Two related problems prevented devices behind an intermediate hub (e.g.
the VIA Labs hub on the RPi 400's VL805 xHCI) from being authorized
when confd unlocks a USB bus:
1. Cascade ordering: usb_authorize() ran nftw() with FTW_DEPTH, which
visits children before the root-hub entry. The hub was authorized
while authorized_default was still 2, so when the kernel probed the
hub's children it immediately denied them. Fix: write
authorized_default=1 on the bus before entering nftw.
2. Slow/async probe: hub port enumeration is asynchronous — devices
behind a hub may appear in sysfs after nftw has already finished.
Fix: add a udev rule that catches usb_device add events on buses
where authorized_default=1 is already set on any ancestor root hub
and authorizes them immediately.
The ATTRS{} matcher in udev walks the full sysfs parent chain, so
authorized_default=1 on the root hub is visible even for devices several
hubs deep. Buses still locked at authorized_default=0 are left alone.
Also expand the docstring in generic_usb_ports() to document the
design: each root hub gets its own uniquely-named entry (USB, or USB1/
USB2/... when multiple) so buses can be individually controlled, and
boards needing finer control should use DT usb-ports annotations.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replace the costly read-only filter loop (awk+tr per line) with a
stderr redirect, use /sys/class/net/ instead of ip+jq, and batch
all sysctl writes into a single call.
Reduces boot time by ~4s on 32-bit Arm systems.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Calling tune2fs for ext4 partitions at boot costs more than one second
boot time on 32-bit Arm systems, with very little gain. Dropping this
restores the default periodic fsck *and* saves boot time.
Instead of calling sgdisk four times, call it only when resizing and
instead use sysfs to find named paritions. Saves seconds on boards
with weaker CPU and slow media.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The MVEBU SafeXcel Crypto Engine firmware (linux-firmware minifw) was
originally added in 70c12c3 to the generic aarch64 defconfigs to silence
kernel probe failures on Marvell Armada SoCs (37xx, 7k, 8k, CN913x):
crypto-safexcel f2800000.crypto: Firmware load failed.
crypto-safexcel f2800000.crypto: HW init failed (-2)
It was then accidentally dropped in 0e2d12e (kernel upgrade to 6.18),
which rebased on a tree that predated the firmware addition.
Rather than restoring it to the generic defconfigs, move it to the two
Marvell board Config.in files where it actually belongs — consistent
with how RTL8169 firmware was handled for the Raspberry Pi CM4 IoT
Router Board Mini in 68313773.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Increase Zebra NETLINK buffer to fix reported issues with zebra being
out of sync with kernel routes and interface changes.
Also, try '-a' option to allow other processes to delete zebra routes.
Other changes in this commit:
- Minor fixes to Finit service files for consistency
- Empty daemon.conf stub files to silence bogus mgmtd errors at startup
- Relocate all skeleton files from board/common to separate from files
that are actual Infix additions and what's package system integration
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
network.local is a discovery/browse page, not a management interface.
Serving it over HTTP eliminates the self-signed certificate warning
browsers show for .local mDNS names without changing the security
posture of the actual device management pages (still HTTPS-only).
The new port-80 server_name block takes precedence over the catch-all
HTTP → HTTPS redirect in default.conf.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Instead of publishing A/AAAA records for $(hostname).loocal with a CNAME
infix.local, we flip it around to take advantage of the mDNS conflict
resolution rules. This gives us infix.local for one device ont the LAN
and infix-2.local for the next.
Update all service records to *not* advertise hostname, but instead to
let Avahi imply that from the advertised A/AAAA and CNAME records.
Fixes#1387
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
DNS does not allow CNAME records at an apex domain (e.g. kernelkit.org),
so GitHub Pages cannot reliably redirect kernelkit.github.io to it. A
www subdomain can carry a CNAME pointing directly to kernelkit.github.io,
giving GitHub full control over the mapping and making the redirect work.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The weird `if env | grep -q 'reset-volumes'` construct is due to Klish
not sanitizing names before constructing variables, which leads to env
variables with '-' in them, not allowed in POSIX sh.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Rename BR2_PACKAGE_NETD_FRR to BR2_PACKAGE_NETD_FRR_GRPC to match the
naming convention of the other FRR backends (VTYSH, CONF) and make the
intent self-evident.
