Introduce a new approach to dtb-building:
Old way: `rsync` an overlay containing our dt source to the kernel,
and then build via buildroot's `_INTREE_DTS_NAME`. This does not work
in recent kernels (at least since 6.12), which requires all dtb's to
be explicitly listed in a `Makefile`.
New way: Create a separate package for every board, and build the
device trees via the kernel's standard interface for building external
modules. This has two main advantages:
1. We can easily interpose a patched version of an upstream device
tree. E.g., we can easily set the factory password.
2. It is much easier to get an overview of which boards are enabled,
rather than scrolling back and forth in the `_INTREE_DTS_NAME` list.
Enable all fully supported boards in the defconfigs.
Since `conmon` only logs the output from the monitored container's
`stdout`/`stderr`, we might as well get rid of `k8s-logger`, and let
the output pass through to finit, which will then pipe the messages to
syslog.
Fix#836
Fixes issue with netopeer2-server failing to load its host certificate.
Follow-up to 8b75022 for the NanoPi R2S.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Declare that confd-test-mode depends on confd, otherwise with 'select',
a call to `make update-defconfig` will remove BR2_PACKAGE_CONFD=y, which
we feel is very confusing -- in particular when comparing any defconfig
that does not have test-mode package.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
NETOPEER2 requries the OpenSSL backend of libssh. By default, except on
minimal builds, is to use GCrypt backend. Gcrypt is selected because of
Podman, which is not in the minimal builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Sync (make update-defconfig)
- test-mode selects confd
- gencert seclets openssl which in turn selects LIBSSH*_OPENSSL
- rest is relocaations according to Config.in
- Add LIBMNL to x86_64 targets, otherwise iproute2 does not install devlink
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The name 'minimal' was chosen after a long AFK discussion where names
like 'generic', 'reference', 'testing', 'mod', and others were tossed
around and quickly discarded.
The minimal name can also be extended upon in customer trees, e.g., a
aarch64_minimal_styx_defconfig would indicate something built on the
upstream minimal Aarch64 build of Infix, but with Styx additions.
Issue #597
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This intoduce a new sysrepo plugin to handle a new YANG
model 'infix-test'. Today only contains the actions.
This is required to run tests on infix using infamy.
This is a part of #561
Signed-off-by: Mattias Walström <lazzer@gmail.com>
The PAM plugin lastlog, previously used (optional) by Netopeer2 and
Rousette, does not rotate /var/log/lastlog, and since we don't have
cron and logrotate this can potentially fill up /var.
This patch disables pam_lastlog.so from the build and drops the two
matching session lines for both Netopeer2 and Rousette. Both still
log user access to sysrepo, so no critical functionality is lost.
Follow-up to issue #542
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Backport pam-lastlog build fix from latest Buildroot master and enable
in all defconfigs to fix syslog warning:
login[2819]: PAM unable to dlopen(/lib/security/pam_lastlog.so)
Fixes#542
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch allows us to define the rauc manifest compatibility string with
menuconfig. The INFIX_IMAGE_ID is a direct replacement for the previously
composed "infix-$ARCH" in mkrauc.sh.
For example, the compatibility string "infix-aarch64" is replaced for the
NanoPi R2S with "infix-r2s" to ensure users get a proper warning if they
try upgrading to an image that maybe boots, but is not likely to work.
The CLI upgrade command gets a 'force' flag to override the compat string.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This patch further cleans up the r2s kernel config and also enables the
input event framework for the gpio0 reset button on the device.
The very simple input-event-daemon is introduced, with the only purpose
of listening to /dev/input/event1 for KEY_RESTART and trigger reboot.
Some helpful tooling is also added to help debug events (evtest).
Issue #276
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Enable BR2_DOWNLOAD_FORCE_CHECK_HASHES for R2S
- Relocate VisionFive2 patches to global patch dir for sharing with R2S
- Add hash for ATF v2.9
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Bump kernel to 6.10.3
- Initial defconfig sync with aarch64
- Enable kprobes, ksyms, and function tracer
- Enable missing file systems for parity with Infix
- Enable bridging, netfilter, and other Infix requirements
- Initial virtion support for running in Qemu (untested)
- Enable device mapper, required for rauc bundle install
- Make dummy and tunnel drivers modules to be able to drop dummy0
and tunl0 interfaces that otherwise mess up "show interfaces"
- Disable suspend and hibernation, not supported in Infix
- Disable unused GPIO, PHY, MDIO, and USB drivers
- Disable RK3328 watchdog driver, cannot perform reset on R2S,
enablle softdog instead as a seamless replacement for Infix.
Even though not optimal (since it's software) reboot works
- Disable ethtool netlink support, does not work and breaks
interface configuration completely on R2S!
- Enable netdev LED triggers, for LAN and WAN LEDs
- Bump u-boot to 2024.07
- Hard code developer mode to allow shell access
- Disable factory reset button support (not yet supported)
- Bump ATF to v2.9
- Enable squashfs for rootfs image
- Enable signing of images
- Add secondary partition
- Add dedicated var partition
- Add aux partition for signatures and uboot env
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Sync defconfig with aarch64
- Sync linux_defconfig with aarch64
- ethtool w/ netlink not supported yet for the StarFice dwmac
- note, waaay too many unused drivers still
- Add aux/cfg/var partitions to sdcard, no rauc support yet
- Add factory-password-hash to device tree
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This change builds on top of the earlier work to bootstrap Infix YANG
modules at build time. Adding a step at the end of post-build.sh to
call the yangdoc tool. The resulting yangdoc.html is a stand-alone HTML
file of (almost) all YANG nodes. Almost because some top-level nodes
are unused by Infix atm. and have been filtered out for readability.
Fixes#432
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Sync after `make update-defconfig`:
- avahi selected by mdns-alias package (all)
- iptables and ca-certs selected by other packages (r2s)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Add sshd 'UsePAM yes'
- Buildroot automatically adds and enables:
- /etc/pam.d/ with authentication for login, sshd, and sudo
- PAM support in BusyBox login
Also, prepare for adding RADIUS authentication support to ietf-system
the only tricky part is testing against a RADIUS server.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Buildroot's default ATF version changed from 2.9 to 2.10 when we
upgraded to 24.02.x. This meant that our patches were not applied,
which broke the build.
Take a conservative approach for now, and just pin the ATF version to
the known-good 2.9 series.
Mattias Walström