This commit adds support for the Raspberry Pi CM4 based mini DFRobot IoT
Router board, SKU:DFR0767. It comes with an additional RTL8111 PCIe NIC
hence the addidtional kernel module and firmware. The latter fixes:
r8169 0000:01:00.0: Direct firmware load for rtl_nic/rtl8168h-2.fw failed with error -2
r8169 0000:01:00.0: Unable to load firmware rtl_nic/rtl8168h-2.fw (-2)
Please note, the change in BCMGENET from module to built-in is to ensure
it is probed before any PCIe NIC, both this board and the CM4-based NVME
NAS base board enumerate the built-in MAC as eth0.
Also, unlike the RPi 3B/4B, it is not a given fact that a CM4 based board
comes with WiFi onboard, and since most compute module setups are DYI, we
take the easy way out and leave it as an exercise to the user to add WiFi
interface to the config.
https://wiki.dfrobot.com/Compute_Module_4_IoT_Router_Board_Mini_SKU_DFR0767
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The BCM2837 core is used not just in the RPi 3B but also in the Zero 2W,
both device trees have been added to the board config.
The BCM2711 support has been extended to include RPi 400 and CM4 I/O.
To support the BCM2837 family more firmware options habe been enabled,
since the RPi3 does not have bootcode.bin flashed in the SoC. The SD
card image now uses a hybrid GPT/MBR format so the RPi3 bootcode.bin
can read all files from the first VFAT partition.
The default device tree for Linux is now chosen by the U-Boot probe and
the only exception is the "laundry room" detector that looks for a RPi4
with a 7" touch screen, which then selects the DSI enabled RPi4 variant.
This is enough to properly load an RPi 3B and a CM4 based router board.
The BCM2837 does not have PCI/PCIe or a built-in MAC so it relies on the
USB to Ethernet LAN78xx which does not support disabling pause frames.
I have opted for checking for EOPNOTSUPP instead of adding yet another
quirk, because it is likely to be a common limitation of more drivers
and chipsets, and this code is best-effort anyway.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add bash completion for the common datastores, like we already do in the
CLI, and update the usage text accordingly.
Also, make sure to install to /usr/bin, not /bin since we've now merged
the hierarchies since a while back.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fixes a minor regression after merge of BPi-R3. The RPi4 device tree,
specifically regulator-sd-io-1v8 in bcm2711-rpi-4-b.dts, requires the
GPIO voltage regulator be built-in for the SD card controller.
Fixes#1197
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add supoprt for infix-firewall.yang, modeled on the zone-based firewalld
The terminology is a mix of firewalld, classic netfilter and inspired by
Ubiquity. E.g., zone 'policy' -> 'action', and the zone matrix overview.
- Port forwarding allows forwarding a range of ports
- Operational data comes from firewalld active rules
- Firewall logging goes to /var/log/firewall.log
- Show implicit/built-in rules and zones (HOST) in firewall matrix,
includes "locked" policy for the default-drop behavior
- The zone services field in admin-exec 'show firewall' shows ANY when
the zone default action is set to 'accept'
- Zone 'forwarding' and 'masquerade' settings live in Infix in the
policys instead, meaning users need to explicitly add a policy
to allow both intra-zone and inter-zone forwarding
- Support for emergency lockdown (kill switch)
- Pre-defined services (xml+enums) are filtered and included as a
separate YANG model, extensions added for netconf and restconf
- Includes initial support for firewalld rich rules
firewalld policy rules, including rich rules, have an obnoxious priority
field which is extremely hard to get right, so in Infix we use the far
superior YANG construct 'ordered-by user;'. This ensure all rules are
generated in that order by setting the priority field, on read-back from
firewalld (operational) the priority field is used to sort the output
of rules in the CLI.
Fixes#448
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The default 'trace' log level is quite verbose for our production systems.
This commit changes the default to 'info' and adds a command line option
to control the log level if needed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To be able to maintain our own set of patches on top rousette, a kkit
branch have been set up with a reduced set of backported fixes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The Banana Pi R3 is a high-performance networking board featuring:
- MediaTek MT7986 ARM Cortex-A53 quad-core processor
- 4x Gigabit LAN ports (lan1-lan4)
- 1x Gigabit WAN port
- 2x SFP ports (sfp1, sfp2) for fiber connectivity
- Dual WiFi interfaces (wifi0 for 2.4GHz, wifi1 for 5GHz)
- USB support
- SD card boot support
Highlights:
- fixes to systemd and s6 type services
- bare-bones libsystemd replacement with #include <systemd/sd-daemon.h>
- new reload:script mimicking systemd ExecReload, and
- new stop:script mimicking systemd ExecStop
- exit status/signal info when a process dies
- service kill:SEC now support up to 300 sec.
- the /tmp/norespawn trick now also covers service_retry()
- the sysv 'stop' command process environment is now same as 'start'
- State machine ordering issue: enter new config generation after
services disabled in previous generation have been stopped
Full changelog at:
- <https://github.com/troglobit/finit/releases/tag/4.13>
- <https://github.com/troglobit/finit/releases/tag/4.14>
Fixes#1123
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit migrates the bootloader build from Raspberry Pi 4 board
package to a dedicated bootloader defconfig. The idea is to set up
dedicated wokflows for building bootloaders, which change rarely,
streamlining the Infix image builds.
A dedicated workflow, or job in an existing workflow, can then do
the composition to minimal SD-card images useful for starting up
Infix on boards where SD-card is the primary boot source.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The execd runner has not been used since Nov, 2024, ca0e54b. This
weekend it started triggering a warning from Coverity Scan, so let
us drop it for good this time.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We was missing the firmware required for this, and for this to work
cfg80211 needs to be as module since the rootfs is not loaded when it
is loaded if compiled in kernel.
And add iw since it very useful for debugging.
- Fix by-word movement, detect word barrier using non-alphanum chars
- Fix delete word left/right, make sure to save word in kill buffer
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Buildroot updated to v25.02.3
- Tefactor of nftables container
The nftables container now includes BusyBox, a shell with vi and some
basic filesystem tools, as well as nsenter and unshare, suitable for
testing and other more advanced tasks.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Support implemented:
* WPA2/3 support
* scanning (in background, results in operational)
* Unencrypted networks
No certificate support, only PSK
*only* client so far, no AP
Non-privileged users in the sys-cli group can now access sysrepo data.
The data is now solely protected by the NCAM rules and not Unix file
permissions. Any stray user that's not part of the (default) sys-cli
group still can't access syrepo, like users added from the shell.
Fixes#932
Signed-off-by: Richard Alpe <richard@bit42.se>
Sysrepo, netopeer etc are still responsible to install the modules in
target directory, this will make that we will discover quickly if something
is updated.
Also this enables rm -rf output/target/etc/sysrepo/data/* && make confd-rebuild
This will reinstall all modules again.
The reason for this is:
1) We want to use the same fetch tool for all operational data, to
avoid having duplicated xpaths scattered across the repo.
2) We want to call this directly from the CLI, which means it need to
be escape safe. A unprivileged user shall be able to use it but not
escape into a shell or do other malicious stuff.
Signed-off-by: Richard Alpe <richard@bit42.se>
There is no such loglevel 'critical', only 'crit' is defined.
For some reason this issue has not been spotted until the upgrade to
Buildroot 2025.02, which includes sysklogd v2.7.0, and Finit v4.11.
Introduced in 3e48af6, when the concept of failure-config was added.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg