| @@ -1,648 +1,649 | |||||
| 1 | # |
|
1 | # | |
| 2 | # Build and Setup RPi2/3 Kernel |
|
2 | # Build and Setup RPi2/3 Kernel | |
| 3 | # |
|
3 | # | |
| 4 |
|
4 | |||
| 5 | # Load utility functions |
|
5 | # Load utility functions | |
| 6 | . ./functions.sh |
|
6 | . ./functions.sh | |
| 7 |
|
7 | |||
| 8 | # Need to use kali kernel src if nexmon is enabled |
|
8 | # Need to use kali kernel src if nexmon is enabled | |
| 9 | if [ "$ENABLE_NEXMON" = true ] ; then |
|
9 | if [ "$ENABLE_NEXMON" = true ] ; then | |
| 10 | KERNEL_URL="${KALI_KERNEL_URL}" |
|
10 | KERNEL_URL="${KALI_KERNEL_URL}" | |
| 11 | # Clear Branch and KernelSRC_DIR if using nexmon. Everyone will forget to clone kali kernel instead of nomrla kernel |
|
11 | # Clear Branch and KernelSRC_DIR if using nexmon. Everyone will forget to clone kali kernel instead of nomrla kernel | |
| 12 | KERNEL_BRANCH="" |
|
12 | KERNEL_BRANCH="" | |
| 13 | KERNELSRC_DIR="" |
|
13 | KERNELSRC_DIR="" | |
| 14 | fi |
|
14 | fi | |
| 15 |
|
15 | |||
| 16 | # Fetch and build latest raspberry kernel |
|
16 | # Fetch and build latest raspberry kernel | |
| 17 | if [ "$BUILD_KERNEL" = true ] ; then |
|
17 | if [ "$BUILD_KERNEL" = true ] ; then | |
| 18 | # Setup source directory |
|
18 | # Setup source directory | |
| 19 | mkdir -p "${KERNEL_DIR}" |
|
19 | mkdir -p "${KERNEL_DIR}" | |
| 20 |
|
20 | |||
| 21 | # Copy existing kernel sources into chroot directory |
|
21 | # Copy existing kernel sources into chroot directory | |
| 22 | if [ -n "$KERNELSRC_DIR" ] && [ -d "$KERNELSRC_DIR" ] ; then |
|
22 | if [ -n "$KERNELSRC_DIR" ] && [ -d "$KERNELSRC_DIR" ] ; then | |
| 23 | # Copy kernel sources and include hidden files |
|
23 | # Copy kernel sources and include hidden files | |
| 24 | cp -r "${KERNELSRC_DIR}/". "${KERNEL_DIR}" |
|
24 | cp -r "${KERNELSRC_DIR}/". "${KERNEL_DIR}" | |
| 25 |
|
25 | |||
| 26 | # Clean the kernel sources |
|
26 | # Clean the kernel sources | |
| 27 | if [ "$KERNELSRC_CLEAN" = true ] && [ "$KERNELSRC_PREBUILT" = false ] ; then |
|
27 | if [ "$KERNELSRC_CLEAN" = true ] && [ "$KERNELSRC_PREBUILT" = false ] ; then | |
| 28 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" mrproper |
|
28 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" mrproper | |
| 29 | fi |
|
29 | fi | |
| 30 | else # KERNELSRC_DIR="" |
|
30 | else # KERNELSRC_DIR="" | |
| 31 | # Create temporary directory for kernel sources |
|
31 | # Create temporary directory for kernel sources | |
| 32 | temp_dir=$(as_nobody mktemp -d) |
|
32 | temp_dir=$(as_nobody mktemp -d) | |
| 33 |
|
33 | |||
| 34 | # Fetch current RPi2/3 kernel sources |
|
34 | # Fetch current RPi2/3 kernel sources | |
| 35 | if [ -z "${KERNEL_BRANCH}" ] ; then |
|
35 | if [ -z "${KERNEL_BRANCH}" ] ; then | |
| 36 | as_nobody -H git -C "${temp_dir}" clone --depth=1 "${KERNEL_URL}" linux |
|
36 | as_nobody -H git -C "${temp_dir}" clone --depth=1 "${KERNEL_URL}" linux | |
| 37 | else |
|
37 | else | |
| 38 | as_nobody -H git -C "${temp_dir}" clone --depth=1 --branch "${KERNEL_BRANCH}" "${KERNEL_URL}" linux |
|
38 | as_nobody -H git -C "${temp_dir}" clone --depth=1 --branch "${KERNEL_BRANCH}" "${KERNEL_URL}" linux | |
| 39 | fi |
|
39 | fi | |
| 40 |
|
40 | |||
| 41 | # Copy downloaded kernel sources |
|
41 | # Copy downloaded kernel sources | |
| 42 | cp -r "${temp_dir}/linux/"* "${KERNEL_DIR}" |
|
42 | cp -r "${temp_dir}/linux/"* "${KERNEL_DIR}" | |
| 43 |
|
43 | |||
| 44 | # Remove temporary directory for kernel sources |
|
44 | # Remove temporary directory for kernel sources | |
| 45 | rm -fr "${temp_dir}" |
|
45 | rm -fr "${temp_dir}" | |
| 46 |
|
46 | |||
| 47 | # Set permissions of the kernel sources |
|
47 | # Set permissions of the kernel sources | |
| 48 | chown -R root:root "${R}/usr/src" |
|
48 | chown -R root:root "${R}/usr/src" | |
| 49 | fi |
|
49 | fi | |
| 50 |
|
50 | |||
| 51 | # Calculate optimal number of kernel building threads |
|
51 | # Calculate optimal number of kernel building threads | |
| 52 | if [ "$KERNEL_THREADS" = "1" ] && [ -r /proc/cpuinfo ] ; then |
|
52 | if [ "$KERNEL_THREADS" = "1" ] && [ -r /proc/cpuinfo ] ; then | |
| 53 | KERNEL_THREADS=$(grep -c processor /proc/cpuinfo) |
|
53 | KERNEL_THREADS=$(grep -c processor /proc/cpuinfo) | |
| 54 | fi |
|
54 | fi | |
| 55 |
|
55 | |||
| 56 | if [ "$ENABLE_QEMU" = true ] && [ "$KERNEL_ARCH" = arm64 ]; then |
|
56 | if [ "$ENABLE_QEMU" = true ] && [ "$KERNEL_ARCH" = arm64 ]; then | |
| 57 | cp "${KERNEL_DIR}"/arch/arm/configs/vexpress_defconfig "${KERNEL_DIR}"/arch/arm64/configs/ |
|
57 | cp "${KERNEL_DIR}"/arch/arm/configs/vexpress_defconfig "${KERNEL_DIR}"/arch/arm64/configs/ | |
| 58 | fi |
|
58 | fi | |
| 59 |
|
59 | |||
| 60 | # Configure and build kernel |
|
60 | # Configure and build kernel | |
| 61 | if [ "$KERNELSRC_PREBUILT" = false ] ; then |
|
61 | if [ "$KERNELSRC_PREBUILT" = false ] ; then | |
| 62 | # Remove device, network and filesystem drivers from kernel configuration |
|
62 | # Remove device, network and filesystem drivers from kernel configuration | |
| 63 | if [ "$KERNEL_REDUCE" = true ] ; then |
|
63 | if [ "$KERNEL_REDUCE" = true ] ; then | |
| 64 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}" |
|
64 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}" | |
| 65 | sed -i\ |
|
65 | sed -i\ | |
| 66 | -e "s/\(^CONFIG_SND.*\=\).*/\1n/"\ |
|
66 | -e "s/\(^CONFIG_SND.*\=\).*/\1n/"\ | |
| 67 | -e "s/\(^CONFIG_SOUND.*\=\).*/\1n/"\ |
|
67 | -e "s/\(^CONFIG_SOUND.*\=\).*/\1n/"\ | |
| 68 | -e "s/\(^CONFIG_AC97.*\=\).*/\1n/"\ |
|
68 | -e "s/\(^CONFIG_AC97.*\=\).*/\1n/"\ | |
| 69 | -e "s/\(^CONFIG_VIDEO_.*\=\).*/\1n/"\ |
|
69 | -e "s/\(^CONFIG_VIDEO_.*\=\).*/\1n/"\ | |
| 70 | -e "s/\(^CONFIG_MEDIA_TUNER.*\=\).*/\1n/"\ |
|
70 | -e "s/\(^CONFIG_MEDIA_TUNER.*\=\).*/\1n/"\ | |
| 71 | -e "s/\(^CONFIG_DVB.*\=\)[ym]/\1n/"\ |
|
71 | -e "s/\(^CONFIG_DVB.*\=\)[ym]/\1n/"\ | |
| 72 | -e "s/\(^CONFIG_REISERFS.*\=\).*/\1n/"\ |
|
72 | -e "s/\(^CONFIG_REISERFS.*\=\).*/\1n/"\ | |
| 73 | -e "s/\(^CONFIG_JFS.*\=\).*/\1n/"\ |
|
73 | -e "s/\(^CONFIG_JFS.*\=\).*/\1n/"\ | |
| 74 | -e "s/\(^CONFIG_XFS.*\=\).*/\1n/"\ |
|
74 | -e "s/\(^CONFIG_XFS.*\=\).*/\1n/"\ | |
| 75 | -e "s/\(^CONFIG_GFS2.*\=\).*/\1n/"\ |
|
75 | -e "s/\(^CONFIG_GFS2.*\=\).*/\1n/"\ | |
| 76 | -e "s/\(^CONFIG_OCFS2.*\=\).*/\1n/"\ |
|
76 | -e "s/\(^CONFIG_OCFS2.*\=\).*/\1n/"\ | |
| 77 | -e "s/\(^CONFIG_BTRFS.*\=\).*/\1n/"\ |
|
77 | -e "s/\(^CONFIG_BTRFS.*\=\).*/\1n/"\ | |
| 78 | -e "s/\(^CONFIG_HFS.*\=\).*/\1n/"\ |
|
78 | -e "s/\(^CONFIG_HFS.*\=\).*/\1n/"\ | |
| 79 | -e "s/\(^CONFIG_JFFS2.*\=\)[ym]/\1n/"\ |
|
79 | -e "s/\(^CONFIG_JFFS2.*\=\)[ym]/\1n/"\ | |
| 80 | -e "s/\(^CONFIG_UBIFS.*\=\).*/\1n/"\ |
|
80 | -e "s/\(^CONFIG_UBIFS.*\=\).*/\1n/"\ | |
| 81 | -e "s/\(^CONFIG_SQUASHFS.*\=\)[ym]/\1n/"\ |
|
81 | -e "s/\(^CONFIG_SQUASHFS.*\=\)[ym]/\1n/"\ | |
| 82 | -e "s/\(^CONFIG_W1.*\=\)[ym]/\1n/"\ |
|
82 | -e "s/\(^CONFIG_W1.*\=\)[ym]/\1n/"\ | |
| 83 | -e "s/\(^CONFIG_HAMRADIO.*\=\).*/\1n/"\ |
|
83 | -e "s/\(^CONFIG_HAMRADIO.*\=\).*/\1n/"\ | |
| 84 | -e "s/\(^CONFIG_CAN.*\=\).*/\1n/"\ |
|
84 | -e "s/\(^CONFIG_CAN.*\=\).*/\1n/"\ | |
| 85 | -e "s/\(^CONFIG_IRDA.*\=\).*/\1n/"\ |
|
85 | -e "s/\(^CONFIG_IRDA.*\=\).*/\1n/"\ | |
| 86 | -e "s/\(^CONFIG_BT_.*\=\).*/\1n/"\ |
|
86 | -e "s/\(^CONFIG_BT_.*\=\).*/\1n/"\ | |
| 87 | -e "s/\(^CONFIG_WIMAX.*\=\)[ym]/\1n/"\ |
|
87 | -e "s/\(^CONFIG_WIMAX.*\=\)[ym]/\1n/"\ | |
| 88 | -e "s/\(^CONFIG_6LOWPAN.*\=\).*/\1n/"\ |
|
