##// END OF EJS Templates
-using --verbose and debug while creating cryptfs to give a hint by default...
Unknown -
r696:2f2cf24844e7 pull
parent child
Show More
@@ -1,551 +1,572
1 1 # rpi23-gen-image
2 2 ## Introduction
3 `rpi23-gen-image.sh` is an advanced Debian Linux bootstrapping shell script for generating Debian OS images for all Raspberry Pi computers. The script at this time supports the bootstrapping of the Debian (armhf/armel) releases `stretch` and `buster`. Raspberry Pi 0/1/2/3 images are generated for 32-bit mode only. Raspberry Pi 3 supports 64-bit images that can be generated using custom configuration parameters (```templates/rpi3-stretch-arm64-4.14.y```).
3 `rpi23-gen-image.sh` is an advanced Debian Linux bootstrapping shell script for generating Debian OS images for all Raspberry Pi computers. The script at this time supports the bootstrapping of the Debian (armhf/armel) releases `stretch` and `buster`. Raspberry Pi 0/1/2/3/4 images are generated for 32-bit mode only. Raspberry Pi 3 supports 64-bit images that can be generated using custom configuration parameters (```templates/rpi3-stretch-arm64-4.14.y```).
4 4
5 5 ## Build dependencies
6 6 The following list of Debian packages must be installed on the build system because they are essentially required for the bootstrapping process. The script will check if all required packages are installed and missing packages will be installed automatically if confirmed by the user.
7 7
8 8 ```debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo```
9 9
10 It is recommended to configure the `rpi23-gen-image.sh` script to build and install the latest Raspberry Pi Linux kernel. For the Raspberry 3 this is mandatory. Kernel compilation and linking will be performed on the build system using an ARM (armhf/armel) cross-compiler toolchain.
10 It is recommended to configure the `rpi23-gen-image.sh` script to build and install the latest Raspberry Pi Linux kernel. For the Raspberry 3 this is mandatory. Kernel compilation and linking will be performed on the build system using an ARM (armhf/armel/aarch64) cross-compiler toolchain.
11 11
12 12 The script has been tested using the default `crossbuild-essential-armhf` and `crossbuild-essential-armel` toolchain meta packages on Debian Linux `stretch` build systems. Please check the [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains) for further information.
13 13
14 14 ## Command-line parameters
15 15 The script accepts certain command-line parameters to enable or disable specific OS features, services and configuration settings. These parameters are passed to the `rpi23-gen-image.sh` script via (simple) shell-variables. Unlike environment shell-variables (simple) shell-variables are defined at the beginning of the command-line call of the `rpi23-gen-image.sh` script.
16 16
17 17 ##### Command-line examples:
18 18 ```shell
19 19 ENABLE_UBOOT=true ./rpi23-gen-image.sh
20 20 ENABLE_CONSOLE=false ENABLE_IPV6=false ./rpi23-gen-image.sh
21 21 ENABLE_WM=xfce4 ENABLE_FBTURBO=true ENABLE_MINBASE=true ./rpi23-gen-image.sh
22 22 ENABLE_HARDNET=true ENABLE_IPTABLES=true /rpi23-gen-image.sh
23 23 APT_SERVER=ftp.de.debian.org APT_PROXY="http://127.0.0.1:3142/" ./rpi23-gen-image.sh
24 24 ENABLE_MINBASE=true ./rpi23-gen-image.sh
25 25 BUILD_KERNEL=true ENABLE_MINBASE=true ENABLE_IPV6=false ./rpi23-gen-image.sh
26 26 BUILD_KERNEL=true KERNELSRC_DIR=/tmp/linux ./rpi23-gen-image.sh
27 27 ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
28 28 ENABLE_CRYPTFS=true CRYPTFS_PASSWORD=changeme EXPANDROOT=false ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
29 29 RELEASE=stretch BUILD_KERNEL=true ./rpi23-gen-image.sh
30 30 RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
31 31 RELEASE=stretch RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
32 32 ```
33 33
34 34 ## Configuration template files
35 35 To avoid long lists of command-line parameters and to help to store the favourite parameter configurations the `rpi23-gen-image.sh` script supports so called configuration template files (`CONFIG_TEMPLATE`=template). These are simple text files located in the `./templates` directory that contain the list of configuration parameters that will be used. New configuration template files can be added to the `./templates` directory.
36 36
37 37 ##### Command-line examples:
38 38 ```shell
39 39 CONFIG_TEMPLATE=rpi3stretch ./rpi23-gen-image.sh
40 40 CONFIG_TEMPLATE=rpi2stretch ./rpi23-gen-image.sh
41 41 ```
42 42
43 43 ## Supported parameters and settings
44 44 #### APT settings:
45 45 ##### `APT_SERVER`="ftp.debian.org"
46 46 Set Debian packages server address. Choose a server from the list of Debian worldwide [mirror sites](https://www.debian.org/mirror/list). Using a nearby server will probably speed-up all required downloads within the bootstrapping process.
47 47
48 48 ##### `APT_PROXY`=""
49 49 Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will speed-up the bootstrapping process because all required Debian packages will only be downloaded from the Debian mirror site once. If `apt-cacher-ng` is running on default `http://127.0.0.1:3142` it is autodetected and you don't need to set this.
50 50
51 51 ##### `KEEP_APT_PROXY`=false
52 52 Keep the APT_PROXY settings used in the bootsrapping process in the generated image.
53 53
54 54 ##### `APT_INCLUDES`=""
55 55 A comma-separated list of additional packages to be installed by debootstrap during bootstrapping.
56 56
57 57 ##### `APT_INCLUDES_LATE`=""
58 58 A comma-separated list of additional packages to be installed by apt after bootstrapping and after APT sources are set up. This is useful for packages with pre-depends, which debootstrap do not handle well.
59 59
60 60 ---
61 61
62 62 #### General system settings:
63 63 ##### `SET_ARCH`=32
64 Set Architecture to default 32bit. If you want to compile 64-bit (RPI3 or RPI3+) set it to `64`. This option will set every needed cross-compiler or board specific option for a successful build.
64 Set Architecture to default 32bit. If you want to compile 64-bit (RPI3/RPI3+/RPI4) set it to `64`. This option will set every needed cross-compiler or board specific option for a successful build.
65 65
66 66 ##### `RPI_MODEL`=2
67 67 Specify the target Raspberry Pi hardware model. The script at this time supports the following Raspberry Pi models:
68 68 - `0` = Raspberry Pi 0 and Raspberry Pi 0 W
69 69 - `1` = Raspberry Pi 1 model A and B
70 70 - `1P` = Raspberry Pi 1 model B+ and A+
71 71 - `2` = Raspberry Pi 2 model B
72 72 - `3` = Raspberry Pi 3 model B
73 73 - `3P` = Raspberry Pi 3 model B+
74 - `4` = Raspberry Pi 4 model B
74 75
75 76 ##### `RELEASE`="buster"
76 77 Set the desired Debian release name. The script at this time supports the bootstrapping of the Debian releases `stretch` and `buster`.
77 78
78 79 ##### `RELEASE_ARCH`="armhf"
79 80 Set the desired Debian release architecture.
80 81
81 82 ##### `HOSTNAME`="rpi$RPI_MODEL-$RELEASE"
82 83 Set system hostname. It's recommended that the hostname is unique in the corresponding subnet.
83 84
84 85 ##### `PASSWORD`="raspberry"
85 86 Set system `root` password. It's **STRONGLY** recommended that you choose a custom password.
86 87
87 88 ##### `USER_PASSWORD`="raspberry"
88 89 Set password for the created non-root user `USER_NAME`=pi. Ignored if `ENABLE_USER`=false. It's **STRONGLY** recommended that you choose a custom password.
89 90
90 91 ##### `DEFLOCAL`="en_US.UTF-8"
91 92 Set default system locale. This setting can also be changed inside the running OS using the `dpkg-reconfigure locales` command. Please note that on using this parameter the script will automatically install the required packages `locales`, `keyboard-configuration` and `console-setup`.
92 93
93 94 ##### `TIMEZONE`="Europe/Berlin"
94 95 Set default system timezone. All available timezones can be found in the `/usr/share/zoneinfo/` directory. This setting can also be changed inside the running OS using the `dpkg-reconfigure tzdata` command.
95 96
96 97 ##### `EXPANDROOT`=true
97 98 Expand the root partition and filesystem automatically on first boot.
98 99
99 100 ##### `ENABLE_DPHYSSWAP`=true
100 101 Enable swap. The size of the swapfile is chosen relative to the size of the root partition. It'll use the `dphys-swapfile` package for that.
101 102
102 103 ##### `ENABLE_QEMU`=false
103 104 Generate kernel (`vexpress_defconfig`), file system image (`qcow2`) and DTB files that can be used for QEMU full system emulation (`vexpress-A15`). The output files are stored in the `$(pwd)/images/qemu` directory. You can find more information about running the generated image in the QEMU section of this readme file.
104 105
105 106 ---
106 107
107 108 #### Keyboard settings:
108 109 These options are used to configure keyboard layout in `/etc/default/keyboard` for console and Xorg. These settings can also be changed inside the running OS using the `dpkg-reconfigure keyboard-configuration` command.
109 110
110 111 ##### `XKB_MODEL`=""
111 112 Set the name of the model of your keyboard type.
112 113
113 114 ##### `XKB_LAYOUT`=""
114 115 Set the supported keyboard layout(s).
115 116
116 117 ##### `XKB_VARIANT`=""
117 118 Set the supported variant(s) of the keyboard layout(s).
118 119
119 120 ##### `XKB_OPTIONS`=""
120 121 Set extra xkb configuration options.
121 122
122 123 ---
123 124
124 125 #### Networking settings (DHCP):
125 126 This parameter is used to set up networking auto-configuration in `/etc/systemd/network/eth.network`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.`
126 127
127 128 ##### `ENABLE_DHCP`=true
128 129 Set the system to use DHCP. This requires an DHCP server.
129 130
130 131 ---
131 132
132 133 #### Networking settings (static):
133 134 These parameters are used to set up a static networking configuration in `/etc/systemd/network/eth.network`. The following static networking parameters are only supported if `ENABLE_DHCP` was set to `false`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.
134 135
135 136 ##### `NET_ADDRESS`=""
136 137 Set a static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24".
137 138
138 139 ##### `NET_GATEWAY`=""
139 140 Set the IP address for the default gateway.
140 141
141 142 ##### `NET_DNS_1`=""
142 143 Set the IP address for the first DNS server.
143 144
144 145 ##### `NET_DNS_2`=""
145 146 Set the IP address for the second DNS server.
146 147
147 148 ##### `NET_DNS_DOMAINS`=""
148 149 Set the default DNS search domains to use for non fully qualified hostnames.
149 150
150 151 ##### `NET_NTP_1`=""
151 152 Set the IP address for the first NTP server.
152 153
153 154 ##### `NET_NTP_2`=""
154 155 Set the IP address for the second NTP server.
155 156
156 157 ---
157 158
158 159 #### Basic system features:
159 160 ##### `ENABLE_CONSOLE`=true
160 161 Enable serial console interface. Recommended if no monitor or keyboard is connected to the RPi2/3. In case of problems fe. if the network (auto) configuration failed - the serial console can be used to access the system. On RPI `0` `3` `3P` the CPU speed is locked at lowest speed.
161 162
162 163 ##### `ENABLE_PRINTK`=false
163 164 Enables printing kernel messages to konsole. printk is `3 4 1 3` as in raspbian.
164 165
165 166 ##### `ENABLE_BLUETOOTH`=false
166 167 Enable onboard Bluetooth interface on the RPi0/3/3P. See: [Configuring the GPIO serial port on Raspbian jessie and stretch](https://spellfoundry.com/2016/05/29/configuring-gpio-serial-port-raspbian-jessie-including-pi-3/).
167 168
168 169 ##### `ENABLE_MINIUART_OVERLAY`=false
169 170 Enable Bluetooth to use this. Adds overlay to swap UART0 with UART1. Enabling (slower) Bluetooth and full speed serial console. - RPI `0` `3` `3P` have a fast `hardware UART0` (ttyAMA0) and a `mini UART1` (ttyS0)! RPI `1` `1P` `2` only have a `hardware UART0`. `UART0` is considered better, because is faster and more stable than `mini UART1`. By default the Bluetooth modem is mapped to the `hardware UART0` and `mini UART` is used for console. The `mini UART` is a problem for the serial console, because its baudrate depends on the CPU frequency, which is changing on runtime. Resulting in a volatile baudrate and thus in an unusable serial console.
170 171
171 172 ##### `ENABLE_TURBO`=false
172 173 Enable Turbo mode. This setting locks cpu at the highest frequency. As setting ENABLE_CONSOLE=true locks RPI to lowest CPU speed, this is can be used additionally to lock cpu hat max speed. Need a good power supply and probably cooling for the Raspberry PI.
173 174
174 175 ##### `ENABLE_I2C`=false
175 176 Enable I2C interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
176 177
177 178 ##### `ENABLE_SPI`=false
178 179 Enable SPI interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
179 180
180 181 ##### `ENABLE_IPV6`=true
181 182 Enable IPv6 support. The network interface configuration is managed via systemd-networkd.
182 183
183 184 ##### `ENABLE_SSHD`=true
184 185 Install and enable OpenSSH service. The default configuration of the service doesn't allow `root` to login. Please use the user `pi` instead and `su -` or `sudo` to execute commands as root.
185 186
186 187 ##### `ENABLE_NONFREE`=false
187 188 Allow the installation of non-free Debian packages that do not comply with the DFSG. This is required to install closed-source firmware binary blobs.
188 189
189 190 ##### `ENABLE_WIRELESS`=false
190 191 Download and install the [closed-source firmware binary blob](https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm) that is required to run the internal wireless interface of the Raspberry Pi model `3`. This parameter is ignored if the specified `RPI_MODEL` is not `3`.
191 192
192 193 ##### `ENABLE_RSYSLOG`=true
193 194 If set to false, disable and uninstall rsyslog (so logs will be available only in journal files)
194 195
195 196 ##### `ENABLE_SOUND`=true
196 197 Enable sound hardware and install Advanced Linux Sound Architecture.
197 198
198 199 ##### `ENABLE_HWRANDOM`=true
199 200 Enable Hardware Random Number Generator. Strong random numbers are important for most network-based communications that use encryption. It's recommended to be enabled.
200 201
201 202 ##### `ENABLE_MINGPU`=false
202 203 Minimize the amount of shared memory reserved for the GPU. It doesn't seem to be possible to fully disable the GPU.
203 204
204 205 ##### `ENABLE_DBUS`=true
205 206 Install and enable D-Bus message bus. Please note that systemd should work without D-bus but it's recommended to be enabled.
206 207
207 208 ##### `ENABLE_XORG`=false
208 209 Install Xorg open-source X Window System.
209 210
210 211 ##### `ENABLE_WM`=""
211 212 Install a user-defined window manager for the X Window System. To make sure all X related package dependencies are getting installed `ENABLE_XORG` will automatically get enabled if `ENABLE_WM` is used. The `rpi23-gen-image.sh` script has been tested with the following list of window managers: `blackbox`, `openbox`, `fluxbox`, `jwm`, `dwm`, `xfce4`, `awesome`.
212 213
213 214 ##### `ENABLE_SYSVINIT`=false
214 215 Support for halt,init,poweroff,reboot,runlevel,shutdown,telinit commands
215 216
216 217 ---
217 218
218 219 #### Advanced system features:
219 220 ##### `ENABLE_KEYGEN`=false
220 221 Recover your lost codec license
221 222
222 223 ##### `ENABLE_SYSTEMDSWAP`=false
223 224 Enables [Systemd-swap service](https://github.com/Nefelim4ag/systemd-swap). Usefull if `KERNEL_ZSWAP` is enabled.
224 225
225 226 ##### `ENABLE_MINBASE`=false
226 227 Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.
227 228
228 229 ##### `ENABLE_REDUCE`=false
229 230 Reduce the disk space usage by deleting packages and files. See `REDUCE_*` parameters for detailed information.
230 231
231 232 ##### `ENABLE_UBOOT`=false
232 233 Replace the default RPi 0/1/2/3 second stage bootloader (bootcode.bin) with [U-Boot bootloader](https://git.denx.de/?p=u-boot.git;a=summary). U-Boot can boot images via the network using the BOOTP/TFTP protocol.
234 RPI4 needs tbd
233 235
234 236 ##### `UBOOTSRC_DIR`=""
235 237 Path to a directory (`u-boot`) of [U-Boot bootloader sources](https://git.denx.de/?p=u-boot.git;a=summary) that will be copied, configured, build and installed inside the chroot.
236 238
237 239 ##### `ENABLE_FBTURBO`=false
238 240 Install and enable the [hardware accelerated Xorg video driver](https://github.com/ssvb/xf86-video-fbturbo) `fbturbo`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
239 241
240 242 ##### `FBTURBOSRC_DIR`=""
241 243 Path to a directory (`xf86-video-fbturbo`) of [hardware accelerated Xorg video driver sources](https://github.com/ssvb/xf86-video-fbturbo) that will be copied, configured, build and installed inside the chroot.
242 244
243 245 ##### `ENABLE_VIDEOCORE`=false
244 246 Install and enable the [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) `vcgencmd`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
245 247
246 248 ##### `VIDEOCORESRC_DIR`=""
247 249 Path to a directory (`userland`) of [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot.
248 250
249 251 ##### `ENABLE_NEXMON`=false
250 252 Install and enable the [Source code for a C-based firmware patching framework for Broadcom/Cypress WiFi chips that enables you to write your own firmware patches, for example, to enable monitor mode with radiotap headers and frame injection](https://github.com/seemoo-lab/nexmon.git).
251 253
252 254 ##### `NEXMONSRC_DIR`=""
253 255 Path to a directory (`nexmon`) of [Source code for ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot.
254 256
255 257 ##### `ENABLE_IPTABLES`=false
256 258 Enable iptables IPv4/IPv6 firewall. Simplified ruleset: Allow all outgoing connections. Block all incoming connections except to OpenSSH service.
257 259
258 260 ##### `ENABLE_USER`=true
259 261 Create non-root user with password `USER_PASSWORD`=raspberry. Unless overridden with `USER_NAME`=user, the username will be `pi`.
260 262
261 263 ##### `USER_NAME`=pi
262 264 Non-root user to create. Ignored if `ENABLE_USER`=false
263 265
264 266 ##### `ENABLE_ROOT`=false
265 267 Set root user password so root login will be enabled
266 268
267 269 ##### `ENABLE_HARDNET`=false
268 270 Enable IPv4/IPv6 network stack hardening settings.
269 271
270 272 ##### `ENABLE_SPLITFS`=false
271 273 Enable having root partition on an USB drive by creating two image files: one for the `/boot/firmware` mount point, and another for `/`.
272 274
273 275 ##### `CHROOT_SCRIPTS`=""
274 276 Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this directory is run in lexicographical order.
275 277
276 278 ##### `ENABLE_INITRAMFS`=false
277 279 Create an initramfs that that will be loaded during the Linux startup process. `ENABLE_INITRAMFS` will automatically get enabled if `ENABLE_CRYPTFS`=true. This parameter will be ignored if `BUILD_KERNEL`=false.
278 280
279 281 ##### `ENABLE_IFNAMES`=true
280 282 Enable automatic assignment of predictable, stable network interface names for all local Ethernet, WLAN interfaces. This might create complex and long interface names.
281 283
282 284 ##### `ENABLE_SPLASH`=true
283 285 Enable default Raspberry Pi boot up rainbow splash screen.
284 286
285 287 ##### `ENABLE_LOGO`=true
286 288 Enable default Raspberry Pi console logo (image of four raspberries in the top left corner).
287 289
288 290 ##### `ENABLE_SILENT_BOOT`=false
289 291 Set the verbosity of console messages shown during boot up to a strict minimum.
290 292
291 293 ##### `DISABLE_UNDERVOLT_WARNINGS`=
292 294 Disable RPi2/3 under-voltage warnings and overlays. Setting the parameter to `1` will disable the warning overlay. Setting it to `2` will additionally allow RPi2/3 turbo mode when low-voltage is present.
293 295
294 296 ---
295 297
296 298 #### SSH settings:
297 299 ##### `SSH_ENABLE_ROOT`=false
298 300 Enable password-based root login via SSH. This may be a security risk with the default password set, use only in trusted environments. `ENABLE_ROOT` must be set to `true`.
299 301
300 302 ##### `SSH_DISABLE_PASSWORD_AUTH`=false
301 303 Disable password-based SSH authentication. Only public key based SSH (v2) authentication will be supported.
302 304
303 305 ##### `SSH_LIMIT_USERS`=false
304 306 Limit the users that are allowed to login via SSH. Only allow user `USER_NAME`=pi and root if `SSH_ENABLE_ROOT`=true to login. This parameter will be ignored if `dropbear` SSH is used (`REDUCE_SSHD`=true).
305 307
306 308 ##### `SSH_ROOT_PUB_KEY`=""
307 309 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`.
308 310
309 311 ##### `SSH_USER_PUB_KEY`=""
310 312 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported.
311 313
312 314 ---
313 315
314 316 #### Kernel compilation:
315 317 ##### `BUILD_KERNEL`=true
316 Build and install the latest RPi 0/1/2/3 Linux kernel. Currently only the default RPi 0/1/2/3 kernel configuration is used.
318 Build and install the latest RPi 0/1/2/3/4 Linux kernel. The default RPi 0/1/2/3/ kernel configuration is used most of the time.
319 ENABLE_NEXMON - Changes Kernel Source to [https://github.com/Re4son/](Kali Linux Kernel)
320 Precompiled 32bit kernel for RPI0/1/2/3 by [https://github.com/hypriot/](hypriot)
321 Precompiled 64bit kernel for RPI3/4 by [https://github.com/sakaki-/](sakaki)
322
317 323
318 324 ##### `CROSS_COMPILE`="arm-linux-gnueabihf-"
319 325 This sets the cross-compile environment for the compiler.
320 326
321 327 ##### `KERNEL_ARCH`="arm"
322 328 This sets the kernel architecture for the compiler.
323 329
324 330 ##### `KERNEL_IMAGE`="kernel7.img"
325 331 Name of the image file in the boot partition. If not set, `KERNEL_IMAGE` will be set to "kernel8.img" automatically if building for arm64.
326 332
327 333 ##### `KERNEL_BRANCH`=""
328 334 Name of the requested branch from the GIT location for the RPi Kernel. Default is using the current default branch from the GIT site.
329 335
330 336 ##### `QEMU_BINARY`="/usr/bin/qemu-arm-static"
331 337 Sets the QEMU enviornment for the Debian archive. If not set, `QEMU_BINARY` will be set to "/usr/bin/qemu-aarch64-static" automatically if building for arm64.
332 338
333 339 ##### `KERNEL_DEFCONFIG`="bcm2709_defconfig"
334 340 Sets the default config for kernel compiling. If not set, `KERNEL_DEFCONFIG` will be set to "bcmrpi3\_defconfig" automatically if building for arm64.
335 341
336 342 ##### `KERNEL_REDUCE`=false
337 343 Reduce the size of the generated kernel by removing unwanted devices, network and filesystem drivers (experimental).
338 344
339 345 ##### `KERNEL_THREADS`=1
340 346 Number of parallel kernel building threads. If the parameter is left untouched the script will automatically determine the number of CPU cores to set the number of parallel threads to speed the kernel compilation.
341 347
342 348 ##### `KERNEL_HEADERS`=true
343 349 Install kernel headers with the built kernel.
344 350
345 351 ##### `KERNEL_MENUCONFIG`=false
346 352 Start `make menuconfig` interactive menu-driven kernel configuration. The script will continue after `make menuconfig` was terminated.
347 353
348 354 ##### `KERNEL_OLDDEFCONFIG`=false
349 355 Run `make olddefconfig` to automatically set all new kernel configuration options to their recommended default values.
350 356
351 357 ##### `KERNEL_CCACHE`=false
352 358 Compile the kernel using ccache. This speeds up kernel recompilation by caching previous compilations and detecting when the same compilation is being done again.
353 359
354 360 ##### `KERNEL_REMOVESRC`=true
355 361 Remove all kernel sources from the generated OS image after it was built and installed.
356 362
357 363 ##### `KERNELSRC_DIR`=""
358 364 Path to a directory (`linux`) of [RaspberryPi Linux kernel sources](https://github.com/raspberrypi/linux) that will be copied, configured, build and installed inside the chroot.
359 365
360 366 ##### `KERNELSRC_CLEAN`=false
361 367 Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This parameter will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true.
362 368
363 369 ##### `KERNELSRC_CONFIG`=true
364 370 Run `make bcm2709_defconfig` (and optional `make menuconfig`) to configure the kernel sources before building. This parameter is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This parameter is ignored if `KERNELSRC_PREBUILT`=true.
365 371
366 372 ##### `KERNELSRC_USRCONFIG`=""
367 373 Copy own config file to kernel `.config`. If `KERNEL_MENUCONFIG`=true then running after copy.
368 374
369 375 ##### `KERNELSRC_PREBUILT`=false
370 376 With this parameter set to true the script expects the existing kernel sources directory to be already successfully cross-compiled. The parameters `KERNELSRC_CLEAN`, `KERNELSRC_CONFIG`, `KERNELSRC_USRCONFIG` and `KERNEL_MENUCONFIG` are ignored and no kernel compilation tasks are performed.
371 377
372 378 ##### `RPI_FIRMWARE_DIR`=""
373 379 The directory (`firmware`) containing a local copy of the firmware from the [RaspberryPi firmware project](https://github.com/raspberrypi/firmware). Default is to download the latest firmware directly from the project.
374 380
375 381 ##### `KERNEL_DEFAULT_GOV`="ONDEMAND"
376 382 Set the default cpu governor at kernel compilation. Supported values are: PERFORMANCE POWERSAVE USERSPACE ONDEMAND CONSERVATIVE SCHEDUTIL
377 383
378 384 ##### `KERNEL_NF`=false
379 385 Enable Netfilter modules as kernel modules
380 386
381 387 ##### `KERNEL_VIRT`=false
382 388 Enable Kernel KVM support (/dev/kvm)
383 389
384 390 ##### `KERNEL_ZSWAP`=false
385 391 Enable Kernel Zswap support. Best use on high RAM load and mediocre CPU load usecases
386 392
387 393 ##### `KERNEL_BPF`=true
388 394 Allow attaching eBPF programs to a cgroup using the bpf syscall (CONFIG_BPF_SYSCALL CONFIG_CGROUP_BPF) [systemd compilations about it - File /lib/systemd/system/systemd-journald.server:36 configures an IP firewall (IPAddressDeny=all), but the local system does not support BPF/cgroup based firewalls]
389 395
390 396 ##### `KERNEL_SECURITY`=false
391 397 Enables Apparmor, integrity subsystem, auditing.
392 398
399 ##### `KERNEL_BTRFS`="false"
400 enable btrfs kernel support
401
402 ##### `KERNEL_POEHAT`="false"
403 enable Enable RPI POE HAT fan kernel support
404
405 ##### `KERNEL_NSPAWN`="false"
406 Enable per-interface network priority control - for systemd-nspawn
407
408 ##### `KERNEL_DHKEY`="true"
409 Diffie-Hellman operations on retained keys - required for >keyutils-1.6
410
393 411 ---
394 412
395 413 #### Reduce disk usage:
396 414 The following list of parameters is ignored if `ENABLE_REDUCE`=false.
397 415
398 416 ##### `REDUCE_APT`=true
399 417 Configure APT to use compressed package repository lists and no package caching files.
400 418
401 419 ##### `REDUCE_DOC`=true
402 420 Remove all doc files (harsh). Configure APT to not include doc files on future `apt-get` package installations.
403 421
404 422 ##### `REDUCE_MAN`=true
405 423 Remove all man pages and info files (harsh). Configure APT to not include man pages on future `apt-get` package installations.
406 424
407 425 ##### `REDUCE_VIM`=false
408 426 Replace `vim-tiny` package by `levee` a tiny vim clone.
409 427
410 428 ##### `REDUCE_BASH`=false
411 429 Remove `bash` package and switch to `dash` shell (experimental).
412 430
413 431 ##### `REDUCE_HWDB`=true
414 432 Remove PCI related hwdb files (experimental).
415 433
416 434 ##### `REDUCE_SSHD`=true
417 435 Replace `openssh-server` with `dropbear`.
418 436
419 437 ##### `REDUCE_LOCALE`=true
420 438 Remove all `locale` translation files.
421 439
422 440 ---
423 441
424 442 #### Encrypted root partition:
425 443 ##### `ENABLE_CRYPTFS`=false
426 444 Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental. SSH-to-initramfs is currently not supported but will be soon - feel free to help.
427 445
428 446 ##### `CRYPTFS_PASSWORD`=""
429 447 Set password of the encrypted root partition. This parameter is mandatory if `ENABLE_CRYPTFS`=true.
430 448
431 449 ##### `CRYPTFS_MAPPING`="secure"
432 450 Set name of dm-crypt managed device-mapper mapping.
433 451
434 ##### `CRYPTFS_CIPHER`="aes-xts-plain64:sha512"
452 ##### `CRYPTFS_CIPHER`="aes-xts-plain64"
435 453 Set cipher specification string. `aes-xts*` ciphers are strongly recommended.
436 454
455 ##### `CRYPTFS_HASH`=sha512
456 Hash function and size to be used
457
437 458 ##### `CRYPTFS_XTSKEYSIZE`=512
438 459 Sets key size in bits. The argument has to be a multiple of 8.
439 460
440 461 ##### `CRYPTFS_DROPBEAR`=false
441 462 Enable Dropbear Initramfs support
442 463
443 464 ##### `CRYPTFS_DROPBEAR_PUBKEY`=""
444 465 Provide path to dropbear Public RSA-OpenSSH Key
445 466
446 467 ---
447 468
448 469 #### Build settings:
449 470 ##### `BASEDIR`=$(pwd)/images/${RELEASE}
450 471 Set a path to a working directory used by the script to generate an image.
451 472
452 473 ##### `IMAGE_NAME`=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}
453 474 Set a filename for the output file(s). Note: the script will create $IMAGE_NAME.img if `ENABLE_SPLITFS`=false or $IMAGE_NAME-frmw.img and $IMAGE_NAME-root.img if `ENABLE_SPLITFS`=true. Note 2: If the KERNEL_BRANCH is not set, the word "CURRENT" is used.
454 475
455 476 ## Understanding the script
456 477 The functions of this script that are required for the different stages of the bootstrapping are split up into single files located inside the `bootstrap.d` directory. During the bootstrapping every script in this directory gets executed in lexicographical order:
457 478
458 479 | Script | Description |
459 480 | --- | --- |
460 481 | `10-bootstrap.sh` | Debootstrap basic system |
461 482 | `11-apt.sh` | Setup APT repositories |
462 483 | `12-locale.sh` | Setup Locales and keyboard settings |
463 484 | `13-kernel.sh` | Build and install RPi 0/1/2/3 Kernel |
464 485 | `14-fstab.sh` | Setup fstab and initramfs |
465 486 | `15-rpi-config.sh` | Setup RPi 0/1/2/3 config and cmdline |
466 487 | `20-networking.sh` | Setup Networking |
467 488 | `21-firewall.sh` | Setup Firewall |
468 489 | `30-security.sh` | Setup Users and Security settings |
469 490 | `31-logging.sh` | Setup Logging |
470 491 | `32-sshd.sh` | Setup SSH and public keys |
471 492 | `41-uboot.sh` | Build and Setup U-Boot |
472 493 | `42-fbturbo.sh` | Build and Setup fbturbo Xorg driver |
473 494 | `43-videocore.sh` | Build and Setup videocore libraries |
474 495 | `50-firstboot.sh` | First boot actions |
475 496 | `99-reduce.sh` | Reduce the disk space usage |
476 497
477 498 All the required configuration files that will be copied to the generated OS image are located inside the `files` directory. It is not recommended to modify these configuration files manually.
478 499
479 500 | Directory | Description |
480 501 | --- | --- |
481 502 | `apt` | APT management configuration files |
482 503 | `boot` | Boot and RPi 0/1/2/3 configuration files |
483 504 | `dpkg` | Package Manager configuration |
484 505 | `etc` | Configuration files and rc scripts |
485 506 | `firstboot` | Scripts that get executed on first boot |
486 507 | `initramfs` | Initramfs scripts |
487 508 | `iptables` | Firewall configuration files |
488 509 | `locales` | Locales configuration |
489 510 | `modules` | Kernel Modules configuration |
490 511 | `mount` | Fstab configuration |
491 512 | `network` | Networking configuration files |
492 513 | `sysctl.d` | Swapping and Network Hardening configuration |
493 514 | `xorg` | fbturbo Xorg driver configuration |
494 515
495 516 ## Custom packages and scripts
496 517 Debian custom packages, i.e. those not in the debian repositories, can be installed by placing them in the `packages` directory. They are installed immediately after packages from the repositories are installed. Any dependencies listed in the custom packages will be downloaded automatically from the repositories. Do not list these custom packages in `APT_INCLUDES`.
497 518
498 519 Scripts in the custom.d directory will be executed after all other installation is complete but before the image is created.
499 520
500 521 ## Logging of the bootstrapping process
501 522 All information related to the bootstrapping process and the commands executed by the `rpi23-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:
502 523
503 524 ```shell
504 525 script -c 'APT_SERVER=ftp.de.debian.org ./rpi23-gen-image.sh' ./build.log
505 526 ```
506 527
507 528 ## Flashing the image file
508 529 After the image file was successfully created by the `rpi23-gen-image.sh` script it can be copied to the microSD card that will be used by the RPi 0/1/2/3 computer. This can be performed by using the tools `bmaptool` or `dd`. Using `bmaptool` will probably speed-up the copy process because `bmaptool` copies more wisely than `dd`.
509 530
510 531 ##### Flashing examples:
511 532 ```shell
512 533 bmaptool copy ./images/buster/2017-01-23-rpi3-buster.img /dev/mmcblk0
513 534 dd bs=4M if=./images/buster/2017-01-23-rpi3-buster.img of=/dev/mmcblk0
514 535 ```
515 536 If you have set `ENABLE_SPLITFS`, copy the `-frmw` image on the microSD card, then the `-root` one on the USB drive:
516 537 ```shell
517 538 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-frmw.img /dev/mmcblk0
518 539 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-root.img /dev/sdc
519 540 ```
520 541
521 542 ## QEMU emulation
522 543 Start QEMU full system emulation:
523 544 ```shell
524 545 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=tty1"
525 546 ```
526 547
527 548 Start QEMU full system emulation and output to console:
528 549 ```shell
529 550 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
530 551 ```
531 552
532 553 Start QEMU full system emulation with SMP and output to console:
533 554 ```shell
534 555 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -smp cpus=2,maxcpus=2 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
535 556 ```
536 557
537 558 Start QEMU full system emulation with cryptfs, initramfs and output to console:
538 559 ```shell
539 560 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -initrd "initramfs-${KERNEL_VERSION}" -append "root=/dev/mapper/secure cryptdevice=/dev/mmcblk0p2:secure rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
540 561 ```
541 562
542 563 ## External links and references
543 564 * [Debian worldwide mirror sites](https://www.debian.org/mirror/list)
544 565 * [Debian Raspberry Pi 2 Wiki](https://wiki.debian.org/RaspberryPi2)
545 566 * [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains)
546 567 * [Official Raspberry Pi Firmware on github](https://github.com/raspberrypi/firmware)
547 568 * [Official Raspberry Pi Kernel on github](https://github.com/raspberrypi/linux)
548 569 * [U-BOOT git repository](https://git.denx.de/?p=u-boot.git;a=summary)
549 570 * [Xorg DDX driver fbturbo](https://github.com/ssvb/xf86-video-fbturbo)
550 571 * [RPi3 Wireless interface firmware](https://github.com/RPi-Distro/firmware-nonfree/tree/master/brcm)
551 572 * [Collabora RPi2 Kernel precompiled](https://repositories.collabora.co.uk/debian/)
@@ -1,44 +1,50
1 1 #
2 2 # Setup APT repositories
3 3 #
4 4
5 5 # Load utility functions
6 6 . ./functions.sh
7 7
8 8 # Install and setup APT proxy configuration
9 9 if [ -z "$APT_PROXY" ] ; then
10 10 install_readonly files/apt/10proxy "${ETC_DIR}/apt/apt.conf.d/10proxy"
11 11 sed -i "s/\"\"/\"${APT_PROXY}\"/" "${ETC_DIR}/apt/apt.conf.d/10proxy"
12 12 fi
13 13
14 14 # Install APT sources.list
15 15 install_readonly files/apt/sources.list "${ETC_DIR}/apt/sources.list"
16 16
17 17 # Use specified APT server and release
18 18 sed -i "s/\/ftp.debian.org\//\/${APT_SERVER}\//" "${ETC_DIR}/apt/sources.list"
19
20 #Fix for changing path for security updates in testing/bullseye
19 21 if [ "$RELEASE" = "testing" ] ; then
20 22 sed -i "s,stretch\\/updates,testing-security," "${ETC_DIR}/apt/sources.list"
21 else
23 sed -i "s/ stretch/ ${RELEASE}/" "${ETC_DIR}/apt/sources.list"
24 fi
25
26 if [ -z "$RELEASE" ] ; then
27 # Change release in sources list
22 28 sed -i "s/ stretch/ ${RELEASE}/" "${ETC_DIR}/apt/sources.list"
23 29 fi
24 30
25 31 # Upgrade package index and update all installed packages and changed dependencies
26 32 chroot_exec apt-get -qq -y update
27 33 chroot_exec apt-get -qq -y -u dist-upgrade
28 34
29 35 # Install additional packages
30 36 if [ "$APT_INCLUDES_LATE" ] ; then
31 37 chroot_exec apt-get -qq -y install $(echo "$APT_INCLUDES_LATE" |tr , ' ')
32 38 fi
33 39
34 40 # Install Debian custom packages
35 41 if [ -d packages ] ; then
36 42 for package in packages/*.deb ; do
37 43 cp "$package" "${R}"/tmp
38 44 chroot_exec dpkg --unpack /tmp/"$(basename "$package")"
39 45 done
40 46 fi
41 47
42 48 chroot_exec apt-get -qq -y -f install
43 49
44 50 chroot_exec apt-get -qq -y check
@@ -1,866 +1,889
1 1 #
2 2 # Build and Setup RPi2/3 Kernel
3 3 #
4 4
5 5 # Load utility functions
6 6 . ./functions.sh
7 7
8 8 # Need to use kali kernel src if nexmon is enabled
9 9 if [ "$ENABLE_NEXMON" = true ] ; then
10 10 KERNEL_URL="${KALI_KERNEL_URL}"
11 11 # Clear Branch and KernelSRC_DIR if using nexmon. Everyone will forget to clone kali kernel instead of nomrla kernel
12 12 KERNEL_BRANCH=""
13 13 KERNELSRC_DIR=""
14 14 fi
15 15
16 16 # Fetch and build latest raspberry kernel
17 17 if [ "$BUILD_KERNEL" = true ] ; then
18 18 # Setup source directory
19 19 mkdir -p "${KERNEL_DIR}"
20 20
21 21 # Copy existing kernel sources into chroot directory
22 22 if [ -n "$KERNELSRC_DIR" ] && [ -d "$KERNELSRC_DIR" ] ; then
23 23 # Copy kernel sources and include hidden files
24 24 cp -r "${KERNELSRC_DIR}/". "${KERNEL_DIR}"
25 25
26 26 # Clean the kernel sources
27 27 if [ "$KERNELSRC_CLEAN" = true ] && [ "$KERNELSRC_PREBUILT" = false ] ; then
28 28 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" mrproper
29 29 fi
30 30 else # KERNELSRC_DIR=""
31 31 # Create temporary directory for kernel sources
32 32 temp_dir=$(as_nobody mktemp -d)
33 33
34 34 # Fetch current RPi2/3 kernel sources
35 35 if [ -z "${KERNEL_BRANCH}" ] ; then
36 36 as_nobody -H git -C "${temp_dir}" clone --depth=1 "${KERNEL_URL}" linux
37 37 else
38 38 as_nobody -H git -C "${temp_dir}" clone --depth=1 --branch "${KERNEL_BRANCH}" "${KERNEL_URL}" linux
39 39 fi
40 40
41 41 # Copy downloaded kernel sources
42 42 cp -r "${temp_dir}/linux/"* "${KERNEL_DIR}"
43 43
44 44 # Remove temporary directory for kernel sources
45 45 rm -fr "${temp_dir}"
46 46
47 47 # Set permissions of the kernel sources
48 48 chown -R root:root "${R}/usr/src"
49 49 fi
50 50
51 51 # Calculate optimal number of kernel building threads
52 52 if [ "$KERNEL_THREADS" = "1" ] && [ -r /proc/cpuinfo ] ; then
53 53 KERNEL_THREADS=$(grep -c processor /proc/cpuinfo)
54 54 fi
55 55
56 56 #Copy 32bit config to 64bit
57 57 if [ "$ENABLE_QEMU" = true ] && [ "$KERNEL_ARCH" = arm64 ]; then
58 58 cp "${KERNEL_DIR}"/arch/arm/configs/vexpress_defconfig "${KERNEL_DIR}"/arch/arm64/configs/
59 59 fi
60 60
61 61 # Configure and build kernel
62 62 if [ "$KERNELSRC_PREBUILT" = false ] ; then
63 63 # Remove device, network and filesystem drivers from kernel configuration
64 64 if [ "$KERNEL_REDUCE" = true ] ; then
65 65 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
66 66 sed -i\
67 67 -e "s/\(^CONFIG_SND.*\=\).*/\1n/"\
68 68 -e "s/\(^CONFIG_SOUND.*\=\).*/\1n/"\
69 69 -e "s/\(^CONFIG_AC97.*\=\).*/\1n/"\
70 70 -e "s/\(^CONFIG_VIDEO_.*\=\).*/\1n/"\
71 71 -e "s/\(^CONFIG_MEDIA_TUNER.*\=\).*/\1n/"\
72 72 -e "s/\(^CONFIG_DVB.*\=\)[ym]/\1n/"\
73 73 -e "s/\(^CONFIG_REISERFS.*\=\).*/\1n/"\
74 74 -e "s/\(^CONFIG_JFS.*\=\).*/\1n/"\
75 75 -e "s/\(^CONFIG_XFS.*\=\).*/\1n/"\
76 76 -e "s/\(^CONFIG_GFS2.*\=\).*/\1n/"\
77 77 -e "s/\(^CONFIG_OCFS2.*\=\).*/\1n/"\
78 78 -e "s/\(^CONFIG_BTRFS.*\=\).*/\1n/"\
79 79 -e "s/\(^CONFIG_HFS.*\=\).*/\1n/"\
80 80 -e "s/\(^CONFIG_JFFS2.*\=\)[ym]/\1n/"\
81 81 -e "s/\(^CONFIG_UBIFS.*\=\).*/\1n/"\
82 82 -e "s/\(^CONFIG_SQUASHFS.*\=\)[ym]/\1n/"\
83 83 -e "s/\(^CONFIG_W1.*\=\)[ym]/\1n/"\
84 84 -e "s/\(^CONFIG_HAMRADIO.*\=\).*/\1n/"\
85 85 -e "s/\(^CONFIG_CAN.*\=\).*/\1n/"\
86 86 -e "s/\(^CONFIG_IRDA.*\=\).*/\1n/"\
87 87 -e "s/\(^CONFIG_BT_.*\=\).*/\1n/"\
88 88 -e "s/\(^CONFIG_WIMAX.*\=\)[ym]/\1n/"\
89 89 -e "s/\(^CONFIG_6LOWPAN.*\=\).*/\1n/"\
90 90 -e "s/\(^CONFIG_IEEE802154.*\=\).*/\1n/"\
91 91 -e "s/\(^CONFIG_NFC.*\=\).*/\1n/"\
92 92 -e "s/\(^CONFIG_FB_TFT=.*\=\).*/\1n/"\
93 93 -e "s/\(^CONFIG_TOUCHSCREEN.*\=\).*/\1n/"\
94 94 -e "s/\(^CONFIG_USB_GSPCA_.*\=\).*/\1n/"\
95 95 -e "s/\(^CONFIG_DRM.*\=\).*/\1n/"\
96 96 "${KERNEL_DIR}/.config"
97 97 fi
98 98
99 99 if [ "$KERNELSRC_CONFIG" = true ] ; then
100 100 # Load default raspberry kernel configuration
101 101 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
102 102
103 103 #Switch to KERNELSRC_DIR so we can use set_kernel_config
104 104 cd "${KERNEL_DIR}" || exit
105 105
106 if [ "$KERNEL_ARCH" = arm64 ] ; then
106 # Enable RPI POE HAT fan
107 if [ "$KERNEL_POEHAT" = true ]; then
108 set_kernel_config CONFIG_SENSORS_RPI_POE_FAN m
109 fi
110
111 # Enable per-interface network priority control
112 # (for systemd-nspawn)
113 if [ "$KERNEL_NSPAN" = true ]; then
114 set_kernel_config CONFIG_CGROUP_NET_PRIO y
115 fi
116
117 # Compile in BTRFS
118 if [ "$KERNEL_BTRFS" = true ]; then
119 set_kernel_config CONFIG_BTRFS_FS y
120 set_kernel_config CONFIG_BTRFS_FS_POSIX_ACL y
121 set_kernel_config CONFIG_BTRFS_FS_REF_VERIFY y
122 fi
123
124 # Diffie-Hellman operations on retained keys
125 # (required for >keyutils-1.6)
126 if [ "$KERNEL_DHKEY" = true ]; then
127 set_kernel_config CONFIG_KEY_DH_OPERATIONS y
128 fi
129
107 130 if [ "$KERNEL_ARCH" = arm64 ] && [ "$ENABLE_QEMU" = false ]; then
108 131 # Mask this temporarily during switch to rpi-4.19.y
109 132 #Fix SD_DRIVER upstream and downstream mess in 64bit RPIdeb_config
110 133 # use correct driver MMC_BCM2835_MMC instead of MMC_BCM2835_SDHOST - see https://www.raspberrypi.org/forums/viewtopic.php?t=210225
111 134 #set_kernel_config CONFIG_MMC_BCM2835 n
112 135 #set_kernel_config CONFIG_MMC_SDHCI_IPROC n
113 136 #set_kernel_config CONFIG_USB_DWC2 n
114 137 #sed -i "s|depends on MMC_BCM2835_MMC && MMC_BCM2835_DMA|depends on MMC_BCM2835_MMC|" "${KERNEL_DIR}"/drivers/mmc/host/Kconfig
115 138
116 139 #VLAN got disabled without reason in arm64bit
117 140 set_kernel_config CONFIG_IPVLAN m
118 141 fi
119 142
120 143 # enable ZSWAP see https://askubuntu.com/a/472227 or https://wiki.archlinux.org/index.php/zswap
121 144 if [ "$KERNEL_ZSWAP" = true ] ; then
122 145 set_kernel_config CONFIG_ZPOOL y
123 146 set_kernel_config CONFIG_ZSWAP y
124 147 set_kernel_config CONFIG_ZBUD y
125 148 set_kernel_config CONFIG_Z3FOLD y
126 149 set_kernel_config CONFIG_ZSMALLOC y
127 150 set_kernel_config CONFIG_PGTABLE_MAPPING y
128 151 set_kernel_config CONFIG_LZO_COMPRESS y
129 152 fi
130 153
131 154 if [ "$RPI_MODEL" = 4 ] ; then
132 155 # Following are set in current 32-bit LPAE kernel
133 156 set_kernel_config CONFIG_CGROUP_PIDS y
134 157 set_kernel_config CONFIG_NET_IPVTI m
135 158 set_kernel_config CONFIG_NF_TABLES_SET m
136 159 set_kernel_config CONFIG_NF_TABLES_INET y
137 160 set_kernel_config CONFIG_NF_TABLES_NETDEV y
138 161 set_kernel_config CONFIG_NF_FLOW_TABLE m
139 162 set_kernel_config CONFIG_NFT_FLOW_OFFLOAD m
140 163 set_kernel_config CONFIG_NFT_CONNLIMIT m
141 164 set_kernel_config CONFIG_NFT_TUNNEL m
142 165 set_kernel_config CONFIG_NFT_OBJREF m
143 166 set_kernel_config CONFIG_NFT_FIB_IPV4 m
144 167 set_kernel_config CONFIG_NFT_FIB_IPV6 m
145 168 set_kernel_config CONFIG_NFT_FIB_INET m
146 169 set_kernel_config CONFIG_NFT_SOCKET m
147 170 set_kernel_config CONFIG_NFT_OSF m
148 171 set_kernel_config CONFIG_NFT_TPROXY m
149 172 set_kernel_config CONFIG_NF_DUP_NETDEV m
150 173 set_kernel_config CONFIG_NFT_DUP_NETDEV m
151 174 set_kernel_config CONFIG_NFT_FWD_NETDEV m
152 175 set_kernel_config CONFIG_NFT_FIB_NETDEV m
153 176 set_kernel_config CONFIG_NF_FLOW_TABLE_INET m
154 177 set_kernel_config CONFIG_NF_FLOW_TABLE m
155 178 set_kernel_config CONFIG_NETFILTER_XT_MATCH_SOCKET m
156 179 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV6 m
157 180 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV6 m
158 181 set_kernel_config CONFIG_NFT_MASQ_IPV6 m
159 182 set_kernel_config CONFIG_NFT_REDIR_IPV6 m
160 183 set_kernel_config CONFIG_NFT_REJECT_IPV6 m
161 184 set_kernel_config CONFIG_NFT_DUP_IPV6 m
162 185 set_kernel_config CONFIG_NFT_FIB_IPV6 m
163 186 set_kernel_config CONFIG_NF_FLOW_TABLE_IPV6 m
164 187 set_kernel_config CONFIG_NF_TABLES_BRIDGE m
165 188 set_kernel_config CONFIG_NFT_BRIDGE_REJECT m
166 189 set_kernel_config CONFIG_NF_LOG_BRIDGE m
167 190 set_kernel_config CONFIG_MT76_CORE m
168 191 set_kernel_config CONFIG_MT76_LEDS m
169 192 set_kernel_config CONFIG_MT76_USB m
170 193 set_kernel_config CONFIG_MT76x2_COMMON m
171 194 set_kernel_config CONFIG_MT76x0U m
172 195 set_kernel_config CONFIG_MT76x2U m
173 196 set_kernel_config CONFIG_TOUCHSCREEN_ILI210X m
174 197 set_kernel_config CONFIG_BCM_VC_SM m
175 198 set_kernel_config CONFIG_BCM2835_SMI_DEV m
176 199 set_kernel_config CONFIG_RPIVID_MEM m
177 200 set_kernel_config CONFIG_HW_RANDOM_BCM2835 y
178 201 set_kernel_config CONFIG_TCG_TPM m
179 202 set_kernel_config CONFIG_HW_RANDOM_TPM y
180 203 set_kernel_config CONFIG_TCG_TIS m
181 204 set_kernel_config CONFIG_TCG_TIS_SPI m
182 205 set_kernel_config CONFIG_I2C_MUX m
183 206 set_kernel_config CONFIG_I2C_MUX_GPMUX m
184 207 set_kernel_config CONFIG_I2C_MUX_PCA954x m
185 208 set_kernel_config CONFIG_SPI_GPIO m
186 209 set_kernel_config CONFIG_BATTERY_MAX17040 m
187 210 set_kernel_config CONFIG_SENSORS_GPIO_FAN m
188 211 set_kernel_config CONFIG_SENSORS_RASPBERRYPI_HWMON m
189 212 set_kernel_config CONFIG_BCM2835_THERMAL y
190 213 set_kernel_config CONFIG_RC_CORE y
191 214 set_kernel_config CONFIG_RC_MAP y
192 215 set_kernel_config CONFIG_LIRC y
193 216 set_kernel_config CONFIG_RC_DECODERS y
194 217 set_kernel_config CONFIG_IR_NEC_DECODER m
195 218 set_kernel_config CONFIG_IR_RC5_DECODER m
196 219 set_kernel_config CONFIG_IR_RC6_DECODER m
197 220 set_kernel_config CONFIG_IR_JVC_DECODER m
198 221 set_kernel_config CONFIG_IR_SONY_DECODER m
199 222 set_kernel_config CONFIG_IR_SANYO_DECODER m
200 223 set_kernel_config CONFIG_IR_SHARP_DECODER m
201 224 set_kernel_config CONFIG_IR_MCE_KBD_DECODER m
202 225 set_kernel_config CONFIG_IR_XMP_DECODER m
203 226 set_kernel_config CONFIG_IR_IMON_DECODER m
204 227 set_kernel_config CONFIG_RC_DEVICES y
205 228 set_kernel_config CONFIG_RC_ATI_REMOTE m
206 229 set_kernel_config CONFIG_IR_IMON m
207 230 set_kernel_config CONFIG_IR_MCEUSB m
208 231 set_kernel_config CONFIG_IR_REDRAT3 m
209 232 set_kernel_config CONFIG_IR_STREAMZAP m
210 233 set_kernel_config CONFIG_IR_IGUANA m
211 234 set_kernel_config CONFIG_IR_TTUSBIR m
212 235 set_kernel_config CONFIG_RC_LOOPBACK m
213 236 set_kernel_config CONFIG_IR_GPIO_CIR m
