Skip to content

initrd: boot dd-written hybrid ISOs in mount-usb and usb-autoboot - #2186

Open
tlaurion wants to merge 7 commits into
linuxboot:masterfrom
tlaurion:fix-2008-dd-hybrid-iso-boot
Open

initrd: boot dd-written hybrid ISOs in mount-usb and usb-autoboot#2186
tlaurion wants to merge 7 commits into
linuxboot:masterfrom
tlaurion:fix-2008-dd-hybrid-iso-boot

Conversation

@tlaurion

@tlaurion tlaurion commented Aug 15, 2026

Copy link
Copy Markdown
Collaborator

Summary

Fixes #2008: a Kicksecure hybrid ISO dd'd to a USB drive
now boots in both the manual USB boot menu and Basic-mode auto-boot.

The problem

A dd-written Kicksecure ISO is a GPT hybrid whose bootable iso9660
filesystem lives on the whole raw device, not on a partition. The boot
path relied on blkid TYPE="iso9660" to detect such drives, which does
not reliably report the type on these oversized/GPT-hybrid sticks, so no
bootable filesystem was found and boot failed.

The fix

  • initrd/etc/functions.sh: add first_mountable_usb_disk() (a
    non-destructive read-only mount probe that finds a bootable filesystem
    on a whole device) and is_whole_disk(); host _get_blkid_fstype()
    (moved from kexec-iso-init.sh).
  • initrd/bin/mount-usb.sh: add a --whole-disk flag that probes whole USB
    disks with an actual read-only mount instead of blkid; the default
    remains partitions-only.
  • initrd/bin/media-scan.sh: the USB boot path opts in via
    mount_usb --whole-disk, and retries once with the default
    partitions-only mount when a whole disk mounts but yields no boot
    entries.
  • initrd/etc/gui_functions.sh: mount_usb() forwards its arguments to
    mount-usb.sh and maps exit 5 (picker abort) to exit 1.
  • initrd/bin/usb-autoboot.sh: enumerate whole disks before partitions so
    a dd-written hybrid ISO auto-boots in Basic mode.
  • config/busybox.config: enable CONFIG_FEATURE_BLKID_TYPE=y so blkid
    reports the filesystem TYPE used by kexec-iso-init.sh.
  • boards/qemu-coreboot-fbwhiptail-tpm2-basic-usb-autoboot: new QEMU test
    board (Basic mode + USB autoboot) for this path.
  • tests/iso-test/: move the iso-boot test suite out of initrd/ so it no
    longer ships in the initrd image.
  • Docs (boot-process.md, busybox_perks.md, iso_boot.md, logging.md).

Testing

  • ISO boot test suite: 26 passed / 0 failed / 0 skipped.
  • QEMU: a dd'd Kicksecure ISO mounts the whole device and reaches the
    boot menu in manual mode, and auto-boots in Basic mode; Tails, Debian
    live, and partitioned images (NixOS) still boot through the existing
    paths.

Copilot AI lite review requested due to automatic review settings August 15, 2026 14:01

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@tlaurion
tlaurion marked this pull request as draft August 15, 2026 14:11
@tlaurion tlaurion changed the title initrd/mount-usb: detect dd-written hybrid ISO and boot whole disk initrd/mount-usb: mount whole device when it is an iso9660 hybrid ISO Aug 15, 2026
@tlaurion
tlaurion force-pushed the fix-2008-dd-hybrid-iso-boot branch 3 times, most recently from 58a3ab5 to 92d099d Compare August 15, 2026 20:33
@tlaurion tlaurion changed the title initrd/mount-usb: mount whole device when it is an iso9660 hybrid ISO initrd: detect dd-written hybrid ISO on whole device Aug 15, 2026
@tlaurion

Copy link
Copy Markdown
Collaborator Author

Verified working without regression under qemu on thumb drives with multiple isos dropped on it and directly booting on iso from qemu: both work.

@tlaurion
tlaurion marked this pull request as ready for review August 15, 2026 20:37
@tlaurion

Copy link
Copy Markdown
Collaborator Author

verified dd'ed and iso boot on debian-13 xfce too.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 5 out of 7 changed files in this pull request and generated no new comments.

@tlaurion tlaurion changed the title initrd: detect dd-written hybrid ISO on whole device initrd: boot dd-written hybrid ISOs in mount-usb and usb-autoboot Aug 16, 2026
@tlaurion

Copy link
Copy Markdown
Collaborator Author

Was testing Kicksecure-LXQt-18.1.4.2.Intel_AMD64.iso, will test Kicksecure-LXQt-18.2.1.9.Intel_AMD64.iso

- mount-usb.sh: probe whole USB disks with a read-only mount
  (first_mountable_usb_disk) instead of blkid TYPE=iso9660; --whole-disk
  opts in, the default remains partitions-only
- media-scan.sh: retry once with the partitions-only mount when a whole
  disk mounts but yields no boot entries
- gui_functions.sh: mount_usb() forwards its arguments to mount-usb.sh
  and maps exit 5 (picker abort) to exit 1
- functions.sh: add first_mountable_usb_disk and is_whole_disk; host
  _get_blkid_fstype for kexec-iso-init.sh

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Enable CONFIG_FEATURE_BLKID_TYPE so BusyBox blkid reports the filesystem
TYPE, which kexec-iso-init.sh's _get_blkid_fstype (shared from
initrd/etc/functions.sh) relies on.

Part of the issue linuxboot#2008 hybrid ISO boot fix.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Move initrd/tests/iso-test/ to tests/iso-test/ so the test script no longer ships inside the initrd image.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Update boot-process, busybox_perks, iso_boot and logging docs for the kernel mount-test mechanism and the mount-usb.sh exit 5 contract.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
…B autoboot test board

- Add qemu-coreboot-fbwhiptail-tpm2-basic-usb-autoboot board with
  CONFIG_BASIC_USB_AUTOBOOT=y to test automatic boot of bootable USB
  media (dd-written hybrid ISO) under QEMU
- Enable CONFIG_DEBUG_OUTPUT and TPM2 pcap capture for test diagnostics

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
- Print the source git commit (GIT_HASH and HEADS_GIT_VERSION) in the
  build start banner so non-reproducible builds are attributable to the
  commit that produced them
- Part of issue linuxboot#2008 follow-up

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Document that the last console= parameter becomes the primary console
for /dev/console, and how that routes STATUS/NOTE (primary only),
DEBUG/WARN/DIE (kmsg broadcast to all consoles), kernel printk (all
consoles), and whiptail dialogs (framebuffer only).

Part of issue linuxboot#2008 follow-up.

Signed-off-by: Thierry Laurion <insurgo@riseup.net>
@tlaurion
tlaurion force-pushed the fix-2008-dd-hybrid-iso-boot branch from db00961 to aacb22a Compare August 18, 2026 14:56
@tlaurion

tlaurion commented Aug 18, 2026

Copy link
Copy Markdown
Collaborator Author

Tested with oversized raw image vs iso size (thumb drives should always be bigger then iso...) and now works as expected.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

"kicksecure iso doesn't boot under Heads

2 participants