For more advanced hardware with multiple sensor types per device
(e.g., SFP modules with temperature, voltage, current, and power
sensors), use the YANG parent/child relationship to group related
sensors together for better presentation.
Changes:
- Remove parent/parent-rel-pos deviations from infix-hardware.yang
- Create parent components (class: module) for multi-sensor devices
- Add parent references to child sensor components
- Add human-readable descriptions from hwmon labels
- Extend hwmon discovery to support voltage, current, and power
- Normalize sensor names: strip vendor prefixes (mt7915_phy0 -> phy0)
- Remove redundant TYPE column, clarify units (V -> VDC, add spaces)
- Simplify child sensor display by stripping parent prefix
- Fix "show system" to only show CPU temperature and fan speed
Example output from "show hardware":
NAME VALUE STATUS
===================================================
sfp1:
Rx Power 0.000 W ok
Tx Power 0.001 W ok
Vcc 3.35 VDC ok
Bias 0.006 A ok
Temperature 30.3 °C ok
sfp2:
Rx Power 0.000 W ok
Tx Power 0.001 W ok
Vcc 3.34 VDC ok
Bias 0.006 A ok
Temperature 32.0 °C ok
cpu 42.8 °C ok
phy0 47.0 °C ok
phy1 53.0 °C ok
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds resource usage: memory, loadavg, and filesystem usage
by augmenting ietf-system:/system-state.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Remove class deviation to allow iana-hardware:sensor
- Populate sensor operational data from /sys/class/thermal
- Extend 'show hardware'
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Usually, when upgrading a system, you want to reboot it so the upgrade
takes effect. This commit adds a 'reboot' option/flag, alongside the
'force' option, to facilitate this.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The DWC2 controller is a very common IP block in ARM and RiscV SoCs. With the
USB subsystem back to a built-in we can now enable host mode for the DWC2 (USB
2.0) ports on RPi. It also opens up for merging the NanoPi R2S into the
generic aarch64 build.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On some boards, and in particular with a hybrid mbr/gpt partition table,
like on the RPi64, we must resize ext *after* reboot.
Also, do some cleanup and consolidation of error handling to prevent us
from entering an endless boot loop.
Follow-up to 391e9715
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit refactors USB port probing to:
- Eliminate duplicates: previously, 'authorized' and 'authorized_default'
were listed as separate USB port entries (confusing). Now each USB
port is represented once, with the path pointing to the USB device
directory, confd appends the appropriate attribute file as needed
- Add support for Raspberry Pi 4B and CM4 USB port(s) using a generic
discovery function that scans /sys/bus/usb/devices for USB root hubs.
This should work seamlessly across all platforms
- For backwards compatibility and better UX:
- Single USB port systems: Named "USB" (no number)
- Multi-port systems: Named "USB1", "USB2", etc.
- Device tree-based discovery is tried first (for boards like Alder with
explicit DT USB port definitions), with fallback to generic discovery
for boards without DT
Fixes: #315
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit adds support for the Raspberry Pi CM4 based mini DFRobot IoT
Router board, SKU:DFR0767. It comes with an additional RTL8111 PCIe NIC
hence the addidtional kernel module and firmware. The latter fixes:
r8169 0000:01:00.0: Direct firmware load for rtl_nic/rtl8168h-2.fw failed with error -2
r8169 0000:01:00.0: Unable to load firmware rtl_nic/rtl8168h-2.fw (-2)
Please note, the change in BCMGENET from module to built-in is to ensure
it is probed before any PCIe NIC, both this board and the CM4-based NVME
NAS base board enumerate the built-in MAC as eth0.
Also, unlike the RPi 3B/4B, it is not a given fact that a CM4 based board
comes with WiFi onboard, and since most compute module setups are DYI, we
take the easy way out and leave it as an exercise to the user to add WiFi
interface to the config.
https://wiki.dfrobot.com/Compute_Module_4_IoT_Router_Board_Mini_SKU_DFR0767
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The BCM2837 core is used not just in the RPi 3B but also in the Zero 2W,
both device trees have been added to the board config.
The BCM2711 support has been extended to include RPi 400 and CM4 I/O.
To support the BCM2837 family more firmware options habe been enabled,
since the RPi3 does not have bootcode.bin flashed in the SoC. The SD
card image now uses a hybrid GPT/MBR format so the RPi3 bootcode.bin
can read all files from the first VFAT partition.
The default device tree for Linux is now chosen by the U-Boot probe and
the only exception is the "laundry room" detector that looks for a RPi4
with a 7" touch screen, which then selects the DSI enabled RPi4 variant.
This is enough to properly load an RPi 3B and a CM4 based router board.
The BCM2837 does not have PCI/PCIe or a built-in MAC so it relies on the
USB to Ethernet LAN78xx which does not support disabling pause frames.