214 237 set_kernel_config CONFIG_IR_GPIO_TX m
215 238 set_kernel_config CONFIG_IR_PWM_TX m
216 239 set_kernel_config CONFIG_VIDEO_V4L2_SUBDEV_API y
217 240 set_kernel_config CONFIG_VIDEO_AU0828_RC y
218 241 set_kernel_config CONFIG_VIDEO_CX231XX m
219 242 set_kernel_config CONFIG_VIDEO_CX231XX_RC y
220 243 set_kernel_config CONFIG_VIDEO_CX231XX_ALSA m
221 244 set_kernel_config CONFIG_VIDEO_CX231XX_DVB m
222 245 set_kernel_config CONFIG_VIDEO_TM6000 m
223 246 set_kernel_config CONFIG_VIDEO_TM6000_ALSA m
224 247 set_kernel_config CONFIG_VIDEO_TM6000_DVB m
225 248 set_kernel_config CONFIG_DVB_USB m
226 249 set_kernel_config CONFIG_DVB_USB_DIB3000MC m
227 250 set_kernel_config CONFIG_DVB_USB_A800 m
228 251 set_kernel_config CONFIG_DVB_USB_DIBUSB_MB m
229 252 set_kernel_config CONFIG_DVB_USB_DIBUSB_MB_FAULTY y
230 253 set_kernel_config CONFIG_DVB_USB_DIBUSB_MC m
231 254 set_kernel_config CONFIG_DVB_USB_DIB0700 m
232 255 set_kernel_config CONFIG_DVB_USB_UMT_010 m
233 256 set_kernel_config CONFIG_DVB_USB_CXUSB m
234 257 set_kernel_config CONFIG_DVB_USB_M920X m
235 258 set_kernel_config CONFIG_DVB_USB_DIGITV m
236 259 set_kernel_config CONFIG_DVB_USB_VP7045 m
237 260 set_kernel_config CONFIG_DVB_USB_VP702X m
238 261 set_kernel_config CONFIG_DVB_USB_GP8PSK m
239 262 set_kernel_config CONFIG_DVB_USB_NOVA_T_USB2 m
240 263 set_kernel_config CONFIG_DVB_USB_TTUSB2 m
241 264 set_kernel_config CONFIG_DVB_USB_DTT200U m
242 265 set_kernel_config CONFIG_DVB_USB_OPERA1 m
243 266 set_kernel_config CONFIG_DVB_USB_AF9005 m
244 267 set_kernel_config CONFIG_DVB_USB_AF9005_REMOTE m
245 268 set_kernel_config CONFIG_DVB_USB_PCTV452E m
246 269 set_kernel_config CONFIG_DVB_USB_DW2102 m
247 270 set_kernel_config CONFIG_DVB_USB_CINERGY_T2 m
248 271 set_kernel_config CONFIG_DVB_USB_DTV5100 m
249 272 set_kernel_config CONFIG_DVB_USB_AZ6027 m
250 273 set_kernel_config CONFIG_DVB_USB_TECHNISAT_USB2 m
251 274 set_kernel_config CONFIG_DVB_USB_AF9015 m
252 275 set_kernel_config CONFIG_DVB_USB_LME2510 m
253 276 set_kernel_config CONFIG_DVB_USB_RTL28XXU m
254 277 set_kernel_config CONFIG_VIDEO_EM28XX_RC m
255 278 set_kernel_config CONFIG_SMS_SIANO_RC m
256 279 set_kernel_config CONFIG_VIDEO_IR_I2C m
257 280 set_kernel_config CONFIG_VIDEO_ADV7180 m
258 281 set_kernel_config CONFIG_VIDEO_TC358743 m
259 282 set_kernel_config CONFIG_VIDEO_OV5647 m
260 283 set_kernel_config CONFIG_DVB_M88DS3103 m
261 284 set_kernel_config CONFIG_DVB_AF9013 m
262 285 set_kernel_config CONFIG_DVB_RTL2830 m
263 286 set_kernel_config CONFIG_DVB_RTL2832 m
264 287 set_kernel_config CONFIG_DVB_SI2168 m
265 288 set_kernel_config CONFIG_DVB_GP8PSK_FE m
266 289 set_kernel_config CONFIG_DVB_USB m
267 290 set_kernel_config CONFIG_DVB_LGDT3306A m
268 291 set_kernel_config CONFIG_FB_SIMPLE y
269 292 set_kernel_config CONFIG_SND_BCM2708_SOC_IQAUDIO_CODEC m
270 293 set_kernel_config CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M m
271 294 set_kernel_config CONFIG_SND_AUDIOSENSE_PI m
272 295 set_kernel_config CONFIG_SND_SOC_AD193X m
273 296 set_kernel_config CONFIG_SND_SOC_AD193X_SPI m
274 297 set_kernel_config CONFIG_SND_SOC_AD193X_I2C m
275 298 set_kernel_config CONFIG_SND_SOC_CS4265 m
276 299 set_kernel_config CONFIG_SND_SOC_DA7213 m
277 300 set_kernel_config CONFIG_SND_SOC_ICS43432 m
278 301 set_kernel_config CONFIG_SND_SOC_TLV320AIC32X4 m
279 302 set_kernel_config CONFIG_SND_SOC_TLV320AIC32X4_I2C m
280 303 set_kernel_config CONFIG_SND_SOC_I_SABRE_CODEC m
281 304 set_kernel_config CONFIG_HID_BIGBEN_FF m
282 305 #set_kernel_config CONFIG_USB_XHCI_PLATFORM y
283 306 set_kernel_config CONFIG_USB_TMC m
284 307 set_kernel_config CONFIG_USB_UAS y
285 308 set_kernel_config CONFIG_USBIP_VUDC m
286 309 set_kernel_config CONFIG_USB_CONFIGFS m
287 310 set_kernel_config CONFIG_USB_CONFIGFS_SERIAL y
288 311 set_kernel_config CONFIG_USB_CONFIGFS_ACM y
289 312 set_kernel_config CONFIG_USB_CONFIGFS_OBEX y
290 313 set_kernel_config CONFIG_USB_CONFIGFS_NCM y
291 314 set_kernel_config CONFIG_USB_CONFIGFS_ECM y
292 315 set_kernel_config CONFIG_USB_CONFIGFS_ECM_SUBSET y
293 316 set_kernel_config CONFIG_USB_CONFIGFS_RNDIS y
294 317 set_kernel_config CONFIG_USB_CONFIGFS_EEM y
295 318 set_kernel_config CONFIG_USB_CONFIGFS_MASS_STORAGE y
296 319 set_kernel_config CONFIG_USB_CONFIGFS_F_LB_SS y
297 320 set_kernel_config CONFIG_USB_CONFIGFS_F_FS y
298 321 set_kernel_config CONFIG_USB_CONFIGFS_F_UAC1 y
299 322 set_kernel_config CONFIG_USB_CONFIGFS_F_UAC2 y
300 323 set_kernel_config CONFIG_USB_CONFIGFS_F_MIDI y
301 324 set_kernel_config CONFIG_USB_CONFIGFS_F_HID y
302 325 set_kernel_config CONFIG_USB_CONFIGFS_F_UVC y
303 326 set_kernel_config CONFIG_USB_CONFIGFS_F_PRINTER y
304 327 set_kernel_config CONFIG_LEDS_PCA963X m
305 328 set_kernel_config CONFIG_LEDS_IS31FL32XX m
306 329 set_kernel_config CONFIG_LEDS_TRIGGER_NETDEV m
307 330 set_kernel_config CONFIG_RTC_DRV_RV3028 m
308 331 set_kernel_config CONFIG_AUXDISPLAY y
309 332 set_kernel_config CONFIG_HD44780 m
310 333 set_kernel_config CONFIG_FB_TFT_SH1106 m
311 334 set_kernel_config CONFIG_VIDEO_CODEC_BCM2835 m
312 335 set_kernel_config CONFIG_BCM2835_POWER y
313 336 set_kernel_config CONFIG_INV_MPU6050_IIO m
314 337 set_kernel_config CONFIG_INV_MPU6050_I2C m
315 338 set_kernel_config CONFIG_SECURITYFS y
316 339
317 340 # Safer to build this in
318 341 set_kernel_config CONFIG_BINFMT_MISC y
319 342
320 343 # pulseaudio wants a buffer of at least this size
321 344 set_kernel_config CONFIG_SND_HDA_PREALLOC_SIZE 2048
322 345
323 346 # PR#3063: enable 3D acceleration with 64-bit kernel on RPi4
324 347 # set the appropriate kernel configs unlocked by this PR
325 348 set_kernel_config CONFIG_ARCH_BCM y
326 349 set_kernel_config CONFIG_ARCH_BCM2835 y
327 350 set_kernel_config CONFIG_DRM_V3D m
328 351 set_kernel_config CONFIG_DRM_VC4 m
329 352 set_kernel_config CONFIG_DRM_VC4_HDMI_CEC y
330 353
331 354 # PR#3144: add arm64 pcie bounce buffers; enables 4GiB on RPi4
332 355 # required by PR#3144; should already be applied, but just to be safe
333 356 set_kernel_config CONFIG_PCIE_BRCMSTB y
334 357 set_kernel_config CONFIG_BCM2835_MMC y
335 358
336 359 # Snap needs squashfs. The ubuntu eoan-preinstalled-server image at
337 360 # http://cdimage.ubuntu.com/ubuntu-server/daily-preinstalled/current/ uses snap
338 361 # during cloud-init setup at first boot. Without this the login accounts are not
339 362 # created and the user can not login.
340 363 set_kernel_config CONFIG_SQUASHFS y
341 364
342 365 # Ceph support for Block Device (RBD) and Filesystem (FS)
343 366 # https://docs.ceph.com/docs/master/
344 367 set_kernel_config CONFIG_CEPH_LIB m
345 368 set_kernel_config CONFIG_CEPH_LIB_USE_DNS_RESOLVER y
346 369 set_kernel_config CONFIG_CEPH_FS m
347 370 set_kernel_config CONFIG_CEPH_FSCACHE y
348 371 set_kernel_config CONFIG_CEPH_FS_POSIX_ACL y
349 372 set_kernel_config CONFIG_BLK_DEV_RBD m
350 373 fi
351 374
352 375 # enable basic KVM support; see https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=210546&start=25#p1300453
353 376 if [ "$KERNEL_VIRT" = true ] && { [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ]; } ; then
354 377 set_kernel_config CONFIG_HAVE_KVM y
355 378 set_kernel_config CONFIG_HIGH_RES_TIMERS y
356 379 set_kernel_config CONFIG_HAVE_KVM_IRQCHIP y
357 380 set_kernel_config CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL y
358 381 set_kernel_config CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT y
359 382 set_kernel_config CONFIG_HAVE_KVM_EVENTFD y
360 383 set_kernel_config CONFIG_HAVE_KVM_IRQFD y
361 384 set_kernel_config CONFIG_HAVE_KVM_IRQ_ROUTING y
362 385 set_kernel_config CONFIG_HAVE_KVM_MSI y
363 386 set_kernel_config CONFIG_KVM y
364 387 set_kernel_config CONFIG_KVM_ARM_HOST y
365 388 set_kernel_config CONFIG_KVM_ARM_PMU y
366 389 set_kernel_config CONFIG_KVM_COMPAT y
367 390 set_kernel_config CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT y
368 391 set_kernel_config CONFIG_KVM_MMIO y
369 392 set_kernel_config CONFIG_KVM_VFIO y
370 393 set_kernel_config CONFIG_KVM_MMU_AUDIT y
371 394 set_kernel_config CONFIG_VHOST m
372 395 set_kernel_config CONFIG_VHOST_CROSS_ENDIAN_LEGACY y
373 396 set_kernel_config CONFIG_VHOST_NET m
374 397 set_kernel_config CONFIG_VIRTUALIZATION y
375 398 set_kernel_config CONFIG_SLAB_FREELIST_RANDOM=y
376 399 set_kernel_config CONFIG_SLAB_FREELIST_HARDENED=y
377 400 set_kernel_config CONFIG_MMU_NOTIFIER y
378 401
379 402 # erratum
380 403 set_kernel_config ARM64_ERRATUM_834220 y
381 404
382 405 # https://sourceforge.net/p/kvm/mailman/message/18440797/
383 406 set_kernel_config CONFIG_PREEMPT_NOTIFIERS y
384 407 fi
385 408
386 409 # enable apparmor,integrity audit,
387 410 if [ "$KERNEL_SECURITY" = true ] ; then
388 411
389 412 # security filesystem, security models and audit
390 413 set_kernel_config CONFIG_SECURITYFS y
391 414 set_kernel_config CONFIG_SECURITY y
392 415 set_kernel_config CONFIG_AUDIT y
393 416
394 417 # harden strcpy and memcpy
395 418 set_kernel_config CONFIG_HARDENED_USERCOPY y
396 419 set_kernel_config CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR y
397 420 set_kernel_config CONFIG_FORTIFY_SOURCE y
398 421
399 422 # integrity sub-system
400 423 set_kernel_config CONFIG_INTEGRITY y
401 424 set_kernel_config CONFIG_INTEGRITY_ASYMMETRIC_KEYS y
402 425 set_kernel_config CONFIG_INTEGRITY_AUDIT y
403 426 set_kernel_config CONFIG_INTEGRITY_SIGNATURE y
404 427 set_kernel_config CONFIG_INTEGRITY_TRUSTED_KEYRING y
405 428
406 429 # This option provides support for retaining authentication tokens and access keys in the kernel.
407 430 set_kernel_config CONFIG_KEYS y
408 431 set_kernel_config CONFIG_KEYS_COMPAT y
409 432
410 433 # Apparmor
411 434 set_kernel_config CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE 0
412 435 set_kernel_config CONFIG_SECURITY_APPARMOR_HASH_DEFAULT y
413 436 set_kernel_config CONFIG_DEFAULT_SECURITY_APPARMOR y
414 437 set_kernel_config CONFIG_SECURITY_APPARMOR y
415 438 set_kernel_config CONFIG_SECURITY_APPARMOR_HASH y
416 439 set_kernel_config CONFIG_DEFAULT_SECURITY "apparmor"
417 440
418 441 # restrictions on unprivileged users reading the kernel
419 442 set_kernel_config CONFIG_SECURITY_DMESG_RESTRICT y
420 443
421 444 # network security hooks
422 445 set_kernel_config CONFIG_SECURITY_NETWORK y
423 446 set_kernel_config CONFIG_SECURITY_NETWORK_XFRM y
424 447 set_kernel_config CONFIG_SECURITY_PATH y
425 448 set_kernel_config CONFIG_SECURITY_YAMA n
426 449
427 450 set_kernel_config CONFIG_SECURITY_SELINUX n
428 451 set_kernel_config CONFIG_SECURITY_SMACK n
429 452 set_kernel_config CONFIG_SECURITY_TOMOYO n
430 453 set_kernel_config CONFIG_SECURITY_APPARMOR_DEBUG n
431 454 set_kernel_config CONFIG_SECURITY_LOADPIN n
432 455 set_kernel_config CONFIG_HARDENED_USERCOPY_PAGESPAN n
433 456 set_kernel_config CONFIG_IMA n
434 457 set_kernel_config CONFIG_EVM n
435 458 set_kernel_config CONFIG_FANOTIFY_ACCESS_PERMISSIONS y
436 459 set_kernel_config CONFIG_NFSD_V4_SECURITY_LABEL y
437 460 set_kernel_config CONFIG_PKCS7_MESSAGE_PARSER y
438 461 set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYRING y
439 462 set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE y
440 463 set_kernel_config CONFIG_SECONDARY_TRUSTED_KEYRING y
441 464 set_kernel_config CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY n
442 465 set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYS m
443 466 set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE 4096
444 467
445 468 set_kernel_config CONFIG_ARM64_CRYPTO y
446 469 set_kernel_config CONFIG_CRYPTO_SHA256_ARM64 m
447 470 set_kernel_config CONFIG_CRYPTO_SHA512_ARM64 m
448 471 set_kernel_config CONFIG_CRYPTO_SHA1_ARM64_CE m
449 472 set_kernel_config CRYPTO_GHASH_ARM64_CE m
450 473 set_kernel_config CRYPTO_SHA2_ARM64_CE m
451 474 set_kernel_config CONFIG_CRYPTO_CRCT10DIF_ARM64_CE m
452 475 set_kernel_config CONFIG_CRYPTO_CRC32_ARM64_CE m
453 476 set_kernel_config CONFIG_CRYPTO_AES_ARM64 m
454 477 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE m
455 478 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_CCM y
456 479 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_BLK y
457 480 set_kernel_config CONFIG_CRYPTO_AES_ARM64_NEON_BLK m
458 481 set_kernel_config CONFIG_CRYPTO_CHACHA20_NEON m
459 482 set_kernel_config CONFIG_CRYPTO_AES_ARM64_BS m
460 483 fi
461 484
462 485 # Netfilter kernel support See https://github.com/raspberrypi/linux/issues/2177#issuecomment-354647406
463 486 if [ "$KERNEL_NF" = true ] ; then
464 487 set_kernel_config CONFIG_IP_NF_SECURITY m
465 488 set_kernel_config CONFIG_NETLABEL y
466 489 set_kernel_config CONFIG_IP6_NF_SECURITY m
467 490 set_kernel_config CONFIG_IP_NF_TARGET_SYNPROXY m
468 491 set_kernel_config CONFIG_NETFILTER_XT_TARGET_AUDIT m
469 492 set_kernel_config CONFIG_NETFILTER_XT_MATCH_CGROUP m
470 493 set_kernel_config CONFIG_NETFILTER_XT_MATCH_IPCOMP m
471 494 set_kernel_config CONFIG_NETFILTER_XT_MATCH_SOCKET m
472 495 set_kernel_config CONFIG_NFT_FIB_INET m
473 496 set_kernel_config CONFIG_NFT_FIB_IPV4 m
474 497 set_kernel_config CONFIG_NFT_FIB_IPV6 m
475 498 set_kernel_config CONFIG_NFT_FIB_NETDEV m
476 499 set_kernel_config CONFIG_NFT_OBJREF m
477 500 set_kernel_config CONFIG_NFT_RT m
478 501 set_kernel_config CONFIG_NFT_SET_BITMAP m
479 502 set_kernel_config CONFIG_NF_CONNTRACK_TIMEOUT y
480 503 set_kernel_config CONFIG_NF_LOG_ARP m
481 504 set_kernel_config CONFIG_NF_SOCKET_IPV4 m
482 505 set_kernel_config CONFIG_NF_SOCKET_IPV6 m
483 506 set_kernel_config CONFIG_BRIDGE_EBT_BROUTE m
484 507 set_kernel_config CONFIG_BRIDGE_EBT_T_FILTER m
485 508 set_kernel_config CONFIG_BRIDGE_NF_EBTABLES m
486 509 set_kernel_config CONFIG_IP6_NF_IPTABLES m
487 510 set_kernel_config CONFIG_IP6_NF_MATCH_AH m
488 511 set_kernel_config CONFIG_IP6_NF_MATCH_EUI64 m
489 512 set_kernel_config CONFIG_IP6_NF_NAT m
490 513 set_kernel_config CONFIG_IP6_NF_TARGET_MASQUERADE m
491 514 set_kernel_config CONFIG_IP6_NF_TARGET_NPT m
492 515 set_kernel_config CONFIG_IP_SET_BITMAP_IPMAC m
493 516 set_kernel_config CONFIG_IP_SET_BITMAP_PORT m
494 517 set_kernel_config CONFIG_IP_SET_HASH_IP m
495 518 set_kernel_config CONFIG_IP_SET_HASH_IPMARK m
496 519 set_kernel_config CONFIG_IP_SET_HASH_IPPORT m
497 520 set_kernel_config CONFIG_IP_SET_HASH_IPPORTIP m
498 521 set_kernel_config CONFIG_IP_SET_HASH_IPPORTNET m
499 522 set_kernel_config CONFIG_IP_SET_HASH_MAC m
500 523 set_kernel_config CONFIG_IP_SET_HASH_NET m
501 524 set_kernel_config CONFIG_IP_SET_HASH_NETIFACE m
502 525 set_kernel_config CONFIG_IP_SET_HASH_NETNET m
503 526 set_kernel_config CONFIG_IP_SET_HASH_NETPORT m
504 527 set_kernel_config CONFIG_IP_SET_HASH_NETPORTNET m
505 528 set_kernel_config CONFIG_IP_SET_LIST_SET m
506 529 set_kernel_config CONFIG_NETFILTER_XTABLES m
507 530 set_kernel_config CONFIG_NETFILTER_XTABLES m
508 531 set_kernel_config CONFIG_NFT_BRIDGE_META m
509 532 set_kernel_config CONFIG_NFT_BRIDGE_REJECT m
510 533 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV4 m
511 534 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV6 m
512 535 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV4 m
513 536 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV6 m
514 537 set_kernel_config CONFIG_NFT_COMPAT m
515 538 set_kernel_config CONFIG_NFT_COUNTER m
516 539 set_kernel_config CONFIG_NFT_CT m
517 540 set_kernel_config CONFIG_NFT_DUP_IPV4 m
518 541 set_kernel_config CONFIG_NFT_DUP_IPV6 m
519 542 set_kernel_config CONFIG_NFT_DUP_NETDEV m
520 543 set_kernel_config CONFIG_NFT_EXTHDR m
521 544 set_kernel_config CONFIG_NFT_FWD_NETDEV m
522 545 set_kernel_config CONFIG_NFT_HASH m
523 546 set_kernel_config CONFIG_NFT_LIMIT m
524 547 set_kernel_config CONFIG_NFT_LOG m
525 548 set_kernel_config CONFIG_NFT_MASQ m
526 549 set_kernel_config CONFIG_NFT_MASQ_IPV4 m
527 550 set_kernel_config CONFIG_NFT_MASQ_IPV6 m
528 551 set_kernel_config CONFIG_NFT_META m
529 552 set_kernel_config CONFIG_NFT_NAT m
530 553 set_kernel_config CONFIG_NFT_NUMGEN m
531 554 set_kernel_config CONFIG_NFT_QUEUE m
532 555 set_kernel_config CONFIG_NFT_QUOTA m
533 556 set_kernel_config CONFIG_NFT_REDIR m
534 557 set_kernel_config CONFIG_NFT_REDIR_IPV4 m
535 558 set_kernel_config CONFIG_NFT_REDIR_IPV6 m
536 559 set_kernel_config CONFIG_NFT_REJECT m
537 560 set_kernel_config CONFIG_NFT_REJECT_INET m
538 561 set_kernel_config CONFIG_NFT_REJECT_IPV4 m
539 562 set_kernel_config CONFIG_NFT_REJECT_IPV6 m
540 563 set_kernel_config CONFIG_NFT_SET_HASH m
541 564 set_kernel_config CONFIG_NFT_SET_RBTREE m
542 565 set_kernel_config CONFIG_NF_CONNTRACK_IPV4 m
543 566 set_kernel_config CONFIG_NF_CONNTRACK_IPV6 m
544 567 set_kernel_config CONFIG_NF_DEFRAG_IPV4 m
545 568 set_kernel_config CONFIG_NF_DEFRAG_IPV6 m
546 569 set_kernel_config CONFIG_NF_DUP_IPV4 m
547 570 set_kernel_config CONFIG_NF_DUP_IPV6 m
548 571 set_kernel_config CONFIG_NF_DUP_NETDEV m
549 572 set_kernel_config CONFIG_NF_LOG_BRIDGE m
550 573 set_kernel_config CONFIG_NF_LOG_IPV4 m
551 574 set_kernel_config CONFIG_NF_LOG_IPV6 m
552 575 set_kernel_config CONFIG_NF_NAT_IPV4 m
553 576 set_kernel_config CONFIG_NF_NAT_IPV6 m
554 577 set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV4 y
555 578 set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV6 y
556 579 set_kernel_config CONFIG_NF_NAT_PPTP m
557 580 set_kernel_config CONFIG_NF_NAT_PROTO_GRE m
558 581 set_kernel_config CONFIG_NF_NAT_REDIRECT y
559 582 set_kernel_config CONFIG_NF_NAT_SIP m
560 583 set_kernel_config CONFIG_NF_NAT_SNMP_BASIC m
561 584 set_kernel_config CONFIG_NF_NAT_TFTP m
562 585 set_kernel_config CONFIG_NF_REJECT_IPV4 m
563 586 set_kernel_config CONFIG_NF_REJECT_IPV6 m
564 587 set_kernel_config CONFIG_NF_TABLES m
565 588 set_kernel_config CONFIG_NF_TABLES_ARP m
566 589 set_kernel_config CONFIG_NF_TABLES_BRIDGE m
567 590 set_kernel_config CONFIG_NF_TABLES_INET m
568 591 set_kernel_config CONFIG_NF_TABLES_IPV4 y
569 592 set_kernel_config CONFIG_NF_TABLES_IPV6 y
570 593 set_kernel_config CONFIG_NF_TABLES_NETDEV m
571 594 set_kernel_config CONFIG_NF_TABLES_SET m
572 595 set_kernel_config CONFIG_NF_TABLES_INET y
573 596 set_kernel_config CONFIG_NF_TABLES_NETDEV y
574 597 set_kernel_config CONFIG_NFT_CONNLIMIT m
575 598 set_kernel_config CONFIG_NFT_TUNNEL m
576 599 set_kernel_config CONFIG_NFT_SOCKET m
577 600 set_kernel_config CONFIG_NFT_TPROXY m
578 601 set_kernel_config CONFIG_NF_FLOW_TABLE m
579 602 set_kernel_config CONFIG_NFT_FLOW_OFFLOAD m
580 603 set_kernel_config CONFIG_NF_FLOW_TABLE_INET m
581 604 set_kernel_config CONFIG_NF_TABLES_ARP y
582 605 set_kernel_config CONFIG_NF_FLOW_TABLE_IPV4 y
583 606 set_kernel_config CONFIG_NF_FLOW_TABLE_IPV6 y
584 607 set_kernel_config CONFIG_NF_TABLES_BRIDGE y
585 608 set_kernel_config CONFIG_NF_CT_NETLINK_TIMEOUT m
586 609 set_kernel_config CONFIG_NFT_OSF m
587 610
588 611 fi
589 612
590 613 # Enables BPF syscall for systemd-journald see https://github.com/torvalds/linux/blob/master/init/Kconfig#L848 or https://groups.google.com/forum/#!topic/linux.gentoo.user/_2aSc_ztGpA
591 614 if [ "$KERNEL_BPF" = true ] ; then
592 615 set_kernel_config CONFIG_BPF_SYSCALL y
593 616 set_kernel_config CONFIG_BPF_EVENTS y
594 617 set_kernel_config CONFIG_BPF_STREAM_PARSER y
595 618 set_kernel_config CONFIG_CGROUP_BPF y
596 619 set_kernel_config CONFIG_XDP_SOCKETS y
597 620 fi
598 621
599 622 # KERNEL_DEFAULT_GOV was set by user
600 623 if [ "$KERNEL_DEFAULT_GOV" != powersave ] && [ -n "$KERNEL_DEFAULT_GOV" ] ; then
601 624
602 625 case "$KERNEL_DEFAULT_GOV" in
603 626 performance)
604 627 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE y
605 628 ;;
606 629 userspace)
607 630 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE y
608 631 ;;
609 632 ondemand)
610 633 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND y
611 634 ;;
612 635 conservative)
613 636 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE y
614 637 ;;
615 638 shedutil)
616 639 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL y
617 640 ;;
618 641 *)
619 642 echo "error: unsupported default cpu governor"
620 643 exit 1
621 644 ;;
622 645 esac
623 646
624 647 # unset previous default governor
625 648 unset_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE
626 649 fi
627 650
628 651 #Revert to previous directory
629 652 cd "${WORKDIR}" || exit
630 653
631 654 # Set kernel configuration parameters to enable qemu emulation
632 655 if [ "$ENABLE_QEMU" = true ] ; then
633 656 echo "CONFIG_FHANDLE=y" >> "${KERNEL_DIR}"/.config
634 657 echo "CONFIG_LBDAF=y" >> "${KERNEL_DIR}"/.config
635 658
636 659 if [ "$ENABLE_CRYPTFS" = true ] ; then
637 660 {
638 661 echo "CONFIG_EMBEDDED=y"
639 662 echo "CONFIG_EXPERT=y"
640 663 echo "CONFIG_DAX=y"
641 664 echo "CONFIG_MD=y"
642 665 echo "CONFIG_BLK_DEV_MD=y"
643 666 echo "CONFIG_MD_AUTODETECT=y"
644 667 echo "CONFIG_BLK_DEV_DM=y"
645 668 echo "CONFIG_BLK_DEV_DM_BUILTIN=y"
646 669 echo "CONFIG_DM_CRYPT=y"
647 670 echo "CONFIG_CRYPTO_BLKCIPHER=y"
648 671 echo "CONFIG_CRYPTO_CBC=y"
649 672 echo "CONFIG_CRYPTO_XTS=y"
650 673 echo "CONFIG_CRYPTO_SHA512=y"
651 674 echo "CONFIG_CRYPTO_MANAGER=y"
652 675 } >> "${KERNEL_DIR}"/.config
653 676 fi
654 677 fi
655 678
656 679 # Copy custom kernel configuration file
657 680 if [ -n "$KERNELSRC_USRCONFIG" ] ; then
658 681 cp "$KERNELSRC_USRCONFIG" "${KERNEL_DIR}"/.config
659 682 fi
660 683
661 684 # Set kernel configuration parameters to their default values
662 685 if [ "$KERNEL_OLDDEFCONFIG" = true ] ; then
663 686 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" olddefconfig
664 687 fi
665 688
666 689 # Start menu-driven kernel configuration (interactive)
667 690 if [ "$KERNEL_MENUCONFIG" = true ] ; then
668 691 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" menuconfig
669 692 fi
670 693 # end if "$KERNELSRC_CONFIG" = true
671 694 fi
672 695
673 696 # Use ccache to cross compile the kernel
674 697 if [ "$KERNEL_CCACHE" = true ] ; then
675 698 cc="ccache ${CROSS_COMPILE}gcc"
676 699 else
677 700 cc="${CROSS_COMPILE}gcc"
678 701 fi
679 702
680 703 # Cross compile kernel and dtbs
681 704 make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" "${KERNEL_BIN_IMAGE}" dtbs
682 705
683 706 # Cross compile kernel modules
684 707 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
685 708 make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" modules
686 709 fi
687 710 # end if "$KERNELSRC_PREBUILT" = false
688 711 fi
689 712
690 713 # Check if kernel compilation was successful
691 714 if [ ! -r "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" ] ; then
692 715 echo "error: kernel compilation failed! (kernel image not found)"
693 716 cleanup
694 717 exit 1
695 718 fi
696 719
697 720 # Install kernel modules
698 721 if [ "$ENABLE_REDUCE" = true ] ; then
699 722 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
700 723 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=../../.. modules_install
701 724 fi
702 725 else
703 726 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
704 727 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_PATH=../../.. modules_install
705 728 fi
706 729
707 730 # Install kernel firmware
708 731 if grep -q "^firmware_install:" "${KERNEL_DIR}/Makefile" ; then
709 732 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_FW_PATH=../../../lib firmware_install
710 733 fi
711 734 fi
712 735
713 736 # Install kernel headers
714 737 if [ "$KERNEL_HEADERS" = true ] && [ "$KERNEL_REDUCE" = false ] ; then
715 738 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_HDR_PATH=../.. headers_install
716 739 fi
717 740
718 741 # Prepare boot (firmware) directory
719 742 mkdir "${BOOT_DIR}"
720 743
721 744 # Get kernel release version
722 745 KERNEL_VERSION=$(cat "${KERNEL_DIR}/include/config/kernel.release")
723 746
724 747 # Copy kernel configuration file to the boot directory
725 748 install_readonly "${KERNEL_DIR}/.config" "${R}/boot/config-${KERNEL_VERSION}"
726 749
727 750 # Prepare device tree directory
728 751 mkdir "${BOOT_DIR}/overlays"
729 752
730 753 # Ensure the proper .dtb is located
731 754 if [ "$KERNEL_ARCH" = "arm" ] ; then
732 755 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/"*.dtb ; do
733 756 if [ -f "${dtb}" ] ; then
734 757 install_readonly "${dtb}" "${BOOT_DIR}/"
735 758 fi
736 759 done
737 760 else
738 761 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/broadcom/"*.dtb ; do
739 762 if [ -f "${dtb}" ] ; then
740 763 install_readonly "${dtb}" "${BOOT_DIR}/"
741 764 fi
742 765 done
743 766 fi
744 767
745 768 # Copy compiled dtb device tree files
746 769 if [ -d "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays" ] ; then
747 770 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtbo ; do
748 771 if [ -f "${dtb}" ] ; then
749 772 install_readonly "${dtb}" "${BOOT_DIR}/overlays/"
750 773 fi
751 774 done
752 775
753 776 if [ -f "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" ] ; then
754 777 install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "${BOOT_DIR}/overlays/README"
755 778 fi
756 779 fi
757 780
758 781 if [ "$ENABLE_UBOOT" = false ] ; then
759 782 # Convert and copy kernel image to the boot directory
760 783 "${KERNEL_DIR}/scripts/mkknlimg" "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
761 784 else
762 785 # Copy kernel image to the boot directory
763 786 install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
764 787 fi
765 788
766 789 # Remove kernel sources
767 790 if [ "$KERNEL_REMOVESRC" = true ] ; then
768 791 rm -fr "${KERNEL_DIR}"
769 792 else
770 793 # Prepare compiled kernel modules
771 794 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
772 795 if grep -q "^modules_prepare:" "${KERNEL_DIR}/Makefile" ; then
773 796 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" modules_prepare
774 797 fi
775 798
776 799 # Create symlinks for kernel modules
777 800 chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/build"
778 801 chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/source"
779 802 fi
780 803 fi
781 804
782 805 else # BUILD_KERNEL=false
783 806 if [ "$SET_ARCH" = 64 ] ; then
784 807 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
785 808 # Use Sakakis modified kernel if ZSWAP is active
786 809 if [ "$KERNEL_ZSWAP" = true ] || [ "$KERNEL_VIRT" = true ] || [ "$KERNEL_NF" = true ] || [ "$KERNEL_BPF" = true ] ; then
787 810 RPI3_64_KERNEL_URL="${RPI3_64_BIS_KERNEL_URL}"
788 811 fi
789 812
790 813 # Create temporary directory for dl
791 814 temp_dir=$(as_nobody mktemp -d)
792 815
793 816 # Fetch kernel dl
794 817 as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI3_64_KERNEL_URL"
795 818 fi
796 819 if [ "$SET_ARCH" = 64 ] && [ "$RPI_MODEL" = 4 ] ; then
797 820 # Create temporary directory for dl
798 821 temp_dir=$(as_nobody mktemp -d)
799 822
800 823 # Fetch kernel dl
801 824 as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI4_64_KERNEL_URL"
802 825 fi
803 826
804 827 #extract download
805 828 tar -xJf "${temp_dir}"/kernel.tar.xz -C "${temp_dir}"
806 829
807 830 #move extracted kernel to /boot/firmware
808 831 mkdir "${R}/boot/firmware"
809 832 cp "${temp_dir}"/boot/* "${R}"/boot/firmware/
810 833 cp -r "${temp_dir}"/lib/* "${R}"/lib/
811 834
812 835 # Remove temporary directory for kernel sources
813 836 rm -fr "${temp_dir}"
814 837
815 838 # Set permissions of the kernel sources
816 839 chown -R root:root "${R}/boot/firmware"
817 840 chown -R root:root "${R}/lib/modules"
818 841 fi
819 842
820 843 # Install Kernel from hypriot comptabile with all Raspberry PI (dunno if its compatible with RPI4 - better compile your own kernel)
821 844 if [ "$SET_ARCH" = 32 ] && [ "$RPI_MODEL" != 4 ] ; then
822 845 # Create temporary directory for dl
823 846 temp_dir=$(as_nobody mktemp -d)
824 847
825 848 # Fetch kernel
826 849 as_nobody wget -O "${temp_dir}"/kernel.deb -c "$RPI_32_KERNEL_URL"
827 850
828 851 # Copy downloaded kernel package
829 852 mv "${temp_dir}"/kernel.deb "${R}"/tmp/kernel.deb
830 853
831 854 # Set permissions
832 855 chown -R root:root "${R}"/tmp/kernel.deb
833 856
834 857 # Install kernel
835 858 chroot_exec dpkg -i /tmp/kernel.deb
836 859
837 860 # move /boot to /boot/firmware to fit script env.
