diff --git a/Makefile b/Makefile index 95b711e..da9b04a 100644 --- a/Makefile +++ b/Makefile @@ -31,6 +31,9 @@ PVE_EXTRA_PACKAGES ?= ifupdown2 open-iscsi chrony postfix lvm2 thin-provisioning ethtool bridge-utils ipmitool nvme-cli lsscsi sudo # ---------------------------------------------------------------- imaj ayarlari +# amd64 | arm64. arm64 is wired up but has never been built or deployed - +# see "Verified status" in the README. Building arm64 on an x86_64 host means +# TCG emulation with no KVM, which is very slow; prefer a native arm64 builder. ARCH ?= amd64 SUBARCH ?= generic BOOT ?= uefi @@ -85,8 +88,21 @@ MAAS_IMAGE_NAME ?= custom/$(IMAGE_NAME) # MAAS snap kurulumu icin: /var/snap/maas/current/preseeds MAAS_PRESEED_DIR ?= /var/snap/maas/current/preseeds -OVMF_DIR ?= /usr/share/OVMF -OVMF_SFX ?= $(shell test -f $(OVMF_DIR)/OVMF_CODE.fd && echo "" || echo "_4M") +# UEFI firmware, keyed on the TARGET architecture - an aarch64 guest needs +# AAVMF whatever the build host is. (Upstream packer-maas keys this on the host +# architecture instead, which only works when host and target match.) +ifeq ($(strip $(ARCH)),arm64) +FW_DIR ?= /usr/share/AAVMF +FW ?= AAVMF +else +FW_DIR ?= /usr/share/OVMF +FW ?= OVMF +endif +FW_SFX ?= $(shell test -f $(FW_DIR)/$(FW)_CODE.fd && echo "" || echo "_4M") + +# KVM is only usable when the host and the guest share an architecture. +# Otherwise QEMU falls back to TCG emulation, which is very slow. +HOST_IS_ARM := $(shell test "$$(uname -m)" = aarch64 && echo true || echo false) # ---------------------------------------------------------------- hedefler .PHONY: help deps deps-cache check-upstream print-var checkout overlay customize image verify preseed install-preseed upload clean distclean lint @@ -165,8 +181,13 @@ ifeq ($(strip $(DEBIAN_IMAGE_CHANNEL)),stable) endif sed -i -E 's|--best --force|-$(GZIP_LEVEL) --force|' $(PM)/scripts/fuse-tar-root @grep -nE 'disk_size|^ cpus|^ memory' $(TPL)/debian-cloudimg.pkr.hcl - cp -v $(OVMF_DIR)/OVMF_CODE$(OVMF_SFX).fd $(TPL)/OVMF_CODE.fd - cp -v $(OVMF_DIR)/OVMF_VARS$(OVMF_SFX).fd $(TPL)/OVMF_VARS.fd + cp -v $(FW_DIR)/$(FW)_CODE$(FW_SFX).fd $(TPL)/OVMF_CODE.fd + cp -v $(FW_DIR)/$(FW)_VARS$(FW_SFX).fd $(TPL)/OVMF_VARS.fd +ifeq ($(strip $(ARCH)),arm64) + # AAVMF images must be padded to 64 MiB for QEMU's arm64 "virt" machine. + truncate -s 64m $(TPL)/OVMF_CODE.fd + truncate -s 64m $(TPL)/OVMF_VARS.fd +endif rm -rf $(TPL)/output-cloudimg $(TPL)/seeds-cloudimg.iso cd $(TPL) && PACKER_LOG=$(PACKER_LOG) packer init . cd $(TPL) && PACKER_LOG=$(PACKER_LOG) packer build \ @@ -174,8 +195,8 @@ endif -var debian_version=$(DEBIAN_VERSION) \ -var architecture=$(ARCH) \ -var boot_mode=$(BOOT) \ - -var ovmf_suffix=$(OVMF_SFX) \ - -var host_is_arm=false \ + -var ovmf_suffix=$(FW_SFX) \ + -var host_is_arm=$(HOST_IS_ARM) \ -var timeout=$(TIMEOUT) \ -var customize_script=$(CUSTOMIZE) \ -var filename=$(OUTPUT) \ diff --git a/README.md b/README.md index 057aaba..12ce127 100644 --- a/README.md +++ b/README.md @@ -28,6 +28,7 @@ variable change away (see [Moving to a new Proxmox release](#moving-to-a-new-pro - [Four traps this image works around](#four-traps-this-image-works-around) - [Moving to a new Proxmox release](#moving-to-a-new-proxmox-release) - [Build performance](#build-performance) +- [arm64](#arm64) - [Release automation](#release-automation) - [Repository layout](#repository-layout) - [Troubleshooting](#troubleshooting) @@ -262,7 +263,7 @@ All of these are `make` variables — `sudo make image DISK_SIZE=24G`, and so on | Variable | Default | Meaning | |---|---|---| | `IMAGE_NAME` | `proxmox-ve-9` | MAAS name (`custom/`) and preseed filename | -| `ARCH` / `SUBARCH` | `amd64` / `generic` | Target architecture. *Only amd64 was tested.* | +| `ARCH` / `SUBARCH` | `amd64` / `generic` | Target architecture. `arm64` is wired up but **never built or deployed** — see [arm64](#arm64). | | `BOOT` | `uefi` | Boot mode baked into the image. *Only UEFI was tested.