88 | -e "s/\(^CONFIG_6LOWPAN.*\=\).*/\1n/"\ | |
| 89 | -e "s/\(^CONFIG_IEEE802154.*\=\).*/\1n/"\ |
|
89 | -e "s/\(^CONFIG_IEEE802154.*\=\).*/\1n/"\ | |
| 90 | -e "s/\(^CONFIG_NFC.*\=\).*/\1n/"\ |
|
90 | -e "s/\(^CONFIG_NFC.*\=\).*/\1n/"\ | |
| 91 | -e "s/\(^CONFIG_FB_TFT=.*\=\).*/\1n/"\ |
|
91 | -e "s/\(^CONFIG_FB_TFT=.*\=\).*/\1n/"\ | |
| 92 | -e "s/\(^CONFIG_TOUCHSCREEN.*\=\).*/\1n/"\ |
|
92 | -e "s/\(^CONFIG_TOUCHSCREEN.*\=\).*/\1n/"\ | |
| 93 | -e "s/\(^CONFIG_USB_GSPCA_.*\=\).*/\1n/"\ |
|
93 | -e "s/\(^CONFIG_USB_GSPCA_.*\=\).*/\1n/"\ | |
| 94 | -e "s/\(^CONFIG_DRM.*\=\).*/\1n/"\ |
|
94 | -e "s/\(^CONFIG_DRM.*\=\).*/\1n/"\ | |
| 95 | "${KERNEL_DIR}/.config" |
|
95 | "${KERNEL_DIR}/.config" | |
| 96 | fi |
|
96 | fi | |
| 97 |
|
97 | |||
| 98 | if [ "$KERNELSRC_CONFIG" = true ] ; then |
|
98 | if [ "$KERNELSRC_CONFIG" = true ] ; then | |
| 99 | # Load default raspberry kernel configuration |
|
99 | # Load default raspberry kernel configuration | |
| 100 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}" |
|
100 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}" | |
| 101 |
|
101 | |||
| 102 | #Switch to KERNELSRC_DIR so we can use set_kernel_config |
|
102 | #Switch to KERNELSRC_DIR so we can use set_kernel_config | |
| 103 | cd "${KERNEL_DIR}" || exit |
|
103 | cd "${KERNEL_DIR}" || exit | |
| 104 |
|
104 | |||
| 105 | if [ "$KERNEL_ARCH" = arm64 ] && [ "$ENABLE_QEMU" = false ]; then |
|
105 | if [ "$KERNEL_ARCH" = arm64 ] && [ "$ENABLE_QEMU" = false ]; then | |
| 106 | #Fix SD_DRIVER upstream and downstream mess in 64bit RPIdeb_config |
|
106 | #Fix SD_DRIVER upstream and downstream mess in 64bit RPIdeb_config | |
| 107 | # use correct driver MMC_BCM2835_MMC instead of MMC_BCM2835_SDHOST - see https://www.raspberrypi.org/forums/viewtopic.php?t=210225 |
|
107 | # use correct driver MMC_BCM2835_MMC instead of MMC_BCM2835_SDHOST - see https://www.raspberrypi.org/forums/viewtopic.php?t=210225 | |
| 108 | set_kernel_config CONFIG_MMC_BCM2835 n |
|
108 | set_kernel_config CONFIG_MMC_BCM2835 n | |
| 109 | set_kernel_config CONFIG_MMC_SDHCI_IPROC n |
|
109 | set_kernel_config CONFIG_MMC_SDHCI_IPROC n | |
| 110 | set_kernel_config CONFIG_USB_DWC2 n |
|
110 | set_kernel_config CONFIG_USB_DWC2 n | |
| 111 | sed -i "s|depends on MMC_BCM2835_MMC && MMC_BCM2835_DMA|depends on MMC_BCM2835_MMC|" "${KERNEL_DIR}"/drivers/mmc/host/Kconfig |
|
111 | sed -i "s|depends on MMC_BCM2835_MMC && MMC_BCM2835_DMA|depends on MMC_BCM2835_MMC|" "${KERNEL_DIR}"/drivers/mmc/host/Kconfig | |
| 112 |
|
112 | |||
| 113 | #VLAN got disabled without reason in arm64bit |
|
113 | #VLAN got disabled without reason in arm64bit | |
| 114 | set_kernel_config CONFIG_IPVLAN m |
|
114 | set_kernel_config CONFIG_IPVLAN m | |
| 115 | fi |
|
115 | fi | |
| 116 |
|
116 | |||
| 117 | # enable ZSWAP see https://askubuntu.com/a/472227 or https://wiki.archlinux.org/index.php/zswap |
|
117 | # enable ZSWAP see https://askubuntu.com/a/472227 or https://wiki.archlinux.org/index.php/zswap | |
| 118 | if [ "$KERNEL_ZSWAP" = true ] ; then |
|
118 | if [ "$KERNEL_ZSWAP" = true ] ; then | |
| 119 | set_kernel_config CONFIG_ZPOOL y |
|
119 | set_kernel_config CONFIG_ZPOOL y | |
| 120 | set_kernel_config CONFIG_ZSWAP y |
|
120 | set_kernel_config CONFIG_ZSWAP y | |
| 121 | set_kernel_config CONFIG_ZBUD y |
|
121 | set_kernel_config CONFIG_ZBUD y | |
| 122 | set_kernel_config CONFIG_Z3FOLD y |
|
122 | set_kernel_config CONFIG_Z3FOLD y | |
| 123 | set_kernel_config CONFIG_ZSMALLOC y |
|
123 | set_kernel_config CONFIG_ZSMALLOC y | |
| 124 | set_kernel_config CONFIG_PGTABLE_MAPPING y |
|
124 | set_kernel_config CONFIG_PGTABLE_MAPPING y | |
| 125 | set_kernel_config CONFIG_LZO_COMPRESS y |
|
125 | set_kernel_config CONFIG_LZO_COMPRESS y | |
| 126 |
|
126 | |||
| 127 | fi |
|
127 | fi | |
| 128 |
|
128 | |||
| 129 | # enable basic KVM support; see https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=210546&start=25#p1300453 |
|
129 | # enable basic KVM support; see https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=210546&start=25#p1300453 | |
| 130 | if [ "$KERNEL_VIRT" = true ] && { [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ]; } ; then |
|
130 | if [ "$KERNEL_VIRT" = true ] && { [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ]; } ; then | |
| 131 | set_kernel_config CONFIG_HAVE_KVM y |
|
131 | set_kernel_config CONFIG_HAVE_KVM y | |
| 132 | set_kernel_config CONFIG_HIGH_RES_TIMERS y |
|
132 | set_kernel_config CONFIG_HIGH_RES_TIMERS y | |
| 133 | set_kernel_config CONFIG_HAVE_KVM_IRQCHIP y |
|
133 | set_kernel_config CONFIG_HAVE_KVM_IRQCHIP y | |
| 134 | set_kernel_config CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL y |
|
134 | set_kernel_config CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL y | |
| 135 | set_kernel_config CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT y |
|
135 | set_kernel_config CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT y | |
| 136 | set_kernel_config CONFIG_HAVE_KVM_EVENTFD y |
|
136 | set_kernel_config CONFIG_HAVE_KVM_EVENTFD y | |
| 137 | set_kernel_config CONFIG_HAVE_KVM_IRQFD y |
|
137 | set_kernel_config CONFIG_HAVE_KVM_IRQFD y | |
| 138 | set_kernel_config CONFIG_HAVE_KVM_IRQ_ROUTING y |
|
138 | set_kernel_config CONFIG_HAVE_KVM_IRQ_ROUTING y | |
| 139 | set_kernel_config CONFIG_HAVE_KVM_MSI y |
|
139 | set_kernel_config CONFIG_HAVE_KVM_MSI y | |
| 140 | set_kernel_config CONFIG_KVM y |
|
140 | set_kernel_config CONFIG_KVM y | |
| 141 | set_kernel_config CONFIG_KVM_ARM_HOST y |
|
141 | set_kernel_config CONFIG_KVM_ARM_HOST y | |
| 142 | set_kernel_config CONFIG_KVM_ARM_PMU y |
|
142 | set_kernel_config CONFIG_KVM_ARM_PMU y | |
| 143 | set_kernel_config CONFIG_KVM_COMPAT y |
|
143 | set_kernel_config CONFIG_KVM_COMPAT y | |
| 144 | set_kernel_config CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT y |
|
144 | set_kernel_config CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT y | |
| 145 | set_kernel_config CONFIG_KVM_MMIO y |
|
145 | set_kernel_config CONFIG_KVM_MMIO y | |
| 146 | set_kernel_config CONFIG_KVM_VFIO y |
|
146 | set_kernel_config CONFIG_KVM_VFIO y | |
| 147 | set_kernel_config CONFIG_KVM_MMU_AUDIT y |
|
147 | set_kernel_config CONFIG_KVM_MMU_AUDIT y | |
| 148 | set_kernel_config CONFIG_VHOST m |
|
148 | set_kernel_config CONFIG_VHOST m | |
| 149 | set_kernel_config CONFIG_VHOST_CROSS_ENDIAN_LEGACY y |
|
149 | set_kernel_config CONFIG_VHOST_CROSS_ENDIAN_LEGACY y | |
| 150 | set_kernel_config CONFIG_VHOST_NET m |
|
150 | set_kernel_config CONFIG_VHOST_NET m | |
| 151 | set_kernel_config CONFIG_VIRTUALIZATION y |
|
151 | set_kernel_config CONFIG_VIRTUALIZATION y | |
| 152 | set_kernel_config CONFIG_MMU_NOTIFIER y |
|
152 | set_kernel_config CONFIG_MMU_NOTIFIER y | |
| 153 |
|
153 | |||
| 154 | set_kernel_config CONFIG_SLAB_FREELIST_RANDOM=y |
|
154 | set_kernel_config CONFIG_SLAB_FREELIST_RANDOM=y | |
| 155 | set_kernel_config CONFIG_SLAB_FREELIST_HARDENED=y |
|
155 | set_kernel_config CONFIG_SLAB_FREELIST_HARDENED=y | |
| 156 |
|
156 | |||
| 157 | # erratum |
|
157 | # erratum | |
| 158 | set_kernel_config ARM64_ERRATUM_834220 y |
|
158 | set_kernel_config ARM64_ERRATUM_834220 y | |
| 159 | # https://sourceforge.net/p/kvm/mailman/message/18440797/ |
|
159 | # https://sourceforge.net/p/kvm/mailman/message/18440797/ | |
| 160 | set_kernel_config CONFIG_PREEMPT_NOTIFIERS y |
|
160 | set_kernel_config CONFIG_PREEMPT_NOTIFIERS y | |