838 861 #mkdir "${BOOT_DIR}"
839 862 mkdir "${temp_dir}"/firmware
840 863 mv "${R}"/boot/* "${temp_dir}"/firmware/
841 864 mv "${temp_dir}"/firmware "${R}"/boot/
842 865
843 866 #same for kernel headers
844 867 if [ "$KERNEL_HEADERS" = true ] ; then
845 868 # Fetch kernel header
846 869 as_nobody wget -O "${temp_dir}"/kernel-header.deb -c "$RPI_32_KERNELHEADER_URL"
847 870 mv "${temp_dir}"/kernel-header.deb "${R}"/tmp/kernel-header.deb
848 871 chown -R root:root "${R}"/tmp/kernel-header.deb
849 872 # Install kernel header
850 873 chroot_exec dpkg -i /tmp/kernel-header.deb
851 874 rm -f "${R}"/tmp/kernel-header.deb
852 875 fi
853 876
854 877 # Remove temporary directory and files
855 878 rm -fr "${temp_dir}"
856 879 rm -f "${R}"/tmp/kernel.deb
857 880 fi
858 881
859 882 # Check if kernel installation was successful
860 883 KERNEL="$(ls -1 "${R}"/boot/firmware/kernel* | sort | tail -n 1)"
861 884 if [ -z "$KERNEL" ] ; then
862 885 echo "error: kernel installation failed! (/boot/kernel* not found)"
863 886 cleanup
864 887 exit 1
865 888 fi
866 889 fi
@@ -1,116 +1,120
1 1 #
2 2 # Setup fstab and initramfs
3 3 #
4 4
5 5 # Load utility functions
6 6 . ./functions.sh
7 7
8 8 # Install and setup fstab
9 9 install_readonly files/mount/fstab "${ETC_DIR}/fstab"
10 10
11 # Add usb/sda disk root partition to fstab
12 if [ "$ENABLE_SPLITFS" = true ] && [ "$ENABLE_CRYPTFS" = false ] ; then
13 sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/fstab"
11 # Generate initramfs file
12 if [ "$ENABLE_INITRAMFS" = true ] ; then
13 if [ "$ENABLE_CRYPTFS" = true ] ; then
14
15 # Include initramfs scripts to auto expand encrypted root partition
16 if [ "$EXPANDROOT" = true ] ; then
17 install_exec files/initramfs/expand_encrypted_rootfs "${ETC_DIR}/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs"
18 install_exec files/initramfs/expand-premount "${ETC_DIR}/initramfs-tools/scripts/local-premount/expand-premount"
19 install_exec files/initramfs/expand-tools "${ETC_DIR}/initramfs-tools/hooks/expand-tools"
14 20 fi
15 21
16 # Add encrypted root partition to fstab and crypttab
17 if [ "$ENABLE_CRYPTFS" = true ] ; then
18 22 # Replace fstab root partition with encrypted partition mapping
19 23 sed -i "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING}/" "${ETC_DIR}/fstab"
20 24
21 25 # Add encrypted partition to crypttab and fstab
22 26 install_readonly files/mount/crypttab "${ETC_DIR}/crypttab"
23 27 echo "${CRYPTFS_MAPPING} /dev/mmcblk0p2 none luks,initramfs" >> "${ETC_DIR}/crypttab"
24 28
25 if [ "$ENABLE_SPLITFS" = true ] ; then
26 # Add usb/sda1 disk to crypttab
27 sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/crypttab"
28 fi
29 fi
30
31 if [ "$ENABLE_USBBOOT" = true ] ; then
29 if [ "$ENABLE_USBBOOT" = true ] && [ "$ENABLE_SPLITFS" = false ]; then
32 30 sed -i "s/mmcblk0p1/sda1/" "${ETC_DIR}/fstab"
33 sed -i "s/mmcblk0p2/sda2/" "${ETC_DIR}/fstab"
34
35 31 # Add usb/sda2 disk to crypttab
36 32 sed -i "s/mmcblk0p2/sda2/" "${ETC_DIR}/crypttab"
37 33 fi
38 34
39 # Generate initramfs file
40 if [ "$ENABLE_INITRAMFS" = true ] ; then
41 if [ "$ENABLE_CRYPTFS" = true ] ; then
42 # Include initramfs scripts to auto expand encrypted root partition
43 if [ "$EXPANDROOT" = true ] ; then
44 install_exec files/initramfs/expand_encrypted_rootfs "${ETC_DIR}/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs"
45 install_exec files/initramfs/expand-premount "${ETC_DIR}/initramfs-tools/scripts/local-premount/expand-premount"
46 install_exec files/initramfs/expand-tools "${ETC_DIR}/initramfs-tools/hooks/expand-tools"
35 # Add encrypted root partition to fstab and crypttab
36 if [ "$ENABLE_SPLITFS" = true ] && [ "$ENABLE_USBBOOT" = false ]; then
37 # Add usb/sda1 disk to crypttab
38 sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/crypttab"
47 39 fi
48 40
41 if [ "$CRYPTFS_DROPBEAR" = true ]; then
49 42 if [ "$ENABLE_DHCP" = false ] ; then
50 43 # Get cdir from NET_ADDRESS e.g. 24
51 cdir=$(${NET_ADDRESS} | cut -d '/' -f2)
44 cdir=$(printf "%s" "${NET_ADDRESS}" | cut -d '/' -f2)
52 45
53 46 # Convert cdir ro netmask e.g. 24 to 255.255.255.0
54 47 NET_MASK=$(cdr2mask "$cdir")
55 48
56 49 # Write static ip settings to "${ETC_DIR}"/initramfs-tools/initramfs.conf
57 sed -i "\$aIP=${NET_ADDRESS}::${NET_GATEWAY}:${NET_MASK}:${HOSTNAME}:" "${ETC_DIR}"/initramfs-tools/initramfs.conf
58
59 # Regenerate initramfs
60 chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
50 # ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<hostname>:<device>:<autoconf>
51 sed -i "\$a\nIP=${NET_ADDRESS}::${NET_GATEWAY}:${NET_MASK}:${HOSTNAME}:" "${ETC_DIR}"/initramfs-tools/initramfs.conf
52 else
53 sed -i "\$a\nIP=::::${HOSTNAME}::dhcp" "${ETC_DIR}"/initramfs-tools/initramfs.conf
61 54 fi
62 55
63 if [ "$CRYPTFS_DROPBEAR" = true ]; then
64 56 if [ -n "$CRYPTFS_DROPBEAR_PUBKEY" ] && [ -f "$CRYPTFS_DROPBEAR_PUBKEY" ] ; then
65 57 install_readonly "${CRYPTFS_DROPBEAR_PUBKEY}" "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
66 58 cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub >> "${ETC_DIR}"/dropbear-initramfs/authorized_keys
67 59 else
68 60 # Create key
69 61 chroot_exec /usr/bin/dropbearkey -t rsa -f /etc/dropbear-initramfs/id_rsa.dropbear
70 62
71 63 # Convert dropbear key to openssh key
72 64 chroot_exec /usr/lib/dropbear/dropbearconvert dropbear openssh /etc/dropbear-initramfs/id_rsa.dropbear /etc/dropbear-initramfs/id_rsa
73 65
74 66 # Get Public Key Part
75 67 chroot_exec /usr/bin/dropbearkey -y -f /etc/dropbear-initramfs/id_rsa.dropbear | chroot_exec tee /etc/dropbear-initramfs/id_rsa.pub
76 68
77 69 # Delete unwanted lines
78 70 sed -i '/Public/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
79 71 sed -i '/Fingerprint/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
80 72
81 73 # Trust the new key
82 74 cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub > "${ETC_DIR}"/dropbear-initramfs/authorized_keys
83 75
84 76 # Save Keys - convert with putty from rsa/openssh to puttkey
85 77 cp -f "${ETC_DIR}"/dropbear-initramfs/id_rsa "${BASEDIR}"/dropbear_initramfs_key.rsa
86 78
87 79 # Get unlock script
88 80 install_exec files/initramfs/crypt_unlock.sh "${ETC_DIR}"/initramfs-tools/hooks/crypt_unlock.sh
89 81
90 82 # Enable Dropbear inside initramfs
91 83 printf "#\n# DROPBEAR: [ y | n ]\n#\n\nDROPBEAR=y\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
92 84
93 85 # Enable Dropbear inside initramfs
94 86 sed -i "54 i sleep 5" "${R}"/usr/share/initramfs-tools/scripts/init-premount/dropbear
95 87 fi
88 # CRYPTFSDROPBEAR=false
96 89 else
97 90 # Disable SSHD inside initramfs
98 91 printf "#\n# DROPBEAR: [ y | n ]\n#\n\nDROPBEAR=n\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
99 92 fi
100 93
101 94 # Add cryptsetup modules to initramfs
102 printf "#\n# CRYPTSETUP: [ y | n ]\n#\n\nCRYPTSETUP=y\n" >> "${ETC_DIR}/initramfs-tools/conf-hook"
95 #printf "#\n# CRYPTSETUP: [ y | n ]\n#\n\nCRYPTSETUP=y\n" >> "${ETC_DIR}/initramfs-tools/conf-hook"
103 96
104 97 # Dummy mapping required by mkinitramfs
105 echo "0 1 crypt $(echo "${CRYPTFS_CIPHER}" | cut -d ':' -f 1) ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 0 7:0 4096" | chroot_exec dmsetup create "${CRYPTFS_MAPPING}"
98 echo "0 1 crypt "${CRYPTFS_CIPHER}" ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 0 7:0 4096" | chroot_exec dmsetup create "${CRYPTFS_MAPPING}"
106 99
107 100 # Generate initramfs with encrypted root partition support
108 101 chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
109 102
110 103 # Remove dummy mapping
111 104 chroot_exec cryptsetup close "${CRYPTFS_MAPPING}"
105 # CRYPTFS=false
112 106 else
107 #USB BOOT /boot on sda1 / on sda2
108 if [ "$ENABLE_USBBOOT" = true ] ; then
109 sed -i "s/mmcblk0p1/sda1/" "${ETC_DIR}/fstab"
110 sed -i "s/mmcblk0p2/sda2/" "${ETC_DIR}/fstab"
111 fi
112
113 # Add usb/sda disk root partition to fstab
114 if [ "$ENABLE_SPLITFS" = true ] ; then
115 sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/fstab"
116 fi
113 117 # Generate initramfs without encrypted root partition support
114 118 chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
115 119 fi
116 120 fi
@@ -1,892 +1,897
1 1 #!/bin/sh
2 2 ########################################################################
3 3 # rpi23-gen-image.sh 2015-2017
4 4 #
5 5 # Advanced Debian "stretch" and "buster" bootstrap script for Raspberry Pi
6 6 #
7 7 # This program is free software; you can redistribute it and/or
8 8 # modify it under the terms of the GNU General Public License
9 9 # as published by the Free Software Foundation; either version 2
10 10 # of the License, or (at your option) any later version.
11 11 #
12 12 # Copyright (C) 2015 Jan Wagner <mail@jwagner.eu>
13 13 #
14 14 # Big thanks for patches and enhancements by 20+ github contributors!
15 15 ########################################################################
16 16
17 17 # Are we running as root?
18 18 if [ "$(id -u)" -ne "0" ] ; then
19 19 echo "error: this script must be executed with root privileges!"
20 20 exit 1
21 21 fi
22 22
23 23 # Check if ./functions.sh script exists
24 24 if [ ! -r "./functions.sh" ] ; then
25 25 echo "error: './functions.sh' required script not found!"
26 26 exit 1
27 27 fi
28 28
29 29 # Load utility functions
30 30 . ./functions.sh
31 31
32 32 # Load parameters from configuration template file
33 33 if [ -n "$CONFIG_TEMPLATE" ] ; then
34 34 use_template
35 35 fi
36 36
37 37 # Introduce settings
38 38 set -e
39 39 echo -n -e "\n#\n# RPi 0/1/2/3 Bootstrap Settings\n#\n"
40 40 set -x
41 41
42 42 # Raspberry Pi model configuration
43 43 RPI_MODEL=${RPI_MODEL:=2}
44 44
45 45 # Debian release
46 46 RELEASE=${RELEASE:=buster}
47 47 if [ $RELEASE = "bullseye" ] ; then
48 48 RELEASE=testing
49 49 fi
50 50
51 51 # Kernel Branch
52 52 KERNEL_BRANCH=${KERNEL_BRANCH:=""}
53 53
54 54 # URLs
55 55 KERNEL_URL=${KERNEL_URL:=https://github.com/raspberrypi/linux}
56 56 FIRMWARE_URL=${FIRMWARE_URL:=https://github.com/raspberrypi/firmware/raw/master/boot}
57 57 WLAN_FIRMWARE_URL=${WLAN_FIRMWARE_URL:=https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm}
58 58 FBTURBO_URL=${FBTURBO_URL:=https://github.com/ssvb/xf86-video-fbturbo.git}
59 59 UBOOT_URL=${UBOOT_URL:=https://git.denx.de/u-boot.git}
60 60 VIDEOCORE_URL=${VIDEOCORE_URL:=https://github.com/raspberrypi/userland}
61 61 BLUETOOTH_URL=${BLUETOOTH_URL:=https://github.com/RPi-Distro/pi-bluetooth.git}
62 62 NEXMON_URL=${NEXMON_URL:=https://github.com/seemoo-lab/nexmon.git}
63 63 SYSTEMDSWAP_URL=${SYSTEMDSWAP_URL:=https://github.com/Nefelim4ag/systemd-swap.git}
64 64
65 65 # Kernel deb packages for 32bit kernel
66 66 RPI_32_KERNEL_URL=${RPI_32_KERNEL_URL:=https://github.com/hypriot/rpi-kernel/releases/download/v4.14.34/raspberrypi-kernel_20180422-141901_armhf.deb}
67 67 RPI_32_KERNELHEADER_URL=${RPI_32_KERNELHEADER_URL:=https://github.com/hypriot/rpi-kernel/releases/download/v4.14.34/raspberrypi-kernel-headers_20180422-141901_armhf.deb}
68 68 # Kernel has KVM and zswap enabled - use if KERNEL_* parameters and precompiled kernel are used
69 69 RPI3_64_BIS_KERNEL_URL=${RPI3_64_BIS_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel-bis/releases/download/4.19.80.20191022/bcmrpi3-kernel-bis-4.19.80.20191022.tar.xz}
70 70 # Default precompiled 64bit kernel
71 71 RPI3_64_DEF_KERNEL_URL=${RPI3_64_DEF_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel/releases/download/4.19.80.20191022/bcmrpi3-kernel-4.19.80.20191022.tar.xz}
72 72 # Sakaki BIS Kernel RPI4 - https://github.com/sakaki-/bcm2711-kernel-bis
73 73 RPI4_64_BIS_KERNEL_URL=${RPI4_64_BIS_KERNEL_URL:=https://github.com/sakaki-/bcm2711-kernel-bis/releases/download/4.19.59.20190724/bcm2711-kernel-bis-4.19.59.20190724.tar.xz}
74 74 # Default precompiled 64bit kernel - https://github.com/sakaki-/bcm2711-kernel
75 75 RPI4_64_DEF_KERNEL_URL=${RPI4_64_DEF_KERNEL_URL:=https://github.com/sakaki-/bcm2711-kernel-bis/releases/download/4.19.59.20190724/bcm2711-kernel-bis-4.19.59.20190724.tar.xz}
76 76 # Generic
77 77 RPI3_64_KERNEL_URL=${RPI3_64_KERNEL_URL:=$RPI3_64_DEF_KERNEL_URL}
78 78 RPI4_64_KERNEL_URL=${RPI4_64_KERNEL_URL:=$RPI4_64_DEF_KERNEL_URL}
79 79 # Kali kernel src - used if ENABLE_NEXMON=true (they patch the wlan kernel modul)
80 80 KALI_KERNEL_URL=${KALI_KERNEL_URL:=https://github.com/Re4son/re4son-raspberrypi-linux.git}
81 81
82 82 # Build directories
83 83 WORKDIR=$(pwd)
84 84 BASEDIR=${BASEDIR:=${WORKDIR}/images/${RELEASE}}
85 85 BUILDDIR="${BASEDIR}/build"
86 86
87 87 # Chroot directories
88 88 R="${BUILDDIR}/chroot"
89 89 ETC_DIR="${R}/etc"
90 90 LIB_DIR="${R}/lib"
91 91 BOOT_DIR="${R}/boot/firmware"
92 92 KERNEL_DIR="${R}/usr/src/linux"
93 93 WLAN_FIRMWARE_DIR="${LIB_DIR}/firmware/brcm"
94 94 BLUETOOTH_FIRMWARE_DIR="${ETC_DIR}/firmware/bt"
95 95
96 96 # Firmware directory: Blank if download from github
97 97 RPI_FIRMWARE_DIR=${RPI_FIRMWARE_DIR:=""}
98 98
99 99 # General settings
100 100 SET_ARCH=${SET_ARCH:=32}
101 101 HOSTNAME=${HOSTNAME:=rpi${RPI_MODEL}-${RELEASE}}
102 102 PASSWORD=${PASSWORD:=raspberry}
103 103 USER_PASSWORD=${USER_PASSWORD:=raspberry}
104 104 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
105 105 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
106 106 EXPANDROOT=${EXPANDROOT:=true}
107 107 ENABLE_DPHYSSWAP=${ENABLE_DPHYSSWAP:=true}
108 108
109 109 # Keyboard settings
110 110 XKB_MODEL=${XKB_MODEL:=""}
111 111 XKB_LAYOUT=${XKB_LAYOUT:=""}
112 112 XKB_VARIANT=${XKB_VARIANT:=""}
113 113 XKB_OPTIONS=${XKB_OPTIONS:=""}
114 114
115 115 # Network settings (DHCP)
116 116 ENABLE_DHCP=${ENABLE_DHCP:=true}
117 117
118 118 # Network settings (static)
119 119 NET_ADDRESS=${NET_ADDRESS:=""}
120 120 NET_GATEWAY=${NET_GATEWAY:=""}
121 121 NET_DNS_1=${NET_DNS_1:=""}
122 122 NET_DNS_2=${NET_DNS_2:=""}
123 123 NET_DNS_DOMAINS=${NET_DNS_DOMAINS:=""}
124 124 NET_NTP_1=${NET_NTP_1:=""}
125 125 NET_NTP_2=${NET_NTP_2:=""}
126 126
127 127 # APT settings
128 128 APT_PROXY=${APT_PROXY:=""}
129 129 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
130 130 KEEP_APT_PROXY=${KEEP_APT_PROXY:=false}
131 131
132 132 # Feature settings
133 133 ENABLE_PRINTK=${ENABLE_PRINTK:=false}
134 134 ENABLE_BLUETOOTH=${ENABLE_BLUETOOTH:=false}
135 135 ENABLE_MINIUART_OVERLAY=${ENABLE_MINIUART_OVERLAY:=false}
136 136 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
137 137 ENABLE_I2C=${ENABLE_I2C:=false}
138 138 ENABLE_SPI=${ENABLE_SPI:=false}
139 139 ENABLE_IPV6=${ENABLE_IPV6:=true}
140 140 ENABLE_SSHD=${ENABLE_SSHD:=true}
141 141 ENABLE_NONFREE=${ENABLE_NONFREE:=false}
142 142 ENABLE_WIRELESS=${ENABLE_WIRELESS:=false}
143 143 ENABLE_SOUND=${ENABLE_SOUND:=true}
144 144 ENABLE_DBUS=${ENABLE_DBUS:=true}
145 145 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
146 146 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
147 147 ENABLE_XORG=${ENABLE_XORG:=false}
148 148 ENABLE_WM=${ENABLE_WM:=""}
149 149 ENABLE_RSYSLOG=${ENABLE_RSYSLOG:=true}
150 150 ENABLE_USER=${ENABLE_USER:=true}
151 151 USER_NAME=${USER_NAME:="pi"}
152 152 ENABLE_ROOT=${ENABLE_ROOT:=false}
153 153 ENABLE_QEMU=${ENABLE_QEMU:=false}
154 154 ENABLE_SYSVINIT=${ENABLE_SYSVINIT:=false}
155 155
156 156 # SSH settings
157 157 SSH_ENABLE_ROOT=${SSH_ENABLE_ROOT:=false}
158 158 SSH_DISABLE_PASSWORD_AUTH=${SSH_DISABLE_PASSWORD_AUTH:=false}
159 159 SSH_LIMIT_USERS=${SSH_LIMIT_USERS:=false}
160 160 SSH_ROOT_PUB_KEY=${SSH_ROOT_PUB_KEY:=""}
161 161 SSH_USER_PUB_KEY=${SSH_USER_PUB_KEY:=""}
162 162
163 163 # Advanced settings
164 164 ENABLE_SYSTEMDSWAP=${ENABLE_SYSTEMDSWAP:=false}
165 165 ENABLE_MINBASE=${ENABLE_MINBASE:=false}
166 166 ENABLE_REDUCE=${ENABLE_REDUCE:=false}
167 167 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
168 168 UBOOTSRC_DIR=${UBOOTSRC_DIR:=""}
169 169 ENABLE_USBBOOT=${ENABLE_USBBOOT=false}
170 170 ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
171 171 ENABLE_VIDEOCORE=${ENABLE_VIDEOCORE:=false}
172 172 ENABLE_NEXMON=${ENABLE_NEXMON:=false}
173 173 VIDEOCORESRC_DIR=${VIDEOCORESRC_DIR:=""}
174 174 FBTURBOSRC_DIR=${FBTURBOSRC_DIR:=""}
175 175 NEXMONSRC_DIR=${NEXMONSRC_DIR:=""}
176 176 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
177 177 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
178 178 ENABLE_SPLITFS=${ENABLE_SPLITFS:=false}
179 179 ENABLE_INITRAMFS=${ENABLE_INITRAMFS:=false}
180 180 ENABLE_IFNAMES=${ENABLE_IFNAMES:=true}
181 181 ENABLE_SPLASH=${ENABLE_SPLASH:=true}
182 182 ENABLE_LOGO=${ENABLE_LOGO:=true}
183 183 ENABLE_SILENT_BOOT=${ENABLE_SILENT_BOOT=false}
184 184 DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS:=}
185 185
186 186 # Kernel compilation settings
187 187 BUILD_KERNEL=${BUILD_KERNEL:=true}
188 188 KERNEL_REDUCE=${KERNEL_REDUCE:=false}
189 189 KERNEL_THREADS=${KERNEL_THREADS:=1}
190 190 KERNEL_HEADERS=${KERNEL_HEADERS:=true}
191 191 KERNEL_MENUCONFIG=${KERNEL_MENUCONFIG:=false}
192 192 KERNEL_REMOVESRC=${KERNEL_REMOVESRC:=true}
193 193 KERNEL_OLDDEFCONFIG=${KERNEL_OLDDEFCONFIG:=false}
194 194 KERNEL_CCACHE=${KERNEL_CCACHE:=false}
195 195 KERNEL_ZSWAP=${KERNEL_ZSWAP:=false}
196 196 KERNEL_VIRT=${KERNEL_VIRT:=false}
197 197 KERNEL_BPF=${KERNEL_BPF:=false}
198 198 KERNEL_DEFAULT_GOV=${KERNEL_DEFAULT_GOV:=ondemand}
199 199 KERNEL_SECURITY=${KERNEL_SECURITY:=false}
200 200 KERNEL_NF=${KERNEL_NF:=false}
201 KERNEL_DHKEY=${KERNEL_DHKEY:=true}
202 KERNEL_BTRFS=${KERNEL_BTRFS:=false}
203 KERNEL_NSPAN=${KERNEL_NSPAN:=false}
204 KERNEL_POEHAT=${KERNEL_POEHAT:=false}
201 205
202 206 # Kernel compilation from source directory settings
203 207 KERNELSRC_DIR=${KERNELSRC_DIR:=""}
204 208 KERNELSRC_CLEAN=${KERNELSRC_CLEAN:=false}
205 209 KERNELSRC_CONFIG=${KERNELSRC_CONFIG:=true}
206 210 KERNELSRC_PREBUILT=${KERNELSRC_PREBUILT:=false}
207 211
208 212 # Reduce disk usage settings
209 213 REDUCE_APT=${REDUCE_APT:=true}
210 214 REDUCE_DOC=${REDUCE_DOC:=true}
211 215 REDUCE_MAN=${REDUCE_MAN:=true}
212 216 REDUCE_VIM=${REDUCE_VIM:=false}
213 217 REDUCE_BASH=${REDUCE_BASH:=false}
214 218 REDUCE_HWDB=${REDUCE_HWDB:=true}
215 219 REDUCE_SSHD=${REDUCE_SSHD:=true}
216 220 REDUCE_LOCALE=${REDUCE_LOCALE:=true}
217 221
218 222 # Encrypted filesystem settings
219 223 ENABLE_CRYPTFS=${ENABLE_CRYPTFS:=false}
220 224 CRYPTFS_PASSWORD=${CRYPTFS_PASSWORD:=""}
221 225 CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
222 CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64:sha512"}
226 CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64"}
227 CRYPTFS_HASH=${CRYPTFS_HASH:="sha512"}
223 228 CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512}
224 229 #Dropbear-initramfs supports unlocking encrypted filesystem via SSH on bootup
225 230 CRYPTFS_DROPBEAR=${CRYPTFS_DROPBEAR:=false}
226 231 #Provide your own Dropbear Public RSA-OpenSSH Key otherwise it will be generated
227 232 CRYPTFS_DROPBEAR_PUBKEY=${CRYPTFS_DROPBEAR_PUBKEY:=""}
228 233
229 234 # Chroot scripts directory
230 235 CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
231 236
232 237 # Packages required in the chroot build environment
233 238 APT_INCLUDES=${APT_INCLUDES:=""}
234 239 APT_INCLUDES="${APT_INCLUDES},flex,bison,libssl-dev,apt-transport-https,apt-utils,ca-certificates,debian-archive-keyring,dialog,sudo,systemd,sysvinit-utils,locales,keyboard-configuration,console-setup,libnss-systemd"
235 240
236 241 # Packages to exclude from chroot build environment
237 242 APT_EXCLUDES=${APT_EXCLUDES:=""}
238 243
239 244 # Packages required for bootstrapping
240 245 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo"
241 246 MISSING_PACKAGES=""
242 247
243 248 # Packages installed for c/c++ build environment in chroot (keep empty)
244 249 COMPILER_PACKAGES=""
245 250
246 251 # Check if apt-cacher-ng has port 3142 open and set APT_PROXY
247 252 APT_CACHER_RUNNING=$(lsof -i :3142 | cut -d ' ' -f3 | uniq | sed '/^\s*$/d')
248 253 if [ "${APT_CACHER_RUNNING}" = "apt-cacher-ng" ] ; then
249 254 APT_PROXY=http://127.0.0.1:3142/
250 255 fi
251 256
252 257 # Setup architecture specific settings
253 258 if [ -n "$SET_ARCH" ] ; then
254 259 # 64-bit configuration
255 260 if [ "$SET_ARCH" = 64 ] ; then
256 261 # General 64-bit depended settings
257 262 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-aarch64-static}
258 263 KERNEL_ARCH=${KERNEL_ARCH:=arm64}
259 264 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="Image"}
260 265
261 266 # Raspberry Pi model specific settings
262 267 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
263 268 if [ "$RPI_MODEL" != 4 ] ; then
264 269 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi3_defconfig}
265 270 else
266 271 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2711_defconfig}
267 272 fi
268 273
269 274 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-arm64"
270 275 RELEASE_ARCH=${RELEASE_ARCH:=arm64}
271 276 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel8.img}
272 277 CROSS_COMPILE=${CROSS_COMPILE:=aarch64-linux-gnu-}
273 278 else
274 279 echo "error: Only Raspberry PI 3, 3B+ and 4 support 64-bit"
275 280 exit 1
276 281 fi
277 282 fi
278 283
279 284 # 32-bit configuration
280 285 if [ "$SET_ARCH" = 32 ] ; then
281 286 # General 32-bit dependend settings
282 287 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-arm-static}
283 288 KERNEL_ARCH=${KERNEL_ARCH:=arm}
284 289 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="zImage"}
285 290
286 291 # Raspberry Pi model specific settings
287 292 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 1 ] || [ "$RPI_MODEL" = 1P ] ; then
288 293 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armel"
289 294 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi_defconfig}
290 295 RELEASE_ARCH=${RELEASE_ARCH:=armel}
291 296 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel.img}
292 297 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabi-}
293 298 fi
294 299
295 300 # Raspberry Pi model specific settings
296 301 if [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
297 302 if [ "$RPI_MODEL" != 4 ] ; then
298 303 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2709_defconfig}
299 304 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7.img}
300 305 else
301 306 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2711_defconfig}
302 307 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7l.img}
303 308 fi
304 309
305 310 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armhf"
306 311 RELEASE_ARCH=${RELEASE_ARCH:=armhf}
307 312
308 313 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabihf-}
309 314 fi
310 315 fi
311 316 # SET_ARCH not set
312 317 else
313 318 echo "error: Please set '32' or '64' as value for SET_ARCH"
314 319 exit 1
315 320 fi
316 321 # Device specific configuration and U-Boot configuration
317 322 case "$RPI_MODEL" in
318 323 0)
319 324 DTB_FILE=${DTB_FILE:=bcm2708-rpi-0-w.dtb}
320 325 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
321 326 ;;
322 327 1)
323 328 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b.dtb}
324 329 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
325 330 ;;
326 331 1P)
327 332 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b-plus.dtb}
328 333 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
329 334 ;;
330 335 2)
331 336 DTB_FILE=${DTB_FILE:=bcm2709-rpi-2-b.dtb}
332 337 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_2_defconfig}
333 338 ;;
334 339 3)
335 340 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
336 341 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
337 342 ;;
338 343 3P)
339 344 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
340 345 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
341 346 ;;
342 347 4)
343 348 DTB_FILE=${DTB_FILE:=bcm2711-rpi-4-b.dtb}
344 349 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_4_defconfig}
345 350 ;;
346 351 *)
347 352 echo "error: Raspberry Pi model $RPI_MODEL is not supported!"
348 353 exit 1
349 354 ;;
350 355 esac
351 356
352 357 # Raspberry PI 0,3,3P with Bluetooth and Wifi onboard
353 358 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
354 359 # Include bluetooth packages on supported boards
355 360 if [ "$ENABLE_BLUETOOTH" = true ] ; then
356 361 APT_INCLUDES="${APT_INCLUDES},bluetooth,bluez"
357 362 fi
358 363 if [ "$ENABLE_WIRELESS" = true ] ; then
359 364 APT_INCLUDES="${APT_INCLUDES},wireless-tools,crda,wireless-regdb"
360 365 fi
361 366 else # Raspberry PI 1,1P,2 without Wifi and bluetooth onboard
362 367 # Check if the internal wireless interface is not supported by the RPi model
363 368 if [ "$ENABLE_WIRELESS" = true ] || [ "$ENABLE_BLUETOOTH" = true ]; then
364 369 echo "error: The selected Raspberry Pi model has no integrated interface for wireless or bluetooth"
365 370 exit 1
366 371 fi
367 372 fi
368 373
369 374 if [ "$BUILD_KERNEL" = false ] && [ "$ENABLE_NEXMON" = true ]; then
370 375 echo "error: You have to compile kernel sources, if you want to enable nexmon"
371 376 exit 1
372 377 fi
373 378
374 379 # Prepare date string for default image file name
375 380 DATE="$(date +%Y-%m-%d)"
376 381 if [ -z "$KERNEL_BRANCH" ] ; then
377 382 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
378 383 else
379 384 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
380 385 fi
381 386
382 387 # Check if DISABLE_UNDERVOLT_WARNINGS parameter value is supported
383 388 if [ -n "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
384 389 if [ "$DISABLE_UNDERVOLT_WARNINGS" != 1 ] && [ "$DISABLE_UNDERVOLT_WARNINGS" != 2 ] ; then
385 390 echo "error: DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS} is not supported"
386 391 exit 1
387 392 fi
388 393 fi
389 394
390 395 # Add cmake to compile videocore sources
391 396 if [ "$ENABLE_VIDEOCORE" = true ] ; then
392 397 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cmake"
393 398 fi
394 399
395 400 # Add deps for nexmon
396 401 if [ "$ENABLE_NEXMON" = true ] ; then
397 402 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libgmp3-dev gawk qpdf make autoconf automake build-essential libtool"
398 403 fi
399 404
400 405 # Add libncurses5 to enable kernel menuconfig
401 406 if [ "$KERNEL_MENUCONFIG" = true ] ; then
402 407 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libncurses-dev"
403 408 fi
404 409
405 410 # Add ccache compiler cache for (faster) kernel cross (re)compilation
406 411 if [ "$KERNEL_CCACHE" = true ] ; then
407 412 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} ccache"
408 413 fi
409 414
410 415 # Add cryptsetup package to enable filesystem encryption
411 416 if [ "$ENABLE_CRYPTFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
412 417 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
413 APT_INCLUDES="${APT_INCLUDES},cryptsetup,busybox,console-setup"
418 APT_INCLUDES="${APT_INCLUDES},cryptsetup,busybox,console-setup,cryptsetup-initramfs"
414 419
415 420 # If cryptfs,dropbear and initramfs are enabled include dropbear-initramfs package
416 421 if [ "$CRYPTFS_DROPBEAR" = true ] && [ "$ENABLE_INITRAMFS" = true ]; then
417 422 APT_INCLUDES="${APT_INCLUDES},dropbear-initramfs"
418 423 fi
419 424
420 425 if [ -z "$CRYPTFS_PASSWORD" ] ; then
421 426 echo "error: no password defined (CRYPTFS_PASSWORD)!"
422 427 exit 1
423 428 fi
424 429 ENABLE_INITRAMFS=true
425 430 fi
426 431
427 432 # Add initramfs generation tools
428 433 if [ "$ENABLE_INITRAMFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
429 434 APT_INCLUDES="${APT_INCLUDES},initramfs-tools"
430 435 fi
431 436
432 437 # Add device-tree-compiler required for building the U-Boot bootloader
433 438 if [ "$ENABLE_UBOOT" = true ] ; then
434 439 APT_INCLUDES="${APT_INCLUDES},device-tree-compiler,bison,flex,bc"
435 440 fi
436 441
437 442 if [ "$ENABLE_USBBOOT" = true ] ; then
438 443 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 1P ] || [ "$RPI_MODEL" = 1 ] || [ "$RPI_MODEL" = 2 ]; then
439 444 echo "error: Booting from USB alone is only supported by Raspberry Pi 3 and 3P"
440 445 exit 1
441 446 fi
442 447 fi
443 448
444 449 # Check if root SSH (v2) public key file exists
445 450 if [ -n "$SSH_ROOT_PUB_KEY" ] ; then
446 451 if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then
447 452 echo "error: '$SSH_ROOT_PUB_KEY' specified SSH public key file not found (SSH_ROOT_PUB_KEY)!"
448 453 exit 1
449 454 fi
450 455 fi
451 456
452 457 # Check if $USER_NAME SSH (v2) public key file exists
453 458 if [ -n "$SSH_USER_PUB_KEY" ] ; then
454 459 if [ ! -f "$SSH_USER_PUB_KEY" ] ; then
455 460 echo "error: '$SSH_USER_PUB_KEY' specified SSH public key file not found (SSH_USER_PUB_KEY)!"
456 461 exit 1
457 462 fi
458 463 fi
459 464
460 465 if [ "$ENABLE_NEXMON" = true ] && [ -n "$KERNEL_BRANCH" ] ; then
461 466 echo "error: Please unset KERNEL_BRANCH if using ENABLE_NEXMON"
462 467 exit 1
463 468 fi
464 469
465 470 # Check if all required packages are installed on the build system
466 471 for package in $REQUIRED_PACKAGES ; do
467 472 if [ "$(dpkg-query -W -f='${Status}' "$package")" != "install ok installed" ] ; then
468 473 MISSING_PACKAGES="${MISSING_PACKAGES} $package"
469 474 fi
470 475 done
471 476
472 477 # If there are missing packages ask confirmation for install, or exit
473 478 if [ -n "$MISSING_PACKAGES" ] ; then
474 479 echo "the following packages needed by this script are not installed:"
475 480 echo "$MISSING_PACKAGES"
476 481
477 482 printf "\ndo you want to install the missing packages right now? [y/n] "
478 483 read -r confirm
479 484 [ "$confirm" != "y" ] && exit 1
480 485
481 486 # Make sure all missing required packages are installed
482 487 apt-get update && apt-get -qq -y install `echo "${MISSING_PACKAGES}" | sed "s/ //"`
483 488 fi
484 489
485 490 # Check if ./bootstrap.d directory exists
486 491 if [ ! -d "./bootstrap.d/" ] ; then
487 492 echo "error: './bootstrap.d' required directory not found!"
488 493 exit 1
489 494 fi
490 495
491 496 # Check if ./files directory exists
492 497 if [ ! -d "./files/" ] ; then
493 498 echo "error: './files' required directory not found!"
494 499 exit 1
495 500 fi
496 501
497 502 # Check if specified KERNELSRC_DIR directory exists
498 503 if [ -n "$KERNELSRC_DIR" ] && [ ! -d "$KERNELSRC_DIR" ] ; then
499 504 echo "error: '${KERNELSRC_DIR}' specified directory not found (KERNELSRC_DIR)!"
500 505 exit 1
501 506 fi
502 507
503 508 # Check if specified UBOOTSRC_DIR directory exists
504 509 if [ -n "$UBOOTSRC_DIR" ] && [ ! -d "$UBOOTSRC_DIR" ] ; then
505 510 echo "error: '${UBOOTSRC_DIR}' specified directory not found (UBOOTSRC_DIR)!"
506 511 exit 1
507 512 fi
508 513
509 514 # Check if specified VIDEOCORESRC_DIR directory exists
510 515 if [ -n "$VIDEOCORESRC_DIR" ] && [ ! -d "$VIDEOCORESRC_DIR" ] ; then
511 516 echo "error: '${VIDEOCORESRC_DIR}' specified directory not found (VIDEOCORESRC_DIR)!"
512 517 exit 1
513 518 fi
514 519
515 520 # Check if specified FBTURBOSRC_DIR directory exists
516 521 if [ -n "$FBTURBOSRC_DIR" ] && [ ! -d "$FBTURBOSRC_DIR" ] ; then
517 522 echo "error: '${FBTURBOSRC_DIR}' specified directory not found (FBTURBOSRC_DIR)!"
