This is not the full environment used by U-Boot, just the bits needed
for U-Boot to know which slot to boot and for Infix to know how the
boot process went.
U-Boot will selectively import/export only these keys during boot,
which avoids a malicious user from altering the boot in a way that
might bypass signature validation.
The blkmap patches were not included in the original U-Boot Secure
Boot changeset.
Fixes: d243c80 ("aarch64: Convenience target to configure a QEMU compatible U-Boot")
Now that the uncut FIT is stored in primary/secondary, we don't create
any FIT header files.
Fixes: 499a8f7 ("common: Create (e)MMC image with redundant root filesystems")
- Drop unused com32 modules
- Fix duplicate prompt output (serial not needed)
- Reduce timeout before booting default to 0.5 sec
- UI or DEFAULT must be set, otherwise isolinux complains
so replace ONTIMEOUT with DEFAULT
- Increase user-walked-away timeout to 5 minutes
- Always show the prompt
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
On rebuild (without distclean) the getty.conf contained two tty lines
for the same TTY, causing Finit to believe the command line args had
been changed between each reload -- and thus kicking out the logged
in console user who just typed `initctl reload`.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Need to rsync the whole skeleton since we provide more than just the
finit.d files, e.g. /etc/fstab, which we also modify in this .mk.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Now that we have dialog on target we can add a user-friendly factory
reset dialog. The new `yorn` script handles any form of yes-or-no
question, with or without dialog, to call a command.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Now that we only support mmc and squash in `make run` we should make
sure the reference platform works as well as aarch64.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change adds support for setting the system boot mode to native /etc
style for systems where it's difficult, or close to impossible, to set
the Finit boot condition to 'etc'.
Note: this also moves the check for factory reset before we check if we
should use_etc, rather than NETCONF. This to allow clearing out any of
the state files (.use_etc) before proceeding to boot in the default mode
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
1. Use same naming standard for quagga and frr
2. Only one of quagga and frr can be used at the same time
3. Subdirectories in available/ only in the skeleton, not on target
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Only install the corresponding Finit svc if the package is selected in
the Buildroot menuconfig. Some packages cannot be enabled by default
though, since they require a daemon configuration file, e.g. in the
case of ulogd it requires a valid /etc/ulogd.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This image contains:
- A partition to hold bootloader config ("aux").
- Two redundant copies of the FIT framed rootfs (which will be
upgradable by RAUC from within Infix).
- A partition to store critical configuration data ("cfg")
- A partition to store data created dynamically by Infix ("var")
mkimage will generate an FIT image containing a signature of the
rootfs, where the data is kept out of the DTB data structure, i.e.:
.---------.
| DTB |
:---------:
| Padding |
:---------:
| |
| |
| rootfs |
| |
| |
'---------'
This is the on-disk format of Infix. At boot, we extract kernel and
device trees from the rootfs, and then use Linux's device mapper to
create a virtual block device that exposes the rootfs (squash).
This ensures that U-Boot images that we build can always:
- Rely on the environment extensions in env.dtsi being available
- Access the configured signing keys
- Use SD/eMMC cards
- Extract files from SquashFS filesystems
All of which are foundations that we intend to design our image
loading around.
Ensure that whenever U-Boot is built:
- The chosen signing key and is converted to the expected format and
installed in the build tree.
- Infix's environment extensions are installed in the build tree
Keep a shared in-tree key that can be used to sign Infix images during
development. The idea is that this will also be included in developer
builds of U-Boot.
This is likely the last before v4.4-rc1. Last remaining thing is a very
basic tmpfiles.so plugin that replaces a lot of what bootmisc.so hs been
(ab)used for.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also add libcurl so all Clixon utility functions and apps are build with
full support for RESTCONF.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This introduces a dependency on /run/clixon to exist when starting up.
Requires a patch to Finit panding the upcoming tempfiles.so plugin.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Also needs /var/cache/nginx when starting up. Requires separate patch
for now, but will be added a tmpflies.so plugn to Finit.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Primarily for evaluating OSPF in customer's use-case. Preparing for
some (static) multicast routing tests as well.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Keep the transient files in the system's /mnt/tmp, and only persist
startup_db in /cfg.
This design (with a symlink) means that /cfg/startup_db _must_ exist
in order for clixon to start properly. Therefore run
/lib/infix/prep-db to take care of this.
At the moment, this just creates an empty factory config, and copies
it to startup if it doesn't exist. In the future, prep-db could select
a factory config based on some hardware identifier, or even build one
dynamically, based on available ports etc.
Joachim Wiberg