| 161 | fi |
|
161 | fi | |
| 162 |
|
162 | |||
| 163 | # enable apparmor,integrity audit, |
|
163 | # enable apparmor,integrity audit, | |
| 164 | if [ "$KERNEL_SECURITY" = true ] ; then |
|
164 | if [ "$KERNEL_SECURITY" = true ] ; then | |
| 165 |
|
165 | |||
| 166 | # security filesystem, security models and audit |
|
166 | # security filesystem, security models and audit | |
| 167 | set_kernel_config CONFIG_SECURITYFS y |
|
167 | set_kernel_config CONFIG_SECURITYFS y | |
| 168 | set_kernel_config CONFIG_SECURITY y |
|
168 | set_kernel_config CONFIG_SECURITY y | |
| 169 | set_kernel_config CONFIG_AUDIT y |
|
169 | set_kernel_config CONFIG_AUDIT y | |
| 170 |
|
170 | |||
| 171 | # harden strcpy and memcpy |
|
171 | # harden strcpy and memcpy | |
| 172 | set_kernel_config CONFIG_HARDENED_USERCOPY y |
|
172 | set_kernel_config CONFIG_HARDENED_USERCOPY y | |
| 173 | set_kernel_config CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR y |
|
173 | set_kernel_config CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR y | |
| 174 | set_kernel_config CONFIG_FORTIFY_SOURCE y |
|
174 | set_kernel_config CONFIG_FORTIFY_SOURCE y | |
| 175 |
|
175 | |||
| 176 | # integrity sub-system |
|
176 | # integrity sub-system | |
| 177 | set_kernel_config CONFIG_INTEGRITY y |
|
177 | set_kernel_config CONFIG_INTEGRITY y | |
| 178 | set_kernel_config CONFIG_INTEGRITY_ASYMMETRIC_KEYS y |
|
178 | set_kernel_config CONFIG_INTEGRITY_ASYMMETRIC_KEYS y | |
| 179 | set_kernel_config CONFIG_INTEGRITY_AUDIT y |
|
179 | set_kernel_config CONFIG_INTEGRITY_AUDIT y | |
| 180 | set_kernel_config CONFIG_INTEGRITY_SIGNATURE y |
|
180 | set_kernel_config CONFIG_INTEGRITY_SIGNATURE y | |
| 181 | set_kernel_config CONFIG_INTEGRITY_TRUSTED_KEYRING y |
|
181 | set_kernel_config CONFIG_INTEGRITY_TRUSTED_KEYRING y | |
| 182 |
|
182 | |||
| 183 | # This option provides support for retaining authentication tokens and access keys in the kernel. |
|
183 | # This option provides support for retaining authentication tokens and access keys in the kernel. | |
| 184 | set_kernel_config CONFIG_KEYS y |
|
184 | set_kernel_config CONFIG_KEYS y | |
| 185 | set_kernel_config CONFIG_KEYS_COMPAT y |
|
185 | set_kernel_config CONFIG_KEYS_COMPAT y | |
| 186 |
|
186 | |||
| 187 | # Apparmor |
|
187 | # Apparmor | |
| 188 | set_kernel_config CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE 0 |
|
188 | set_kernel_config CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE 0 | |
| 189 | set_kernel_config CONFIG_SECURITY_APPARMOR_HASH_DEFAULT y |
|
189 | set_kernel_config CONFIG_SECURITY_APPARMOR_HASH_DEFAULT y | |
| 190 | set_kernel_config CONFIG_DEFAULT_SECURITY_APPARMOR y |
|
190 | set_kernel_config CONFIG_DEFAULT_SECURITY_APPARMOR y | |
| 191 | set_kernel_config CONFIG_SECURITY_APPARMOR y |
|
191 | set_kernel_config CONFIG_SECURITY_APPARMOR y | |
| 192 | set_kernel_config CONFIG_SECURITY_APPARMOR_HASH y |
|
192 | set_kernel_config CONFIG_SECURITY_APPARMOR_HASH y | |
| 193 | set_kernel_config CONFIG_DEFAULT_SECURITY "apparmor" |
|
193 | set_kernel_config CONFIG_DEFAULT_SECURITY "apparmor" | |
| 194 |
|
194 | |||
| 195 | # restrictions on unprivileged users reading the kernel |
|
195 | # restrictions on unprivileged users reading the kernel | |
| 196 | set_kernel_config CONFIG_SECURITY_DMESG_RESTRICT y |
|
196 | set_kernel_config CONFIG_SECURITY_DMESG_RESTRICT y | |
| 197 |
|
197 | |||
| 198 | # network security hooks |
|
198 | # network security hooks | |
| 199 | set_kernel_config CONFIG_SECURITY_NETWORK y |
|
199 | set_kernel_config CONFIG_SECURITY_NETWORK y | |
| 200 | set_kernel_config CONFIG_SECURITY_NETWORK_XFRM y |
|
200 | set_kernel_config CONFIG_SECURITY_NETWORK_XFRM y | |
| 201 | set_kernel_config CONFIG_SECURITY_PATH y |
|
201 | set_kernel_config CONFIG_SECURITY_PATH y | |
| 202 | set_kernel_config CONFIG_SECURITY_YAMA n |
|
202 | set_kernel_config CONFIG_SECURITY_YAMA n | |
| 203 |
|
203 | |||
| 204 | # New Options |
|
204 | # New Options | |
| 205 | if [ "$KERNEL_NF" = true ] ; then |
|
205 | if [ "$KERNEL_NF" = true ] ; then | |
| 206 | set_kernel_config CONFIG_IP_NF_SECURITY m |
|
206 | set_kernel_config CONFIG_IP_NF_SECURITY m | |
| 207 | set_kernel_config CONFIG_NETLABEL y |
|
207 | set_kernel_config CONFIG_NETLABEL y | |
| 208 | set_kernel_config CONFIG_IP6_NF_SECURITY m |
|
208 | set_kernel_config CONFIG_IP6_NF_SECURITY m | |
| 209 | fi |
|
209 | fi | |
| 210 | set_kernel_config CONFIG_SECURITY_SELINUX n |
|
210 | set_kernel_config CONFIG_SECURITY_SELINUX n | |
| 211 | set_kernel_config CONFIG_SECURITY_SMACK n |
|
211 | set_kernel_config CONFIG_SECURITY_SMACK n | |
| 212 | set_kernel_config CONFIG_SECURITY_TOMOYO n |
|
212 | set_kernel_config CONFIG_SECURITY_TOMOYO n | |
| 213 | set_kernel_config CONFIG_SECURITY_APPARMOR_DEBUG n |
|
213 | set_kernel_config CONFIG_SECURITY_APPARMOR_DEBUG n | |
| 214 | set_kernel_config CONFIG_SECURITY_LOADPIN n |
|
214 | set_kernel_config CONFIG_SECURITY_LOADPIN n | |
| 215 | set_kernel_config CONFIG_HARDENED_USERCOPY_PAGESPAN n |
|
215 | set_kernel_config CONFIG_HARDENED_USERCOPY_PAGESPAN n | |
| 216 | set_kernel_config CONFIG_IMA n |
|
216 | set_kernel_config CONFIG_IMA n | |
| 217 | set_kernel_config CONFIG_EVM n |
|
217 | set_kernel_config CONFIG_EVM n | |
| 218 | set_kernel_config CONFIG_FANOTIFY_ACCESS_PERMISSIONS y |
|
218 | set_kernel_config CONFIG_FANOTIFY_ACCESS_PERMISSIONS y | |
| 219 | set_kernel_config CONFIG_NFSD_V4_SECURITY_LABEL y |
|
219 | set_kernel_config CONFIG_NFSD_V4_SECURITY_LABEL y | |
| 220 | set_kernel_config CONFIG_PKCS7_MESSAGE_PARSER y |
|
220 | set_kernel_config CONFIG_PKCS7_MESSAGE_PARSER y | |
| 221 | set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYRING y |
|
221 | set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYRING y | |
| 222 | set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYS y |
|
222 | set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYS y | |
| 223 | set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE y |
|
223 | set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE y | |
| 224 | set_kernel_config CONFIG_SECONDARY_TRUSTED_KEYRING y |
|
224 | set_kernel_config CONFIG_SECONDARY_TRUSTED_KEYRING y | |
| 225 | set_kernel_config CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY n |
|
225 | set_kernel_config CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY n | |
| 226 | set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYS m |
|
226 | set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYS m | |
| 227 | set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE 4096 |
|
227 | set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE 4096 | |
| 228 |
|
228 | |||
| 229 | set_kernel_config CONFIG_ARM64_CRYPTO y |
|
229 | set_kernel_config CONFIG_ARM64_CRYPTO y | |
| 230 | set_kernel_config CONFIG_CRYPTO_SHA256_ARM64 m |
|
230 | set_kernel_config CONFIG_CRYPTO_SHA256_ARM64 m | |
| 231 | set_kernel_config CONFIG_CRYPTO_SHA512_ARM64 m |
|
231 | set_kernel_config CONFIG_CRYPTO_SHA512_ARM64 m | |
| 232 | set_kernel_config CONFIG_CRYPTO_SHA1_ARM64_CE m |
|
232 | set_kernel_config CONFIG_CRYPTO_SHA1_ARM64_CE m | |
| 233 | set_kernel_config CRYPTO_GHASH_ARM64_CE m |
|
233 | set_kernel_config CRYPTO_GHASH_ARM64_CE m | |
| 234 | set_kernel_config CRYPTO_SHA2_ARM64_CE m |
|
234 | set_kernel_config CRYPTO_SHA2_ARM64_CE m | |
| 235 | set_kernel_config CONFIG_CRYPTO_CRCT10DIF_ARM64_CE m |
|
235 | set_kernel_config CONFIG_CRYPTO_CRCT10DIF_ARM64_CE m | |
| 236 | set_kernel_config CONFIG_CRYPTO_CRC32_ARM64_CE m |
|
236 | set_kernel_config CONFIG_CRYPTO_CRC32_ARM64_CE m | |
| 237 | set_kernel_config CONFIG_CRYPTO_AES_ARM64 m |
|
237 | set_kernel_config CONFIG_CRYPTO_AES_ARM64 m | |
| 238 | set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE m |
|
238 | set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE m | |
| 239 | set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_CCM y |
|
239 | set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_CCM y | |
| 240 | set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_BLK y |
|
240 | set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_BLK y | |
| 241 | set_kernel_config CONFIG_CRYPTO_AES_ARM64_NEON_BLK m |
|
241 | set_kernel_config CONFIG_CRYPTO_AES_ARM64_NEON_BLK m | |
| 242 | set_kernel_config CONFIG_CRYPTO_CHACHA20_NEON m |
|
242 | set_kernel_config CONFIG_CRYPTO_CHACHA20_NEON m | |
| 243 | set_kernel_config CONFIG_CRYPTO_AES_ARM64_BS m |
|
243 | set_kernel_config CONFIG_CRYPTO_AES_ARM64_BS m | |
| 244 | set_kernel_config SYSTEM_TRUSTED_KEYS |
|
244 | set_kernel_config SYSTEM_TRUSTED_KEYS | |
| 245 | fi |
|
245 | fi | |
| 246 |
|
246 | |||
| 247 | # Netfilter kernel support See https://github.com/raspberrypi/linux/issues/2177#issuecomment-354647406 |
|
247 | # Netfilter kernel support See https://github.com/raspberrypi/linux/issues/2177#issuecomment-354647406 | |
| 248 | if [ "$KERNEL_NF" = true ] ; then |
|
248 | if [ "$KERNEL_NF" = true ] ; then | |
| 249 | set_kernel_config CONFIG_IP_NF_TARGET_SYNPROXY m |
|
249 | set_kernel_config CONFIG_IP_NF_TARGET_SYNPROXY m | |
| 250 | set_kernel_config CONFIG_NETFILTER_XT_TARGET_AUDIT m |
|
250 | set_kernel_config CONFIG_NETFILTER_XT_TARGET_AUDIT m | |
| 251 | set_kernel_config CONFIG_NETFILTER_XT_MATCH_CGROUP m |
|
251 | set_kernel_config CONFIG_NETFILTER_XT_MATCH_CGROUP m | |
| 252 | set_kernel_config CONFIG_NETFILTER_XT_MATCH_IPCOMP m |
|
252 | set_kernel_config CONFIG_NETFILTER_XT_MATCH_IPCOMP m | |
| 253 | set_kernel_config CONFIG_NETFILTER_XT_MATCH_SOCKET m |
|
253 | set_kernel_config CONFIG_NETFILTER_XT_MATCH_SOCKET m | |
| 254 | set_kernel_config CONFIG_NFT_FIB_INET m |
|
254 | set_kernel_config CONFIG_NFT_FIB_INET m | |
| 255 | set_kernel_config CONFIG_NFT_FIB_IPV4 m |
|
255 | set_kernel_config CONFIG_NFT_FIB_IPV4 m | |
| 256 | set_kernel_config CONFIG_NFT_FIB_IPV6 m |
|
256 | set_kernel_config CONFIG_NFT_FIB_IPV6 m | |
| 257 | set_kernel_config CONFIG_NFT_FIB_NETDEV m |
|
257 | set_kernel_config CONFIG_NFT_FIB_NETDEV m | |
| 258 | set_kernel_config CONFIG_NFT_OBJREF m |
|
258 | set_kernel_config CONFIG_NFT_OBJREF m | |
| 259 | set_kernel_config CONFIG_NFT_RT m |
|
259 | set_kernel_config CONFIG_NFT_RT m | |
| 260 | set_kernel_config CONFIG_NFT_SET_BITMAP m |
|
260 | set_kernel_config CONFIG_NFT_SET_BITMAP m | |
| 261 | set_kernel_config CONFIG_NF_CONNTRACK_TIMEOUT y |
|
261 | set_kernel_config CONFIG_NF_CONNTRACK_TIMEOUT y | |
| 262 | set_kernel_config CONFIG_NF_LOG_ARP m |
|
262 | set_kernel_config CONFIG_NF_LOG_ARP m | |
| 263 | set_kernel_config CONFIG_NF_SOCKET_IPV4 m |
|
263 | set_kernel_config CONFIG_NF_SOCKET_IPV4 m | |
| 264 | set_kernel_config CONFIG_NF_SOCKET_IPV6 m |
|
264 | set_kernel_config CONFIG_NF_SOCKET_IPV6 m | |
| 265 | set_kernel_config CONFIG_BRIDGE_EBT_BROUTE m |
|
265 | set_kernel_config CONFIG_BRIDGE_EBT_BROUTE m | |
| 266 | set_kernel_config CONFIG_BRIDGE_EBT_T_FILTER m |
|
266 | set_kernel_config CONFIG_BRIDGE_EBT_T_FILTER m | |
| 267 | set_kernel_config CONFIG_BRIDGE_NF_EBTABLES m |
|
267 | set_kernel_config CONFIG_BRIDGE_NF_EBTABLES m | |
| 268 | set_kernel_config CONFIG_IP6_NF_IPTABLES m |
|
268 | set_kernel_config CONFIG_IP6_NF_IPTABLES m | |
| 269 | set_kernel_config CONFIG_IP6_NF_MATCH_AH m |
|
269 | set_kernel_config CONFIG_IP6_NF_MATCH_AH m | |
| 270 | set_kernel_config CONFIG_IP6_NF_MATCH_EUI64 m |
|
270 | set_kernel_config CONFIG_IP6_NF_MATCH_EUI64 m | |
| 271 | set_kernel_config CONFIG_IP6_NF_NAT m |
|
271 | set_kernel_config CONFIG_IP6_NF_NAT m | |
| 272 | set_kernel_config CONFIG_IP6_NF_TARGET_MASQUERADE m |
|
272 | set_kernel_config CONFIG_IP6_NF_TARGET_MASQUERADE m | |
| 273 | set_kernel_config CONFIG_IP6_NF_TARGET_NPT m |
|
273 | set_kernel_config CONFIG_IP6_NF_TARGET_NPT m | |
| 274 | set_kernel_config CONFIG_IP_NF_SECURITY m |
|
274 | set_kernel_config CONFIG_IP_NF_SECURITY m | |
| 275 | set_kernel_config CONFIG_IP_SET_BITMAP_IPMAC m |
|
275 | set_kernel_config CONFIG_IP_SET_BITMAP_IPMAC m | |
| 276 | set_kernel_config CONFIG_IP_SET_BITMAP_PORT m |
|
276 | set_kernel_config CONFIG_IP_SET_BITMAP_PORT m | |
| 277 | set_kernel_config CONFIG_IP_SET_HASH_IP m |
|
277 | set_kernel_config CONFIG_IP_SET_HASH_IP m | |
| 278 | set_kernel_config CONFIG_IP_SET_HASH_IPMARK m |
|
278 | set_kernel_config CONFIG_IP_SET_HASH_IPMARK m | |
| 279 | set_kernel_config CONFIG_IP_SET_HASH_IPPORT m |
|
279 | set_kernel_config CONFIG_IP_SET_HASH_IPPORT m | |
| 280 | set_kernel_config CONFIG_IP_SET_HASH_IPPORTIP m |
|
280 | set_kernel_config CONFIG_IP_SET_HASH_IPPORTIP m | |
| 281 | set_kernel_config CONFIG_IP_SET_HASH_IPPORTNET m |
|
281 | set_kernel_config CONFIG_IP_SET_HASH_IPPORTNET m | |
| 282 | set_kernel_config CONFIG_IP_SET_HASH_MAC m |
|
282 | set_kernel_config CONFIG_IP_SET_HASH_MAC m | |
| 283 | set_kernel_config CONFIG_IP_SET_HASH_NET m |
|
283 | set_kernel_config CONFIG_IP_SET_HASH_NET m | |
| 284 | set_kernel_config CONFIG_IP_SET_HASH_NETIFACE m |
|
284 | set_kernel_config CONFIG_IP_SET_HASH_NETIFACE m | |
| 285 | set_kernel_config CONFIG_IP_SET_HASH_NETNET m |
|
285 | set_kernel_config CONFIG_IP_SET_HASH_NETNET m | |
| 286 | set_kernel_config CONFIG_IP_SET_HASH_NETPORT m |
|
286 | set_kernel_config CONFIG_IP_SET_HASH_NETPORT m | |
| 287 | set_kernel_config CONFIG_IP_SET_HASH_NETPORTNET m |
|
287 | set_kernel_config CONFIG_IP_SET_HASH_NETPORTNET m | |
| 288 | set_kernel_config CONFIG_IP_SET_LIST_SET m |
|
288 | set_kernel_config CONFIG_IP_SET_LIST_SET m | |
| 289 | set_kernel_config CONFIG_NETFILTER_XTABLES m |
|
289 | set_kernel_config CONFIG_NETFILTER_XTABLES m | |
| 290 | set_kernel_config CONFIG_NETFILTER_XTABLES m |
|
290 | set_kernel_config CONFIG_NETFILTER_XTABLES m | |
| 291 | set_kernel_config CONFIG_NFT_BRIDGE_META m |
|
291 | set_kernel_config CONFIG_NFT_BRIDGE_META m | |
| 292 | set_kernel_config CONFIG_NFT_BRIDGE_REJECT m |
|
292 | set_kernel_config CONFIG_NFT_BRIDGE_REJECT m | |
| 293 | set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV4 m |
|
293 | set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV4 m | |
| 294 | set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV6 m |
|
294 | set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV6 m | |
| 295 | set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV4 m |
|
295 | set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV4 m | |
| 296 | set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV6 m |
|
296 | set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV6 m | |
| 297 | set_kernel_config CONFIG_NFT_COMPAT m |
|
297 | set_kernel_config CONFIG_NFT_COMPAT m | |
| 298 | set_kernel_config CONFIG_NFT_COUNTER m |
|
298 | set_kernel_config CONFIG_NFT_COUNTER m | |
| 299 | set_kernel_config CONFIG_NFT_CT m |
|
299 | set_kernel_config CONFIG_NFT_CT m | |
| 300 | set_kernel_config CONFIG_NFT_DUP_IPV4 m |
|
300 | set_kernel_config CONFIG_NFT_DUP_IPV4 m | |