* | | `DISK_SIZE` | `16G` | Build VM disk. Upstream's 4G cannot fit Debian + Proxmox | | `BUILD_CPUS` / `BUILD_MEM` | `4` / `4096` | Build VM resources | @@ -751,6 +752,42 @@ serve them; package signatures are still verified. --- +## arm64 + +Proxmox VE 9.2 added **official** arm64 support — same code base, same +repositories, same release lifecycle as x86-64, with full support on NVIDIA Grace +and Vera platforms and best-effort on other UEFI Armv8-A/Armv9-A hardware. The +`pve-no-subscription` repository carries `proxmox-ve`, `pve-manager`, +`proxmox-default-kernel` and `pve-qemu-kvm` for arm64. + +This repository is wired for it: + +```bash +sudo WITH_ARM64=1 ./scripts/install-deps.sh # adds qemu-system-arm, AAVMF +sudo make image ARCH=arm64 +make preseed ARCH=arm64 # -> ..._arm64_generic_proxmox-ve-9 +make upload ARCH=arm64 +``` + +The firmware is selected from the **target** architecture (`AAVMF` for arm64, +`OVMF` for amd64) and padded to 64 MiB as QEMU's arm64 `virt` machine requires; +KVM is used only when the host and target architectures match. + +**This has never been run.** Nothing here has been built for arm64, let alone +deployed, and it is listed under [Not verified](#not-verified) for that reason. +Two things stand between the code and a usable image: + +- **Build speed.** On an x86_64 builder an arm64 build runs under TCG emulation + with no KVM. Expect it to be several times slower than the ~11 minutes an amd64 + build takes; how much slower has not been measured. The I/O optimisations + (`eatmydata`, deferred initramfs) help less when the bottleneck is CPU. +- **Somewhere to deploy it.** An arm64 image needs arm64 machines behind MAAS to + be worth anything, and none were available to test against. + +If you want arm64 seriously, put a native arm64 builder behind a second runner +rather than emulating. That removes the speed problem entirely and lets the same +pipeline build both architectures. + ## Release automation [`.gitea/workflows/build-image.yml`](.gitea/workflows/build-image.yml) builds the image @@ -931,7 +968,9 @@ plaintext `PVE_ROOT_PASSWORD`, `PVE_ENABLED=false`, `PVE_FQDN`, and every **Build variants** - `pve-enterprise` and `pve-test` repositories -- arm64 +- **arm64** — the Makefile and scripts handle it (firmware selection, MAAS + architecture, the Debian-kernel check), but no arm64 image has been built and + none deployed. See [arm64](#arm64). - BIOS boot (`BOOT=bios`) - `DEBIAN_IMAGE_CHANNEL=daily` - `APT_PROXY` and `make deps-cache`. The ~700 MB figure quoted under diff --git a/scripts/ci/publish-release.sh b/scripts/ci/publish-release.sh index 857281a..89313d0 100755 --- a/scripts/ci/publish-release.sh +++ b/scripts/ci/publish-release.sh @@ -20,6 +20,9 @@ REPO_URL="${GITHUB_SERVER_URL:-}/${GITHUB_REPOSITORY:-}" RUN="${GITHUB_RUN_NUMBER:-manual}" SHA="${GITHUB_SHA:-}" IMAGE=$(basename "$(ls "$DIST"/maas-image-*.tar.gz)") +MAAS_ARCH=$(make -s print-var VAR=MAAS_ARCH) +PVE_MAJOR=$(make -s print-var VAR=PVE_VERSION) +IMAGE_NAME=$(make -s print-var VAR=IMAGE_NAME) BODY=$(cat < arm64 hedefi icin ek paketler (WITH_ARM64=1)" + apt-get install -y --no-install-recommends qemu-system-arm qemu-efi-aarch64 +fi + echo "==> HashiCorp APT deposu ekleniyor (packer)" install -d -m 0755 /etc/apt/keyrings curl -fsSL https://apt.releases.hashicorp.com/gpg \ diff --git a/scripts/verify-image.sh b/scripts/verify-image.sh index 5a63d0c..517387d 100755 --- a/scripts/verify-image.sh +++ b/scripts/verify-image.sh @@ -55,7 +55,11 @@ check "iSCSI initiator adi yok (dugumde uretilir)" '! present "etc/iscsi/initia check "SSH host anahtarlari yok" '! grep -qE "^\./etc/ssh/ssh_host_.*_key$" "$TMP/list"' check "networking.service etkin DEGIL" '! present "etc/systemd/system/multi-user.target.wants/networking.service"' check "interfaces.new yok (pvenetcommit ezmesin)" '! present "etc/network/interfaces.new"' -check "Debian cekirdegi yok" '! grep -qE "^\./boot/vmlinuz-.*[^e]-(cloud-)?amd64$" "$TMP/list"' +# Mimariden bagimsiz: /boot altinda -pve ile bitmeyen hicbir cekirdek olmamali. +# Debian'inki amd64'te *-amd64, arm64'te *-arm64 diye adlandirilir; Proxmox'unki +# her zaman -pve ile biter. Hic cekirdek yoksa da gecer - PVE cekirdeginin +# varligini asagidaki ayri kontrol dogruluyor. +check "Debian cekirdegi yok" '! grep -E "^\./boot/vmlinuz-" "$TMP/list" | grep -qv -- "-pve$"' echo echo "==> Proxmox cekirdegi"