Have the gRPC backend select BR2_PACKAGE_FRR_GRPC so FRR is built with
gRPC support when — and only when — this backend is chosen.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a simpler approach than both grpc and watchfrr. Since we only
really need dynamic handling of static routes (for DHCP), we can track
changes made and maintain a "diff engine" for the resulting frr.conf.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
With the latest backported fixes to Finit, we no longer need to remove
/run/netd.pid to trigger a reload (restart) of staticd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This includes adding a netd-daemon since FRR has gone towards all
daemons should be configured from mgmtd using YANG, netd uses gRPC to
reconfigure in mgmtd
Signed-off-by: Enable grpc
This is a simple two port router board, with the same
WiFi chips as BPI-r3.
The bootloader shall be the same as the BPI-r3, the bootloader
now probes which of the two is booting by checking for the PHYS
that only exist on BPI-r3-mini.
This update brings new support for editing cleartext-symmetric-keys with
the 'change' command. The cleartext-symmetric-key is of type binary and
its use differs between different key-formats.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Environment variables are stored in a separate .env file from the main
container script. The config SHA256 checksum only covered the script
file, so changes to env vars went undetected -- the container was not
recreated and kept running with stale values.
Include the env file contents in the config checksum calculation so that
any change to environment variables triggers a proper container restart.
Fixes#1313
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
All build scripts use $BR2_ARCH to determine location of critical board files
and configuration. As per previous decisions, the BR2_ARCH variable controls
all naming in Infix and for consistency the defconfig files are also renamed.
This fixes the issue with missing DTB file(s) for the Raspberry Pi 2B.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The RTL8169 firmware was specifically added for the Raspberry Pi Compute
Module 4 IoT Router Board Mini, it does not need to be part of defconfig.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
RSSI is a vendor-specific relative index (0-255), while dBm is an
absolute power measurement. Since we report dBm values from iw,
rename the leaf to signal-strength for accuracy.
The trick to starting the scanner mode is to have a dummy network that
cannot associate with anything.
Fixes#1193
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Was set to informational, and Zebra to debug, which is mostly useful for
developers when debugging the integration of Frr daemons.
Example of before this patch:
Nov 4 13:44:09 infix-6f-05-e1 finit[1]: staticd[4366], stopping, sending SIGTERM ...
Nov 4 13:44:09 infix-6f-05-e1 staticd[4366]: Terminating on signal
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [N5M5Y-J5BPG][EC 4043309121] Client 'static' (session id 0) encountered an error and is shutting down.
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [KQB7H-NPVW9] zebra/zebra_ptm.c:1333 failed to find process pid registration
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [JPSA8-5KYEA] client 26 disconnected 1 static routes removed from the rib
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [S929C-NZR3N] client 26 disconnected 0 static nhgs removed from the rib
Nov 4 13:44:09 infix-6f-05-e1 finit[1]: Starting staticd[5529]
Nov 4 13:44:09 infix-6f-05-e1 zebra[4221]: [V98V0-MTWPF] client 26 says hello and bids fair to announce only static routes vrf=0
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We want the command to show the entire log file, but fast forward to and
tail at the end, handling any file rotations from syslogd.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Simplify USB device debugging by allowing USB core to always announce
details of every new USB device to syslog.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When the shell is blocked on sleep, signal handlers don't execute until
the command completes. This caused the script to ignore SIGTERM at
shutdown, forcing Finit to wait and eventually SIGKILL it instead.
Fix by running sleep in the background and using wait, which is
interruptible by signals.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This reverts commit bf1eca0567.
This mess up order if having more than 1 phy, have not been
reproduce the error that got me to introduce this fix from
the beginning.
Joachim Wiberg