| 301 | set_kernel_config CONFIG_NFT_DUP_IPV6 m |
|
301 | set_kernel_config CONFIG_NFT_DUP_IPV6 m | |
| 302 | set_kernel_config CONFIG_NFT_DUP_NETDEV m |
|
302 | set_kernel_config CONFIG_NFT_DUP_NETDEV m | |
| 303 | set_kernel_config CONFIG_NFT_EXTHDR m |
|
303 | set_kernel_config CONFIG_NFT_EXTHDR m | |
| 304 | set_kernel_config CONFIG_NFT_FWD_NETDEV m |
|
304 | set_kernel_config CONFIG_NFT_FWD_NETDEV m | |
| 305 | set_kernel_config CONFIG_NFT_HASH m |
|
305 | set_kernel_config CONFIG_NFT_HASH m | |
| 306 | set_kernel_config CONFIG_NFT_LIMIT m |
|
306 | set_kernel_config CONFIG_NFT_LIMIT m | |
| 307 | set_kernel_config CONFIG_NFT_LOG m |
|
307 | set_kernel_config CONFIG_NFT_LOG m | |
| 308 | set_kernel_config CONFIG_NFT_MASQ m |
|
308 | set_kernel_config CONFIG_NFT_MASQ m | |
| 309 | set_kernel_config CONFIG_NFT_MASQ_IPV4 m |
|
309 | set_kernel_config CONFIG_NFT_MASQ_IPV4 m | |
| 310 | set_kernel_config CONFIG_NFT_MASQ_IPV6 m |
|
310 | set_kernel_config CONFIG_NFT_MASQ_IPV6 m | |
| 311 | set_kernel_config CONFIG_NFT_META m |
|
311 | set_kernel_config CONFIG_NFT_META m | |
| 312 | set_kernel_config CONFIG_NFT_NAT m |
|
312 | set_kernel_config CONFIG_NFT_NAT m | |
| 313 | set_kernel_config CONFIG_NFT_NUMGEN m |
|
313 | set_kernel_config CONFIG_NFT_NUMGEN m | |
| 314 | set_kernel_config CONFIG_NFT_QUEUE m |
|
314 | set_kernel_config CONFIG_NFT_QUEUE m | |
| 315 | set_kernel_config CONFIG_NFT_QUOTA m |
|
315 | set_kernel_config CONFIG_NFT_QUOTA m | |
| 316 | set_kernel_config CONFIG_NFT_REDIR m |
|
316 | set_kernel_config CONFIG_NFT_REDIR m | |
| 317 | set_kernel_config CONFIG_NFT_REDIR_IPV4 m |
|
317 | set_kernel_config CONFIG_NFT_REDIR_IPV4 m | |
| 318 | set_kernel_config CONFIG_NFT_REDIR_IPV6 m |
|
318 | set_kernel_config CONFIG_NFT_REDIR_IPV6 m | |
| 319 | set_kernel_config CONFIG_NFT_REJECT m |
|
319 | set_kernel_config CONFIG_NFT_REJECT m | |
| 320 | set_kernel_config CONFIG_NFT_REJECT_INET m |
|
320 | set_kernel_config CONFIG_NFT_REJECT_INET m | |
| 321 | set_kernel_config CONFIG_NFT_REJECT_IPV4 m |
|
321 | set_kernel_config CONFIG_NFT_REJECT_IPV4 m | |
| 322 | set_kernel_config CONFIG_NFT_REJECT_IPV6 m |
|
322 | set_kernel_config CONFIG_NFT_REJECT_IPV6 m | |
| 323 | set_kernel_config CONFIG_NFT_SET_HASH m |
|
323 | set_kernel_config CONFIG_NFT_SET_HASH m | |
| 324 | set_kernel_config CONFIG_NFT_SET_RBTREE m |
|
324 | set_kernel_config CONFIG_NFT_SET_RBTREE m | |
| 325 | set_kernel_config CONFIG_NF_CONNTRACK_IPV4 m |
|
325 | set_kernel_config CONFIG_NF_CONNTRACK_IPV4 m | |
| 326 | set_kernel_config CONFIG_NF_CONNTRACK_IPV6 m |
|
326 | set_kernel_config CONFIG_NF_CONNTRACK_IPV6 m | |
| 327 | set_kernel_config CONFIG_NF_DEFRAG_IPV4 m |
|
327 | set_kernel_config CONFIG_NF_DEFRAG_IPV4 m | |
| 328 | set_kernel_config CONFIG_NF_DEFRAG_IPV6 m |
|
328 | set_kernel_config CONFIG_NF_DEFRAG_IPV6 m | |
| 329 | set_kernel_config CONFIG_NF_DUP_IPV4 m |
|
329 | set_kernel_config CONFIG_NF_DUP_IPV4 m | |
| 330 | set_kernel_config CONFIG_NF_DUP_IPV6 m |
|
330 | set_kernel_config CONFIG_NF_DUP_IPV6 m | |
| 331 | set_kernel_config CONFIG_NF_DUP_NETDEV m |
|
331 | set_kernel_config CONFIG_NF_DUP_NETDEV m | |
| 332 | set_kernel_config CONFIG_NF_LOG_BRIDGE m |
|
332 | set_kernel_config CONFIG_NF_LOG_BRIDGE m | |
| 333 | set_kernel_config CONFIG_NF_LOG_IPV4 m |
|
333 | set_kernel_config CONFIG_NF_LOG_IPV4 m | |
| 334 | set_kernel_config CONFIG_NF_LOG_IPV6 m |
|
334 | set_kernel_config CONFIG_NF_LOG_IPV6 m | |
| 335 | set_kernel_config CONFIG_NF_NAT_IPV4 m |
|
335 | set_kernel_config CONFIG_NF_NAT_IPV4 m | |
| 336 | set_kernel_config CONFIG_NF_NAT_IPV6 m |
|
336 | set_kernel_config CONFIG_NF_NAT_IPV6 m | |
| 337 | set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV4 y |
|
337 | set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV4 y | |
| 338 | set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV6 y |
|
338 | set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV6 y | |
| 339 | set_kernel_config CONFIG_NF_NAT_PPTP m |
|
339 | set_kernel_config CONFIG_NF_NAT_PPTP m | |
| 340 | set_kernel_config CONFIG_NF_NAT_PROTO_GRE m |
|
340 | set_kernel_config CONFIG_NF_NAT_PROTO_GRE m | |
| 341 | set_kernel_config CONFIG_NF_NAT_REDIRECT y |
|
341 | set_kernel_config CONFIG_NF_NAT_REDIRECT y | |
| 342 | set_kernel_config CONFIG_NF_NAT_SIP m |
|
342 | set_kernel_config CONFIG_NF_NAT_SIP m | |
| 343 | set_kernel_config CONFIG_NF_NAT_SNMP_BASIC m |
|
343 | set_kernel_config CONFIG_NF_NAT_SNMP_BASIC m | |
| 344 | set_kernel_config CONFIG_NF_NAT_TFTP m |
|
344 | set_kernel_config CONFIG_NF_NAT_TFTP m | |
| 345 | set_kernel_config CONFIG_NF_REJECT_IPV4 m |
|
345 | set_kernel_config CONFIG_NF_REJECT_IPV4 m | |
| 346 | set_kernel_config CONFIG_NF_REJECT_IPV6 m |
|
346 | set_kernel_config CONFIG_NF_REJECT_IPV6 m | |
| 347 | set_kernel_config CONFIG_NF_TABLES m |
|
347 | set_kernel_config CONFIG_NF_TABLES m | |
| 348 | set_kernel_config CONFIG_NF_TABLES_ARP m |
|
348 | set_kernel_config CONFIG_NF_TABLES_ARP m | |
| 349 | set_kernel_config CONFIG_NF_TABLES_BRIDGE m |
|
349 | set_kernel_config CONFIG_NF_TABLES_BRIDGE m | |
| 350 | set_kernel_config CONFIG_NF_TABLES_INET m |
|
350 | set_kernel_config CONFIG_NF_TABLES_INET m | |
| 351 | set_kernel_config CONFIG_NF_TABLES_IPV4 y |
|
351 | set_kernel_config CONFIG_NF_TABLES_IPV4 y | |
| 352 | set_kernel_config CONFIG_NF_TABLES_IPV6 y |
|
352 | set_kernel_config CONFIG_NF_TABLES_IPV6 y | |
| 353 | set_kernel_config CONFIG_NF_TABLES_NETDEV m |
|
353 | set_kernel_config CONFIG_NF_TABLES_NETDEV m | |
| 354 | set_kernel_config CONFIG_NF_TABLES_SET m |
|
354 | set_kernel_config CONFIG_NF_TABLES_SET m | |
| 355 | set_kernel_config CONFIG_NF_TABLES_INET y |
|
355 | set_kernel_config CONFIG_NF_TABLES_INET y | |
| 356 | set_kernel_config CONFIG_NF_TABLES_NETDEV y |
|
356 | set_kernel_config CONFIG_NF_TABLES_NETDEV y | |
| 357 | set_kernel_config CONFIG_NFT_CONNLIMIT m |
|
357 | set_kernel_config CONFIG_NFT_CONNLIMIT m | |
| 358 | set_kernel_config CONFIG_NFT_TUNNEL m |
|
358 | set_kernel_config CONFIG_NFT_TUNNEL m | |
| 359 | set_kernel_config CONFIG_NFT_SOCKET m |
|
359 | set_kernel_config CONFIG_NFT_SOCKET m | |
| 360 | set_kernel_config CONFIG_NFT_TPROXY m |
|
360 | set_kernel_config CONFIG_NFT_TPROXY m | |
| 361 | set_kernel_config CONFIG_NF_FLOW_TABLE m |
|
361 | set_kernel_config CONFIG_NF_FLOW_TABLE m | |
| 362 | set_kernel_config CONFIG_NFT_FLOW_OFFLOAD m |
|
362 | set_kernel_config CONFIG_NFT_FLOW_OFFLOAD m | |
| 363 | set_kernel_config CONFIG_NF_FLOW_TABLE_INET m |
|
363 | set_kernel_config CONFIG_NF_FLOW_TABLE_INET m | |
| 364 | set_kernel_config CONFIG_NF_TABLES_ARP y |
|
364 | set_kernel_config CONFIG_NF_TABLES_ARP y | |
| 365 | set_kernel_config CONFIG_NF_FLOW_TABLE_IPV4 y |
|
365 | set_kernel_config CONFIG_NF_FLOW_TABLE_IPV4 y | |
| 366 | set_kernel_config CONFIG_NF_FLOW_TABLE_IPV6 y |
|
366 | set_kernel_config CONFIG_NF_FLOW_TABLE_IPV6 y | |
| 367 | set_kernel_config CONFIG_NF_TABLES_BRIDGE y |
|
367 | set_kernel_config CONFIG_NF_TABLES_BRIDGE y | |
| 368 | set_kernel_config CONFIG_NF_CT_NETLINK_TIMEOUT m |
|
368 | set_kernel_config CONFIG_NF_CT_NETLINK_TIMEOUT m | |
| 369 | set_kernel_config CONFIG_NFT_OSF m |
|
369 | set_kernel_config CONFIG_NFT_OSF m | |
| 370 |
|
370 | |||
| 371 | fi |
|
371 | fi | |
| 372 |
|
372 | |||
| 373 | # Enables BPF syscall for systemd-journald see https://github.com/torvalds/linux/blob/master/init/Kconfig#L848 or https://groups.google.com/forum/#!topic/linux.gentoo.user/_2aSc_ztGpA |