I have opted for checking for EOPNOTSUPP instead of adding yet another
quirk, because it is likely to be a common limitation of more drivers
and chipsets, and this code is best-effort anyway.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Use kernel cmdline option 'usbcore.authorized_default=2' to lock all
external/user-visible USB ports by default.
The kernel distinguishes internal vs external USB ports using ACPI
methods (_UPC and _PLD) on x86/x86_64 systems. On ACPI systems, ports
marked as non-visible but connectable are considered internal (e.g.,
hard-wired USB-to-Ethernet adapters) and are automatically authorized,
while user-visible external ports require manual authorization.
However, on device tree systems the kernel lacks a standard mechanism
for identifying internal ports. The 'authorized_default=2' setting falls
back to requiring authorization for all devices on these platforms,
We list user-accessible USB ports in the device tree ('usb-ports' and
'usb-port-names'), with unlisted ports being implicitly internal and
managed separately.
Fixes#1065
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This will make sure to apply NACM rules for all the data. It also
makes it possible for a luser access a subset of the data, even if
they to do not have read access to /cfg/startup-config.cfg.
This will fix#1106, in time, but only allows manual trigger for now,
needs more test and verification
utils/kernel-upgrade.sh at least automate all the manual manual processes
for upgrading the kernel.
Bridge ports should not have IP addresses configured. The IP address
should be configured on the bridge interface itself, not its member ports.
Add YANG must expression to enforce this rule at configuration time.
Fixes#1122
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A valid DHCP server setup for a subnet is one of pool and/or at least one
static host entry/lease. If pool is enabled the pool must have a start
and an end address.
To allow setting up a DHCP server with no pool and at least one static host
entry/lease, we make the pool a presence container, otherwise the pool will
always be set and trigger the below inference.
When an interactive CLI/Web user enables the address pool we infer a default
range .100-.250, but only for /24, C-class networks. This is what most users
know and expect.
The YANG model now validates that:
- If an address pool is created, both start-address and end-address must be set
- Each subnet must have either a pool or at least one static host entry
- The pool container is now a presence container, so "no pool" fully deletes it
Fixes#1121
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Addresses disk space issues in GitHub Actions for generic x86_64 builds
by removing unused tools (Android SDK, .NET, Docker images, etc.) before
the build starts. This frees up ~30GB of space.
Fixes#1210
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Multiple services can have PID 0 when stopped/done, making PID
unsuitable as a unique key. There could also be multiple services with
the same name (I would assume?).
Signed-off-by: Richard Alpe <richard@bit42.se>
This patch adds operational data support for system services. The
data is in a generic format but is intended to be able to represent
finit information (initctl) nicely.
The reason for augmenting this to ietf-system and not to
infix-services is that we consider this generic system information
which is totally disconnected from what ever services infix might
provide.
In this first state we only support pid, name, description and state.
Making the data look something like:
"infix-system:services": {
"service": [
{
"pid": 1185,
"name": "udevd",
"status": "running",
"description": "Device event daemon (udev)"
}]
Signed-off-by: Richard Alpe <richard@bit42.se>
Address two issues identified by Coverity Scan:
1. CID 550484 (TOCTOU): Remove access() check before realpath()
- realpath() already fails if file doesn't exist, making the
access() check redundant and introducing a TOCTOU race
- Simplifies code while improving security
2. CID 550483 (CHECKED_RETURN): Mark unchecked remove() calls
- Add (void) cast to two remove() calls to explicitly indicate
we don't care about the return value
- These are cleanup operations for temp files where failure
is acceptable, even expected
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Much of the content was made obsolete by recent changes, we now optimize
the experience for users, avoiding recreate at boot unless checksums for
configuration or base image have changed.
This was also a good time to explain the difference between mutable and
immutable tags, which sometimes is a cause for great confusion.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since there is no safe way (unique hash/id) to identify unused named
volumes, we cannot automate removal of them. Since volume data, when
compared to a container image, is quite small, it was decided that we
document this instead.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add bash completion for the common datastores, like we already do in the
CLI, and update the usage text accordingly.
Also, make sure to install to /usr/bin, not /bin since we've now merged
the hierarchies since a while back.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The regular file-to-file copy, was missing calls to cfg_adjust(), this
commit fixes that and adds some helpful comments for each use-case.
Also, drop insecure mktemp() in favor of our own version which uses the
basename of the remote source file.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a follow-up to PR #717 where path traversal protection was
discussed. A year later and it's clear that having a user-friendly
copy tool in the shell is a good thing, but that we proably want to
restrict what it can do when called from the CLI.
A sanitize flag (-s) is added to control the behavior, when used in the
shell without -s, both commands act like traditional UNIX tools and do
assume . for relative paths, and allow ../, whereas when running from
the CLI only /media/ is allowed and otherwise files are assumed to be
in $HOME or /cfg
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg