These changes are designed to make the experience working with log files
easier. Both listing available log files and viewing them.
- replace C dir@infix with a shell script for easier extensions,
e.g., we want to show both available .cfg and log files
- add support for gunzipping .gz log files before viewing them
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To support testing, the test-config.cfg file has been introduced in Infix.
Additionally, a "test mode" for the running image is required for this
configuration to be applied.
Basically the test-config will only be loaded when the device is in test mode,
which is determined by the presence of the /mnt/aux/test-mode file.
However, placing this file via the Qeneth system proved to be
inconvenient in the test environment. Therefore, it the entire image is
built in test mode, with the 'test-mode' file preloaded onto the disk
image (specifically in the auxiliary partition).
To support this, a new variable, (bool) DISK_IMAGE_TEST_MODE, has been
introduced:
enabled: the image will be built in the test mode;
disabled: the image will be built in the standard mode.
Part of issue #568
In order for the probe logic to source product data from a VPD, it
must be marked as such. Otherwise we end up in a scenario where the
data is collected, but not hoisted up to the system level, leaving the
system without a defined base-MAC for instance.
When the interface is up and has a 'proto dhcp' address the WAN LED is
lit up. When the interface goes down, or loses its DHCP lease, the LED
is turned off.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Allow reset button on the R2S to be used for factory reset at power-on.
See board README for details.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch greatly improves the security of the Infix factory reset by
replacing 'rm' with 'shred'. The shred tool overwrites the contents of
files three times. With the -z and -u options the last pass writes
zeroes and then uninks the files.
On the NanoPi R2S the factory-reset now takes 24 seconds:
Aug 11 16:00:34 infix mnt[121]: Resetting to factory defaults.
Aug 11 16:00:58 infix mnt[173]: Factory reset complete.
A visual aid is also added, setting *all* LEDs to on, that can be found
mounted on the device, before starting the file shredders. The LEDs are
reset back to off and SYS red blinking as soon as the wipe has completed
and iitod has been started.
Fixes#158
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows us to define the rauc manifest compatibility string with
menuconfig. The INFIX_IMAGE_ID is a direct replacement for the previously
composed "infix-$ARCH" in mkrauc.sh.
For example, the compatibility string "infix-aarch64" is replaced for the
NanoPi R2S with "infix-r2s" to ensure users get a proper warning if they
try upgrading to an image that maybe boots, but is not likely to work.
The CLI upgrade command gets a 'force' flag to override the compat string.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch further cleans up the r2s kernel config and also enables the
input event framework for the gpio0 reset button on the device.
The very simple input-event-daemon is introduced, with the only purpose
of listening to /dev/input/event1 for KEY_RESTART and trigger reboot.
Some helpful tooling is also added to help debug events (evtest).
Issue #276
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This serves as an example of how a board specific builds in Infix can
carry a static factory-config. This will be extended upon as we add
support for DHCP server, WiFi access point, and firewall support.
For now the following features are added:
- Default hostname: r2s instead of infix-00-00-00
- LAN port always at 192.168.2.1/24, IPv6 SLAAC enabled
- WAN port has DHCP enabled for IPv4, IPv6 SLAAC disabled
- NTP client enabled, default server pool.ntp.org
- DHCP client is set up to request and allow ntp server
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The R2S has a minimal set of system LEDs, all of which are single color.
This commit tries to distill and map the essence of the Infix functions
to available LEDs.
The SYS LED is turned on (fainy red) at power-on, when U-Boot has loaded
the kernel it turns the SYS LED bright red on. The idea is then to turn
the red SYS LED off as soon as the system has successfully loaded system
startup-config, and then turn the green LAN LED on. Indicating that the
both the device is operational and that the user can connect to the LAN
port.
The WAN LED is given a "wan-up" input condition, with the intention of
turning it on (green) when the device has acquired a DHCP address.
The failure modes, which in many ways is the essence of Infix signaling,
are fail-safe and panic, triggered by loading failure-config, or failing
to loadd failure-config, respectively. In fail-safe mode the SYS LED is
blinking red at 5 Hz and in panic mode *all* LEDs blink at 5 Hz.
Issue #276
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With new features & fixes, Infix grows. With the latest support for
rauc upgrades introduced with the VisionFive2, and now also for R2S,
we need to reserve room for future upgrades even when running from
an SD card.
This is a quick fix for genimge generated SD card imaages before we
get a proper installer in place that can be used both on the target
and host systems to partition and provision an eMMC, NVME, SSD, or
an SD card.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable BR2_DOWNLOAD_FORCE_CHECK_HASHES for R2S
- Relocate VisionFive2 patches to global patch dir for sharing with R2S
- Add hash for ATF v2.9
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change allows modifying and saving the U-Boot environment to the
aux partition on the NanoPi R2S. Required to able to safely maintain
multiple R2S devices on the same LAN.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
U-Boot (2024.07) does not yet support the 'metadata_csum' feature flag
to Ext4 file systems. So let's disable it for now in mkaux.sh so we
can allow builds for, e.g., the R2S and VisionFive2 boards to modify
and save their U-Boot environment.
Needed on the NanoPi R2S to set ethaddr + eth1addr since it does not
have any VPD EEPROM mounted.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Bump kernel to 6.10.3
- Initial defconfig sync with aarch64
- Enable kprobes, ksyms, and function tracer
- Enable missing file systems for parity with Infix
- Enable bridging, netfilter, and other Infix requirements
- Initial virtion support for running in Qemu (untested)
- Enable device mapper, required for rauc bundle install
- Make dummy and tunnel drivers modules to be able to drop dummy0
and tunl0 interfaces that otherwise mess up "show interfaces"
- Disable suspend and hibernation, not supported in Infix
- Disable unused GPIO, PHY, MDIO, and USB drivers
- Disable RK3328 watchdog driver, cannot perform reset on R2S,
enablle softdog instead as a seamless replacement for Infix.
Even though not optimal (since it's software) reboot works
- Disable ethtool netlink support, does not work and breaks
interface configuration completely on R2S!
- Enable netdev LED triggers, for LAN and WAN LEDs
- Bump u-boot to 2024.07
- Hard code developer mode to allow shell access
- Disable factory reset button support (not yet supported)
- Bump ATF to v2.9
- Enable squashfs for rootfs image
- Enable signing of images
- Add secondary partition
- Add dedicated var partition
- Add aux partition for signatures and uboot env
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For systems with multiple paths to the network, different situations
may call for different paths to be used. Therefore, allow the user to
override the active interface via the environment on the auxiliary
partition.
The default (defined the bootloader's device tree) is still used in
cases when nothing else is specified in the environment.
For consistency with the / + /usr merge, see 2194f7be, let's move the
last remnants in /: /libexec/infix to /usr/libexec/infix
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Ensure Finit installs its files to /usr/lib/finit when building with the
merged-usr config option. For consistency we adjust --exec-prefix, which
is the base for $libdir, meaning also /libexec is moved to /usr/libexec.
Finit tracks the paths internally, we only need to update runparts probe.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Sync defconfig with aarch64
- Sync linux_defconfig with aarch64
- ethtool w/ netlink not supported yet for the StarFice dwmac
- note, waaay too many unused drivers still
- Add aux/cfg/var partitions to sdcard, no rauc support yet
- Add factory-password-hash to device tree
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Consolidate empty password and $factory$ hash extraction to a common
function called before set_pasword(). The purpose is to ensure all
error handling and log messages are in the same place, except for
missing factory-password-hash, which is now treated as a PANIC and
logged to /dev/console.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When syncing interface defaults at boot, some settings are read-only and
some are write-only. Filter these out so sysctl does not log any bogus
Permission Denied messages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
cp: cannot stat '/home/lazzer/Documents/addiva/infix/board/common/rootfs/bin/onieprom': No such file or directory
Signed-off-by: Mattias Walström <lazzer@gmail.com>
From https://en.wikipedia.org/wiki/exFAT:
... a file system optimized for flash memory such as USB flash
drives and SD cards.
... has been adopted by the SD Association as the default file
system for SDXC and SDUC cards larger than 32 GB.
The exfatprogs is also a default installed package on most modern
distros, compared to dosfstools (mkfs.vfat) which is not.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change builds on top of the earlier work to bootstrap Infix YANG
modules at build time. Adding a step at the end of post-build.sh to
call the yangdoc tool. The resulting yangdoc.html is a stand-alone HTML
file of (almost) all YANG nodes. Almost because some top-level nodes
are unused by Infix atm. and have been filtered out for readability.
Fixes#432
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the recent changes to confd to support: hostname format specifiers,
$factory$ default keyword for password, and on-the-fly generation of the
NETCONF SSH host keys, the system no longer depend on the very intricate
confd gen-* scripts to create factory-config and failure-config.
This patch set adds support for detecting and installing product/vendor
specific static factory-config and failure-config files. See the confd
README for details.
To facilitate generation, e.g., of the NETCONF SSH host keys, the confd
daemon must be running when bootstrapping the first startup-config from
eithe generated or static factory-config. This is why the bootstrap and
load helper scripts have been changed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch adds support for an empty "genkey" pair in the keystore for
the NETCONF hostkeys. Primarily intended for static factory-config.
When a configuration is loaded and confd detects a missing public or
private key in the "genkey" asymmetric key, it loads generated keys
from disk and store in the running datastore.
Fixes#435
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add metadata 'version' field to ietf-system to be able to detect .cfg
file version. Fixes#308
Add early boot script to automatically migrate configuration files of
older version to new syntax. Fixes#178
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Since a user has access to the shell in developer mode, we might as
well allow booting through the standard boot scripts as well. This
means that a product with a bootloader only accepting images signed by
Company A can now be configured to netboot a regular developer image
without any special user interaction.
We no longer need to set bootdelay on development platforms. You can
now always get to the bootmenu with a Ctrl-C, from there you can get
to the shell if developer mode is enabled. Therefore, override the
default dev-mode detection to statically enable it on the CRB.
If we receive an option 67 (bootfile) matching http://IP/rootfs.itb,
use U-Boot's wget implementation to download the file. The web server
must listen on port 80. tftp:// is also supported.
Without a protocol prefix, assume that the bootfile should be fetched
using TFTP from ${serverip}.
Generate a boot menu, accessible with C-c during a short window, where
a user can interactively select a custom boot source and/or trigger a
factory reset of the device.
With this in place, we should always be able to unbrick a device, as
the image can be fed over the network, and local data can be ignored
by opting in to a factory reset.
Joachim Wiberg