|
373 | # Enables BPF syscall for systemd-journald see https://github.com/torvalds/linux/blob/master/init/Kconfig#L848 or https://groups.google.com/forum/#!topic/linux.gentoo.user/_2aSc_ztGpA | |
| 374 | if [ "$KERNEL_BPF" = true ] ; then |
|
374 | if [ "$KERNEL_BPF" = true ] ; then | |
| 375 | set_kernel_config CONFIG_BPF_SYSCALL y |
|
375 | set_kernel_config CONFIG_BPF_SYSCALL y | |
| 376 | set_kernel_config CONFIG_BPF_EVENTS y |
|
376 | set_kernel_config CONFIG_BPF_EVENTS y | |
| 377 | set_kernel_config CONFIG_BPF_STREAM_PARSER y |
|
377 | set_kernel_config CONFIG_BPF_STREAM_PARSER y | |
| 378 | set_kernel_config CONFIG_CGROUP_BPF y |
|
378 | set_kernel_config CONFIG_CGROUP_BPF y | |
|
|
379 | set_kernel_config CONFIG_XDP_SOCKETS y | |||
| 379 | fi |
|
380 | fi | |
| 380 |
|
381 | |||
| 381 | # KERNEL_DEFAULT_GOV was set by user |
|
382 | # KERNEL_DEFAULT_GOV was set by user | |
| 382 | if [ "$KERNEL_DEFAULT_GOV" != powersave ] && [ -n "$KERNEL_DEFAULT_GOV" ] ; then |
|
383 | if [ "$KERNEL_DEFAULT_GOV" != powersave ] && [ -n "$KERNEL_DEFAULT_GOV" ] ; then | |
| 383 |
|
384 | |||
| 384 | case "$KERNEL_DEFAULT_GOV" in |
|
385 | case "$KERNEL_DEFAULT_GOV" in | |
| 385 | performance) |
|
386 | performance) | |
| 386 | set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE y |
|
387 | set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE y | |
| 387 | ;; |
|
388 | ;; | |
| 388 | userspace) |
|
389 | userspace) | |
| 389 | set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE y |
|
390 | set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE y | |
| 390 | ;; |
|
391 | ;; | |
| 391 | ondemand) |
|
392 | ondemand) | |
| 392 | set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND y |
|
393 | set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND y | |
| 393 | ;; |
|
394 | ;; | |
| 394 | conservative) |
|
395 | conservative) | |
| 395 | set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE y |
|
396 | set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE y | |
| 396 | ;; |
|
397 | ;; | |
| 397 | shedutil) |
|
398 | shedutil) | |
| 398 | set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL y |
|
399 | set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL y | |
| 399 | ;; |
|
400 | ;; | |
| 400 | *) |
|
401 | *) | |
| 401 | echo "error: unsupported default cpu governor" |
|
402 | echo "error: unsupported default cpu governor" | |
| 402 | exit 1 |
|
403 | exit 1 | |
| 403 | ;; |
|
404 | ;; | |
| 404 | esac |
|
405 | esac | |
| 405 |
|
406 | |||
| 406 | # unset previous default governor |
|
407 | # unset previous default governor | |
| 407 | unset_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE |
|
408 | unset_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE | |
| 408 | fi |
|
409 | fi | |
| 409 |
|
410 | |||
| 410 | #Revert to previous directory |
|
411 | #Revert to previous directory | |
| 411 | cd "${WORKDIR}" || exit |
|
412 | cd "${WORKDIR}" || exit | |
| 412 |
|
413 | |||
| 413 | # Set kernel configuration parameters to enable qemu emulation |
|
414 | # Set kernel configuration parameters to enable qemu emulation | |
| 414 | if [ "$ENABLE_QEMU" = true ] ; then |
|
415 | if [ "$ENABLE_QEMU" = true ] ; then | |
| 415 | echo "CONFIG_FHANDLE=y" >> "${KERNEL_DIR}"/.config |
|
416 | echo "CONFIG_FHANDLE=y" >> "${KERNEL_DIR}"/.config | |
| 416 | echo "CONFIG_LBDAF=y" >> "${KERNEL_DIR}"/.config |
|
417 | echo "CONFIG_LBDAF=y" >> "${KERNEL_DIR}"/.config | |
| 417 |
|
418 | |||
| 418 | if [ "$KERNEL_CRYPTFS" = true ] ; then |
|
419 | if [ "$KERNEL_CRYPTFS" = true ] ; then | |
| 419 | { |
|
420 | { | |
| 420 | echo "CONFIG_EMBEDDED=y" |
|
421 | echo "CONFIG_EMBEDDED=y" | |
| 421 | echo "CONFIG_EXPERT=y" |
|
422 | echo "CONFIG_EXPERT=y" | |
| 422 | echo "CONFIG_DAX=y" |
|
423 | echo "CONFIG_DAX=y" | |
| 423 | echo "CONFIG_MD=y" |
|
424 | echo "CONFIG_MD=y" | |
| 424 | echo "CONFIG_BLK_DEV_MD=y" |
|
425 | echo "CONFIG_BLK_DEV_MD=y" | |
| 425 | echo "CONFIG_MD_AUTODETECT=y" |
|
426 | echo "CONFIG_MD_AUTODETECT=y" | |
| 426 | echo "CONFIG_BLK_DEV_DM=y" |
|
427 | echo "CONFIG_BLK_DEV_DM=y" | |
| 427 | echo "CONFIG_BLK_DEV_DM_BUILTIN=y" |
|
428 | echo "CONFIG_BLK_DEV_DM_BUILTIN=y" | |
| 428 | echo "CONFIG_DM_CRYPT=y" |
|
429 | echo "CONFIG_DM_CRYPT=y" | |
| 429 | echo "CONFIG_CRYPTO_BLKCIPHER=y" |
|
430 | echo "CONFIG_CRYPTO_BLKCIPHER=y" | |
| 430 | echo "CONFIG_CRYPTO_CBC=y" |
|
431 | echo "CONFIG_CRYPTO_CBC=y" | |
| 431 | echo "CONFIG_CRYPTO_XTS=y" |
|
432 | echo "CONFIG_CRYPTO_XTS=y" | |
| 432 | echo "CONFIG_CRYPTO_SHA512=y" |
|
433 | echo "CONFIG_CRYPTO_SHA512=y" | |
| 433 | echo "CONFIG_CRYPTO_MANAGER=y" |
|
434 | echo "CONFIG_CRYPTO_MANAGER=y" | |
| 434 | } >> "${KERNEL_DIR}"/.config |
|
435 | } >> "${KERNEL_DIR}"/.config | |
| 435 | fi |
|
436 | fi | |
| 436 | fi |
|
437 | fi | |
| 437 |
|
438 | |||
| 438 | # Copy custom kernel configuration file |
|
439 | # Copy custom kernel configuration file | |
| 439 | if [ -n "$KERNELSRC_USRCONFIG" ] ; then |
|
440 | if [ -n "$KERNELSRC_USRCONFIG" ] ; then | |
| 440 | cp "$KERNELSRC_USRCONFIG" "${KERNEL_DIR}"/.config |
|
441 | cp "$KERNELSRC_USRCONFIG" "${KERNEL_DIR}"/.config | |
| 441 | fi |
|
442 | fi | |
| 442 |
|
443 | |||
| 443 | # Set kernel configuration parameters to their default values |
|
444 | # Set kernel configuration parameters to their default values | |
| 444 | if [ "$KERNEL_OLDDEFCONFIG" = true ] ; then |
|
445 | if [ "$KERNEL_OLDDEFCONFIG" = true ] ; then | |
| 445 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" olddefconfig |
|
446 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" olddefconfig | |
| 446 | fi |
|
447 | fi | |
| 447 |
|
448 | |||
| 448 | # Start menu-driven kernel configuration (interactive) |
|
449 | # Start menu-driven kernel configuration (interactive) | |
| 449 | if [ "$KERNEL_MENUCONFIG" = true ] ; then |
|
450 | if [ "$KERNEL_MENUCONFIG" = true ] ; then | |
| 450 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" menuconfig |
|
451 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" menuconfig | |
| 451 | fi |
|
452 | fi | |
| 452 | # end if "$KERNELSRC_CONFIG" = true |
|
453 | # end if "$KERNELSRC_CONFIG" = true | |
| 453 | fi |
|
454 | fi | |
| 454 |
|
455 | |||
| 455 | # Use ccache to cross compile the kernel |
|
456 | # Use ccache to cross compile the kernel | |
| 456 | if [ "$KERNEL_CCACHE" = true ] ; then |
|
457 | if [ "$KERNEL_CCACHE" = true ] ; then | |
| 457 | cc="ccache ${CROSS_COMPILE}gcc" |
|
458 | cc="ccache ${CROSS_COMPILE}gcc" | |
| 458 | else |
|
459 | else | |
| 459 | cc="${CROSS_COMPILE}gcc" |
|
460 | cc="${CROSS_COMPILE}gcc" | |
| 460 | fi |
|
461 | fi | |
| 461 |
|
462 | |||
| 462 | # Cross compile kernel and dtbs |
|
463 | # Cross compile kernel and dtbs | |
| 463 | make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" "${KERNEL_BIN_IMAGE}" dtbs |
|
464 | make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" "${KERNEL_BIN_IMAGE}" dtbs | |
| 464 |
|
465 | |||
| 465 | # Cross compile kernel modules |
|
466 | # Cross compile kernel modules | |
| 466 | if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then |
|
467 | if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then | |
| 467 | make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" modules |
|
468 | make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" modules | |
| 468 | fi |
|
469 | fi | |
| 469 | # end if "$KERNELSRC_PREBUILT" = false |
|
470 | # end if "$KERNELSRC_PREBUILT" = false | |
| 470 | fi |
|
471 | fi | |
| 471 |
|
472 | |||
| 472 | # Check if kernel compilation was successful |
|
473 | # Check if kernel compilation was successful | |
| 473 | if [ ! -r "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" ] ; then |
|
474 | if [ ! -r "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" ] ; then | |
| 474 | echo "error: kernel compilation failed! (kernel image not found)" |
|
475 | echo "error: kernel compilation failed! (kernel image not found)" | |
| 475 | cleanup |
|
476 | cleanup | |
| 476 | exit 1 |
|
477 | exit 1 | |
| 477 | fi |
|
478 | fi | |
| 478 |
|
479 | |||
| 479 | # Install kernel modules |
|
480 | # Install kernel modules | |
| 480 | if [ "$ENABLE_REDUCE" = true ] ; then |
|
481 | if [ "$ENABLE_REDUCE" = true ] ; then | |
| 481 | if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then |
|
482 | if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then | |
| 482 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=../../.. modules_install |
|
483 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=../../.. modules_install | |
| 483 | fi |
|
484 | fi | |
| 484 | else |
|
485 | else | |
| 485 | if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then |
|
486 | if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then | |
| 486 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_PATH=../../.. modules_install |
|
487 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_PATH=../../.. modules_install | |
| 487 | fi |
|
488 | fi | |
| 488 |
|
489 | |||
| 489 | # Install kernel firmware |
|
490 | # Install kernel firmware | |
| 490 | if grep -q "^firmware_install:" "${KERNEL_DIR}/Makefile" ; then |
|
491 | if grep -q "^firmware_install:" "${KERNEL_DIR}/Makefile" ; then | |
| 491 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_FW_PATH=../../../lib firmware_install |
|
492 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_FW_PATH=../../../lib firmware_install | |
| 492 | fi |
|
493 | fi | |
| 493 | fi |
|
494 | fi | |
| 494 |
|
495 | |||
| 495 | # Install kernel headers |
|
496 | # Install kernel headers | |
| 496 | if [ "$KERNEL_HEADERS" = true ] && [ "$KERNEL_REDUCE" = false ] ; then |
|
497 | if [ "$KERNEL_HEADERS" = true ] && [ "$KERNEL_REDUCE" = false ] ; then | |
| 497 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_HDR_PATH=../.. headers_install |
|
498 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_HDR_PATH=../.. headers_install | |
| 498 | fi |
|
499 | fi | |
| 499 |
|
500 | |||
| 500 | # Prepare boot (firmware) directory |
|
501 | # Prepare boot (firmware) directory | |
| 501 | mkdir "${BOOT_DIR}" |
|
502 | mkdir "${BOOT_DIR}" | |
| 502 |
|
503 | |||
| 503 | # Get kernel release version |
|
504 | # Get kernel release version | |
| 504 | KERNEL_VERSION=$(cat "${KERNEL_DIR}/include/config/kernel.release") |
|
505 | KERNEL_VERSION=$(cat "${KERNEL_DIR}/include/config/kernel.release") | |
| 505 |
|
506 | |||
| 506 | # Copy kernel configuration file to the boot directory |
|
507 | # Copy kernel configuration file to the boot directory | |
| 507 | install_readonly "${KERNEL_DIR}/.config" "${R}/boot/config-${KERNEL_VERSION}" |
|
508 | install_readonly "${KERNEL_DIR}/.config" "${R}/boot/config-${KERNEL_VERSION}" | |
| 508 |
|
509 | |||
| 509 | # Prepare device tree directory |
|
510 | # Prepare device tree directory | |
| 510 | mkdir "${BOOT_DIR}/overlays" |
|
511 | mkdir "${BOOT_DIR}/overlays" | |
| 511 |
|
512 | |||
| 512 | # Ensure the proper .dtb is located |
|
513 | # Ensure the proper .dtb is located | |
| 513 | if [ "$KERNEL_ARCH" = "arm" ] ; then |
|
514 | if [ "$KERNEL_ARCH" = "arm" ] ; then | |
| 514 | for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/"*.dtb ; do |
|
515 | for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/"*.dtb ; do | |
| 515 | if [ -f "${dtb}" ] ; then |
|
516 | if [ -f "${dtb}" ] ; then | |
| 516 | install_readonly "${dtb}" "${BOOT_DIR}/" |
|
517 | install_readonly "${dtb}" "${BOOT_DIR}/" | |
| 517 | fi |
|
518 | fi | |
| 518 | done |
|
519 | done | |
| 519 | else |
|
520 | else | |
| 520 | for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/broadcom/"*.dtb ; do |
|
521 | for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/broadcom/"*.dtb ; do | |
| 521 | if [ -f "${dtb}" ] ; then |
|
522 | if [ -f "${dtb}" ] ; then | |
| 522 | install_readonly "${dtb}" "${BOOT_DIR}/" |
|
523 | install_readonly "${dtb}" "${BOOT_DIR}/" | |
| 523 | fi |
|
524 | fi | |
| 524 | done |
|
525 | done | |
| 525 | fi |
|
526 | fi | |
| 526 |
|
527 | |||
| 527 | # Copy compiled dtb device tree files |
|
528 | # Copy compiled dtb device tree files | |
| 528 | if [ -d "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays" ] ; then |
|
529 | if [ -d "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays" ] ; then | |
| 529 | for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtbo ; do |
|
530 | for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtbo ; do | |
| 530 | if [ -f "${dtb}" ] ; then |
|
531 | if [ -f "${dtb}" ] ; then | |
| 531 | install_readonly "${dtb}" "${BOOT_DIR}/overlays/" |
|
532 | install_readonly "${dtb}" "${BOOT_DIR}/overlays/" | |
| 532 | fi |
|
533 | fi | |
| 533 | done |
|
534 | done | |
| 534 |
|
535 | |||
| 535 | if [ -f "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" ] ; then |
|
536 | if [ -f "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" ] ; then | |
| 536 | install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "${BOOT_DIR}/overlays/README" |
|
537 | install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "${BOOT_DIR}/overlays/README" | |
| 537 | fi |
|
538 | fi | |
| 538 | fi |
|
539 | fi | |
| 539 |
|
540 | |||
| 540 | if [ "$ENABLE_UBOOT" = false ] ; then |
|
541 | if [ "$ENABLE_UBOOT" = false ] ; then | |
| 541 | # Convert and copy kernel image to the boot directory |
|
542 | # Convert and copy kernel image to the boot directory | |
| 542 | "${KERNEL_DIR}/scripts/mkknlimg" "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}" |
|
543 | "${KERNEL_DIR}/scripts/mkknlimg" "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}" | |
| 543 | else |
|
544 | else | |
| 544 | # Copy kernel image to the boot directory |
|
545 | # Copy kernel image to the boot directory | |
| 545 | install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}" |
|
546 | install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}" | |
| 546 | fi |
|
547 | fi | |
| 547 |
|
548 | |||
| 548 | # Remove kernel sources |
|
549 | # Remove kernel sources | |
| 549 | if [ "$KERNEL_REMOVESRC" = true ] ; then |
|
550 | if [ "$KERNEL_REMOVESRC" = true ] ; then | |
| 550 | rm -fr "${KERNEL_DIR}" |
|
551 | rm -fr "${KERNEL_DIR}" | |
| 551 | else |
|
552 | else | |
| 552 | # Prepare compiled kernel modules |
|
553 | # Prepare compiled kernel modules | |
| 553 | if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then |
|
554 | if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then | |
| 554 | if grep -q "^modules_prepare:" "${KERNEL_DIR}/Makefile" ; then |
|
555 | if grep -q "^modules_prepare:" "${KERNEL_DIR}/Makefile" ; then | |
| 555 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" modules_prepare |
|
556 | make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" modules_prepare | |
| 556 | fi |
|
557 | fi | |
| 557 |
|
558 | |||
| 558 | # Create symlinks for kernel modules |
|
