#!/bin/sh
# Blackbox: tools the measured initramfs needs beyond what the stock hooks add,
# plus the pruning that keeps the module tree (which the guest inherits at
# runtime) to what a virtual machine can actually use.
PREREQ="dropbear cryptroot"
prereqs() { echo "$PREREQ"; }
case "$1" in prereqs) prereqs; exit 0 ;; esac
. /usr/share/initramfs-tools/hook-functions

copy_exec /sbin/resize2fs
copy_exec /sbin/e2fsck
copy_exec /sbin/tune2fs
copy_exec /sbin/blkid
copy_exec /usr/bin/dropbearkey
# growpart and what it drives: the template's root partition is sized for the
# template, and a measured VM never runs cloud-init's growpart on a first boot.
copy_file script /usr/bin/growpart /sbin/growpart
copy_exec /sbin/sfdisk
copy_exec /usr/sbin/sgdisk
copy_exec /usr/bin/partx
copy_exec /sbin/blockdev
copy_exec /usr/bin/flock
[ -x /usr/lib/klibc/bin/ipconfig ] && copy_exec /usr/lib/klibc/bin/ipconfig /bin/ipconfig
if [ ! -x "$DESTDIR/usr/sbin/cryptroot-unlock" ] && [ -f /usr/share/cryptsetup/initramfs/bin/cryptroot-unlock ]; then
    mkdir -p "$DESTDIR/usr/sbin"
    cp /usr/share/cryptsetup/initramfs/bin/cryptroot-unlock "$DESTDIR/usr/sbin/cryptroot-unlock"
    chmod 755 "$DESTDIR/usr/sbin/cryptroot-unlock"
fi
copy_exec /usr/local/lib/bb/snpreport /bin/snpreport
copy_file script /usr/local/lib/bb/bb-shell /bin/bb-shell
copy_file script /usr/local/lib/bb/unlock.sh /scripts/unlock.sh
copy_file script /usr/local/lib/bb/fde-encrypt.sh /scripts/fde-encrypt.sh
chmod 755 "$DESTDIR/bin/bb-shell" "$DESTDIR/scripts/unlock.sh" "$DESTDIR/scripts/fde-encrypt.sh"
manual_add_modules sev-guest

# The guest reuses this tree when its own root lacks modules for the measured
# kernel, so it has to be the WHOLE tree (netfilter, wireguard, overlay, nfs,
# ...), not the storage-and-network subset MODULES=most selects. Copy
# everything, then remove hardware a virtual machine cannot have.
copy_modules_dir kernel
for d in gpu media sound net/wireless net/ethernet net/wan net/can net/fddi net/hamradio net/wwan net/usb net/dsa net/pcs net/mdio net/phy \
         net/fjes net/hyperv net/vmxnet3 \
         infiniband staging bluetooth usb hid input iio mmc mtd isdn firewire thunderbolt \
         platform hwmon video pcmcia w1 spi i2c gpio comedi greybus accel nvme ata \
         scsi/qla2xxx scsi/lpfc scsi/mpt3sas scsi/megaraid scsi/aacraid scsi/be2iscsi scsi/bnx2fc \
         scsi/bnx2i scsi/csiostor scsi/cxgbi scsi/esas2r scsi/fcoe scsi/fnic scsi/hisi_sas scsi/mvsas \
         scsi/pm8001 scsi/qedf scsi/qedi scsi/smartpqi scsi/snic scsi/qla4xxx scsi/aic7xxx scsi/aic94xx \
         scsi/arcmsr scsi/hptiop scsi/isci scsi/libsas scsi/mpi3mr scsi/elx scsi/ibmvscsi_tgt; do
    rm -rf "$DESTDIR/lib/modules/$version/kernel/drivers/$d"
done
# Storage HBAs live in subdirectories of drivers/scsi; the core (sd, sr,
# virtio_scsi) sits in the directory itself and stays.
find "$DESTDIR/lib/modules/$version/kernel/drivers/scsi" -mindepth 1 -maxdepth 1 -type d ! -name device_handler -exec rm -rf {} + 2>/dev/null || true
for d in kernel/arch/x86/kvm kernel/sound kernel/net/wireless kernel/net/bluetooth kernel/net/mac80211 kernel/net/nfc kernel/drivers/firmware kernel/drivers/fpga kernel/drivers/vfio kernel/drivers/xen kernel/drivers/hv; do
    rm -rf "$DESTDIR/lib/modules/$version/$d"
done
