "true"
+    execute_command = "sudo sh -c '. {{.EnvVarFile}} && {{.Path}}'"
   }
 ]
 
diff --git a/profiles/base/1 b/profiles/base/1
index a4c8ab1..3bda7ed 100644
--- a/profiles/base/1
+++ b/profiles/base/1
@@ -41,7 +41,6 @@ apk_tools           = null
 apk_tools_sha256    = null
 alpine_keys         = null
 alpine_keys_sha256  = null
-bootloader          = null
 repos {}
 pkgs {
   linux-virt          = true
@@ -55,12 +54,10 @@ pkgs {
   tzdata              = true
 }
 svcs {
-  # sysinit
   devfs     = "sysinit"
   dmesg     = "sysinit"
   hwdrivers = "sysinit"
   mdev      = "sysinit"
-  # boot
   acpid     = "boot"
   bootmisc  = "boot"
   haveged   = "boot"
@@ -70,13 +67,20 @@ svcs {
   swap      = "boot"
   sysctl    = "boot"
   syslog    = "boot"
-  # default
   chronyd             = "default"
   networking          = "default"
   sshd                = "default"
   tiny-ec2-bootstrap  = "default"
-  # shutdown
   killprocs = "shutdown"
   mount-ro  = "shutdown"
   savecache = "shutdown"
 }
+kernel_modules {
+  "sd-mod"      = true
+  "usb-storage" = true
+  "ext4"        = true
+}
+kernel_options {
+  "console=ttyS0" = true
+  "console=tty0"  = true
+}
diff --git a/scripts/resolve-profile.py.in b/scripts/resolve-profile.py.in
index 67f9d24..050da00 100644
--- a/scripts/resolve-profile.py.in
+++ b/scripts/resolve-profile.py.in
@@ -22,20 +22,23 @@ os.makedirs(profile_dir)
 
 # func to fold dict down to scalar
 def fold(dict, fmt):
-    a = []
+    s = ''
     for k, v in dict.items():
+        k = k.strip('"')    # complex keys may be in quotes
         if v == True:
-            a.append(k)
+            s += fmt[0] + k
         elif not (v == None or v == False):
-            a.append(fmt.format(k, v))
-    return ','.join(str(x) for x in a)
+            s += fmt.format(k, v)
+    return s[1:]
 
 # fold these dicts vars down to scalar, based on item values
 fold_dicts = {
-    'ami_access': '{0}',
-    'ami_regions': '{0}',
-    'repos': '@{1} {0}',
-    'pkgs': '{0}@{1}'
+    'ami_access': ',{0}',
+    'ami_regions': ',{0}',
+    'repos': "\n@{1} {0}",
+    'pkgs': ' {0}@{1}',
+    'kernel_modules': ',{0}',
+    'kernel_options': ' {0}'
 }
 
 # parse/resolve HOCON profile config, we need just the 'builds' portion
@@ -62,17 +65,17 @@ for bk, b in builds.items():
         b[dk] = fold(b[dk], fmt)
 
     # fold 'svcs' dict to scalar
-    svcs = {}
-    for svc, v in b['svcs'].items():
-        if v == True:
+    lvls = {}
+    for svc, lvl in b['svcs'].items():
+        if lvl == True:
             # service in default runlevel
-            svcs['default'].append(svc)
-        elif not (v == None or v == False):
+            lvls['default'].append(svc)
+        elif not (lvl == None or lvl == False):
             # service in specified runlevel (skip svc when false/null)
-            if v not in svcs.keys():
-                svcs[v] = []
-            svcs[v].append(svc)
-    b['svcs'] = ':'.join(str(l) + '=' + ','.join(str(s) for s in ss) for l, ss in svcs.items())
+            if lvl not in lvls.keys():
+                lvls[lvl] = []
+            lvls[lvl].append(svc)
+    b['svcs'] = ' '.join(str(lvl) + '=' + ','.join(str(svc) for svc in svcs) for lvl, svcs in lvls.items())
 
     # write build def json file
     with open(vars_file, 'w') as out:
diff --git a/scripts/setup-ami.sh b/scripts/setup-ami.sh
index b79768c..72157a5 100755
--- a/scripts/setup-ami.sh
+++ b/scripts/setup-ami.sh
@@ -3,6 +3,9 @@
 
 set -eu
 
+# what bootloader should we use?
+[ -d "/sys/firmware/efi" ] && BOOTLOADER=grub-efi || BOOTLOADER=syslinux
+
 die() {
     printf '\033[1;31mERROR:\033[0m %s\n' "$@" >&2  # bold red
     exit 1
@@ -55,21 +58,55 @@ fetch_apk_tools() {
     find "$store" -name apk
 }
 
+# mostly from Alpine's /sbin/setup-disk
+setup_partitions() {
+    # TODO: do we really need to waste 1M?
+    local diskdev="$1" start=1M line=
+    shift
+
+    # create new partitions
+    (
+        for line in "$@"; do
+            case "$line" in
+            0M*) ;;
+            *) echo "$start,$line"; start= ;;
+            esac
+        done
+    ) | sfdisk --quiet --label $DISKLABEL $diskdev
+
+    # create device nodes if not exist
+    mdev -s
+}
+
 make_filesystem() {
-    local device="$1"  # target device path
-    local target="$2"  # mount target
+    local device="$1"   # target device path
+    local root_dev="$1" # root partition
+    local target="$2"   # mount target
+    local efi_dev=      # EFI partition
+
+    if [ "$BOOTLOADER" = 'grub-efi' ]; then
+        # create a small EFI partition (remainder for root), and format it
+        setup_partitions "$device" '5M,EF' ',L'
+        efi_dev="${device}1"
+        root_dev="${device}2"
+        mkfs.vfat -n EFI "${device}1"
+    fi
 
-    mkfs.ext4 -O ^64bit "$device"
-    e2label "$device" /
-    mount "$device" "$target"
+    mkfs.ext4 -O ^64bit -L / "$root_dev"
+    mount "$root_dev" "$target"
+
+    if [ "$BOOTLOADER" = 'grub-efi' ]; then
+        mkdir -p "$target"/boot/efi
+        mount -t vfat "$efi_dev" "$target"/boot/efi
+    fi
+    # TODO? return "$root_dev"
 }
 
 setup_repositories() {
     local target="$1"   # target directory
-    local repos="$2"    # repositories
 
     mkdir -p "$target"/etc/apk/keys
-    echo "$repos" > "$target"/etc/apk/repositories
+    echo "$REPOS" > "$target"/etc/apk/repositories
 }
 
 fetch_keys() {
@@ -107,9 +144,8 @@ setup_chroot() {
 
 install_core_packages() {
     local target="$1"    # target directory
-    local pkgs="$2"      # packages, space separated
 
-    chroot "$target" apk --no-cache add $pkgs
+    chroot "$target" apk --no-cache add $PKGS
 
     chroot "$target" apk --no-cache add --no-scripts $BOOTLOADER
 
@@ -131,26 +167,28 @@ setup_mdev() {
     sed -n -i -e '/# fallback/r /tmp/nvme-ebs-mdev.conf' -e 1x -e '2,${x;p}' -e '${x;p}' "$target"/etc/mdev.conf
 }
 
-# TODO: use alpine-conf setup-*? (based on $BOOTLOADER)
 create_initfs() {
     local target="$1"
 
-    # TODO: other useful mkinitfs stuff?
-
-    # Create ENA feature for mkinitfs
-    echo "kernel/drivers/net/ethernet/amazon" > \
-        "$target"/etc/mkinitfs/features.d/ena.modules
-
     # Enable ENA and NVME features these don't hurt for any instance and are
     # hard requirements of the 5 series and i3 series of instances
+    # TODO: profile-ize?
     sed -Ei 's/^features="([^"]+)"/features="\1 nvme ena"/' \
         "$target"/etc/mkinitfs/mkinitfs.conf
 
     chroot "$target" /sbin/mkinitfs $(basename $(find "$target"/lib/modules/* -maxdepth 0))
 }
 
-# TODO: this is for syslinux only, there's likely a grub equivalence
-setup_extlinux() {
+install_bootloader() {
+    local target="$1"
+    case "$BOOTLOADER" in
+        syslinux)   install_extlinux "$target" ;;
+        grub-efi)   install_grub_efi "$target" ;;
+        *)          die "unknown bootloader '$BOOTLOADER'" ;;
+    esac
+}
+
+install_extlinux() {
     local target="$1"
 
     # Must use disk labels instead of UUID or devices paths so that this works
@@ -159,26 +197,51 @@ setup_extlinux() {
     #
     # Enable ext4 because the root device is formatted ext4
     #
-    # Shorten timeout because EC2 has no way to interact with instance console
+    # Shorten timeout (1/10s) as EC2 has no way to interact with instance console
     #
     # ttyS0 is the target for EC2s "Get System Log" feature whereas tty0 is the
     # target for EC2s "Get Instance Screenshot" feature. Enabling the serial
     # port early in extlinux gives the most complete output in the system log.
     sed -Ei -e "s|^[# ]*(root)=.*|\1=LABEL=/|" \
-        -e "s|^[# ]*(default_kernel_opts)=.*|\1=\"console=ttyS0 console=tty0\"|" \
+        -e "s|^[# ]*(default_kernel_opts)=.*|\1=\"$KERNEL_OPTS\"|" \
         -e "s|^[# ]*(serial_port)=.*|\1=ttyS0|" \
-        -e "s|^[# ]*(modules)=.*|\1=sd-mod,usb-storage,ext4|" \
+        -e "s|^[# ]*(modules)=.*|\1=$KERNEL_MODS|" \
         -e "s|^[# ]*(default)=.*|\1=virt|" \
         -e "s|^[# ]*(timeout)=.*|\1=1|" \
         "$target"/etc/update-extlinux.conf
+
+    chroot "$target" /sbin/extlinux --install /boot
+    chroot "$target" /sbin/update-extlinux --warn-only
 }
 
-# TODO: this is for syslinux only, there's likely a grub equivalence
-install_extlinux() {
+install_grub_efi() {
     local target="$1"
 
-    chroot "$target" /sbin/extlinux --install /boot
-    chroot "$target" /sbin/update-extlinux --warn-only
+    case "$ARCH" in
+        x86_64)     grub_target=x86_64-efi ; fwa=x64 ;;
+        aarch64)    grub_target=arm64-efi ; fwa=aa64 ;;
+        *)          die "ARCH=$ARCH is currently unsupported" ;;
+    esac
+
+    # TODO: this should be set up when we mkfs/mount
+    #mkdir -p "$target"/boot/efi
+
+    # disable nvram so grub doesn't call efibootmgr
+    chroot "$target" /sbin/grub-install --target=$grub_target --efi-directory=/boot/efi \
+        --bootloader-id=alpine --boot-directory=/boot --no-nvram
+
+    # fallback mode
+    install -D "$target"/boot/efi/EFI/alpine/grub$fwa.efi "$target"/boot/efi/EFI/boot/$fwa.efi
+
+    # add cmdline linux defaults to /etc/default/grub
+    echo "GRUB_CMDLINE_LINUX_DEFAULT=\"modules=$KERNEL_MODS $KERNEL_OPTS\"" >> "$target"/etc/default/grub
+
+    # eliminate grub pause
+    sed -ie 's/^GRUB_TIMEOUT=.$/GRUB_TIMEOUT=0/' "$target"/etc/default/grub
+
+    # generate/install new config
+    [ -e "$target"/boot/grub/grub.cfg ] && cp "$target"/boot/grub/grub.cfg "$target"/boot/grub/grub.cfg.backup
+    chroot "$target" grub-mkconfig -o /boot/grub/grub.cfg
 }
 
 setup_fstab() {
@@ -188,6 +251,11 @@ setup_fstab() {
 # <fs>      <mountpoint>   <type>   <opts>              <dump/pass>
 LABEL=/     /              ext4     defaults,noatime    1 1
 EOF
+
+    # if we're using grub-efi bootloader, add extra line for EFI partition
+    if [ "$BOOTLOADER" = 'grub-efi' ]; then
+        echo "LABEL=EFI   /boot/efi      vfat     defaults,noatime,uid=0,gid=0,umask=077  0 0" >> "$target"/etc/fstab
+    fi
 }
 
 setup_networking() {
@@ -204,9 +272,8 @@ EOF
 
 enable_services() {
     local target="$1"
-    local svcs="$2"
 
-    local lvl_svcs; for lvl_svcs in $svcs; do
+    local lvl_svcs; for lvl_svcs in $SVCS; do
         rc_add "$target" $(echo "$lvl_svcs" | tr =, ' ')
     done
 }
@@ -267,10 +334,6 @@ cleanup() {
 }
 
 main() {
-    local repos=$(echo "$REPOS" | tr , "\n")
-    local pkgs=$(echo "$PKGS" | tr , ' ')
-    local svcs=$(echo "$SVCS" | tr : ' ')
-
     local device="/dev/xvdf"
     local target="/mnt/target"
 
@@ -285,7 +348,7 @@ main() {
     make_filesystem "$device" "$target"
 
     einfo "Configuring Alpine repositories"
-    setup_repositories "$target" "$repos"
+    setup_repositories "$target"
 
     einfo "Fetching Alpine signing keys"
     fetch_keys "$target"
@@ -296,19 +359,17 @@ main() {
     setup_chroot "$target"
 
     einfo "Installing core packages"
-    install_core_packages "$target" "$pkgs"
+    install_core_packages "$target"
 
-    # TODO: syslinux vs grub, maybe use setup-* scripts?
     einfo "Configuring and enabling boot loader"
     create_initfs "$target"
-    setup_extlinux "$target"
-    install_extlinux "$target"
+    install_bootloader "$target"
 
     einfo "Configuring system"
     setup_mdev "$target"
     setup_fstab "$target"
     setup_networking "$target"
-    enable_services "$target" "$svcs"
+    enable_services "$target"
     create_alpine_user "$target"
     configure_ntp "$target"