559 | # Create symlinks for kernel modules | |
| 559 | chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/build" |
|
560 | chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/build" | |
| 560 | chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/source" |
|
561 | chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/source" | |
| 561 | fi |
|
562 | fi | |
| 562 | fi |
|
563 | fi | |
| 563 |
|
564 | |||
| 564 | else # BUILD_KERNEL=false |
|
565 | else # BUILD_KERNEL=false | |
| 565 | if [ "$SET_ARCH" = 64 ] ; then |
|
566 | if [ "$SET_ARCH" = 64 ] ; then | |
| 566 | if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then |
|
567 | if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then | |
| 567 | # Use Sakakis modified kernel if ZSWAP is active |
|
568 | # Use Sakakis modified kernel if ZSWAP is active | |
| 568 | if [ "$KERNEL_ZSWAP" = true ] || [ "$KERNEL_VIRT" = true ] || [ "$KERNEL_NF" = true ] || [ "$KERNEL_BPF" = true ] ; then |
|
569 | if [ "$KERNEL_ZSWAP" = true ] || [ "$KERNEL_VIRT" = true ] || [ "$KERNEL_NF" = true ] || [ "$KERNEL_BPF" = true ] ; then | |
| 569 | RPI3_64_KERNEL_URL="${RPI3_64_BIS_KERNEL_URL}" |
|
570 | RPI3_64_KERNEL_URL="${RPI3_64_BIS_KERNEL_URL}" | |
| 570 | fi |
|
571 | fi | |
| 571 |
|
572 | |||
| 572 | # Create temporary directory for dl |
|
573 | # Create temporary directory for dl | |
| 573 | temp_dir=$(as_nobody mktemp -d) |
|
574 | temp_dir=$(as_nobody mktemp -d) | |
| 574 |
|
575 | |||
| 575 | # Fetch kernel dl |
|
576 | # Fetch kernel dl | |
| 576 | as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI3_64_KERNEL_URL" |
|
577 | as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI3_64_KERNEL_URL" | |
| 577 | fi |
|
578 | fi | |
| 578 | if [ "$SET_ARCH" = 64 ] && [ "$RPI_MODEL" = 4 ] ; then |
|
579 | if [ "$SET_ARCH" = 64 ] && [ "$RPI_MODEL" = 4 ] ; then | |
| 579 | # Create temporary directory for dl |
|
580 | # Create temporary directory for dl | |
| 580 | temp_dir=$(as_nobody mktemp -d) |
|
581 | temp_dir=$(as_nobody mktemp -d) | |
| 581 |
|
582 | |||
| 582 | # Fetch kernel dl |
|
583 | # Fetch kernel dl | |
| 583 | as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI4_64_KERNEL_URL" |
|
584 | as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI4_64_KERNEL_URL" | |
| 584 | fi |
|
585 | fi | |
| 585 |
|
586 | |||
| 586 | #extract download |
|
587 | #extract download | |
| 587 | tar -xJf "${temp_dir}"/kernel.tar.xz -C "${temp_dir}" |
|
588 | tar -xJf "${temp_dir}"/kernel.tar.xz -C "${temp_dir}" | |
| 588 |
|
589 | |||
| 589 | #move extracted kernel to /boot/firmware |
|
590 | #move extracted kernel to /boot/firmware | |
| 590 | mkdir "${R}/boot/firmware" |
|
591 | mkdir "${R}/boot/firmware" | |
| 591 | cp "${temp_dir}"/boot/* "${R}"/boot/firmware/ |
|
592 | cp "${temp_dir}"/boot/* "${R}"/boot/firmware/ | |
| 592 | cp -r "${temp_dir}"/lib/* "${R}"/lib/ |
|
593 | cp -r "${temp_dir}"/lib/* "${R}"/lib/ | |
| 593 |
|
594 | |||
| 594 | # Remove temporary directory for kernel sources |
|
595 | # Remove temporary directory for kernel sources | |
| 595 | rm -fr "${temp_dir}" |
|
596 | rm -fr "${temp_dir}" | |
| 596 |
|
597 | |||
| 597 | # Set permissions of the kernel sources |
|
598 | # Set permissions of the kernel sources | |
| 598 | chown -R root:root "${R}/boot/firmware" |
|
599 | chown -R root:root "${R}/boot/firmware" | |
| 599 | chown -R root:root "${R}/lib/modules" |
|
600 | chown -R root:root "${R}/lib/modules" | |
| 600 | fi |
|
601 | fi | |
| 601 |
|
602 | |||
| 602 | # Install Kernel from hypriot comptabile with all Raspberry PI (dunno if its compatible with RPI4 - better compile your own kernel) |
|
603 | # Install Kernel from hypriot comptabile with all Raspberry PI (dunno if its compatible with RPI4 - better compile your own kernel) | |
| 603 | if [ "$SET_ARCH" = 32 ] && [ "$RPI_MODEL" != 4 ] ; then |
|
604 | if [ "$SET_ARCH" = 32 ] && [ "$RPI_MODEL" != 4 ] ; then | |
| 604 | # Create temporary directory for dl |
|
605 | # Create temporary directory for dl | |
| 605 | temp_dir=$(as_nobody mktemp -d) |
|
606 | temp_dir=$(as_nobody mktemp -d) | |
| 606 |
|
607 | |||
| 607 | # Fetch kernel |
|
608 | # Fetch kernel | |
| 608 | as_nobody wget -O "${temp_dir}"/kernel.deb -c "$RPI_32_KERNEL_URL" |
|
609 | as_nobody wget -O "${temp_dir}"/kernel.deb -c "$RPI_32_KERNEL_URL" | |
| 609 |
|
610 | |||
| 610 | # Copy downloaded kernel package |
|
611 | # Copy downloaded kernel package | |
| 611 | mv "${temp_dir}"/kernel.deb "${R}"/tmp/kernel.deb |
|
612 | mv "${temp_dir}"/kernel.deb "${R}"/tmp/kernel.deb | |
| 612 |
|
613 | |||
| 613 | # Set permissions |
|
614 | # Set permissions | |
| 614 | chown -R root:root "${R}"/tmp/kernel.deb |
|
615 | chown -R root:root "${R}"/tmp/kernel.deb | |
| 615 |
|
616 | |||
| 616 | # Install kernel |
|
617 | # Install kernel | |
| 617 | chroot_exec dpkg -i /tmp/kernel.deb |
|
618 | chroot_exec dpkg -i /tmp/kernel.deb | |
| 618 |
|
619 | |||
| 619 | # move /boot to /boot/firmware to fit script env. |
|
620 | # move /boot to /boot/firmware to fit script env. | |
| 620 | #mkdir "${BOOT_DIR}" |
|
621 | #mkdir "${BOOT_DIR}" | |
| 621 | mkdir "${temp_dir}"/firmware |
|
622 | mkdir "${temp_dir}"/firmware | |
| 622 | mv "${R}"/boot/* "${temp_dir}"/firmware/ |
|
623 | mv "${R}"/boot/* "${temp_dir}"/firmware/ | |
| 623 | mv "${temp_dir}"/firmware "${R}"/boot/ |
|
624 | mv "${temp_dir}"/firmware "${R}"/boot/ | |
| 624 |
|
625 | |||
| 625 | #same for kernel headers |
|
626 | #same for kernel headers | |
| 626 | if [ "$KERNEL_HEADERS" = true ] ; then |
|
627 | if [ "$KERNEL_HEADERS" = true ] ; then | |
| 627 | # Fetch kernel header |
|
628 | # Fetch kernel header | |
| 628 | as_nobody wget -O "${temp_dir}"/kernel-header.deb -c "$RPI_32_KERNELHEADER_URL" |
|
629 | as_nobody wget -O "${temp_dir}"/kernel-header.deb -c "$RPI_32_KERNELHEADER_URL" | |
| 629 | mv "${temp_dir}"/kernel-header.deb "${R}"/tmp/kernel-header.deb |
|
630 | mv "${temp_dir}"/kernel-header.deb "${R}"/tmp/kernel-header.deb | |
| 630 | chown -R root:root "${R}"/tmp/kernel-header.deb |
|
631 | chown -R root:root "${R}"/tmp/kernel-header.deb | |
| 631 | # Install kernel header |
|
632 | # Install kernel header | |
| 632 | chroot_exec dpkg -i /tmp/kernel-header.deb |
|
633 | chroot_exec dpkg -i /tmp/kernel-header.deb | |
| 633 | rm -f "${R}"/tmp/kernel-header.deb |
|
634 | rm -f "${R}"/tmp/kernel-header.deb | |
| 634 | fi |
|
635 | fi | |
| 635 |
|
636 | |||
| 636 | # Remove temporary directory and files |
|
637 | # Remove temporary directory and files | |
| 637 | rm -fr "${temp_dir}" |
|
638 | rm -fr "${temp_dir}" | |
| 638 | rm -f "${R}"/tmp/kernel.deb |
|
639 | rm -f "${R}"/tmp/kernel.deb | |
| 639 | fi |
|
640 | fi | |
| 640 |
|
641 | |||
| 641 | # Check if kernel installation was successful |
|
642 | # Check if kernel installation was successful | |
| 642 | KERNEL="$(ls -1 "${R}"/boot/firmware/kernel* | sort | tail -n 1)" |
|
643 | KERNEL="$(ls -1 "${R}"/boot/firmware/kernel* | sort | tail -n 1)" | |
| 643 | if [ -z "$KERNEL" ] ; then |
|
644 | if [ -z "$KERNEL" ] ; then | |
| 644 | echo "error: kernel installation failed! (/boot/kernel* not found)" |
|
645 | echo "error: kernel installation failed! (/boot/kernel* not found)" | |
| 645 | cleanup |
|
646 | cleanup | |
| 646 | exit 1 |
|
647 | exit 1 | |
| 647 | fi |
|
648 | fi | |
| 648 | fi |
|
649 | fi | |
General Comments 0
Vous devez vous connecter pour laisser un commentaire.
Se connecter maintenant