518 523 exit 1
519 524 fi
520 525
521 526 # Check if specified NEXMONSRC_DIR directory exists
522 527 if [ -n "$NEXMONSRC_DIR" ] && [ ! -d "$NEXMONSRC_DIR" ] ; then
523 528 echo "error: '${NEXMONSRC_DIR}' specified directory not found (NEXMONSRC_DIR)!"
524 529 exit 1
525 530 fi
526 531
527 532 # Check if specified CHROOT_SCRIPTS directory exists
528 533 if [ -n "$CHROOT_SCRIPTS" ] && [ ! -d "$CHROOT_SCRIPTS" ] ; then
529 534 echo "error: ${CHROOT_SCRIPTS} specified directory not found (CHROOT_SCRIPTS)!"
530 535 exit 1
531 536 fi
532 537
533 538 # Check if specified device mapping already exists (will be used by cryptsetup)
534 539 if [ -r "/dev/mapping/${CRYPTFS_MAPPING}" ] ; then
535 540 echo "error: mapping /dev/mapping/${CRYPTFS_MAPPING} already exists, not proceeding"
536 541 exit 1
537 542 fi
538 543
539 544 # Don't clobber an old build
540 545 if [ -e "$BUILDDIR" ] ; then
541 546 echo "error: directory ${BUILDDIR} already exists, not proceeding"
542 547 exit 1
543 548 fi
544 549
545 550 # Setup chroot directory
546 551 mkdir -p "${R}"
547 552
548 553 # Check if build directory has enough of free disk space >512MB
549 554 if [ "$(df --output=avail "${BUILDDIR}" | sed "1d")" -le "524288" ] ; then
550 555 echo "error: ${BUILDDIR} not enough space left to generate the output image!"
551 556 exit 1
552 557 fi
553 558
554 559 set -x
555 560
556 561 # Call "cleanup" function on various signals and errors
557 562 trap cleanup 0 1 2 3 6
558 563
559 564 # Add required packages for the minbase installation
560 565 if [ "$ENABLE_MINBASE" = true ] ; then
561 566 APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools,ifupdown"
562 567 fi
563 568
564 569 # Add parted package, required to get partprobe utility
565 570 if [ "$EXPANDROOT" = true ] ; then
566 571 APT_INCLUDES="${APT_INCLUDES},parted"
567 572 fi
568 573
569 574 # Add dphys-swapfile package, required to enable swap
570 575 if [ "$ENABLE_DPHYSSWAP" = true ] ; then
571 576 APT_INCLUDES="${APT_INCLUDES},dphys-swapfile"
572 577 fi
573 578
574 579 # Add dbus package, recommended if using systemd
575 580 if [ "$ENABLE_DBUS" = true ] ; then
576 581 APT_INCLUDES="${APT_INCLUDES},dbus"
577 582 fi
578 583
579 584 # Add iptables IPv4/IPv6 package
580 585 if [ "$ENABLE_IPTABLES" = true ] ; then
581 586 APT_INCLUDES="${APT_INCLUDES},iptables,iptables-persistent"
582 587 fi
583 588 # Add apparmor for KERNEL_SECURITY
584 589 if [ "$KERNEL_SECURITY" = true ] ; then
585 590 APT_INCLUDES="${APT_INCLUDES},apparmor,apparmor-utils,apparmor-profiles,apparmor-profiles-extra,libapparmor-perl"
586 591 fi
587 592
588 593 # Add openssh server package
589 594 if [ "$ENABLE_SSHD" = true ] ; then
590 595 APT_INCLUDES="${APT_INCLUDES},openssh-server"
591 596 fi
592 597
593 598 # Add alsa-utils package
594 599 if [ "$ENABLE_SOUND" = true ] ; then
595 600 APT_INCLUDES="${APT_INCLUDES},alsa-utils"
596 601 fi
597 602
598 603 # Add rng-tools package
599 604 if [ "$ENABLE_HWRANDOM" = true ] ; then
600 605 APT_INCLUDES="${APT_INCLUDES},rng-tools"
601 606 fi
602 607
603 608 # Add fbturbo video driver
604 609 if [ "$ENABLE_FBTURBO" = true ] ; then
605 610 # Enable xorg package dependencies
606 611 ENABLE_XORG=true
607 612 fi
608 613
609 614 # Add user defined window manager package
610 615 if [ -n "$ENABLE_WM" ] ; then
611 616 APT_INCLUDES="${APT_INCLUDES},${ENABLE_WM}"
612 617
613 618 # Enable xorg package dependencies
614 619 ENABLE_XORG=true
615 620 fi
616 621
617 622 # Add xorg package
618 623 if [ "$ENABLE_XORG" = true ] ; then
619 624 APT_INCLUDES="${APT_INCLUDES},xorg,dbus-x11"
620 625 fi
621 626
622 627 # Replace selected packages with smaller clones
623 628 if [ "$ENABLE_REDUCE" = true ] ; then
624 629 # Add levee package instead of vim-tiny
625 630 if [ "$REDUCE_VIM" = true ] ; then
626 631 APT_INCLUDES="$(echo ${APT_INCLUDES} | sed "s/vim-tiny/levee/")"
627 632 fi
628 633
629 634 # Add dropbear package instead of openssh-server
630 635 if [ "$REDUCE_SSHD" = true ] ; then
631 636 APT_INCLUDES="$(echo "${APT_INCLUDES}" | sed "s/openssh-server/dropbear/")"
632 637 fi
633 638 fi
634 639
635 640 # Configure systemd-sysv exclude to make halt/reboot/shutdown scripts available
636 641 if [ "$ENABLE_SYSVINIT" = false ] ; then
637 642 APT_EXCLUDES="--exclude=${APT_EXCLUDES},init,systemd-sysv"
638 643 fi
639 644
640 645 # Configure kernel sources if no KERNELSRC_DIR
641 646 if [ "$BUILD_KERNEL" = true ] && [ -z "$KERNELSRC_DIR" ] ; then
642 647 KERNELSRC_CONFIG=true
643 648 fi
644 649
645 650 # Configure reduced kernel
646 651 if [ "$KERNEL_REDUCE" = true ] ; then
647 652 KERNELSRC_CONFIG=false
648 653 fi
649 654
650 655 # Configure qemu compatible kernel
651 656 if [ "$ENABLE_QEMU" = true ] ; then
652 657 DTB_FILE=vexpress-v2p-ca15_a7.dtb
653 658 UBOOT_CONFIG=vexpress_ca15_tc2_defconfig
654 659 KERNEL_DEFCONFIG="vexpress_defconfig"
655 660 if [ "$KERNEL_MENUCONFIG" = false ] ; then
656 661 KERNEL_OLDDEFCONFIG=true
657 662 fi
658 663 fi
659 664
660 665 # Execute bootstrap scripts
661 666 for SCRIPT in bootstrap.d/*.sh; do
662 667 head -n 3 "$SCRIPT"
663 668 . "$SCRIPT"
664 669 done
665 670
666 671 ## Execute custom bootstrap scripts
667 672 if [ -d "custom.d" ] ; then
668 673 for SCRIPT in custom.d/*.sh; do
669 674 . "$SCRIPT"
670 675 done
671 676 fi
672 677
673 678 # Execute custom scripts inside the chroot
674 679 if [ -n "$CHROOT_SCRIPTS" ] && [ -d "$CHROOT_SCRIPTS" ] ; then
675 680 cp -r "${CHROOT_SCRIPTS}" "${R}/chroot_scripts"
676 681 chroot_exec /bin/bash -x <<'EOF'
677 682 for SCRIPT in /chroot_scripts/* ; do
678 683 if [ -f $SCRIPT -a -x $SCRIPT ] ; then
679 684 $SCRIPT
680 685 fi
681 686 done
682 687 EOF
683 688 rm -rf "${R}/chroot_scripts"
684 689 fi
685 690
686 691 # Remove c/c++ build environment from the chroot
687 692 chroot_remove_cc
688 693
689 694 # Generate required machine-id
690 695 MACHINE_ID=$(dbus-uuidgen)
691 696 echo -n "${MACHINE_ID}" > "${R}/var/lib/dbus/machine-id"
692 697 echo -n "${MACHINE_ID}" > "${ETC_DIR}/machine-id"
693 698
694 699 # APT Cleanup
695 700 chroot_exec apt-get -y clean
696 701 chroot_exec apt-get -y autoclean
697 702 chroot_exec apt-get -y autoremove
698 703
699 704 # Unmount mounted filesystems
700 705 umount -l "${R}/proc"
701 706 umount -l "${R}/sys"
702 707
703 708 # Clean up directories
704 709 rm -rf "${R}/run/*"
705 710 rm -rf "${R}/tmp/*"
706 711
707 712 # Clean up APT proxy settings
708 713 if [ "$KEEP_APT_PROXY" = false ] ; then
709 714 rm -f "${ETC_DIR}/apt/apt.conf.d/10proxy"
710 715 fi
711 716
712 717 # Clean up files
713 718 rm -f "${ETC_DIR}/ssh/ssh_host_*"
714 719 rm -f "${ETC_DIR}/dropbear/dropbear_*"
715 720 rm -f "${ETC_DIR}/apt/sources.list.save"
716 721 rm -f "${ETC_DIR}/resolvconf/resolv.conf.d/original"
717 722 rm -f "${ETC_DIR}/*-"
718 723 rm -f "${ETC_DIR}/resolv.conf"
719 724 rm -f "${R}/root/.bash_history"
720 725 rm -f "${R}/var/lib/urandom/random-seed"
721 726 rm -f "${R}/initrd.img"
722 727 rm -f "${R}/vmlinuz"
723 728 rm -f "${R}${QEMU_BINARY}"
724 729
725 730 if [ "$ENABLE_QEMU" = true ] ; then
726 731 # Setup QEMU directory
727 732 mkdir "${BASEDIR}/qemu"
728 733
729 734 # Copy kernel image to QEMU directory
730 735 install_readonly "${BOOT_DIR}/${KERNEL_IMAGE}" "${BASEDIR}/qemu/${KERNEL_IMAGE}"
731 736
732 737 # Copy kernel config to QEMU directory
733 738 install_readonly "${R}/boot/config-${KERNEL_VERSION}" "${BASEDIR}/qemu/config-${KERNEL_VERSION}"
734 739
735 740 # Copy kernel dtbs to QEMU directory
736 741 for dtb in "${BOOT_DIR}/"*.dtb ; do
737 742 if [ -f "${dtb}" ] ; then
738 743 install_readonly "${dtb}" "${BASEDIR}/qemu/"
739 744 fi
740 745 done
741 746
742 747 # Copy kernel overlays to QEMU directory
743 748 if [ -d "${BOOT_DIR}/overlays" ] ; then
744 749 # Setup overlays dtbs directory
745 750 mkdir "${BASEDIR}/qemu/overlays"
746 751
747 752 for dtb in "${BOOT_DIR}/overlays/"*.dtbo ; do
748 753 if [ -f "${dtb}" ] ; then
749 754 install_readonly "${dtb}" "${BASEDIR}/qemu/overlays/"
750 755 fi
751 756 done
752 757 fi
753 758
754 759 # Copy u-boot files to QEMU directory
755 760 if [ "$ENABLE_UBOOT" = true ] ; then
756 761 if [ -f "${BOOT_DIR}/u-boot.bin" ] ; then
757 762 install_readonly "${BOOT_DIR}/u-boot.bin" "${BASEDIR}/qemu/u-boot.bin"
758 763 fi
759 764 if [ -f "${BOOT_DIR}/uboot.mkimage" ] ; then
760 765 install_readonly "${BOOT_DIR}/uboot.mkimage" "${BASEDIR}/qemu/uboot.mkimage"
761 766 fi
762 767 if [ -f "${BOOT_DIR}/boot.scr" ] ; then
763 768 install_readonly "${BOOT_DIR}/boot.scr" "${BASEDIR}/qemu/boot.scr"
764 769 fi
765 770 fi
766 771
767 772 # Copy initramfs to QEMU directory
768 773 if [ -f "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" ] ; then
769 774 install_readonly "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" "${BASEDIR}/qemu/initramfs-${KERNEL_VERSION}"
770 775 fi
771 776 fi
772 777
773 778 # Calculate size of the chroot directory in KB
774 779 CHROOT_SIZE=$(expr "$(du -s "${R}" | awk '{ print $1 }')")
775 780
776 781 # Calculate the amount of needed 512 Byte sectors
777 782 TABLE_SECTORS=$(expr 1 \* 1024 \* 1024 \/ 512)
778 783 FRMW_SECTORS=$(expr 64 \* 1024 \* 1024 \/ 512)
779 784 ROOT_OFFSET=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}")
780 785
781 786 # The root partition is EXT4
782 787 # This means more space than the actual used space of the chroot is used.
783 788 # As overhead for journaling and reserved blocks 35% are added.
784 789 ROOT_SECTORS=$(expr "$(expr "${CHROOT_SIZE}" + "${CHROOT_SIZE}" \/ 100 \* 35)" \* 1024 \/ 512)
785 790
786 791 # Calculate required image size in 512 Byte sectors
787 792 IMAGE_SECTORS=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}")
788 793
789 794 # Prepare image file
790 795 if [ "$ENABLE_SPLITFS" = true ] ; then
791 796 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count="${TABLE_SECTORS}"
792 797 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count=0 seek="${FRMW_SECTORS}"
793 798 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count="${TABLE_SECTORS}"
794 799 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count=0 seek="${ROOT_SECTORS}"
795 800
796 801 # Write firmware/boot partition tables
797 802 sfdisk -q -L -uS -f "$IMAGE_NAME-frmw.img" 2> /dev/null <<EOM
798 803 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
799 804 EOM
800 805
801 806 # Write root partition table
802 807 sfdisk -q -L -uS -f "$IMAGE_NAME-root.img" 2> /dev/null <<EOM
803 808 ${TABLE_SECTORS},${ROOT_SECTORS},83
804 809 EOM
805 810
806 811 # Setup temporary loop devices
807 812 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME"-frmw.img)"
808 813 ROOT_LOOP="$(losetup -o 1M -f --show "$IMAGE_NAME"-root.img)"
809 814 else # ENABLE_SPLITFS=false
810 815 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count="${TABLE_SECTORS}"
811 816 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count=0 seek="${IMAGE_SECTORS}"
812 817
813 818 # Write partition table
814 819 sfdisk -q -L -uS -f "$IMAGE_NAME.img" 2> /dev/null <<EOM
815 820 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
816 821 ${ROOT_OFFSET},${ROOT_SECTORS},83
817 822 EOM
818 823
819 824 # Setup temporary loop devices
820 825 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME".img)"
821 826 ROOT_LOOP="$(losetup -o 65M -f --show "$IMAGE_NAME".img)"
822 827 fi
823 828
824 829 if [ "$ENABLE_CRYPTFS" = true ] ; then
825 830 # Create dummy ext4 fs
826 831 mkfs.ext4 "$ROOT_LOOP"
827 832
828 833 # Setup password keyfile
829 834 touch .password
830 835 chmod 600 .password
831 836 echo -n ${CRYPTFS_PASSWORD} > .password
832 837
833 838 # Initialize encrypted partition
834 echo "YES" | cryptsetup luksFormat "${ROOT_LOOP}" -c "${CRYPTFS_CIPHER}" -s "${CRYPTFS_XTSKEYSIZE}" .password
839 cryptsetup --verbose --debug -q luksFormat "${ROOT_LOOP}" -c "${CRYPTFS_CIPHER}" -h "${CRYPTFS_HASH}" -s "${CRYPTFS_XTSKEYSIZE}" .password
835 840
836 841 # Open encrypted partition and setup mapping
837 842 cryptsetup luksOpen "${ROOT_LOOP}" -d .password "${CRYPTFS_MAPPING}"
838 843
839 844 # Secure delete password keyfile
840 845 shred -zu .password
841 846
842 847 # Update temporary loop device
843 848 ROOT_LOOP="/dev/mapper/${CRYPTFS_MAPPING}"
844 849
845 850 # Wipe encrypted partition (encryption cipher is used for randomness)
846 851 dd if=/dev/zero of="${ROOT_LOOP}" bs=512 count="$(blockdev --getsz "${ROOT_LOOP}")"
847 852 fi
848 853
849 854 # Build filesystems
850 855 mkfs.vfat "$FRMW_LOOP"
851 856 mkfs.ext4 "$ROOT_LOOP"
852 857
853 858 # Mount the temporary loop devices
854 859 mkdir -p "$BUILDDIR/mount"
855 860 mount "$ROOT_LOOP" "$BUILDDIR/mount"
856 861
857 862 mkdir -p "$BUILDDIR/mount/boot/firmware"
858 863 mount "$FRMW_LOOP" "$BUILDDIR/mount/boot/firmware"
859 864
860 865 # Copy all files from the chroot to the loop device mount point directory
861 866 rsync -a "${R}/" "$BUILDDIR/mount/"
862 867
863 868 # Unmount all temporary loop devices and mount points
864 869 cleanup
865 870
866 871 # Create block map file(s) of image(s)
867 872 if [ "$ENABLE_SPLITFS" = true ] ; then
868 873 # Create block map files for "bmaptool"
869 874 bmaptool create -o "$IMAGE_NAME-frmw.bmap" "$IMAGE_NAME-frmw.img"
870 875 bmaptool create -o "$IMAGE_NAME-root.bmap" "$IMAGE_NAME-root.img"
871 876
872 877 # Image was successfully created
873 878 echo "$IMAGE_NAME-frmw.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
874 879 echo "$IMAGE_NAME-root.img ($(expr \( "${TABLE_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
875 880 else
876 881 # Create block map file for "bmaptool"
877 882 bmaptool create -o "$IMAGE_NAME.bmap" "$IMAGE_NAME.img"
878 883
879 884 # Image was successfully created
880 885 echo "$IMAGE_NAME.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
881 886
882 887 # Create qemu qcow2 image
883 888 if [ "$ENABLE_QEMU" = true ] ; then
884 889 QEMU_IMAGE=${QEMU_IMAGE:=${BASEDIR}/qemu/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
885 890 QEMU_SIZE=16G
886 891
887 892 qemu-img convert -f raw -O qcow2 "$IMAGE_NAME".img "$QEMU_IMAGE".qcow2
888 893 qemu-img resize "$QEMU_IMAGE".qcow2 $QEMU_SIZE
889 894
890 895 echo "$QEMU_IMAGE.qcow2 ($QEMU_SIZE)" ": successfully created"
891 896 fi
892 897 fi
General Comments 0
Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant