##// END OF EJS Templates
Merge remote-tracking branch 'upstream/testing' into swap
Yannick Schinko -
r575:a72a8bcdbff3 Fusion
parent child
Show More
@@ -0,0 +1,97
1 #!/bin/sh
2 #
3 # Build and Setup nexmon with monitor mode patch
4 #
5
6 # Load utility functions
7 . ./functions.sh
8
9 if [ "$ENABLE_NEXMON" = true ] && [ "$ENABLE_WIRELESS" = true ]; then
10 # Copy existing nexmon sources into chroot directory
11 if [ -n "$NEXMONSRC_DIR" ] && [ -d "$NEXMONSRC_DIR" ] ; then
12 # Copy local U-Boot sources
13 cp -r "${NEXMONSRC_DIR}" "${R}/tmp"
14 else
15 # Create temporary directory for nexmon sources
16 temp_dir=$(as_nobody mktemp -d)
17
18 # Fetch nexmon sources
19 as_nobody git -C "${temp_dir}" clone "${NEXMON_URL}"
20
21 # Copy downloaded nexmon sources
22 mv "${temp_dir}/nexmon" "${R}"/tmp/
23
24 # Set permissions of the nexmon sources
25 chown -R root:root "${R}"/tmp/nexmon
26
27 # Remove temporary directory for nexmon sources
28 rm -fr "${temp_dir}"
29 fi
30
31 # Set script Root
32 export NEXMON_ROOT="${R}"/tmp/nexmon
33
34 # Build nexmon firmware outside the build system, if we can.
35 cd "${NEXMON_ROOT}" || exit
36
37 # Make ancient isl build
38 cd buildtools/isl-0.10 || exit
39 ./configure
40 make
41 cd ../.. || exit
42
43 # Disable statistics
44 touch DISABLE_STATISTICS
45
46 # Setup Enviroment: see https://github.com/NoobieDog/nexmon/blob/master/setup_env.sh
47 export KERNEL="${KERNEL_IMAGE}"
48 export ARCH=arm
49 export SUBARCH=arm
50 export CC="${NEXMON_ROOT}"/buildtools/gcc-arm-none-eabi-5_4-2016q2-linux-x86/bin/arm-none-eabi-
51 export CC="${CC}"gcc
52 export CCPLUGIN="${NEXMON_ROOT}"/buildtools/gcc-nexmon-plugin/nexmon.so
53 export ZLIBFLATE="zlib-flate -compress"
54 export Q=@
55 export NEXMON_SETUP_ENV=1
56 export HOSTUNAME=$(uname -s)
57 export PLATFORMUNAME=$(uname -m)
58
59 # Make nexmon
60 make
61
62 # build patches
63 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] ; then
64 cd "${NEXMON_ROOT}"/patches/bcm43430a1/7_45_41_46/nexmon || exit
65 sed -i -e 's/all:.*/all: $(RAM_FILE)/g' ${NEXMON_ROOT}/patches/bcm43430a1/7_45_41_46/nexmon/Makefile
66 make clean
67
68 # We do this so we don't have to install the ancient isl version into /usr/local/lib on systems.
69 LD_LIBRARY_PATH="${NEXMON_ROOT}"/buildtools/isl-0.10/.libs make ARCH="${KERNEL_ARCH}" CC="${NEXMON_ROOT}"/buildtools/gcc-arm-none-eabi-5_4-2016q2-linux-x86/bin/arm-none-eabi-
70
71 # copy RPi0W & RPi3 firmware
72 mv "${WLAN_FIRMWARE_DIR}"/brcmfmac43430-sdio.bin "${WLAN_FIRMWARE_DIR}"/brcmfmac43430-sdio.org.bin
73 cp "${NEXMON_ROOT}"/patches/bcm43430a1/7_45_41_46/nexmon/brcmfmac43430-sdio.bin "${WLAN_FIRMWARE_DIR}"/brcmfmac43430-sdio.nexmon.bin
74 cp -f "${NEXMON_ROOT}"/patches/bcm43430a1/7_45_41_46/nexmon/brcmfmac43430-sdio.bin "${WLAN_FIRMWARE_DIR}"/brcmfmac43430-sdio.bin
75 fi
76
77 if [ "$RPI_MODEL" = 3P ] ; then
78 cd "${NEXMON_ROOT}"/patches/bcm43455c0/7_45_154/nexmon || exit
79 sed -i -e 's/all:.*/all: $(RAM_FILE)/g' ${NEXMON_ROOT}/patches/bcm43455c0/7_45_154/nexmon/Makefile
80 make clean
81
82 # We do this so we don't have to install the ancient isl version into /usr/local/lib on systems.
83 LD_LIBRARY_PATH=${NEXMON_ROOT}/buildtools/isl-0.10/.libs make ARCH="${KERNEL_ARCH}" CC="${NEXMON_ROOT}"/buildtools/gcc-arm-none-eabi-5_4-2016q2-linux-x86/bin/arm-none-eabi-
84
85 # RPi3B+ firmware
86 mv "${WLAN_FIRMWARE_DIR}"/brcmfmac43455-sdio.bin "${WLAN_FIRMWARE_DIR}"/brcmfmac43455-sdio.org.bin
87 cp "${NEXMON_ROOT}"/patches/bcm43455c0/7_45_154/nexmon/brcmfmac43455-sdio.bin "${WLAN_FIRMWARE_DIR}"/brcmfmac43455-sdio.nexmon.bin
88 cp -f "${NEXMON_ROOT}"/patches/bcm43455c0/7_45_154/nexmon/brcmfmac43455-sdio.bin "${WLAN_FIRMWARE_DIR}"/brcmfmac43455-sdio.bin
89 fi
90
91 #Revert to previous directory
92 cd "${WORKDIR}" || exit
93
94 # Remove nexmon sources
95 rm -fr "${NEXMON_ROOT}"
96
97 fi
@@ -0,0 +1,45
1 #!/bin/sh
2
3 PREREQ="dropbear"
4
5 prereqs() {
6 echo "$PREREQ"
7 }
8
9 case "$1" in
10 prereqs)
11 prereqs
12 exit 0
13 ;;
14 esac
15
16 . "${CONFDIR}/initramfs.conf"
17 . /usr/share/initramfs-tools/hook-functions
18
19 if [ "${DROPBEAR}" != "n" ] && [ -r "/etc/crypttab" ] ; then
20 cat > "${DESTDIR}/bin/unlock" << EOF
21 #!/bin/sh
22 if PATH=/lib/unlock:/bin:/sbin /scripts/local-top/cryptroot; then
23 kill \`ps | grep cryptroot | grep -v "grep" | awk '{print \$1}'\`
24 # following line kill the remote shell right after the passphrase has
25 # been entered.
26 kill -9 \`ps | grep "\-sh" | grep -v "grep" | awk '{print \$1}'\`
27 exit 0
28 fi
29 exit 1
30 EOF
31
32 chmod 755 "${DESTDIR}/bin/unlock"
33
34 mkdir -p "${DESTDIR}/lib/unlock"
35 cat > "${DESTDIR}/lib/unlock/plymouth" << EOF
36 #!/bin/sh
37 [ "\$1" == "--ping" ] && exit 1
38 /bin/plymouth "\$@"
39 EOF
40
41 chmod 755 "${DESTDIR}/lib/unlock/plymouth"
42
43 echo To unlock root-partition run "unlock" >> ${DESTDIR}/etc/motd
44
45 fi No newline at end of file
@@ -1,503 +1,547
1 # rpi23-gen-image
1 # rpi23-gen-image
2 ## Introduction
2 ## Introduction
3 `rpi23-gen-image.sh` is an advanced Debian Linux bootstrapping shell script for generating Debian OS images for all Raspberry Pi computers. The script at this time supports the bootstrapping of the Debian (armhf/armel) releases `stretch` and `buster`. Raspberry Pi 0/1/2/3 images are generated for 32-bit mode only. Raspberry Pi 3 supports 64-bit images that can be generated using custom configuration parameters (```templates/rpi3-stretch-arm64-4.14.y```).
3 `rpi23-gen-image.sh` is an advanced Debian Linux bootstrapping shell script for generating Debian OS images for all Raspberry Pi computers. The script at this time supports the bootstrapping of the Debian (armhf/armel) releases `stretch` and `buster`. Raspberry Pi 0/1/2/3 images are generated for 32-bit mode only. Raspberry Pi 3 supports 64-bit images that can be generated using custom configuration parameters (```templates/rpi3-stretch-arm64-4.14.y```).
4
4
5 ## Build dependencies
5 ## Build dependencies
6 The following list of Debian packages must be installed on the build system because they are essentially required for the bootstrapping process. The script will check if all required packages are installed and missing packages will be installed automatically if confirmed by the user.
6 The following list of Debian packages must be installed on the build system because they are essentially required for the bootstrapping process. The script will check if all required packages are installed and missing packages will be installed automatically if confirmed by the user.
7
7
8 ```debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo```
8 ```debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo```
9
9
10 It is recommended to configure the `rpi23-gen-image.sh` script to build and install the latest Raspberry Pi Linux kernel. For the Raspberry 3 this is mandatory. Kernel compilation and linking will be performed on the build system using an ARM (armhf/armel) cross-compiler toolchain.
10 It is recommended to configure the `rpi23-gen-image.sh` script to build and install the latest Raspberry Pi Linux kernel. For the Raspberry 3 this is mandatory. Kernel compilation and linking will be performed on the build system using an ARM (armhf/armel) cross-compiler toolchain.
11
11
12 The script has been tested using the default `crossbuild-essential-armhf` and `crossbuild-essential-armel` toolchain meta packages on Debian Linux `stretch` build systems. Please check the [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains) for further information.
12 The script has been tested using the default `crossbuild-essential-armhf` and `crossbuild-essential-armel` toolchain meta packages on Debian Linux `stretch` build systems. Please check the [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains) for further information.
13
13
14 ## Command-line parameters
14 ## Command-line parameters
15 The script accepts certain command-line parameters to enable or disable specific OS features, services and configuration settings. These parameters are passed to the `rpi23-gen-image.sh` script via (simple) shell-variables. Unlike environment shell-variables (simple) shell-variables are defined at the beginning of the command-line call of the `rpi23-gen-image.sh` script.
15 The script accepts certain command-line parameters to enable or disable specific OS features, services and configuration settings. These parameters are passed to the `rpi23-gen-image.sh` script via (simple) shell-variables. Unlike environment shell-variables (simple) shell-variables are defined at the beginning of the command-line call of the `rpi23-gen-image.sh` script.
16
16
17 ##### Command-line examples:
17 ##### Command-line examples:
18 ```shell
18 ```shell
19 ENABLE_UBOOT=true ./rpi23-gen-image.sh
19 ENABLE_UBOOT=true ./rpi23-gen-image.sh
20 ENABLE_CONSOLE=false ENABLE_IPV6=false ./rpi23-gen-image.sh
20 ENABLE_CONSOLE=false ENABLE_IPV6=false ./rpi23-gen-image.sh
21 ENABLE_WM=xfce4 ENABLE_FBTURBO=true ENABLE_MINBASE=true ./rpi23-gen-image.sh
21 ENABLE_WM=xfce4 ENABLE_FBTURBO=true ENABLE_MINBASE=true ./rpi23-gen-image.sh
22 ENABLE_HARDNET=true ENABLE_IPTABLES=true /rpi23-gen-image.sh
22 ENABLE_HARDNET=true ENABLE_IPTABLES=true /rpi23-gen-image.sh
23 APT_SERVER=ftp.de.debian.org APT_PROXY="http://127.0.0.1:3142/" ./rpi23-gen-image.sh
23 APT_SERVER=ftp.de.debian.org APT_PROXY="http://127.0.0.1:3142/" ./rpi23-gen-image.sh
24 ENABLE_MINBASE=true ./rpi23-gen-image.sh
24 ENABLE_MINBASE=true ./rpi23-gen-image.sh
25 BUILD_KERNEL=true ENABLE_MINBASE=true ENABLE_IPV6=false ./rpi23-gen-image.sh
25 BUILD_KERNEL=true ENABLE_MINBASE=true ENABLE_IPV6=false ./rpi23-gen-image.sh
26 BUILD_KERNEL=true KERNELSRC_DIR=/tmp/linux ./rpi23-gen-image.sh
26 BUILD_KERNEL=true KERNELSRC_DIR=/tmp/linux ./rpi23-gen-image.sh
27 ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
27 ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
28 ENABLE_CRYPTFS=true CRYPTFS_PASSWORD=changeme EXPANDROOT=false ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
28 ENABLE_CRYPTFS=true CRYPTFS_PASSWORD=changeme EXPANDROOT=false ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
29 RELEASE=stretch BUILD_KERNEL=true ./rpi23-gen-image.sh
29 RELEASE=stretch BUILD_KERNEL=true ./rpi23-gen-image.sh
30 RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
30 RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
31 RELEASE=stretch RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
31 RELEASE=stretch RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
32 ```
32 ```
33
33
34 ## Configuration template files
34 ## Configuration template files
35 To avoid long lists of command-line parameters and to help to store the favourite parameter configurations the `rpi23-gen-image.sh` script supports so called configuration template files (`CONFIG_TEMPLATE`=template). These are simple text files located in the `./templates` directory that contain the list of configuration parameters that will be used. New configuration template files can be added to the `./templates` directory.
35 To avoid long lists of command-line parameters and to help to store the favourite parameter configurations the `rpi23-gen-image.sh` script supports so called configuration template files (`CONFIG_TEMPLATE`=template). These are simple text files located in the `./templates` directory that contain the list of configuration parameters that will be used. New configuration template files can be added to the `./templates` directory.
36
36
37 ##### Command-line examples:
37 ##### Command-line examples:
38 ```shell
38 ```shell
39 CONFIG_TEMPLATE=rpi3stretch ./rpi23-gen-image.sh
39 CONFIG_TEMPLATE=rpi3stretch ./rpi23-gen-image.sh
40 CONFIG_TEMPLATE=rpi2stretch ./rpi23-gen-image.sh
40 CONFIG_TEMPLATE=rpi2stretch ./rpi23-gen-image.sh
41 ```
41 ```
42
42
43 ## Supported parameters and settings
43 ## Supported parameters and settings
44 #### APT settings:
44 #### APT settings:
45 ##### `APT_SERVER`="ftp.debian.org"
45 ##### `APT_SERVER`="ftp.debian.org"
46 Set Debian packages server address. Choose a server from the list of Debian worldwide [mirror sites](https://www.debian.org/mirror/list). Using a nearby server will probably speed-up all required downloads within the bootstrapping process.
46 Set Debian packages server address. Choose a server from the list of Debian worldwide [mirror sites](https://www.debian.org/mirror/list). Using a nearby server will probably speed-up all required downloads within the bootstrapping process.
47
47
48 ##### `APT_PROXY`=""
48 ##### `APT_PROXY`=""
49 Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will speed-up the bootstrapping process because all required Debian packages will only be downloaded from the Debian mirror site once. If `apt-cacher-ng` is running on default `http://127.0.0.1:3142` it is autodetected and you don't need to set this.
49 Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will speed-up the bootstrapping process because all required Debian packages will only be downloaded from the Debian mirror site once. If `apt-cacher-ng` is running on default `http://127.0.0.1:3142` it is autodetected and you don't need to set this.
50
50
51 ##### `KEEP_APT_PROXY`=false
52 Keep the APT_PROXY settings used in the bootsrapping process in the generated image.
53
51 ##### `APT_INCLUDES`=""
54 ##### `APT_INCLUDES`=""
52 A comma-separated list of additional packages to be installed by debootstrap during bootstrapping.
55 A comma-separated list of additional packages to be installed by debootstrap during bootstrapping.
53
56
54 ##### `APT_INCLUDES_LATE`=""
57 ##### `APT_INCLUDES_LATE`=""
55 A comma-separated list of additional packages to be installed by apt after bootstrapping and after APT sources are set up. This is useful for packages with pre-depends, which debootstrap do not handle well.
58 A comma-separated list of additional packages to be installed by apt after bootstrapping and after APT sources are set up. This is useful for packages with pre-depends, which debootstrap do not handle well.
56
59
57 ---
60 ---
58
61
59 #### General system settings:
62 #### General system settings:
60 ##### `SET_ARCH`=32
63 ##### `SET_ARCH`=32
61 Set Architecture to default 32bit. If you want to compile 64-bit (RPI3 or RPI3+) set it to `64`. This option will set every needed cross-compiler or board specific option for a successful build.
64 Set Architecture to default 32bit. If you want to compile 64-bit (RPI3 or RPI3+) set it to `64`. This option will set every needed cross-compiler or board specific option for a successful build.
62
65
63 ##### `RPI_MODEL`=2
66 ##### `RPI_MODEL`=2
64 Specify the target Raspberry Pi hardware model. The script at this time supports the following Raspberry Pi models:
67 Specify the target Raspberry Pi hardware model. The script at this time supports the following Raspberry Pi models:
65 - `0` = Raspberry Pi 0 and Raspberry Pi 0 W
68 - `0` = Raspberry Pi 0 and Raspberry Pi 0 W
66 - `1` = Raspberry Pi 1 model A and B
69 - `1` = Raspberry Pi 1 model A and B
67 - `1P` = Raspberry Pi 1 model B+ and A+
70 - `1P` = Raspberry Pi 1 model B+ and A+
68 - `2` = Raspberry Pi 2 model B
71 - `2` = Raspberry Pi 2 model B
69 - `3` = Raspberry Pi 3 model B
72 - `3` = Raspberry Pi 3 model B
70 - `3P` = Raspberry Pi 3 model B+
73 - `3P` = Raspberry Pi 3 model B+
71
74
72 ##### `RELEASE`="buster"
75 ##### `RELEASE`="buster"
73 Set the desired Debian release name. The script at this time supports the bootstrapping of the Debian releases `stretch` and `buster`.
76 Set the desired Debian release name. The script at this time supports the bootstrapping of the Debian releases `stretch` and `buster`.
74
77
75 ##### `RELEASE_ARCH`="armhf"
78 ##### `RELEASE_ARCH`="armhf"
76 Set the desired Debian release architecture.
79 Set the desired Debian release architecture.
77
80
78 ##### `HOSTNAME`="rpi$RPI_MODEL-$RELEASE"
81 ##### `HOSTNAME`="rpi$RPI_MODEL-$RELEASE"
79 Set system hostname. It's recommended that the hostname is unique in the corresponding subnet.
82 Set system hostname. It's recommended that the hostname is unique in the corresponding subnet.
80
83
81 ##### `PASSWORD`="raspberry"
84 ##### `PASSWORD`="raspberry"
82 Set system `root` password. It's **STRONGLY** recommended that you choose a custom password.
85 Set system `root` password. It's **STRONGLY** recommended that you choose a custom password.
83
86
84 ##### `USER_PASSWORD`="raspberry"
87 ##### `USER_PASSWORD`="raspberry"
85 Set password for the created non-root user `USER_NAME`=pi. Ignored if `ENABLE_USER`=false. It's **STRONGLY** recommended that you choose a custom password.
88 Set password for the created non-root user `USER_NAME`=pi. Ignored if `ENABLE_USER`=false. It's **STRONGLY** recommended that you choose a custom password.
86
89
87 ##### `DEFLOCAL`="en_US.UTF-8"
90 ##### `DEFLOCAL`="en_US.UTF-8"
88 Set default system locale. This setting can also be changed inside the running OS using the `dpkg-reconfigure locales` command. Please note that on using this parameter the script will automatically install the required packages `locales`, `keyboard-configuration` and `console-setup`.
91 Set default system locale. This setting can also be changed inside the running OS using the `dpkg-reconfigure locales` command. Please note that on using this parameter the script will automatically install the required packages `locales`, `keyboard-configuration` and `console-setup`.
89
92
90 ##### `TIMEZONE`="Europe/Berlin"
93 ##### `TIMEZONE`="Europe/Berlin"
91 Set default system timezone. All available timezones can be found in the `/usr/share/zoneinfo/` directory. This setting can also be changed inside the running OS using the `dpkg-reconfigure tzdata` command.
94 Set default system timezone. All available timezones can be found in the `/usr/share/zoneinfo/` directory. This setting can also be changed inside the running OS using the `dpkg-reconfigure tzdata` command.
92
95
93 ##### `EXPANDROOT`=true
96 ##### `EXPANDROOT`=true
94 Expand the root partition and filesystem automatically on first boot.
97 Expand the root partition and filesystem automatically on first boot.
95
98
96 ##### `ENABLE_DPHYSSWAP`=true
99 ##### `ENABLE_DPHYSSWAP`=true
97 Enable swap. The size of the swapfile is chosen relative to the size of the root partition. It'll use the `dphys-swapfile` package for that.
100 Enable swap. The size of the swapfile is chosen relative to the size of the root partition. It'll use the `dphys-swapfile` package for that.
98
101
99 ##### `ENABLE_QEMU`=false
102 ##### `ENABLE_QEMU`=false
100 Generate kernel (`vexpress_defconfig`), file system image (`qcow2`) and DTB files that can be used for QEMU full system emulation (`vexpress-A15`). The output files are stored in the `$(pwd)/images/qemu` directory. You can find more information about running the generated image in the QEMU section of this readme file.
103 Generate kernel (`vexpress_defconfig`), file system image (`qcow2`) and DTB files that can be used for QEMU full system emulation (`vexpress-A15`). The output files are stored in the `$(pwd)/images/qemu` directory. You can find more information about running the generated image in the QEMU section of this readme file.
101
104
102 ---
105 ---
103
106
104 #### Keyboard settings:
107 #### Keyboard settings:
105 These options are used to configure keyboard layout in `/etc/default/keyboard` for console and Xorg. These settings can also be changed inside the running OS using the `dpkg-reconfigure keyboard-configuration` command.
108 These options are used to configure keyboard layout in `/etc/default/keyboard` for console and Xorg. These settings can also be changed inside the running OS using the `dpkg-reconfigure keyboard-configuration` command.
106
109
107 ##### `XKB_MODEL`=""
110 ##### `XKB_MODEL`=""
108 Set the name of the model of your keyboard type.
111 Set the name of the model of your keyboard type.
109
112
110 ##### `XKB_LAYOUT`=""
113 ##### `XKB_LAYOUT`=""
111 Set the supported keyboard layout(s).
114 Set the supported keyboard layout(s).
112
115
113 ##### `XKB_VARIANT`=""
116 ##### `XKB_VARIANT`=""
114 Set the supported variant(s) of the keyboard layout(s).
117 Set the supported variant(s) of the keyboard layout(s).
115
118
116 ##### `XKB_OPTIONS`=""
119 ##### `XKB_OPTIONS`=""
117 Set extra xkb configuration options.
120 Set extra xkb configuration options.
118
121
119 ---
122 ---
120
123
121 #### Networking settings (DHCP):
124 #### Networking settings (DHCP):
122 This parameter is used to set up networking auto-configuration in `/etc/systemd/network/eth.network`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.`
125 This parameter is used to set up networking auto-configuration in `/etc/systemd/network/eth.network`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.`
123
126
124 ##### `ENABLE_DHCP`=true
127 ##### `ENABLE_DHCP`=true
125 Set the system to use DHCP. This requires an DHCP server.
128 Set the system to use DHCP. This requires an DHCP server.
126
129
127 ---
130 ---
128
131
129 #### Networking settings (static):
132 #### Networking settings (static):
130 These parameters are used to set up a static networking configuration in `/etc/systemd/network/eth.network`. The following static networking parameters are only supported if `ENABLE_DHCP` was set to `false`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.
133 These parameters are used to set up a static networking configuration in `/etc/systemd/network/eth.network`. The following static networking parameters are only supported if `ENABLE_DHCP` was set to `false`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.
131
134
132 ##### `NET_ADDRESS`=""
135 ##### `NET_ADDRESS`=""
133 Set a static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24".
136 Set a static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24".
134
137
135 ##### `NET_GATEWAY`=""
138 ##### `NET_GATEWAY`=""
136 Set the IP address for the default gateway.
139 Set the IP address for the default gateway.
137
140
138 ##### `NET_DNS_1`=""
141 ##### `NET_DNS_1`=""
139 Set the IP address for the first DNS server.
142 Set the IP address for the first DNS server.
140
143
141 ##### `NET_DNS_2`=""
144 ##### `NET_DNS_2`=""
142 Set the IP address for the second DNS server.
145 Set the IP address for the second DNS server.
143
146
144 ##### `NET_DNS_DOMAINS`=""
147 ##### `NET_DNS_DOMAINS`=""
145 Set the default DNS search domains to use for non fully qualified hostnames.
148 Set the default DNS search domains to use for non fully qualified hostnames.
146
149
147 ##### `NET_NTP_1`=""
150 ##### `NET_NTP_1`=""
148 Set the IP address for the first NTP server.
151 Set the IP address for the first NTP server.
149
152
150 ##### `NET_NTP_2`=""
153 ##### `NET_NTP_2`=""
151 Set the IP address for the second NTP server.
154 Set the IP address for the second NTP server.
152
155
153 ---
156 ---
154
157
155 #### Basic system features:
158 #### Basic system features:
156 ##### `ENABLE_CONSOLE`=true
159 ##### `ENABLE_CONSOLE`=true
157 Enable serial console interface. Recommended if no monitor or keyboard is connected to the RPi2/3. In case of problems fe. if the network (auto) configuration failed - the serial console can be used to access the system. On RPI `0` `3` `3P` the CPU speed is locked at lowest speed.
160 Enable serial console interface. Recommended if no monitor or keyboard is connected to the RPi2/3. In case of problems fe. if the network (auto) configuration failed - the serial console can be used to access the system. On RPI `0` `3` `3P` the CPU speed is locked at lowest speed.
158
161
159 ##### `ENABLE_PRINTK`=false
162 ##### `ENABLE_PRINTK`=false
160 Enables printing kernel messages to konsole. printk is `3 4 1 3` as in raspbian.
163 Enables printing kernel messages to konsole. printk is `3 4 1 3` as in raspbian.
161
164
162 ##### `ENABLE_BLUETOOTH`=false
165 ##### `ENABLE_BLUETOOTH`=false
163 Enable onboard Bluetooth interface on the RPi0/3/3P. See: [Configuring the GPIO serial port on Raspbian jessie and stretch](https://spellfoundry.com/2016/05/29/configuring-gpio-serial-port-raspbian-jessie-including-pi-3/).
166 Enable onboard Bluetooth interface on the RPi0/3/3P. See: [Configuring the GPIO serial port on Raspbian jessie and stretch](https://spellfoundry.com/2016/05/29/configuring-gpio-serial-port-raspbian-jessie-including-pi-3/).
164
167
165 ##### `ENABLE_MINIUART_OVERLAY`=false
168 ##### `ENABLE_MINIUART_OVERLAY`=false
166 Enable Bluetooth to use this. Adds overlay to swap UART0 with UART1. Enabling (slower) Bluetooth and full speed serial console. - RPI `0` `3` `3P` have a fast `hardware UART0` (ttyAMA0) and a `mini UART1` (ttyS0)! RPI `1` `1P` `2` only have a `hardware UART0`. `UART0` is considered better, because is faster and more stable than `mini UART1`. By default the Bluetooth modem is mapped to the `hardware UART0` and `mini UART` is used for console. The `mini UART` is a problem for the serial console, because its baudrate depends on the CPU frequency, which is changing on runtime. Resulting in a volatile baudrate and thus in an unusable serial console.
169 Enable Bluetooth to use this. Adds overlay to swap UART0 with UART1. Enabling (slower) Bluetooth and full speed serial console. - RPI `0` `3` `3P` have a fast `hardware UART0` (ttyAMA0) and a `mini UART1` (ttyS0)! RPI `1` `1P` `2` only have a `hardware UART0`. `UART0` is considered better, because is faster and more stable than `mini UART1`. By default the Bluetooth modem is mapped to the `hardware UART0` and `mini UART` is used for console. The `mini UART` is a problem for the serial console, because its baudrate depends on the CPU frequency, which is changing on runtime. Resulting in a volatile baudrate and thus in an unusable serial console.
167
170
168 ##### `ENABLE_TURBO`=false
171 ##### `ENABLE_TURBO`=false
169 Enable Turbo mode. This setting locks cpu at the highest frequency. As setting ENABLE_CONSOLE=true locks RPI to lowest CPU speed, this is can be used additionally to lock cpu hat max speed. Need a good power supply and probably cooling for the Raspberry PI.
172 Enable Turbo mode. This setting locks cpu at the highest frequency. As setting ENABLE_CONSOLE=true locks RPI to lowest CPU speed, this is can be used additionally to lock cpu hat max speed. Need a good power supply and probably cooling for the Raspberry PI.
170
173
171 ##### `ENABLE_I2C`=false
174 ##### `ENABLE_I2C`=false
172 Enable I2C interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
175 Enable I2C interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
173
176
174 ##### `ENABLE_SPI`=false
177 ##### `ENABLE_SPI`=false
175 Enable SPI interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
178 Enable SPI interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
176
179
177 ##### `ENABLE_IPV6`=true
180 ##### `ENABLE_IPV6`=true
178 Enable IPv6 support. The network interface configuration is managed via systemd-networkd.
181 Enable IPv6 support. The network interface configuration is managed via systemd-networkd.
179
182
180 ##### `ENABLE_SSHD`=true
183 ##### `ENABLE_SSHD`=true
181 Install and enable OpenSSH service. The default configuration of the service doesn't allow `root` to login. Please use the user `pi` instead and `su -` or `sudo` to execute commands as root.
184 Install and enable OpenSSH service. The default configuration of the service doesn't allow `root` to login. Please use the user `pi` instead and `su -` or `sudo` to execute commands as root.
182
185
183 ##### `ENABLE_NONFREE`=false
186 ##### `ENABLE_NONFREE`=false
184 Allow the installation of non-free Debian packages that do not comply with the DFSG. This is required to install closed-source firmware binary blobs.
187 Allow the installation of non-free Debian packages that do not comply with the DFSG. This is required to install closed-source firmware binary blobs.
185
188
186 ##### `ENABLE_WIRELESS`=false
189 ##### `ENABLE_WIRELESS`=false
187 Download and install the [closed-source firmware binary blob](https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm) that is required to run the internal wireless interface of the Raspberry Pi model `3`. This parameter is ignored if the specified `RPI_MODEL` is not `3`.
190 Download and install the [closed-source firmware binary blob](https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm) that is required to run the internal wireless interface of the Raspberry Pi model `3`. This parameter is ignored if the specified `RPI_MODEL` is not `3`.
188
191
189 ##### `ENABLE_RSYSLOG`=true
192 ##### `ENABLE_RSYSLOG`=true
190 If set to false, disable and uninstall rsyslog (so logs will be available only in journal files)
193 If set to false, disable and uninstall rsyslog (so logs will be available only in journal files)
191
194
192 ##### `ENABLE_SOUND`=true
195 ##### `ENABLE_SOUND`=true
193 Enable sound hardware and install Advanced Linux Sound Architecture.
196 Enable sound hardware and install Advanced Linux Sound Architecture.
194
197
195 ##### `ENABLE_HWRANDOM`=true
198 ##### `ENABLE_HWRANDOM`=true
196 Enable Hardware Random Number Generator. Strong random numbers are important for most network-based communications that use encryption. It's recommended to be enabled.
199 Enable Hardware Random Number Generator. Strong random numbers are important for most network-based communications that use encryption. It's recommended to be enabled.
197
200
198 ##### `ENABLE_MINGPU`=false
201 ##### `ENABLE_MINGPU`=false
199 Minimize the amount of shared memory reserved for the GPU. It doesn't seem to be possible to fully disable the GPU.
202 Minimize the amount of shared memory reserved for the GPU. It doesn't seem to be possible to fully disable the GPU.
200
203
201 ##### `ENABLE_DBUS`=true
204 ##### `ENABLE_DBUS`=true
202 Install and enable D-Bus message bus. Please note that systemd should work without D-bus but it's recommended to be enabled.
205 Install and enable D-Bus message bus. Please note that systemd should work without D-bus but it's recommended to be enabled.
203
206
204 ##### `ENABLE_XORG`=false
207 ##### `ENABLE_XORG`=false
205 Install Xorg open-source X Window System.
208 Install Xorg open-source X Window System.
206
209
207 ##### `ENABLE_WM`=""
210 ##### `ENABLE_WM`=""
208 Install a user-defined window manager for the X Window System. To make sure all X related package dependencies are getting installed `ENABLE_XORG` will automatically get enabled if `ENABLE_WM` is used. The `rpi23-gen-image.sh` script has been tested with the following list of window managers: `blackbox`, `openbox`, `fluxbox`, `jwm`, `dwm`, `xfce4`, `awesome`.
211 Install a user-defined window manager for the X Window System. To make sure all X related package dependencies are getting installed `ENABLE_XORG` will automatically get enabled if `ENABLE_WM` is used. The `rpi23-gen-image.sh` script has been tested with the following list of window managers: `blackbox`, `openbox`, `fluxbox`, `jwm`, `dwm`, `xfce4`, `awesome`.
209
212
210 ##### `ENABLE_SYSVINIT`=false
213 ##### `ENABLE_SYSVINIT`=false
211 Support for halt,init,poweroff,reboot,runlevel,shutdown,telinit commands
214 Support for halt,init,poweroff,reboot,runlevel,shutdown,telinit commands
212
215
213 ---
216 ---
214
217
215 #### Advanced system features:
218 #### Advanced system features:
219 ##### `ENABLE_SYSTEMDSWAP`=false
220 Enables [Systemd-swap service](https://github.com/Nefelim4ag/systemd-swap). Usefull if `KERNEL_ZSWAP` is enabled.
221
216 ##### `ENABLE_MINBASE`=false
222 ##### `ENABLE_MINBASE`=false
217 Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.
223 Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.
218
224
219 ##### `ENABLE_REDUCE`=false
225 ##### `ENABLE_REDUCE`=false
220 Reduce the disk space usage by deleting packages and files. See `REDUCE_*` parameters for detailed information.
226 Reduce the disk space usage by deleting packages and files. See `REDUCE_*` parameters for detailed information.
221
227
222 ##### `ENABLE_UBOOT`=false
228 ##### `ENABLE_UBOOT`=false
223 Replace the default RPi 0/1/2/3 second stage bootloader (bootcode.bin) with [U-Boot bootloader](https://git.denx.de/?p=u-boot.git;a=summary). U-Boot can boot images via the network using the BOOTP/TFTP protocol.
229 Replace the default RPi 0/1/2/3 second stage bootloader (bootcode.bin) with [U-Boot bootloader](https://git.denx.de/?p=u-boot.git;a=summary). U-Boot can boot images via the network using the BOOTP/TFTP protocol.
224
230
225 ##### `UBOOTSRC_DIR`=""
231 ##### `UBOOTSRC_DIR`=""
226 Path to a directory (`u-boot`) of [U-Boot bootloader sources](https://git.denx.de/?p=u-boot.git;a=summary) that will be copied, configured, build and installed inside the chroot.
232 Path to a directory (`u-boot`) of [U-Boot bootloader sources](https://git.denx.de/?p=u-boot.git;a=summary) that will be copied, configured, build and installed inside the chroot.
227
233
228 ##### `ENABLE_FBTURBO`=false
234 ##### `ENABLE_FBTURBO`=false
229 Install and enable the [hardware accelerated Xorg video driver](https://github.com/ssvb/xf86-video-fbturbo) `fbturbo`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
235 Install and enable the [hardware accelerated Xorg video driver](https://github.com/ssvb/xf86-video-fbturbo) `fbturbo`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
230
236
231 ##### `FBTURBOSRC_DIR`=""
237 ##### `FBTURBOSRC_DIR`=""
232 Path to a directory (`xf86-video-fbturbo`) of [hardware accelerated Xorg video driver sources](https://github.com/ssvb/xf86-video-fbturbo) that will be copied, configured, build and installed inside the chroot.
238 Path to a directory (`xf86-video-fbturbo`) of [hardware accelerated Xorg video driver sources](https://github.com/ssvb/xf86-video-fbturbo) that will be copied, configured, build and installed inside the chroot.
233
239
234 ##### `ENABLE_VIDEOCORE`=false
240 ##### `ENABLE_VIDEOCORE`=false
235 Install and enable the [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) `vcgencmd`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
241 Install and enable the [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) `vcgencmd`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
236
242
237 ##### `VIDEOCORESRC_DIR`=""
243 ##### `VIDEOCORESRC_DIR`=""
238 Path to a directory (`userland`) of [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot.
244 Path to a directory (`userland`) of [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot.
239
245
246 ##### `ENABLE_NEXMON`=false
247 Install and enable the [Source code for a C-based firmware patching framework for Broadcom/Cypress WiFi chips that enables you to write your own firmware patches, for example, to enable monitor mode with radiotap headers and frame injection](https://github.com/seemoo-lab/nexmon.git).
248
249 ##### `NEXMONSRC_DIR`=""
250 Path to a directory (`nexmon`) of [Source code for ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot.
251
240 ##### `ENABLE_IPTABLES`=false
252 ##### `ENABLE_IPTABLES`=false
241 Enable iptables IPv4/IPv6 firewall. Simplified ruleset: Allow all outgoing connections. Block all incoming connections except to OpenSSH service.
253 Enable iptables IPv4/IPv6 firewall. Simplified ruleset: Allow all outgoing connections. Block all incoming connections except to OpenSSH service.
242
254
243 ##### `ENABLE_USER`=true
255 ##### `ENABLE_USER`=true
244 Create non-root user with password `USER_PASSWORD`=raspberry. Unless overridden with `USER_NAME`=user, the username will be `pi`.
256 Create non-root user with password `USER_PASSWORD`=raspberry. Unless overridden with `USER_NAME`=user, the username will be `pi`.
245
257
246 ##### `USER_NAME`=pi
258 ##### `USER_NAME`=pi
247 Non-root user to create. Ignored if `ENABLE_USER`=false
259 Non-root user to create. Ignored if `ENABLE_USER`=false
248
260
249 ##### `ENABLE_ROOT`=false
261 ##### `ENABLE_ROOT`=false
250 Set root user password so root login will be enabled
262 Set root user password so root login will be enabled
251
263
252 ##### `ENABLE_HARDNET`=false
264 ##### `ENABLE_HARDNET`=false
253 Enable IPv4/IPv6 network stack hardening settings.
265 Enable IPv4/IPv6 network stack hardening settings.
254
266
255 ##### `ENABLE_SPLITFS`=false
267 ##### `ENABLE_SPLITFS`=false
256 Enable having root partition on an USB drive by creating two image files: one for the `/boot/firmware` mount point, and another for `/`.
268 Enable having root partition on an USB drive by creating two image files: one for the `/boot/firmware` mount point, and another for `/`.
257
269
258 ##### `CHROOT_SCRIPTS`=""
270 ##### `CHROOT_SCRIPTS`=""
259 Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this directory is run in lexicographical order.
271 Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this directory is run in lexicographical order.
260
272
261 ##### `ENABLE_INITRAMFS`=false
273 ##### `ENABLE_INITRAMFS`=false
262 Create an initramfs that that will be loaded during the Linux startup process. `ENABLE_INITRAMFS` will automatically get enabled if `ENABLE_CRYPTFS`=true. This parameter will be ignored if `BUILD_KERNEL`=false.
274 Create an initramfs that that will be loaded during the Linux startup process. `ENABLE_INITRAMFS` will automatically get enabled if `ENABLE_CRYPTFS`=true. This parameter will be ignored if `BUILD_KERNEL`=false.
263
275
264 ##### `ENABLE_IFNAMES`=true
276 ##### `ENABLE_IFNAMES`=true
265 Enable automatic assignment of predictable, stable network interface names for all local Ethernet, WLAN interfaces. This might create complex and long interface names.
277 Enable automatic assignment of predictable, stable network interface names for all local Ethernet, WLAN interfaces. This might create complex and long interface names.
266
278
279 ##### `ENABLE_SPLASH`=true
280 Enable default Raspberry Pi boot up rainbow splash screen.
281
282 ##### `ENABLE_LOGO`=true
283 Enable default Raspberry Pi console logo (image of four raspberries in the top left corner).
284
285 ##### `ENABLE_SILENT_BOOT`=false
286 Set the verbosity of console messages shown during boot up to a strict minimum.
287
267 ##### `DISABLE_UNDERVOLT_WARNINGS`=
288 ##### `DISABLE_UNDERVOLT_WARNINGS`=
268 Disable RPi2/3 under-voltage warnings and overlays. Setting the parameter to `1` will disable the warning overlay. Setting it to `2` will additionally allow RPi2/3 turbo mode when low-voltage is present.
289 Disable RPi2/3 under-voltage warnings and overlays. Setting the parameter to `1` will disable the warning overlay. Setting it to `2` will additionally allow RPi2/3 turbo mode when low-voltage is present.
269
290
270 ---
291 ---
271
292
272 #### SSH settings:
293 #### SSH settings:
273 ##### `SSH_ENABLE_ROOT`=false
294 ##### `SSH_ENABLE_ROOT`=false
274 Enable password-based root login via SSH. This may be a security risk with the default password set, use only in trusted environments. `ENABLE_ROOT` must be set to `true`.
295 Enable password-based root login via SSH. This may be a security risk with the default password set, use only in trusted environments. `ENABLE_ROOT` must be set to `true`.
275
296
276 ##### `SSH_DISABLE_PASSWORD_AUTH`=false
297 ##### `SSH_DISABLE_PASSWORD_AUTH`=false
277 Disable password-based SSH authentication. Only public key based SSH (v2) authentication will be supported.
298 Disable password-based SSH authentication. Only public key based SSH (v2) authentication will be supported.
278
299
279 ##### `SSH_LIMIT_USERS`=false
300 ##### `SSH_LIMIT_USERS`=false
280 Limit the users that are allowed to login via SSH. Only allow user `USER_NAME`=pi and root if `SSH_ENABLE_ROOT`=true to login. This parameter will be ignored if `dropbear` SSH is used (`REDUCE_SSHD`=true).
301 Limit the users that are allowed to login via SSH. Only allow user `USER_NAME`=pi and root if `SSH_ENABLE_ROOT`=true to login. This parameter will be ignored if `dropbear` SSH is used (`REDUCE_SSHD`=true).
281
302
282 ##### `SSH_ROOT_PUB_KEY`=""
303 ##### `SSH_ROOT_PUB_KEY`=""
283 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`.
304 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`.
284
305
285 ##### `SSH_USER_PUB_KEY`=""
306 ##### `SSH_USER_PUB_KEY`=""
286 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported.
307 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported.
287
308
288 ---
309 ---
289
310
290 #### Kernel compilation:
311 #### Kernel compilation:
291 ##### `BUILD_KERNEL`=true
312 ##### `BUILD_KERNEL`=true
292 Build and install the latest RPi 0/1/2/3 Linux kernel. Currently only the default RPi 0/1/2/3 kernel configuration is used.
313 Build and install the latest RPi 0/1/2/3 Linux kernel. Currently only the default RPi 0/1/2/3 kernel configuration is used.
293
314
294 ##### `CROSS_COMPILE`="arm-linux-gnueabihf-"
315 ##### `CROSS_COMPILE`="arm-linux-gnueabihf-"
295 This sets the cross-compile environment for the compiler.
316 This sets the cross-compile environment for the compiler.
296
317
297 ##### `KERNEL_ARCH`="arm"
318 ##### `KERNEL_ARCH`="arm"
298 This sets the kernel architecture for the compiler.
319 This sets the kernel architecture for the compiler.
299
320
300 ##### `KERNEL_IMAGE`="kernel7.img"
321 ##### `KERNEL_IMAGE`="kernel7.img"
301 Name of the image file in the boot partition. If not set, `KERNEL_IMAGE` will be set to "kernel8.img" automatically if building for arm64.
322 Name of the image file in the boot partition. If not set, `KERNEL_IMAGE` will be set to "kernel8.img" automatically if building for arm64.
302
323
303 ##### `KERNEL_BRANCH`=""
324 ##### `KERNEL_BRANCH`=""
304 Name of the requested branch from the GIT location for the RPi Kernel. Default is using the current default branch from the GIT site.
325 Name of the requested branch from the GIT location for the RPi Kernel. Default is using the current default branch from the GIT site.
305
326
306 ##### `QEMU_BINARY`="/usr/bin/qemu-arm-static"
327 ##### `QEMU_BINARY`="/usr/bin/qemu-arm-static"
307 Sets the QEMU enviornment for the Debian archive. If not set, `QEMU_BINARY` will be set to "/usr/bin/qemu-aarch64-static" automatically if building for arm64.
328 Sets the QEMU enviornment for the Debian archive. If not set, `QEMU_BINARY` will be set to "/usr/bin/qemu-aarch64-static" automatically if building for arm64.
308
329
309 ##### `KERNEL_DEFCONFIG`="bcm2709_defconfig"
330 ##### `KERNEL_DEFCONFIG`="bcm2709_defconfig"
310 Sets the default config for kernel compiling. If not set, `KERNEL_DEFCONFIG` will be set to "bcmrpi3\_defconfig" automatically if building for arm64.
331 Sets the default config for kernel compiling. If not set, `KERNEL_DEFCONFIG` will be set to "bcmrpi3\_defconfig" automatically if building for arm64.
311
332
312 ##### `KERNEL_REDUCE`=false
333 ##### `KERNEL_REDUCE`=false
313 Reduce the size of the generated kernel by removing unwanted devices, network and filesystem drivers (experimental).
334 Reduce the size of the generated kernel by removing unwanted devices, network and filesystem drivers (experimental).
314
335
315 ##### `KERNEL_THREADS`=1
336 ##### `KERNEL_THREADS`=1
316 Number of parallel kernel building threads. If the parameter is left untouched the script will automatically determine the number of CPU cores to set the number of parallel threads to speed the kernel compilation.
337 Number of parallel kernel building threads. If the parameter is left untouched the script will automatically determine the number of CPU cores to set the number of parallel threads to speed the kernel compilation.
317
338
318 ##### `KERNEL_HEADERS`=true
339 ##### `KERNEL_HEADERS`=true
319 Install kernel headers with the built kernel.
340 Install kernel headers with the built kernel.
320
341
321 ##### `KERNEL_MENUCONFIG`=false
342 ##### `KERNEL_MENUCONFIG`=false
322 Start `make menuconfig` interactive menu-driven kernel configuration. The script will continue after `make menuconfig` was terminated.
343 Start `make menuconfig` interactive menu-driven kernel configuration. The script will continue after `make menuconfig` was terminated.
323
344
324 ##### `KERNEL_OLDDEFCONFIG`=false
345 ##### `KERNEL_OLDDEFCONFIG`=false
325 Run `make olddefconfig` to automatically set all new kernel configuration options to their recommended default values.
346 Run `make olddefconfig` to automatically set all new kernel configuration options to their recommended default values.
326
347
327 ##### `KERNEL_CCACHE`=false
348 ##### `KERNEL_CCACHE`=false
328 Compile the kernel using ccache. This speeds up kernel recompilation by caching previous compilations and detecting when the same compilation is being done again.
349 Compile the kernel using ccache. This speeds up kernel recompilation by caching previous compilations and detecting when the same compilation is being done again.
329
350
330 ##### `KERNEL_REMOVESRC`=true
351 ##### `KERNEL_REMOVESRC`=true
331 Remove all kernel sources from the generated OS image after it was built and installed.
352 Remove all kernel sources from the generated OS image after it was built and installed.
332
353
333 ##### `KERNELSRC_DIR`=""
354 ##### `KERNELSRC_DIR`=""
334 Path to a directory (`linux`) of [RaspberryPi Linux kernel sources](https://github.com/raspberrypi/linux) that will be copied, configured, build and installed inside the chroot.
355 Path to a directory (`linux`) of [RaspberryPi Linux kernel sources](https://github.com/raspberrypi/linux) that will be copied, configured, build and installed inside the chroot.
335
356
336 ##### `KERNELSRC_CLEAN`=false
357 ##### `KERNELSRC_CLEAN`=false
337 Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This parameter will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true.
358 Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This parameter will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true.
338
359
339 ##### `KERNELSRC_CONFIG`=true
360 ##### `KERNELSRC_CONFIG`=true
340 Run `make bcm2709_defconfig` (and optional `make menuconfig`) to configure the kernel sources before building. This parameter is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This parameter is ignored if `KERNELSRC_PREBUILT`=true.
361 Run `make bcm2709_defconfig` (and optional `make menuconfig`) to configure the kernel sources before building. This parameter is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This parameter is ignored if `KERNELSRC_PREBUILT`=true.
341
362
342 ##### `KERNELSRC_USRCONFIG`=""
363 ##### `KERNELSRC_USRCONFIG`=""
343 Copy own config file to kernel `.config`. If `KERNEL_MENUCONFIG`=true then running after copy.
364 Copy own config file to kernel `.config`. If `KERNEL_MENUCONFIG`=true then running after copy.
344
365
345 ##### `KERNELSRC_PREBUILT`=false
366 ##### `KERNELSRC_PREBUILT`=false
346 With this parameter set to true the script expects the existing kernel sources directory to be already successfully cross-compiled. The parameters `KERNELSRC_CLEAN`, `KERNELSRC_CONFIG`, `KERNELSRC_USRCONFIG` and `KERNEL_MENUCONFIG` are ignored and no kernel compilation tasks are performed.
367 With this parameter set to true the script expects the existing kernel sources directory to be already successfully cross-compiled. The parameters `KERNELSRC_CLEAN`, `KERNELSRC_CONFIG`, `KERNELSRC_USRCONFIG` and `KERNEL_MENUCONFIG` are ignored and no kernel compilation tasks are performed.
347
368
348 ##### `RPI_FIRMWARE_DIR`=""
369 ##### `RPI_FIRMWARE_DIR`=""
349 The directory (`firmware`) containing a local copy of the firmware from the [RaspberryPi firmware project](https://github.com/raspberrypi/firmware). Default is to download the latest firmware directly from the project.
370 The directory (`firmware`) containing a local copy of the firmware from the [RaspberryPi firmware project](https://github.com/raspberrypi/firmware). Default is to download the latest firmware directly from the project.
350
371
372 ##### `KERNEL_DEFAULT_GOV`="ONDEMAND"
373 Set the default cpu governor at kernel compilation. Supported values are: PERFORMANCE POWERSAVE USERSPACE ONDEMAND CONSERVATIVE SCHEDUTIL
374
375 ##### `KERNEL_NF`=false
376 Enable Netfilter modules as kernel modules
377
378 ##### `KERNEL_VIRT`=false
379 Enable Kernel KVM support (/dev/kvm)
380
381 ##### `KERNEL_ZSWAP`=false
382 Enable Kernel Zswap support. Best use on high RAM load and mediocre CPU load usecases
383
384 ##### `KERNEL_BPF`=true
385 Allow attaching eBPF programs to a cgroup using the bpf syscall (CONFIG_BPF_SYSCALL CONFIG_CGROUP_BPF) [systemd compilations about it - File /lib/systemd/system/systemd-journald.server:36 configures an IP firewall (IPAddressDeny=all), but the local system does not support BPF/cgroup based firewalls]
386
387 ##### `KERNEL_SECURITY`=false
388 Enables Apparmor, integrity subsystem, auditing
351 ---
389 ---
352
390
353 #### Reduce disk usage:
391 #### Reduce disk usage:
354 The following list of parameters is ignored if `ENABLE_REDUCE`=false.
392 The following list of parameters is ignored if `ENABLE_REDUCE`=false.
355
393
356 ##### `REDUCE_APT`=true
394 ##### `REDUCE_APT`=true
357 Configure APT to use compressed package repository lists and no package caching files.
395 Configure APT to use compressed package repository lists and no package caching files.
358
396
359 ##### `REDUCE_DOC`=true
397 ##### `REDUCE_DOC`=true
360 Remove all doc files (harsh). Configure APT to not include doc files on future `apt-get` package installations.
398 Remove all doc files (harsh). Configure APT to not include doc files on future `apt-get` package installations.
361
399
362 ##### `REDUCE_MAN`=true
400 ##### `REDUCE_MAN`=true
363 Remove all man pages and info files (harsh). Configure APT to not include man pages on future `apt-get` package installations.
401 Remove all man pages and info files (harsh). Configure APT to not include man pages on future `apt-get` package installations.
364
402
365 ##### `REDUCE_VIM`=false
403 ##### `REDUCE_VIM`=false
366 Replace `vim-tiny` package by `levee` a tiny vim clone.
404 Replace `vim-tiny` package by `levee` a tiny vim clone.
367
405
368 ##### `REDUCE_BASH`=false
406 ##### `REDUCE_BASH`=false
369 Remove `bash` package and switch to `dash` shell (experimental).
407 Remove `bash` package and switch to `dash` shell (experimental).
370
408
371 ##### `REDUCE_HWDB`=true
409 ##### `REDUCE_HWDB`=true
372 Remove PCI related hwdb files (experimental).
410 Remove PCI related hwdb files (experimental).
373
411
374 ##### `REDUCE_SSHD`=true
412 ##### `REDUCE_SSHD`=true
375 Replace `openssh-server` with `dropbear`.
413 Replace `openssh-server` with `dropbear`.
376
414
377 ##### `REDUCE_LOCALE`=true
415 ##### `REDUCE_LOCALE`=true
378 Remove all `locale` translation files.
416 Remove all `locale` translation files.
379
417
380 ---
418 ---
381
419
382 #### Encrypted root partition:
420 #### Encrypted root partition:
383 ##### `ENABLE_CRYPTFS`=false
421 ##### `ENABLE_CRYPTFS`=false
384 Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental. SSH-to-initramfs is currently not supported but will be soon - feel free to help.
422 Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental. SSH-to-initramfs is currently not supported but will be soon - feel free to help.
385
423
386 ##### `CRYPTFS_PASSWORD`=""
424 ##### `CRYPTFS_PASSWORD`=""
387 Set password of the encrypted root partition. This parameter is mandatory if `ENABLE_CRYPTFS`=true.
425 Set password of the encrypted root partition. This parameter is mandatory if `ENABLE_CRYPTFS`=true.
388
426
389 ##### `CRYPTFS_MAPPING`="secure"
427 ##### `CRYPTFS_MAPPING`="secure"
390 Set name of dm-crypt managed device-mapper mapping.
428 Set name of dm-crypt managed device-mapper mapping.
391
429
392 ##### `CRYPTFS_CIPHER`="aes-xts-plain64:sha512"
430 ##### `CRYPTFS_CIPHER`="aes-xts-plain64:sha512"
393 Set cipher specification string. `aes-xts*` ciphers are strongly recommended.
431 Set cipher specification string. `aes-xts*` ciphers are strongly recommended.
394
432
395 ##### `CRYPTFS_XTSKEYSIZE`=512
433 ##### `CRYPTFS_XTSKEYSIZE`=512
396 Sets key size in bits. The argument has to be a multiple of 8.
434 Sets key size in bits. The argument has to be a multiple of 8.
397
435
436 ##### `CRYPTFS_DROPBEAR`=false
437 Enable Dropbear Initramfs support
438
439 ##### `CRYPTFS_DROPBEAR_PUBKEY`=""
440 Provide path to dropbear Public RSA-OpenSSH Key
441
398 ---
442 ---
399
443
400 #### Build settings:
444 #### Build settings:
401 ##### `BASEDIR`=$(pwd)/images/${RELEASE}
445 ##### `BASEDIR`=$(pwd)/images/${RELEASE}
402 Set a path to a working directory used by the script to generate an image.
446 Set a path to a working directory used by the script to generate an image.
403
447
404 ##### `IMAGE_NAME`=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}
448 ##### `IMAGE_NAME`=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}
405 Set a filename for the output file(s). Note: the script will create $IMAGE_NAME.img if `ENABLE_SPLITFS`=false or $IMAGE_NAME-frmw.img and $IMAGE_NAME-root.img if `ENABLE_SPLITFS`=true. Note 2: If the KERNEL_BRANCH is not set, the word "CURRENT" is used.
449 Set a filename for the output file(s). Note: the script will create $IMAGE_NAME.img if `ENABLE_SPLITFS`=false or $IMAGE_NAME-frmw.img and $IMAGE_NAME-root.img if `ENABLE_SPLITFS`=true. Note 2: If the KERNEL_BRANCH is not set, the word "CURRENT" is used.
406
450
407 ## Understanding the script
451 ## Understanding the script
408 The functions of this script that are required for the different stages of the bootstrapping are split up into single files located inside the `bootstrap.d` directory. During the bootstrapping every script in this directory gets executed in lexicographical order:
452 The functions of this script that are required for the different stages of the bootstrapping are split up into single files located inside the `bootstrap.d` directory. During the bootstrapping every script in this directory gets executed in lexicographical order:
409
453
410 | Script | Description |
454 | Script | Description |
411 | --- | --- |
455 | --- | --- |
412 | `10-bootstrap.sh` | Debootstrap basic system |
456 | `10-bootstrap.sh` | Debootstrap basic system |
413 | `11-apt.sh` | Setup APT repositories |
457 | `11-apt.sh` | Setup APT repositories |
414 | `12-locale.sh` | Setup Locales and keyboard settings |
458 | `12-locale.sh` | Setup Locales and keyboard settings |
415 | `13-kernel.sh` | Build and install RPi 0/1/2/3 Kernel |
459 | `13-kernel.sh` | Build and install RPi 0/1/2/3 Kernel |
416 | `14-fstab.sh` | Setup fstab and initramfs |
460 | `14-fstab.sh` | Setup fstab and initramfs |
417 | `15-rpi-config.sh` | Setup RPi 0/1/2/3 config and cmdline |
461 | `15-rpi-config.sh` | Setup RPi 0/1/2/3 config and cmdline |
418 | `20-networking.sh` | Setup Networking |
462 | `20-networking.sh` | Setup Networking |
419 | `21-firewall.sh` | Setup Firewall |
463 | `21-firewall.sh` | Setup Firewall |
420 | `30-security.sh` | Setup Users and Security settings |
464 | `30-security.sh` | Setup Users and Security settings |
421 | `31-logging.sh` | Setup Logging |
465 | `31-logging.sh` | Setup Logging |
422 | `32-sshd.sh` | Setup SSH and public keys |
466 | `32-sshd.sh` | Setup SSH and public keys |
423 | `41-uboot.sh` | Build and Setup U-Boot |
467 | `41-uboot.sh` | Build and Setup U-Boot |
424 | `42-fbturbo.sh` | Build and Setup fbturbo Xorg driver |
468 | `42-fbturbo.sh` | Build and Setup fbturbo Xorg driver |
425 | `43-videocore.sh` | Build and Setup videocore libraries |
469 | `43-videocore.sh` | Build and Setup videocore libraries |
426 | `50-firstboot.sh` | First boot actions |
470 | `50-firstboot.sh` | First boot actions |
427 | `99-reduce.sh` | Reduce the disk space usage |
471 | `99-reduce.sh` | Reduce the disk space usage |
428
472
429 All the required configuration files that will be copied to the generated OS image are located inside the `files` directory. It is not recommended to modify these configuration files manually.
473 All the required configuration files that will be copied to the generated OS image are located inside the `files` directory. It is not recommended to modify these configuration files manually.
430
474
431 | Directory | Description |
475 | Directory | Description |
432 | --- | --- |
476 | --- | --- |
433 | `apt` | APT management configuration files |
477 | `apt` | APT management configuration files |
434 | `boot` | Boot and RPi 0/1/2/3 configuration files |
478 | `boot` | Boot and RPi 0/1/2/3 configuration files |
435 | `dpkg` | Package Manager configuration |
479 | `dpkg` | Package Manager configuration |
436 | `etc` | Configuration files and rc scripts |
480 | `etc` | Configuration files and rc scripts |
437 | `firstboot` | Scripts that get executed on first boot |
481 | `firstboot` | Scripts that get executed on first boot |
438 | `initramfs` | Initramfs scripts |
482 | `initramfs` | Initramfs scripts |
439 | `iptables` | Firewall configuration files |
483 | `iptables` | Firewall configuration files |
440 | `locales` | Locales configuration |
484 | `locales` | Locales configuration |
441 | `modules` | Kernel Modules configuration |
485 | `modules` | Kernel Modules configuration |
442 | `mount` | Fstab configuration |
486 | `mount` | Fstab configuration |
443 | `network` | Networking configuration files |
487 | `network` | Networking configuration files |
444 | `sysctl.d` | Swapping and Network Hardening configuration |
488 | `sysctl.d` | Swapping and Network Hardening configuration |
445 | `xorg` | fbturbo Xorg driver configuration |
489 | `xorg` | fbturbo Xorg driver configuration |
446
490
447 ## Custom packages and scripts
491 ## Custom packages and scripts
448 Debian custom packages, i.e. those not in the debian repositories, can be installed by placing them in the `packages` directory. They are installed immediately after packages from the repositories are installed. Any dependencies listed in the custom packages will be downloaded automatically from the repositories. Do not list these custom packages in `APT_INCLUDES`.
492 Debian custom packages, i.e. those not in the debian repositories, can be installed by placing them in the `packages` directory. They are installed immediately after packages from the repositories are installed. Any dependencies listed in the custom packages will be downloaded automatically from the repositories. Do not list these custom packages in `APT_INCLUDES`.
449
493
450 Scripts in the custom.d directory will be executed after all other installation is complete but before the image is created.
494 Scripts in the custom.d directory will be executed after all other installation is complete but before the image is created.
451
495
452 ## Logging of the bootstrapping process
496 ## Logging of the bootstrapping process
453 All information related to the bootstrapping process and the commands executed by the `rpi23-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:
497 All information related to the bootstrapping process and the commands executed by the `rpi23-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:
454
498
455 ```shell
499 ```shell
456 script -c 'APT_SERVER=ftp.de.debian.org ./rpi23-gen-image.sh' ./build.log
500 script -c 'APT_SERVER=ftp.de.debian.org ./rpi23-gen-image.sh' ./build.log
457 ```
501 ```
458
502
459 ## Flashing the image file
503 ## Flashing the image file
460 After the image file was successfully created by the `rpi23-gen-image.sh` script it can be copied to the microSD card that will be used by the RPi 0/1/2/3 computer. This can be performed by using the tools `bmaptool` or `dd`. Using `bmaptool` will probably speed-up the copy process because `bmaptool` copies more wisely than `dd`.
504 After the image file was successfully created by the `rpi23-gen-image.sh` script it can be copied to the microSD card that will be used by the RPi 0/1/2/3 computer. This can be performed by using the tools `bmaptool` or `dd`. Using `bmaptool` will probably speed-up the copy process because `bmaptool` copies more wisely than `dd`.
461
505
462 ##### Flashing examples:
506 ##### Flashing examples:
463 ```shell
507 ```shell
464 bmaptool copy ./images/buster/2017-01-23-rpi3-buster.img /dev/mmcblk0
508 bmaptool copy ./images/buster/2017-01-23-rpi3-buster.img /dev/mmcblk0
465 dd bs=4M if=./images/buster/2017-01-23-rpi3-buster.img of=/dev/mmcblk0
509 dd bs=4M if=./images/buster/2017-01-23-rpi3-buster.img of=/dev/mmcblk0
466 ```
510 ```
467 If you have set `ENABLE_SPLITFS`, copy the `-frmw` image on the microSD card, then the `-root` one on the USB drive:
511 If you have set `ENABLE_SPLITFS`, copy the `-frmw` image on the microSD card, then the `-root` one on the USB drive:
468 ```shell
512 ```shell
469 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-frmw.img /dev/mmcblk0
513 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-frmw.img /dev/mmcblk0
470 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-root.img /dev/sdc
514 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-root.img /dev/sdc
471 ```
515 ```
472
516
473 ## QEMU emulation
517 ## QEMU emulation
474 Start QEMU full system emulation:
518 Start QEMU full system emulation:
475 ```shell
519 ```shell
476 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=tty1"
520 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=tty1"
477 ```
521 ```
478
522
479 Start QEMU full system emulation and output to console:
523 Start QEMU full system emulation and output to console:
480 ```shell
524 ```shell
481 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
525 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
482 ```
526 ```
483
527
484 Start QEMU full system emulation with SMP and output to console:
528 Start QEMU full system emulation with SMP and output to console:
485 ```shell
529 ```shell
486 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -smp cpus=2,maxcpus=2 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
530 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -smp cpus=2,maxcpus=2 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
487 ```
531 ```
488
532
489 Start QEMU full system emulation with cryptfs, initramfs and output to console:
533 Start QEMU full system emulation with cryptfs, initramfs and output to console:
490 ```shell
534 ```shell
491 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -initrd "initramfs-${KERNEL_VERSION}" -append "root=/dev/mapper/secure cryptdevice=/dev/mmcblk0p2:secure rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
535 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -initrd "initramfs-${KERNEL_VERSION}" -append "root=/dev/mapper/secure cryptdevice=/dev/mmcblk0p2:secure rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
492 ```
536 ```
493
537
494 ## External links and references
538 ## External links and references
495 * [Debian worldwide mirror sites](https://www.debian.org/mirror/list)
539 * [Debian worldwide mirror sites](https://www.debian.org/mirror/list)
496 * [Debian Raspberry Pi 2 Wiki](https://wiki.debian.org/RaspberryPi2)
540 * [Debian Raspberry Pi 2 Wiki](https://wiki.debian.org/RaspberryPi2)
497 * [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains)
541 * [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains)
498 * [Official Raspberry Pi Firmware on github](https://github.com/raspberrypi/firmware)
542 * [Official Raspberry Pi Firmware on github](https://github.com/raspberrypi/firmware)
499 * [Official Raspberry Pi Kernel on github](https://github.com/raspberrypi/linux)
543 * [Official Raspberry Pi Kernel on github](https://github.com/raspberrypi/linux)
500 * [U-BOOT git repository](https://git.denx.de/?p=u-boot.git;a=summary)
544 * [U-BOOT git repository](https://git.denx.de/?p=u-boot.git;a=summary)
501 * [Xorg DDX driver fbturbo](https://github.com/ssvb/xf86-video-fbturbo)
545 * [Xorg DDX driver fbturbo](https://github.com/ssvb/xf86-video-fbturbo)
502 * [RPi3 Wireless interface firmware](https://github.com/RPi-Distro/firmware-nonfree/tree/master/brcm80211/brcm)
546 * [RPi3 Wireless interface firmware](https://github.com/RPi-Distro/firmware-nonfree/tree/master/brcm80211/brcm)
503 * [Collabora RPi2 Kernel precompiled](https://repositories.collabora.co.uk/debian/)
547 * [Collabora RPi2 Kernel precompiled](https://repositories.collabora.co.uk/debian/)
@@ -1,33 +1,40
1 #
1 #
2 # Setup APT repositories
2 # Setup APT repositories
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 # Install and setup APT proxy configuration
8 # Install and setup APT proxy configuration
9 if [ -z "$APT_PROXY" ] ; then
9 if [ -z "$APT_PROXY" ] ; then
10 install_readonly files/apt/10proxy "${ETC_DIR}/apt/apt.conf.d/10proxy"
10 install_readonly files/apt/10proxy "${ETC_DIR}/apt/apt.conf.d/10proxy"
11 sed -i "s/\"\"/\"${APT_PROXY}\"/" "${ETC_DIR}/apt/apt.conf.d/10proxy"
11 sed -i "s/\"\"/\"${APT_PROXY}\"/" "${ETC_DIR}/apt/apt.conf.d/10proxy"
12 fi
12 fi
13
13
14 # Install APT sources.list
15 install_readonly files/apt/sources.list "${ETC_DIR}/apt/sources.list"
16
17 # Use specified APT server and release
18 sed -i "s/\/ftp.debian.org\//\/${APT_SERVER}\//" "${ETC_DIR}/apt/sources.list"
19 sed -i "s/ stretch/ ${RELEASE}/" "${ETC_DIR}/apt/sources.list"
20
14 # Upgrade package index and update all installed packages and changed dependencies
21 # Upgrade package index and update all installed packages and changed dependencies
15 chroot_exec apt-get -qq -y update
22 chroot_exec apt-get -qq -y update
16 chroot_exec apt-get -qq -y -u dist-upgrade
23 chroot_exec apt-get -qq -y -u dist-upgrade
17
24
18 # Install additional packages
25 # Install additional packages
19 if [ "$APT_INCLUDES_LATE" ] ; then
26 if [ "$APT_INCLUDES_LATE" ] ; then
20 chroot_exec apt-get -qq -y install "$(echo "$APT_INCLUDES_LATE" |tr , ' ')"
27 chroot_exec apt-get -qq -y install "$(echo "$APT_INCLUDES_LATE" |tr , ' ')"
21 fi
28 fi
22
29
23 # Install Debian custom packages
30 # Install Debian custom packages
24 if [ -d packages ] ; then
31 if [ -d packages ] ; then
25 for package in packages/*.deb ; do
32 for package in packages/*.deb ; do
26 cp "$package" "${R}"/tmp
33 cp "$package" "${R}"/tmp
27 chroot_exec dpkg --unpack /tmp/"$(basename "$package")"
34 chroot_exec dpkg --unpack /tmp/"$(basename "$package")"
28 done
35 done
29 fi
36 fi
30
37
31 chroot_exec apt-get -qq -y -f install
38 chroot_exec apt-get -qq -y -f install
32
39
33 chroot_exec apt-get -qq -y check
40 chroot_exec apt-get -qq -y check
@@ -1,255 +1,602
1 #
1 #
2 # Build and Setup RPi2/3 Kernel
2 # Build and Setup RPi2/3 Kernel
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 # Need to use kali kernel src if nexmon is enabled
9 if [ "$ENABLE_NEXMON" = true ] ; then
10 KERNEL_URL="${KALI_KERNEL_URL}"
11 # Clear Branch and KernelSRC_DIR if using nexmon. Everyone will forget to clone kali kernel instead of nomrla kernel
12 KERNEL_BRANCH=""
13 KERNELSRC_DIR=""
14 fi
15
8 # Fetch and build latest raspberry kernel
16 # Fetch and build latest raspberry kernel
9 if [ "$BUILD_KERNEL" = true ] ; then
17 if [ "$BUILD_KERNEL" = true ] ; then
10 # Setup source directory
18 # Setup source directory
11 mkdir -p "${KERNEL_DIR}"
19 mkdir -p "${KERNEL_DIR}"
12
20
13 # Copy existing kernel sources into chroot directory
21 # Copy existing kernel sources into chroot directory
14 if [ -n "$KERNELSRC_DIR" ] && [ -d "$KERNELSRC_DIR" ] ; then
22 if [ -n "$KERNELSRC_DIR" ] && [ -d "$KERNELSRC_DIR" ] ; then
15 # Copy kernel sources and include hidden files
23 # Copy kernel sources and include hidden files
16 cp -r "${KERNELSRC_DIR}/". "${KERNEL_DIR}"
24 cp -r "${KERNELSRC_DIR}/". "${KERNEL_DIR}"
17
25
18 # Clean the kernel sources
26 # Clean the kernel sources
19 if [ "$KERNELSRC_CLEAN" = true ] && [ "$KERNELSRC_PREBUILT" = false ] ; then
27 if [ "$KERNELSRC_CLEAN" = true ] && [ "$KERNELSRC_PREBUILT" = false ] ; then
20 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" mrproper
28 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" mrproper
21 fi
29 fi
22 else # KERNELSRC_DIR=""
30 else # KERNELSRC_DIR=""
23 # Create temporary directory for kernel sources
31 # Create temporary directory for kernel sources
24 temp_dir=$(as_nobody mktemp -d)
32 temp_dir=$(as_nobody mktemp -d)
25
33
26 # Fetch current RPi2/3 kernel sources
34 # Fetch current RPi2/3 kernel sources
27 if [ -z "${KERNEL_BRANCH}" ] ; then
35 if [ -z "${KERNEL_BRANCH}" ] ; then
28 as_nobody -H git -C "${temp_dir}" clone --depth=1 "${KERNEL_URL}" linux
36 as_nobody -H git -C "${temp_dir}" clone --depth=1 "${KERNEL_URL}" linux
29 else
37 else
30 as_nobody -H git -C "${temp_dir}" clone --depth=1 --branch "${KERNEL_BRANCH}" "${KERNEL_URL}" linux
38 as_nobody -H git -C "${temp_dir}" clone --depth=1 --branch "${KERNEL_BRANCH}" "${KERNEL_URL}" linux
31 fi
39 fi
32
40
33 # Copy downloaded kernel sources
41 # Copy downloaded kernel sources
34 cp -r "${temp_dir}/linux/"* "${KERNEL_DIR}"
42 cp -r "${temp_dir}/linux/"* "${KERNEL_DIR}"
35
43
36 # Remove temporary directory for kernel sources
44 # Remove temporary directory for kernel sources
37 rm -fr "${temp_dir}"
45 rm -fr "${temp_dir}"
38
46
39 # Set permissions of the kernel sources
47 # Set permissions of the kernel sources
40 chown -R root:root "${R}/usr/src"
48 chown -R root:root "${R}/usr/src"
41 fi
49 fi
42
50
43 # Calculate optimal number of kernel building threads
51 # Calculate optimal number of kernel building threads
44 if [ "$KERNEL_THREADS" = "1" ] && [ -r /proc/cpuinfo ] ; then
52 if [ "$KERNEL_THREADS" = "1" ] && [ -r /proc/cpuinfo ] ; then
45 KERNEL_THREADS=$(grep -c processor /proc/cpuinfo)
53 KERNEL_THREADS=$(grep -c processor /proc/cpuinfo)
46 fi
54 fi
47
55
48 # Configure and build kernel
56 # Configure and build kernel
49 if [ "$KERNELSRC_PREBUILT" = false ] ; then
57 if [ "$KERNELSRC_PREBUILT" = false ] ; then
50 # Remove device, network and filesystem drivers from kernel configuration
58 # Remove device, network and filesystem drivers from kernel configuration
51 if [ "$KERNEL_REDUCE" = true ] ; then
59 if [ "$KERNEL_REDUCE" = true ] ; then
52 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
60 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
53 sed -i\
61 sed -i\
54 -e "s/\(^CONFIG_SND.*\=\).*/\1n/"\
62 -e "s/\(^CONFIG_SND.*\=\).*/\1n/"\
55 -e "s/\(^CONFIG_SOUND.*\=\).*/\1n/"\
63 -e "s/\(^CONFIG_SOUND.*\=\).*/\1n/"\
56 -e "s/\(^CONFIG_AC97.*\=\).*/\1n/"\
64 -e "s/\(^CONFIG_AC97.*\=\).*/\1n/"\
57 -e "s/\(^CONFIG_VIDEO_.*\=\).*/\1n/"\
65 -e "s/\(^CONFIG_VIDEO_.*\=\).*/\1n/"\
58 -e "s/\(^CONFIG_MEDIA_TUNER.*\=\).*/\1n/"\
66 -e "s/\(^CONFIG_MEDIA_TUNER.*\=\).*/\1n/"\
59 -e "s/\(^CONFIG_DVB.*\=\)[ym]/\1n/"\
67 -e "s/\(^CONFIG_DVB.*\=\)[ym]/\1n/"\
60 -e "s/\(^CONFIG_REISERFS.*\=\).*/\1n/"\
68 -e "s/\(^CONFIG_REISERFS.*\=\).*/\1n/"\
61 -e "s/\(^CONFIG_JFS.*\=\).*/\1n/"\
69 -e "s/\(^CONFIG_JFS.*\=\).*/\1n/"\
62 -e "s/\(^CONFIG_XFS.*\=\).*/\1n/"\
70 -e "s/\(^CONFIG_XFS.*\=\).*/\1n/"\
63 -e "s/\(^CONFIG_GFS2.*\=\).*/\1n/"\
71 -e "s/\(^CONFIG_GFS2.*\=\).*/\1n/"\
64 -e "s/\(^CONFIG_OCFS2.*\=\).*/\1n/"\
72 -e "s/\(^CONFIG_OCFS2.*\=\).*/\1n/"\
65 -e "s/\(^CONFIG_BTRFS.*\=\).*/\1n/"\
73 -e "s/\(^CONFIG_BTRFS.*\=\).*/\1n/"\
66 -e "s/\(^CONFIG_HFS.*\=\).*/\1n/"\
74 -e "s/\(^CONFIG_HFS.*\=\).*/\1n/"\
67 -e "s/\(^CONFIG_JFFS2.*\=\)[ym]/\1n/"\
75 -e "s/\(^CONFIG_JFFS2.*\=\)[ym]/\1n/"\
68 -e "s/\(^CONFIG_UBIFS.*\=\).*/\1n/"\
76 -e "s/\(^CONFIG_UBIFS.*\=\).*/\1n/"\
69 -e "s/\(^CONFIG_SQUASHFS.*\=\)[ym]/\1n/"\
77 -e "s/\(^CONFIG_SQUASHFS.*\=\)[ym]/\1n/"\
70 -e "s/\(^CONFIG_W1.*\=\)[ym]/\1n/"\
78 -e "s/\(^CONFIG_W1.*\=\)[ym]/\1n/"\
71 -e "s/\(^CONFIG_HAMRADIO.*\=\).*/\1n/"\
79 -e "s/\(^CONFIG_HAMRADIO.*\=\).*/\1n/"\
72 -e "s/\(^CONFIG_CAN.*\=\).*/\1n/"\
80 -e "s/\(^CONFIG_CAN.*\=\).*/\1n/"\
73 -e "s/\(^CONFIG_IRDA.*\=\).*/\1n/"\
81 -e "s/\(^CONFIG_IRDA.*\=\).*/\1n/"\
74 -e "s/\(^CONFIG_BT_.*\=\).*/\1n/"\
82 -e "s/\(^CONFIG_BT_.*\=\).*/\1n/"\
75 -e "s/\(^CONFIG_WIMAX.*\=\)[ym]/\1n/"\
83 -e "s/\(^CONFIG_WIMAX.*\=\)[ym]/\1n/"\
76 -e "s/\(^CONFIG_6LOWPAN.*\=\).*/\1n/"\
84 -e "s/\(^CONFIG_6LOWPAN.*\=\).*/\1n/"\
77 -e "s/\(^CONFIG_IEEE802154.*\=\).*/\1n/"\
85 -e "s/\(^CONFIG_IEEE802154.*\=\).*/\1n/"\
78 -e "s/\(^CONFIG_NFC.*\=\).*/\1n/"\
86 -e "s/\(^CONFIG_NFC.*\=\).*/\1n/"\
79 -e "s/\(^CONFIG_FB_TFT=.*\=\).*/\1n/"\
87 -e "s/\(^CONFIG_FB_TFT=.*\=\).*/\1n/"\
80 -e "s/\(^CONFIG_TOUCHSCREEN.*\=\).*/\1n/"\
88 -e "s/\(^CONFIG_TOUCHSCREEN.*\=\).*/\1n/"\
81 -e "s/\(^CONFIG_USB_GSPCA_.*\=\).*/\1n/"\
89 -e "s/\(^CONFIG_USB_GSPCA_.*\=\).*/\1n/"\
82 -e "s/\(^CONFIG_DRM.*\=\).*/\1n/"\
90 -e "s/\(^CONFIG_DRM.*\=\).*/\1n/"\
83 "${KERNEL_DIR}/.config"
91 "${KERNEL_DIR}/.config"
84 fi
92 fi
85
93
86 if [ "$KERNELSRC_CONFIG" = true ] ; then
94 if [ "$KERNELSRC_CONFIG" = true ] ; then
87 # Load default raspberry kernel configuration
95 # Load default raspberry kernel configuration
88 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
96 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
89
97
98 #Switch to KERNELSRC_DIR so we can use set_kernel_config
99 cd "${KERNEL_DIR}" || exit
100
101 # enable ZSWAP see https://askubuntu.com/a/472227 or https://wiki.archlinux.org/index.php/zswap
102 if [ "$KERNEL_ZSWAP" = true ] ; then
103 set_kernel_config CONFIG_ZPOOL y
104 set_kernel_config CONFIG_ZSWAP y
105 set_kernel_config CONFIG_ZBUD y
106 set_kernel_config CONFIG_Z3FOLD y
107 set_kernel_config CONFIG_ZSMALLOC y
108 set_kernel_config CONFIG_PGTABLE_MAPPING y
109 set_kernel_config CONFIG_LZO_COMPRESS y
110 fi
111
112 # enable basic KVM support; see https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=210546&start=25#p1300453
113 if [ "$KERNEL_VIRT" = true ] && { [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; } ; then
114 set_kernel_config CONFIG_HAVE_KVM_IRQCHIP y
115 set_kernel_config CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL y
116 set_kernel_config CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT y
117 set_kernel_config CONFIG_HAVE_KVM_EVENTFD y
118 set_kernel_config CONFIG_HAVE_KVM_IRQFD y
119 set_kernel_config CONFIG_HAVE_KVM_IRQ_ROUTING y
120 set_kernel_config CONFIG_HAVE_KVM_MSI y
121 set_kernel_config CONFIG_KVM y
122 set_kernel_config CONFIG_KVM_ARM_HOST y
123 set_kernel_config CONFIG_KVM_ARM_PMU y
124 set_kernel_config CONFIG_KVM_COMPAT y
125 set_kernel_config CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT y
126 set_kernel_config CONFIG_KVM_MMIO y
127 set_kernel_config CONFIG_KVM_VFIO y
128 set_kernel_config CONFIG_VHOST m
129 set_kernel_config CONFIG_VHOST_CROSS_ENDIAN_LEGACY y
130 set_kernel_config CONFIG_VHOST_NET m
131 set_kernel_config CONFIG_VIRTUALIZATION y
132
133 set_kernel_config CONFIG_MMU_NOTIFIER y
134
135 # erratum
136 set_kernel_config ARM64_ERRATUM_834220 y
137
138 # https://sourceforge.net/p/kvm/mailman/message/18440797/
139 set_kernel_config CONFIG_PREEMPT_NOTIFIERS y
140 fi
141
142 # enable apparmor,integrity audit,
143 if [ "$KERNEL_SECURITY" = true ] ; then
144
145 # security filesystem, security models and audit
146 set_kernel_config CONFIG_SECURITYFS y
147 set_kernel_config CONFIG_SECURITY y
148 set_kernel_config CONFIG_AUDIT y
149
150 # harden strcpy and memcpy
151 set_kernel_config CONFIG_HARDENED_USERCOPY=y
152 set_kernel_config CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y
153 set_kernel_config CONFIG_FORTIFY_SOURCE=y
154
155 # integrity sub-system
156 set_kernel_config CONFIG_INTEGRITY=y
157 set_kernel_config CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
158 set_kernel_config CONFIG_INTEGRITY_AUDIT=y
159 set_kernel_config CONFIG_INTEGRITY_SIGNATURE=y
160 set_kernel_config CONFIG_INTEGRITY_TRUSTED_KEYRING=y
161
162 # This option provides support for retaining authentication tokens and access keys in the kernel.
163 set_kernel_config CONFIG_KEYS=y
164 set_kernel_config CONFIG_KEYS_COMPAT=y
165
166 # Apparmor
167 set_kernel_config CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE 0
168 set_kernel_config CONFIG_SECURITY_APPARMOR_HASH_DEFAULT y
169 set_kernel_config CONFIG_DEFAULT_SECURITY_APPARMOR y
170 set_kernel_config CONFIG_SECURITY_APPARMOR y
171 set_kernel_config CONFIG_SECURITY_APPARMOR_HASH y
172 set_kernel_config CONFIG_DEFAULT_SECURITY "apparmor"
173
174 # restrictions on unprivileged users reading the kernel
175 set_kernel_config CONFIG_SECURITY_DMESG_RESTRICT=y
176
177 # network security hooks
178 set_kernel_config CONFIG_SECURITY_NETWORK y
179 set_kernel_config CONFIG_SECURITY_NETWORK_XFRM=y
180 set_kernel_config CONFIG_SECURITY_PATH=y
181 set_kernel_config CONFIG_SECURITY_YAMA=y
182
183 # New Options
184 if [ "$KERNEL_NF" = true ] ; then
185 set_kernel_config CONFIG_IP_NF_SECURITY m
186 set_kernel_config CONFIG_NETLABEL y
187 set_kernel_config CONFIG_IP6_NF_SECURITY m
188 fi
189 set_kernel_config CONFIG_SECURITY_SELINUX n
190 set_kernel_config CONFIG_SECURITY_SMACK n
191 set_kernel_config CONFIG_SECURITY_TOMOYO n
192 set_kernel_config CONFIG_SECURITY_APPARMOR_DEBUG n
193 set_kernel_config CONFIG_SECURITY_LOADPIN n
194 set_kernel_config CONFIG_HARDENED_USERCOPY_PAGESPAN n
195 set_kernel_config CONFIG_IMA n
196 set_kernel_config CONFIG_EVM n
197 set_kernel_config CONFIG_FANOTIFY_ACCESS_PERMISSIONS y
198 set_kernel_config CONFIG_NFSD_V4_SECURITY_LABEL y
199 set_kernel_config CONFIG_PKCS7_MESSAGE_PARSER y
200 set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYRING y
201 set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYS y
202 set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE y
203 set_kernel_config CONFIG_SECONDARY_TRUSTED_KEYRING y
204 set_kernel_config CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY n
205 set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYS m
206 set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE 4096
207
208 set_kernel_config CONFIG_ARM64_CRYPTO y
209 set_kernel_config CONFIG_CRYPTO_SHA256_ARM64 m
210 set_kernel_config CONFIG_CRYPTO_SHA512_ARM64 m
211 set_kernel_config CONFIG_CRYPTO_SHA1_ARM64_CE m
212 set_kernel_config CRYPTO_GHASH_ARM64_CE m
213 set_kernel_config CRYPTO_SHA2_ARM64_CE m
214 set_kernel_config CONFIG_CRYPTO_CRCT10DIF_ARM64_CE m
215 set_kernel_config CONFIG_CRYPTO_CRC32_ARM64_CE m
216 set_kernel_config CONFIG_CRYPTO_AES_ARM64 m
217 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE m
218 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_CCM y
219 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_BLK y
220 set_kernel_config CONFIG_CRYPTO_AES_ARM64_NEON_BLK m
221 set_kernel_config CONFIG_CRYPTO_CHACHA20_NEON m
222 set_kernel_config CONFIG_CRYPTO_AES_ARM64_BS m
223 set_kernel_config SYSTEM_TRUSTED_KEYS
224 fi
225
226 # Netfilter kernel support See https://github.com/raspberrypi/linux/issues/2177#issuecomment-354647406
227 if [ "$KERNEL_NF" = true ] ; then
228 set_kernel_config CONFIG_IP_NF_TARGET_SYNPROXY m
229 set_kernel_config CONFIG_NETFILTER_XT_TARGET_AUDIT m
230 set_kernel_config CONFIG_NETFILTER_XT_MATCH_CGROUP m
231 set_kernel_config CONFIG_NETFILTER_XT_MATCH_IPCOMP m
232 set_kernel_config CONFIG_NETFILTER_XT_MATCH_SOCKET m
233 set_kernel_config CONFIG_NFT_FIB_INET m
234 set_kernel_config CONFIG_NFT_FIB_IPV4 m
235 set_kernel_config CONFIG_NFT_FIB_IPV6 m
236 set_kernel_config CONFIG_NFT_FIB_NETDEV m
237 set_kernel_config CONFIG_NFT_OBJREF m
238 set_kernel_config CONFIG_NFT_RT m
239 set_kernel_config CONFIG_NFT_SET_BITMAP m
240 set_kernel_config CONFIG_NF_CONNTRACK_TIMEOUT y
241 set_kernel_config CONFIG_NF_LOG_ARP m
242 set_kernel_config CONFIG_NF_SOCKET_IPV4 m
243 set_kernel_config CONFIG_NF_SOCKET_IPV6 m
244 set_kernel_config CONFIG_BRIDGE_EBT_BROUTE m
245 set_kernel_config CONFIG_BRIDGE_EBT_T_FILTER m
246 set_kernel_config CONFIG_BRIDGE_NF_EBTABLES m
247 set_kernel_config CONFIG_IP6_NF_IPTABLES m
248 set_kernel_config CONFIG_IP6_NF_MATCH_AH m
249 set_kernel_config CONFIG_IP6_NF_MATCH_EUI64 m
250 set_kernel_config CONFIG_IP6_NF_NAT m
251 set_kernel_config CONFIG_IP6_NF_TARGET_MASQUERADE m
252 set_kernel_config CONFIG_IP6_NF_TARGET_NPT m
253 set_kernel_config CONFIG_IP_NF_SECURITY m
254 set_kernel_config CONFIG_IP_SET_BITMAP_IPMAC m
255 set_kernel_config CONFIG_IP_SET_BITMAP_PORT m
256 set_kernel_config CONFIG_IP_SET_HASH_IP m
257 set_kernel_config CONFIG_IP_SET_HASH_IPMARK m
258 set_kernel_config CONFIG_IP_SET_HASH_IPPORT m
259 set_kernel_config CONFIG_IP_SET_HASH_IPPORTIP m
260 set_kernel_config CONFIG_IP_SET_HASH_IPPORTNET m
261 set_kernel_config CONFIG_IP_SET_HASH_MAC m
262 set_kernel_config CONFIG_IP_SET_HASH_NET m
263 set_kernel_config CONFIG_IP_SET_HASH_NETIFACE m
264 set_kernel_config CONFIG_IP_SET_HASH_NETNET m
265 set_kernel_config CONFIG_IP_SET_HASH_NETPORT m
266 set_kernel_config CONFIG_IP_SET_HASH_NETPORTNET m
267 set_kernel_config CONFIG_IP_SET_LIST_SET m
268 set_kernel_config CONFIG_NETFILTER_XTABLES m
269 set_kernel_config CONFIG_NETFILTER_XTABLES m
270 set_kernel_config CONFIG_NFT_BRIDGE_META m
271 set_kernel_config CONFIG_NFT_BRIDGE_REJECT m
272 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV4 m
273 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV6 m
274 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV4 m
275 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV6 m
276 set_kernel_config CONFIG_NFT_COMPAT m
277 set_kernel_config CONFIG_NFT_COUNTER m
278 set_kernel_config CONFIG_NFT_CT m
279 set_kernel_config CONFIG_NFT_DUP_IPV4 m
280 set_kernel_config CONFIG_NFT_DUP_IPV6 m
281 set_kernel_config CONFIG_NFT_DUP_NETDEV m
282 set_kernel_config CONFIG_NFT_EXTHDR m
283 set_kernel_config CONFIG_NFT_FWD_NETDEV m
284 set_kernel_config CONFIG_NFT_HASH m
285 set_kernel_config CONFIG_NFT_LIMIT m
286 set_kernel_config CONFIG_NFT_LOG m
287 set_kernel_config CONFIG_NFT_MASQ m
288 set_kernel_config CONFIG_NFT_MASQ_IPV4 m
289 set_kernel_config CONFIG_NFT_MASQ_IPV6 m
290 set_kernel_config CONFIG_NFT_META m
291 set_kernel_config CONFIG_NFT_NAT m
292 set_kernel_config CONFIG_NFT_NUMGEN m
293 set_kernel_config CONFIG_NFT_QUEUE m
294 set_kernel_config CONFIG_NFT_QUOTA m
295 set_kernel_config CONFIG_NFT_REDIR m
296 set_kernel_config CONFIG_NFT_REDIR_IPV4 m
297 set_kernel_config CONFIG_NFT_REDIR_IPV6 m
298 set_kernel_config CONFIG_NFT_REJECT m
299 set_kernel_config CONFIG_NFT_REJECT_INET m
300 set_kernel_config CONFIG_NFT_REJECT_IPV4 m
301 set_kernel_config CONFIG_NFT_REJECT_IPV6 m
302 set_kernel_config CONFIG_NFT_SET_HASH m
303 set_kernel_config CONFIG_NFT_SET_RBTREE m
304 set_kernel_config CONFIG_NF_CONNTRACK_IPV4 m
305 set_kernel_config CONFIG_NF_CONNTRACK_IPV6 m
306 set_kernel_config CONFIG_NF_DEFRAG_IPV4 m
307 set_kernel_config CONFIG_NF_DEFRAG_IPV6 m
308 set_kernel_config CONFIG_NF_DUP_IPV4 m
309 set_kernel_config CONFIG_NF_DUP_IPV6 m
310 set_kernel_config CONFIG_NF_DUP_NETDEV m
311 set_kernel_config CONFIG_NF_LOG_BRIDGE m
312 set_kernel_config CONFIG_NF_LOG_IPV4 m
313 set_kernel_config CONFIG_NF_LOG_IPV6 m
314 set_kernel_config CONFIG_NF_NAT_IPV4 m
315 set_kernel_config CONFIG_NF_NAT_IPV6 m
316 set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV4 m
317 set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV6 m
318 set_kernel_config CONFIG_NF_NAT_PPTP m
319 set_kernel_config CONFIG_NF_NAT_PROTO_GRE m
320 set_kernel_config CONFIG_NF_NAT_REDIRECT m
321 set_kernel_config CONFIG_NF_NAT_SIP m
322 set_kernel_config CONFIG_NF_NAT_SNMP_BASIC m
323 set_kernel_config CONFIG_NF_NAT_TFTP m
324 set_kernel_config CONFIG_NF_REJECT_IPV4 m
325 set_kernel_config CONFIG_NF_REJECT_IPV6 m
326 set_kernel_config CONFIG_NF_TABLES m
327 set_kernel_config CONFIG_NF_TABLES_ARP m
328 set_kernel_config CONFIG_NF_TABLES_BRIDGE m
329 set_kernel_config CONFIG_NF_TABLES_INET m
330 set_kernel_config CONFIG_NF_TABLES_IPV4 m
331 set_kernel_config CONFIG_NF_TABLES_IPV6 m
332 set_kernel_config CONFIG_NF_TABLES_NETDEV m
333 fi
334
335 # Enables BPF syscall for systemd-journald see https://github.com/torvalds/linux/blob/master/init/Kconfig#L848 or https://groups.google.com/forum/#!topic/linux.gentoo.user/_2aSc_ztGpA
336 if [ "$KERNEL_BPF" = true ] ; then
337 set_kernel_config CONFIG_BPF_SYSCALL y
338 set_kernel_config CONFIG_BPF_EVENTS y
339 set_kernel_config CONFIG_BPF_STREAM_PARSER y
340 set_kernel_config CONFIG_CGROUP_BPF y
341 fi
342
343 # KERNEL_DEFAULT_GOV was set by user
344 if [ "$KERNEL_DEFAULT_GOV" != powersave ] && [ -n "$KERNEL_DEFAULT_GOV" ] ; then
345
346 case "$KERNEL_DEFAULT_GOV" in
347 performance)
348 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE y
349 ;;
350 userspace)
351 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE y
352 ;;
353 ondemand)
354 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND y
355 ;;
356 conservative)
357 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE y
358 ;;
359 shedutil)
360 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL y
361 ;;
362 *)
363 echo "error: unsupported default cpu governor"
364 exit 1
365 ;;
366 esac
367
368 # unset previous default governor
369 unset_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE
370 fi
371
372 #Revert to previous directory
373 cd "${WORKDIR}" || exit
374
90 # Set kernel configuration parameters to enable qemu emulation
375 # Set kernel configuration parameters to enable qemu emulation
91 if [ "$ENABLE_QEMU" = true ] ; then
376 if [ "$ENABLE_QEMU" = true ] ; then
92 echo "CONFIG_FHANDLE=y" >> "${KERNEL_DIR}"/.config
377 echo "CONFIG_FHANDLE=y" >> "${KERNEL_DIR}"/.config
93 echo "CONFIG_LBDAF=y" >> "${KERNEL_DIR}"/.config
378 echo "CONFIG_LBDAF=y" >> "${KERNEL_DIR}"/.config
94
379
95 if [ "$ENABLE_CRYPTFS" = true ] ; then
380 if [ "$ENABLE_CRYPTFS" = true ] ; then
96 {
381 {
97 echo "CONFIG_EMBEDDED=y"
382 echo "CONFIG_EMBEDDED=y"
98 echo "CONFIG_EXPERT=y"
383 echo "CONFIG_EXPERT=y"
99 echo "CONFIG_DAX=y"
384 echo "CONFIG_DAX=y"
100 echo "CONFIG_MD=y"
385 echo "CONFIG_MD=y"
101 echo "CONFIG_BLK_DEV_MD=y"
386 echo "CONFIG_BLK_DEV_MD=y"
102 echo "CONFIG_MD_AUTODETECT=y"
387 echo "CONFIG_MD_AUTODETECT=y"
103 echo "CONFIG_BLK_DEV_DM=y"
388 echo "CONFIG_BLK_DEV_DM=y"
104 echo "CONFIG_BLK_DEV_DM_BUILTIN=y"
389 echo "CONFIG_BLK_DEV_DM_BUILTIN=y"
105 echo "CONFIG_DM_CRYPT=y"
390 echo "CONFIG_DM_CRYPT=y"
106 echo "CONFIG_CRYPTO_BLKCIPHER=y"
391 echo "CONFIG_CRYPTO_BLKCIPHER=y"
107 echo "CONFIG_CRYPTO_CBC=y"
392 echo "CONFIG_CRYPTO_CBC=y"
108 echo "CONFIG_CRYPTO_XTS=y"
393 echo "CONFIG_CRYPTO_XTS=y"
109 echo "CONFIG_CRYPTO_SHA512=y"
394 echo "CONFIG_CRYPTO_SHA512=y"
110 echo "CONFIG_CRYPTO_MANAGER=y"
395 echo "CONFIG_CRYPTO_MANAGER=y"
111 } >> "${KERNEL_DIR}"/.config
396 } >> "${KERNEL_DIR}"/.config
112 fi
397 fi
113 fi
398 fi
114
399
115 # Copy custom kernel configuration file
400 # Copy custom kernel configuration file
116 if [ -n "$KERNELSRC_USRCONFIG" ] ; then
401 if [ -n "$KERNELSRC_USRCONFIG" ] ; then
117 cp "$KERNELSRC_USRCONFIG" "${KERNEL_DIR}"/.config
402 cp "$KERNELSRC_USRCONFIG" "${KERNEL_DIR}"/.config
118 fi
403 fi
119
404
120 # Set kernel configuration parameters to their default values
405 # Set kernel configuration parameters to their default values
121 if [ "$KERNEL_OLDDEFCONFIG" = true ] ; then
406 if [ "$KERNEL_OLDDEFCONFIG" = true ] ; then
122 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" olddefconfig
407 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" olddefconfig
123 fi
408 fi
124
409
125 # Start menu-driven kernel configuration (interactive)
410 # Start menu-driven kernel configuration (interactive)
126 if [ "$KERNEL_MENUCONFIG" = true ] ; then
411 if [ "$KERNEL_MENUCONFIG" = true ] ; then
127 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" menuconfig
412 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" menuconfig
128 fi
413 fi
414 # end if "$KERNELSRC_CONFIG" = true
129 fi
415 fi
130
416
131 # Use ccache to cross compile the kernel
417 # Use ccache to cross compile the kernel
132 if [ "$KERNEL_CCACHE" = true ] ; then
418 if [ "$KERNEL_CCACHE" = true ] ; then
133 cc="ccache ${CROSS_COMPILE}gcc"
419 cc="ccache ${CROSS_COMPILE}gcc"
134 else
420 else
135 cc="${CROSS_COMPILE}gcc"
421 cc="${CROSS_COMPILE}gcc"
136 fi
422 fi
137
423
138 # Cross compile kernel and dtbs
424 # Cross compile kernel and dtbs
139 make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" "${KERNEL_BIN_IMAGE}" dtbs
425 make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" "${KERNEL_BIN_IMAGE}" dtbs
140
426
141 # Cross compile kernel modules
427 # Cross compile kernel modules
142 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
428 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
143 make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" modules
429 make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" modules
144 fi
430 fi
431 # end if "$KERNELSRC_PREBUILT" = false
145 fi
432 fi
146
433
147 # Check if kernel compilation was successful
434 # Check if kernel compilation was successful
148 if [ ! -r "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" ] ; then
435 if [ ! -r "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" ] ; then
149 echo "error: kernel compilation failed! (kernel image not found)"
436 echo "error: kernel compilation failed! (kernel image not found)"
150 cleanup
437 cleanup
151 exit 1
438 exit 1
152 fi
439 fi
153
440
154 # Install kernel modules
441 # Install kernel modules
155 if [ "$ENABLE_REDUCE" = true ] ; then
442 if [ "$ENABLE_REDUCE" = true ] ; then
156 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
443 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
157 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=../../.. modules_install
444 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=../../.. modules_install
158 fi
445 fi
159 else
446 else
160 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
447 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
161 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_PATH=../../.. modules_install
448 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_PATH=../../.. modules_install
162 fi
449 fi
163
450
164 # Install kernel firmware
451 # Install kernel firmware
165 if grep -q "^firmware_install:" "${KERNEL_DIR}/Makefile" ; then
452 if grep -q "^firmware_install:" "${KERNEL_DIR}/Makefile" ; then
166 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_FW_PATH=../../../lib firmware_install
453 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_FW_PATH=../../../lib firmware_install
167 fi
454 fi
168 fi
455 fi
169
456
170 # Install kernel headers
457 # Install kernel headers
171 if [ "$KERNEL_HEADERS" = true ] && [ "$KERNEL_REDUCE" = false ] ; then
458 if [ "$KERNEL_HEADERS" = true ] && [ "$KERNEL_REDUCE" = false ] ; then
172 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_HDR_PATH=../.. headers_install
459 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_HDR_PATH=../.. headers_install
173 fi
460 fi
174
461
175 # Prepare boot (firmware) directory
462 # Prepare boot (firmware) directory
176 mkdir "${BOOT_DIR}"
463 mkdir "${BOOT_DIR}"
177
464
178 # Get kernel release version
465 # Get kernel release version
179 KERNEL_VERSION=$(cat "${KERNEL_DIR}/include/config/kernel.release")
466 KERNEL_VERSION=$(cat "${KERNEL_DIR}/include/config/kernel.release")
180
467
181 # Copy kernel configuration file to the boot directory
468 # Copy kernel configuration file to the boot directory
182 install_readonly "${KERNEL_DIR}/.config" "${R}/boot/config-${KERNEL_VERSION}"
469 install_readonly "${KERNEL_DIR}/.config" "${R}/boot/config-${KERNEL_VERSION}"
183
470
184 # Prepare device tree directory
471 # Prepare device tree directory
185 mkdir "${BOOT_DIR}/overlays"
472 mkdir "${BOOT_DIR}/overlays"
186
473
187 # Ensure the proper .dtb is located
474 # Ensure the proper .dtb is located
188 if [ "$KERNEL_ARCH" = "arm" ] ; then
475 if [ "$KERNEL_ARCH" = "arm" ] ; then
189 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/"*.dtb ; do
476 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/"*.dtb ; do
190 if [ -f "${dtb}" ] ; then
477 if [ -f "${dtb}" ] ; then
191 install_readonly "${dtb}" "${BOOT_DIR}/"
478 install_readonly "${dtb}" "${BOOT_DIR}/"
192 fi
479 fi
193 done
480 done
194 else
481 else
195 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/broadcom/"*.dtb ; do
482 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/broadcom/"*.dtb ; do
196 if [ -f "${dtb}" ] ; then
483 if [ -f "${dtb}" ] ; then
197 install_readonly "${dtb}" "${BOOT_DIR}/"
484 install_readonly "${dtb}" "${BOOT_DIR}/"
198 fi
485 fi
199 done
486 done
200 fi
487 fi
201
488
202 # Copy compiled dtb device tree files
489 # Copy compiled dtb device tree files
203 if [ -d "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays" ] ; then
490 if [ -d "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays" ] ; then
204 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtb ; do
491 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtb ; do
205 if [ -f "${dtb}" ] ; then
492 if [ -f "${dtb}" ] ; then
206 install_readonly "${dtb}" "${BOOT_DIR}/overlays/"
493 install_readonly "${dtb}" "${BOOT_DIR}/overlays/"
207 fi
494 fi
208 done
495 done
209
496
210 if [ -f "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" ] ; then
497 if [ -f "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" ] ; then
211 install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "${BOOT_DIR}/overlays/README"
498 install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "${BOOT_DIR}/overlays/README"
212 fi
499 fi
213 fi
500 fi
214
501
215 if [ "$ENABLE_UBOOT" = false ] ; then
502 if [ "$ENABLE_UBOOT" = false ] ; then
216 # Convert and copy kernel image to the boot directory
503 # Convert and copy kernel image to the boot directory
217 "${KERNEL_DIR}/scripts/mkknlimg" "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
504 "${KERNEL_DIR}/scripts/mkknlimg" "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
218 else
505 else
219 # Copy kernel image to the boot directory
506 # Copy kernel image to the boot directory
220 install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
507 install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
221 fi
508 fi
222
509
223 # Remove kernel sources
510 # Remove kernel sources
224 if [ "$KERNEL_REMOVESRC" = true ] ; then
511 if [ "$KERNEL_REMOVESRC" = true ] ; then
225 rm -fr "${KERNEL_DIR}"
512 rm -fr "${KERNEL_DIR}"
226 else
513 else
227 # Prepare compiled kernel modules
514 # Prepare compiled kernel modules
228 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
515 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
229 if grep -q "^modules_prepare:" "${KERNEL_DIR}/Makefile" ; then
516 if grep -q "^modules_prepare:" "${KERNEL_DIR}/Makefile" ; then
230 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" modules_prepare
517 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" modules_prepare
231 fi
518 fi
232
519
233 # Create symlinks for kernel modules
520 # Create symlinks for kernel modules
234 chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/build"
521 chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/build"
235 chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/source"
522 chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/source"
236 fi
523 fi
237 fi
524 fi
238
525
239 else # BUILD_KERNEL=false
526 else # BUILD_KERNEL=false
240 # Kernel installation
527 if [ "$SET_ARCH" = 64 ] && { [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; } ; then
241 chroot_exec apt-get -qq -y --no-install-recommends install linux-image-"${COLLABORA_KERNEL}" raspberrypi-bootloader-nokernel
528
529 # Use Sakakis modified kernel if ZSWAP is active
530 if [ "$KERNEL_ZSWAP" = true ] || [ "$KERNEL_VIRT" = true ] || [ "$KERNEL_NF" = true ] || [ "$KERNEL_BPF" = true ] ; then
531 RPI3_64_KERNEL_URL="${RPI3_64_BIS_KERNEL_URL}"
532 fi
533
534 # Create temporary directory for dl
535 temp_dir=$(as_nobody mktemp -d)
536
537 # Fetch kernel dl
538 as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI3_64_KERNEL_URL"
242
539
243 # Install flash-kernel last so it doesn't try (and fail) to detect the platform in the chroot
540 #extract download
244 chroot_exec apt-get -qq -y install flash-kernel
541 tar -xJf "${temp_dir}"/kernel.tar.xz -C "${temp_dir}"
542
543 #move extracted kernel to /boot/firmware
544 mkdir "${R}/boot/firmware"
545 cp "${temp_dir}"/boot/* "${R}"/boot/firmware/
546 cp -r "${temp_dir}"/lib/* "${R}"/lib/
547
548 # Remove temporary directory for kernel sources
549 rm -fr "${temp_dir}"
550
551 # Set permissions of the kernel sources
552 chown -R root:root "${R}/boot/firmware"
553 chown -R root:root "${R}/lib/modules"
554 fi
555
556 # Install Kernel from hypriot comptabile with all Raspberry PI
557 if [ "$SET_ARCH" = 32 ] ; then
558 # Create temporary directory for dl
559 temp_dir=$(as_nobody mktemp -d)
560
561 # Fetch kernel
562 as_nobody wget -O "${temp_dir}"/kernel.deb -c "$RPI_32_KERNEL_URL"
563
564 # Copy downloaded U-Boot sources
565 mv "${temp_dir}"/kernel.deb "${R}"/tmp/kernel.deb
566
567 # Set permissions
568 chown -R root:root "${R}"/tmp/kernel.deb
569
570 # Install kernel
571 chroot_exec dpkg -i /tmp/kernel.deb
572
573 # move /boot to /boot/firmware to fit script env.
574 #mkdir "${BOOT_DIR}"
575 mkdir "${temp_dir}"/firmware
576 mv "${R}"/boot/* "${temp_dir}"/firmware/
577 mv "${temp_dir}"/firmware "${R}"/boot/
578
579 #same for kernel headers
580 if [ "$KERNEL_HEADERS" = true ] ; then
581 # Fetch kernel header
582 as_nobody wget -O "${temp_dir}"/kernel-header.deb -c "$RPI_32_KERNELHEADER_URL"
583 mv "${temp_dir}"/kernel-header.deb "${R}"/tmp/kernel-header.deb
584 chown -R root:root "${R}"/tmp/kernel-header.deb
585 # Install kernel header
586 chroot_exec dpkg -i /tmp/kernel-header.deb
587 rm -f "${R}"/tmp/kernel-header.deb
588 fi
589
590 # Remove temporary directory and files
591 rm -fr "${temp_dir}"
592 rm -f "${R}"/tmp/kernel.deb
593 fi
245
594
246 # Check if kernel installation was successful
595 # Check if kernel installation was successful
247 VMLINUZ="$(ls -1 "${R}"/boot/vmlinuz-* | sort | tail -n 1)"
596 KERNEL="$(ls -1 "${R}"/boot/firmware/kernel* | sort | tail -n 1)"
248 if [ -z "$VMLINUZ" ] ; then
597 if [ -z "$KERNEL" ] ; then
249 echo "error: kernel installation failed! (/boot/vmlinuz-* not found)"
598 echo "error: kernel installation failed! (/boot/kernel* not found)"
250 cleanup
599 cleanup
251 exit 1
600 exit 1
252 fi
601 fi
253 # Copy vmlinuz kernel to the boot directory
254 install_readonly "${VMLINUZ}" "${BOOT_DIR}/${KERNEL_IMAGE}"
255 fi
602 fi
@@ -1,59 +1,99
1 #
1 #
2 # Setup fstab and initramfs
2 # Setup fstab and initramfs
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 # Install and setup fstab
8 # Install and setup fstab
9 install_readonly files/mount/fstab "${ETC_DIR}/fstab"
9 install_readonly files/mount/fstab "${ETC_DIR}/fstab"
10
10
11 if [ "$ENABLE_UBOOTUSB" = true ] ; then
12 sed -i "s/mmcblk0p1/sda1/" "${ETC_DIR}/fstab"
13 sed -i "s/mmcblk0p2/sda2/" "${ETC_DIR}/fstab"
14 fi
15
11 # Add usb/sda disk root partition to fstab
16 # Add usb/sda disk root partition to fstab
12 if [ "$ENABLE_SPLITFS" = true ] && [ "$ENABLE_CRYPTFS" = false ] ; then
17 if [ "$ENABLE_SPLITFS" = true ] && [ "$ENABLE_CRYPTFS" = false ] ; then
13 sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/fstab"
18 sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/fstab"
14 fi
19 fi
15
20
16 # Add encrypted root partition to fstab and crypttab
21 # Add encrypted root partition to fstab and crypttab
17 if [ "$ENABLE_CRYPTFS" = true ] ; then
22 if [ "$ENABLE_CRYPTFS" = true ] ; then
18 # Replace fstab root partition with encrypted partition mapping
23 # Replace fstab root partition with encrypted partition mapping
19 sed -i "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING}/" "${ETC_DIR}/fstab"
24 sed -i "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING}/" "${ETC_DIR}/fstab"
20
25
21 # Add encrypted partition to crypttab and fstab
26 # Add encrypted partition to crypttab and fstab
22 install_readonly files/mount/crypttab "${ETC_DIR}/crypttab"
27 install_readonly files/mount/crypttab "${ETC_DIR}/crypttab"
23 echo "${CRYPTFS_MAPPING} /dev/mmcblk0p2 none luks,initramfs" >> "${ETC_DIR}/crypttab"
28 echo "${CRYPTFS_MAPPING} /dev/mmcblk0p2 none luks,initramfs" >> "${ETC_DIR}/crypttab"
24
29
25 if [ "$ENABLE_SPLITFS" = true ] ; then
30 if [ "$ENABLE_SPLITFS" = true ] ; then
26 # Add usb/sda disk to crypttab
31 # Add usb/sda disk to crypttab
27 sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/crypttab"
32 sed -i "s/mmcblk0p2/sda1/" "${ETC_DIR}/crypttab"
28 fi
33 fi
29 fi
34 fi
30
35
31 # Generate initramfs file
36 # Generate initramfs file
32 if [ "$BUILD_KERNEL" = true ] && [ "$ENABLE_INITRAMFS" = true ] ; then
37 if [ "$ENABLE_INITRAMFS" = true ] ; then
33 if [ "$ENABLE_CRYPTFS" = true ] ; then
38 if [ "$ENABLE_CRYPTFS" = true ] ; then
34 # Include initramfs scripts to auto expand encrypted root partition
39 # Include initramfs scripts to auto expand encrypted root partition
35 if [ "$EXPANDROOT" = true ] ; then
40 if [ "$EXPANDROOT" = true ] ; then
36 install_exec files/initramfs/expand_encrypted_rootfs "${ETC_DIR}/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs"
41 install_exec files/initramfs/expand_encrypted_rootfs "${ETC_DIR}/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs"
37 install_exec files/initramfs/expand-premount "${ETC_DIR}/initramfs-tools/scripts/local-premount/expand-premount"
42 install_exec files/initramfs/expand-premount "${ETC_DIR}/initramfs-tools/scripts/local-premount/expand-premount"
38 install_exec files/initramfs/expand-tools "${ETC_DIR}/initramfs-tools/hooks/expand-tools"
43 install_exec files/initramfs/expand-tools "${ETC_DIR}/initramfs-tools/hooks/expand-tools"
39 fi
44 fi
40
45
46 if [ "$CRYPTFS_DROPBEAR" = true ]; then
47 if [ -n "$CRYPTFS_DROPBEAR_PUBKEY" ] && [ -f "$CRYPTFS_DROPBEAR_PUBKEY" ] ; then
48 install_readonly "${CRYPTFS_DROPBEAR_PUBKEY}" "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
49 cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub >> "${ETC_DIR}"/dropbear-initramfs/authorized_keys
50 else
51 # Create key
52 chroot_exec /usr/bin/dropbearkey -t rsa -f /etc/dropbear-initramfs/id_rsa.dropbear
53
54 # Convert dropbear key to openssh key
55 chroot_exec /usr/lib/dropbear/dropbearconvert dropbear openssh /etc/dropbear-initramfs/id_rsa.dropbear /etc/dropbear-initramfs/id_rsa
56
57 # Get Public Key Part
58 chroot_exec /usr/bin/dropbearkey -y -f /etc/dropbear-initramfs/id_rsa.dropbear | chroot_exec tee /etc/dropbear-initramfs/id_rsa.pub
59
60 # Delete unwanted lines
61 sed -i '/Public/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
62 sed -i '/Fingerprint/d' "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub
63
64 # Trust the new key
65 cat "${ETC_DIR}"/dropbear-initramfs/id_rsa.pub > "${ETC_DIR}"/dropbear-initramfs/authorized_keys
66
67 # Save Keys - convert with putty from rsa/openssh to puttkey
68 cp -f "${ETC_DIR}"/dropbear-initramfs/id_rsa "${BASEDIR}"/dropbear_initramfs_key.rsa
69
70 # Get unlock script
71 install_exec files/initramfs/crypt_unlock.sh "${ETC_DIR}"/initramfs-tools/hooks/crypt_unlock.sh
72
73 # Enable Dropbear inside initramfs
74 printf "#\n# DROPBEAR: [ y | n ]\n#\n\nDROPBEAR=y\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
75
76 # Enable Dropbear inside initramfs
77 sed -i "54 i sleep 5" "${R}"/usr/share/initramfs-tools/scripts/init-premount/dropbear
78 fi
79 else
41 # Disable SSHD inside initramfs
80 # Disable SSHD inside initramfs
42 printf "#\n# DROPBEAR: [ y | n ]\n#\n\nDROPBEAR=n\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
81 printf "#\n# DROPBEAR: [ y | n ]\n#\n\nDROPBEAR=n\n" >> "${ETC_DIR}/initramfs-tools/initramfs.conf"
82 fi
43
83
44 # Add cryptsetup modules to initramfs
84 # Add cryptsetup modules to initramfs
45 printf "#\n# CRYPTSETUP: [ y | n ]\n#\n\nCRYPTSETUP=y\n" >> "${ETC_DIR}/initramfs-tools/conf-hook"
85 printf "#\n# CRYPTSETUP: [ y | n ]\n#\n\nCRYPTSETUP=y\n" >> "${ETC_DIR}/initramfs-tools/conf-hook"
46
86
47 # Dummy mapping required by mkinitramfs
87 # Dummy mapping required by mkinitramfs
48 echo "0 1 crypt $(echo "${CRYPTFS_CIPHER}" | cut -d ':' -f 1) ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 0 7:0 4096" | chroot_exec dmsetup create "${CRYPTFS_MAPPING}"
88 echo "0 1 crypt $(echo "${CRYPTFS_CIPHER}" | cut -d ':' -f 1) ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff 0 7:0 4096" | chroot_exec dmsetup create "${CRYPTFS_MAPPING}"
49
89
50 # Generate initramfs with encrypted root partition support
90 # Generate initramfs with encrypted root partition support
51 chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
91 chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
52
92
53 # Remove dummy mapping
93 # Remove dummy mapping
54 chroot_exec cryptsetup close "${CRYPTFS_MAPPING}"
94 chroot_exec cryptsetup close "${CRYPTFS_MAPPING}"
55 else
95 else
56 # Generate initramfs without encrypted root partition support
96 # Generate initramfs without encrypted root partition support
57 chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
97 chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
58 fi
98 fi
59 fi
99 fi
@@ -1,229 +1,280
1 #
1 #
2 # Setup RPi2/3 config and cmdline
2 # Setup RPi2/3 config and cmdline
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 if [ "$BUILD_KERNEL" = true ] ; then
9 if [ -n "$RPI_FIRMWARE_DIR" ] && [ -d "$RPI_FIRMWARE_DIR" ] ; then
8 if [ -n "$RPI_FIRMWARE_DIR" ] && [ -d "$RPI_FIRMWARE_DIR" ] ; then
10 # Install boot binaries from local directory
9 # Install boot binaries from local directory
11 cp "${RPI_FIRMWARE_DIR}"/boot/bootcode.bin "${BOOT_DIR}"/bootcode.bin
10 cp "${RPI_FIRMWARE_DIR}"/boot/bootcode.bin "${BOOT_DIR}"/bootcode.bin
12 cp "${RPI_FIRMWARE_DIR}"/boot/fixup.dat "${BOOT_DIR}"/fixup.dat
11 cp "${RPI_FIRMWARE_DIR}"/boot/fixup.dat "${BOOT_DIR}"/fixup.dat
13 cp "${RPI_FIRMWARE_DIR}"/boot/fixup_cd.dat "${BOOT_DIR}"/fixup_cd.dat
12 cp "${RPI_FIRMWARE_DIR}"/boot/fixup_cd.dat "${BOOT_DIR}"/fixup_cd.dat
14 cp "${RPI_FIRMWARE_DIR}"/boot/fixup_x.dat "${BOOT_DIR}"/fixup_x.dat
13 cp "${RPI_FIRMWARE_DIR}"/boot/fixup_x.dat "${BOOT_DIR}"/fixup_x.dat
15 cp "${RPI_FIRMWARE_DIR}"/boot/start.elf "${BOOT_DIR}"/start.elf
14 cp "${RPI_FIRMWARE_DIR}"/boot/start.elf "${BOOT_DIR}"/start.elf
16 cp "${RPI_FIRMWARE_DIR}"/boot/start_cd.elf "${BOOT_DIR}"/start_cd.elf
15 cp "${RPI_FIRMWARE_DIR}"/boot/start_cd.elf "${BOOT_DIR}"/start_cd.elf
17 cp "${RPI_FIRMWARE_DIR}"/boot/start_x.elf "${BOOT_DIR}"/start_x.elf
16 cp "${RPI_FIRMWARE_DIR}"/boot/start_x.elf "${BOOT_DIR}"/start_x.elf
18 else
17 else
19 # Create temporary directory for boot binaries
18 # Create temporary directory for boot binaries
20 temp_dir=$(as_nobody mktemp -d)
19 temp_dir=$(as_nobody mktemp -d)
21
20
22 # Install latest boot binaries from raspberry/firmware github
21 # Install latest boot binaries from raspberry/firmware github
23 as_nobody wget -q -O "${temp_dir}/bootcode.bin" "${FIRMWARE_URL}/bootcode.bin"
22 as_nobody wget -q -O "${temp_dir}/bootcode.bin" "${FIRMWARE_URL}/bootcode.bin"
24 as_nobody wget -q -O "${temp_dir}/fixup.dat" "${FIRMWARE_URL}/fixup.dat"
23 as_nobody wget -q -O "${temp_dir}/fixup.dat" "${FIRMWARE_URL}/fixup.dat"
25 as_nobody wget -q -O "${temp_dir}/fixup_cd.dat" "${FIRMWARE_URL}/fixup_cd.dat"
24 as_nobody wget -q -O "${temp_dir}/fixup_cd.dat" "${FIRMWARE_URL}/fixup_cd.dat"
26 as_nobody wget -q -O "${temp_dir}/fixup_x.dat" "${FIRMWARE_URL}/fixup_x.dat"
25 as_nobody wget -q -O "${temp_dir}/fixup_x.dat" "${FIRMWARE_URL}/fixup_x.dat"
27 as_nobody wget -q -O "${temp_dir}/start.elf" "${FIRMWARE_URL}/start.elf"
26 as_nobody wget -q -O "${temp_dir}/start.elf" "${FIRMWARE_URL}/start.elf"
28 as_nobody wget -q -O "${temp_dir}/start_cd.elf" "${FIRMWARE_URL}/start_cd.elf"
27 as_nobody wget -q -O "${temp_dir}/start_cd.elf" "${FIRMWARE_URL}/start_cd.elf"
29 as_nobody wget -q -O "${temp_dir}/start_x.elf" "${FIRMWARE_URL}/start_x.elf"
28 as_nobody wget -q -O "${temp_dir}/start_x.elf" "${FIRMWARE_URL}/start_x.elf"
30
29
31 # Move downloaded boot binaries
30 # Move downloaded boot binaries
32 mv "${temp_dir}/"* "${BOOT_DIR}/"
31 mv "${temp_dir}/"* "${BOOT_DIR}/"
33
32
34 # Remove temporary directory for boot binaries
33 # Remove temporary directory for boot binaries
35 rm -fr "${temp_dir}"
34 rm -fr "${temp_dir}"
36
35
37 # Set permissions of the boot binaries
36 # Set permissions of the boot binaries
38 chown -R root:root "${BOOT_DIR}"
37 chown -R root:root "${BOOT_DIR}"
39 chmod -R 600 "${BOOT_DIR}"
38 chmod -R 600 "${BOOT_DIR}"
40 fi
39 fi
41 fi
42
40
43 # Setup firmware boot cmdline
41 # Setup firmware boot cmdline
44 if [ "$ENABLE_SPLITFS" = true ] ; then
42 if [ "$ENABLE_SPLITFS" = true ] ; then
45 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/sda1 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait console=tty1 init=/bin/systemd"
43 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/sda1 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait console=tty1 init=/bin/systemd"
46 else
44 else
47 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait console=tty1 init=/bin/systemd"
45 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline rootwait console=tty1 init=/bin/systemd"
48 fi
46 fi
49
47
50 # Add encrypted root partition to cmdline.txt
48 # Add encrypted root partition to cmdline.txt
51 if [ "$ENABLE_CRYPTFS" = true ] ; then
49 if [ "$ENABLE_CRYPTFS" = true ] ; then
52 if [ "$ENABLE_SPLITFS" = true ] ; then
50 if [ "$ENABLE_SPLITFS" = true ] ; then
53 CMDLINE=$(echo "${CMDLINE}" | sed "s/sda1/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/sda1:${CRYPTFS_MAPPING}/")
51 CMDLINE=$(echo "${CMDLINE}" | sed "s/sda1/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/sda1:${CRYPTFS_MAPPING}/")
54 else
52 else
55 CMDLINE=$(echo "${CMDLINE}" | sed "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/mmcblk0p2:${CRYPTFS_MAPPING}/")
53 CMDLINE=$(echo "${CMDLINE}" | sed "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/mmcblk0p2:${CRYPTFS_MAPPING}/")
56 fi
54 fi
57 fi
55 fi
58
56
59 #locks cpu at max frequency
57 # Enable Kernel messages on standard output
60 if [ "$ENABLE_TURBO" = true ] ; then
61 echo "force_turbo=1" >> "${BOOT_DIR}/config.txt"
62 fi
63
64 if [ "$ENABLE_PRINTK" = true ] ; then
58 if [ "$ENABLE_PRINTK" = true ] ; then
65 install_readonly files/sysctl.d/83-rpi-printk.conf "${ETC_DIR}/sysctl.d/83-rpi-printk.conf"
59 install_readonly files/sysctl.d/83-rpi-printk.conf "${ETC_DIR}/sysctl.d/83-rpi-printk.conf"
66 fi
60 fi
67
61
68 # Install udev rule for serial alias
62 # Install udev rule for serial alias - serial0 = console serial1=bluetooth
69 install_readonly files/etc/99-com.rules "${LIB_DIR}/udev/rules.d/99-com.rules"
63 install_readonly files/etc/99-com.rules "${LIB_DIR}/udev/rules.d/99-com.rules"
70
64
71 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
65 # Remove IPv6 networking support
66 if [ "$ENABLE_IPV6" = false ] ; then
67 CMDLINE="${CMDLINE} ipv6.disable=1"
68 fi
69
70 # Automatically assign predictable network interface names
71 if [ "$ENABLE_IFNAMES" = false ] ; then
72 CMDLINE="${CMDLINE} net.ifnames=0"
73 else
74 CMDLINE="${CMDLINE} net.ifnames=1"
75 fi
76
77 # Disable Raspberry Pi console logo
78 if [ "$ENABLE_LOGO" = false ] ; then
79 CMDLINE="${CMDLINE} logo.nologo"
80 fi
81
82 # Strictly limit verbosity of boot up console messages
83 if [ "$ENABLE_SILENT_BOOT" = true ] ; then
84 CMDLINE="${CMDLINE} quiet loglevel=0 rd.systemd.show_status=auto rd.udev.log_priority=0"
85 fi
86
87 # Install firmware config
88 install_readonly files/boot/config.txt "${BOOT_DIR}/config.txt"
72
89
73 # RPI0,3,3P Use default ttyS0 (mini-UART)as serial interface
90 # Disable Raspberry Pi console logo
74 SET_SERIAL="ttyS0"
91 if [ "$ENABLE_SLASH" = false ] ; then
92 echo "disable_splash=1" >> "${BOOT_DIR}/config.txt"
93 fi
94
95 # Locks CPU frequency at maximum
96 if [ "$ENABLE_TURBO" = true ] ; then
97 echo "force_turbo=1" >> "${BOOT_DIR}/config.txt"
98 # helps to avoid sdcard corruption when force_turbo is enabled.
99 echo "boot_delay=1" >> "${BOOT_DIR}/config.txt"
100 fi
101
102 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
75
103
76 # Bluetooth enabled
104 # Bluetooth enabled
77 if [ "$ENABLE_BLUETOOTH" = true ] ; then
105 if [ "$ENABLE_BLUETOOTH" = true ] ; then
78 # Create temporary directory for Bluetooth sources
106 # Create temporary directory for Bluetooth sources
79 temp_dir=$(as_nobody mktemp -d)
107 temp_dir=$(as_nobody mktemp -d)
80
108
81 # Fetch Bluetooth sources
109 # Fetch Bluetooth sources
82 as_nobody git -C "${temp_dir}" clone "${BLUETOOTH_URL}"
110 as_nobody git -C "${temp_dir}" clone "${BLUETOOTH_URL}"
83
111
84 # Copy downloaded sources
112 # Copy downloaded sources
85 mv "${temp_dir}/pi-bluetooth" "${R}/tmp/"
113 mv "${temp_dir}/pi-bluetooth" "${R}/tmp/"
86
114
87 # Bluetooth firmware from arch aur https://aur.archlinux.org/packages/pi-bluetooth/
115 # Bluetooth firmware from arch aur https://aur.archlinux.org/packages/pi-bluetooth/
88 as_nobody wget -q -O "${R}/tmp/pi-bluetooth/LICENCE.broadcom_bcm43xx" https://aur.archlinux.org/cgit/aur.git/plain/LICENCE.broadcom_bcm43xx?h=pi-bluetooth
116 as_nobody wget -q -O "${R}/tmp/pi-bluetooth/LICENCE.broadcom_bcm43xx" https://aur.archlinux.org/cgit/aur.git/plain/LICENCE.broadcom_bcm43xx?h=pi-bluetooth
89 as_nobody wget -q -O "${R}/tmp/pi-bluetooth/BCM43430A1.hcd" https://aur.archlinux.org/cgit/aur.git/plain/BCM43430A1.hcd?h=pi-bluetooth
117 as_nobody wget -q -O "${R}/tmp/pi-bluetooth/BCM43430A1.hcd" https://aur.archlinux.org/cgit/aur.git/plain/BCM43430A1.hcd?h=pi-bluetooth
90
118
91 # Set permissions
119 # Set permissions
92 chown -R root:root "${R}/tmp/pi-bluetooth"
120 chown -R root:root "${R}/tmp/pi-bluetooth"
93
121
94 # Install tools
122 # Install tools
95 install_readonly "${R}/tmp/pi-bluetooth/usr/bin/btuart" "${R}/usr/bin/btuart"
123 install_readonly "${R}/tmp/pi-bluetooth/usr/bin/btuart" "${R}/usr/bin/btuart"
96 install_readonly "${R}/tmp/pi-bluetooth/usr/bin/bthelper" "${R}/usr/bin/bthelper"
124 install_readonly "${R}/tmp/pi-bluetooth/usr/bin/bthelper" "${R}/usr/bin/bthelper"
97
125
126 # make scripts executable
127 chmod +x "${R}/usr/bin/bthelper"
128 chmod +x "${R}/usr/bin/btuart"
129
98 # Install bluetooth udev rule
130 # Install bluetooth udev rule
99 install_readonly "${R}/tmp/pi-bluetooth/lib/udev/rules.d/90-pi-bluetooth.rules" "${LIB_DIR}/udev/rules.d/90-pi-bluetooth.rules"
131 install_readonly "${R}/tmp/pi-bluetooth/lib/udev/rules.d/90-pi-bluetooth.rules" "${LIB_DIR}/udev/rules.d/90-pi-bluetooth.rules"
100
132
101 # Install Firmware Flash file and apropiate licence
133 # Install Firmware Flash file and apropiate licence
102 mkdir -p "$BLUETOOTH_FIRMWARE_DIR"
134 mkdir -p "$BLUETOOTH_FIRMWARE_DIR"
103 install_readonly "${R}/tmp/pi-bluetooth/LICENCE.broadcom_bcm43xx" "${BLUETOOTH_FIRMWARE_DIR}/LICENCE.broadcom_bcm43xx"
135 install_readonly "${R}/tmp/pi-bluetooth/LICENCE.broadcom_bcm43xx" "${BLUETOOTH_FIRMWARE_DIR}/LICENCE.broadcom_bcm43xx"
104 install_readonly "${R}/tmp/pi-bluetooth/BCM43430A1.hcd" "${BLUETOOTH_FIRMWARE_DIR}/LICENCE.broadcom_bcm43xx"
136 install_readonly "${R}/tmp/pi-bluetooth/BCM43430A1.hcd" "${BLUETOOTH_FIRMWARE_DIR}/LICENCE.broadcom_bcm43xx"
105 install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.bthelper@.service" "${ETC_DIR}/systemd/system/pi-bluetooth.bthelper@.service"
137 install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.bthelper@.service" "${ETC_DIR}/systemd/system/pi-bluetooth.bthelper@.service"
106 install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.hciuart.service" "${ETC_DIR}/systemd/system/pi-bluetooth.hciuart.service"
138 install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.hciuart.service" "${ETC_DIR}/systemd/system/pi-bluetooth.hciuart.service"
107
139
108 # Remove temporary directory
140 # Remove temporary directories
109 rm -fr "${temp_dir}"
141 rm -fr "${temp_dir}"
142 rm -fr "${R}"/tmp/pi-bluetooth
110
143
111 # Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore UART0/ttyAMA0 over GPIOs 14 & 15. Slow Bluetooth and slow cpu. Use /dev/ttyS0 instead of /dev/ttyAMA0
144 # Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore UART0/ttyAMA0 over GPIOs 14 & 15. Slow Bluetooth and slow cpu. Use /dev/ttyS0 instead of /dev/ttyAMA0
112 if [ "$ENABLE_MINIUART_OVERLAY" = true ] ; then
145 if [ "$ENABLE_MINIUART_OVERLAY" = true ] ; then
113 SET_SERIAL="ttyAMA0"
114
146
115 # set overlay to swap ttyAMA0 and ttyS0
147 # set overlay to swap ttyAMA0 and ttyS0
116 echo "dtoverlay=pi3-miniuart-bt" >> "${BOOT_DIR}/config.txt"
148 echo "dtoverlay=pi3-miniuart-bt" >> "${BOOT_DIR}/config.txt"
117
149
118 # if force_turbo didn't lock cpu at high speed, lock it at low speed (XOR logic) or miniuart will be broken
150 # if force_turbo didn't lock cpu at high speed, lock it at low speed (XOR logic) or miniuart will be broken
119 if [ "$ENABLE_TURBO" = false ] ; then
151 if [ "$ENABLE_TURBO" = false ] ; then
120 echo "core_freq=250" >> "${BOOT_DIR}/config.txt"
152 echo "core_freq=250" >> "${BOOT_DIR}/config.txt"
121 fi
153 fi
154 fi
122
155
123 # Activate services
156 # Activate services
124 chroot_exec systemctl enable pi-bluetooth.hciuart.service
157 chroot_exec systemctl enable pi-bluetooth.hciuart.service
125 #chroot_exec systemctl enable pi-bluetooth.bthelper@.service
126 else
127 chroot_exec systemctl enable pi-bluetooth.hciuart.service
128 #chroot_exec systemctl enable pi-bluetooth.bthelper@.service
129 fi
130
158
131 else # if ENABLE_BLUETOOTH = false
159 else # if ENABLE_BLUETOOTH = false
132 # set overlay to disable bluetooth
160 # set overlay to disable bluetooth
133 echo "dtoverlay=pi3-disable-bt" >> "${BOOT_DIR}/config.txt"
161 echo "dtoverlay=pi3-disable-bt" >> "${BOOT_DIR}/config.txt"
134 fi # ENABLE_BLUETOOTH end
162 fi # ENABLE_BLUETOOTH end
135
136 else
137 # RPI1,1P,2 Use default ttyAMA0 (full UART) as serial interface
138 SET_SERIAL="ttyAMA0"
139 fi
163 fi
140
164
141 # may need sudo systemctl disable hciuart
165 # may need sudo systemctl disable hciuart
142 if [ "$ENABLE_CONSOLE" = true ] ; then
166 if [ "$ENABLE_CONSOLE" = true ] ; then
143 echo "enable_uart=1" >> "${BOOT_DIR}/config.txt"
167 echo "enable_uart=1" >> "${BOOT_DIR}/config.txt"
144 # add string to cmdline
168 # add string to cmdline
145 CMDLINE="${CMDLINE} console=serial0,115200"
169 CMDLINE="${CMDLINE} console=serial0,115200"
146
170
147 # Enable serial console systemd style
171 # Enable serial console systemd style
148 chroot_exec systemctl enable serial-getty\@"$SET_SERIAL".service
172 chroot_exec systemctl enable serial-getty\@serial0.service
149 else
173 else
150 echo "enable_uart=0" >> "${BOOT_DIR}/config.txt"
174 echo "enable_uart=0" >> "${BOOT_DIR}/config.txt"
175
151 # disable serial console systemd style
176 # disable serial console systemd style
152 chroot_exec systemctl disable serial-getty\@"$SET_SERIAL".service
177 chroot_exec systemctl disable serial-getty\@"$SET_SERIAL".service
153 fi
178 fi
154
179
155 # Remove IPv6 networking support
180 if [ "$ENABLE_SYSTEMDSWAP" = true ] ; then
156 if [ "$ENABLE_IPV6" = false ] ; then
181 # Create temporary directory for systemd-swap sources
157 CMDLINE="${CMDLINE} ipv6.disable=1"
182 temp_dir=$(as_nobody mktemp -d)
158 fi
159
183
160 # Automatically assign predictable network interface names
184 # Fetch systemd-swap sources
161 if [ "$ENABLE_IFNAMES" = false ] ; then
185 as_nobody git -C "${temp_dir}" clone "${SYSTEMDSWAP_URL}"
162 CMDLINE="${CMDLINE} net.ifnames=0"
186
187 # Copy downloaded systemd-swap sources
188 mv "${temp_dir}/systemd-swap" "${R}/tmp/"
189
190 # Set permissions of the systemd-swap sources
191 chown -R root:root "${R}/tmp/systemd-swap"
192
193 # Remove temporary directory for systemd-swap sources
194 rm -fr "${temp_dir}"
195
196 # Change into downloaded src dir
197 cd "${R}/tmp/systemd-swap" || exit
198
199 # Build package
200 . ./package.sh debian
201
202 # Install package
203 chroot_exec dpkg -i /tmp/systemd-swap/systemd-swap-*any.deb
204
205 # Enable service
206 chroot_exec systemctl enable systemd-swap
207
208 # Change back into script root dir
209 cd "${WORKDIR}" || exit
163 else
210 else
164 CMDLINE="${CMDLINE} net.ifnames=1"
211 # Enable ZSWAP in cmdline if systemd-swap is not used
212 if [ "$KERNEL_ZSWAP" = true ] ; then
213 CMDLINE="${CMDLINE} zswap.enabled=1 zswap.max_pool_percent=25 zswap.compressor=lz4"
214 fi
215 fi
216
217 if [ "$KERNEL_SECURITY" = true ] ; then
218 CMDLINE="${CMDLINE} apparmor=1 security=apparmor"
165 fi
219 fi
166
220
167 # Install firmware boot cmdline
221 # Install firmware boot cmdline
168 echo "${CMDLINE}" > "${BOOT_DIR}/cmdline.txt"
222 echo "${CMDLINE}" > "${BOOT_DIR}/cmdline.txt"
169
223
170 # Install firmware config
171 install_readonly files/boot/config.txt "${BOOT_DIR}/config.txt"
172
173 # Setup minimal GPU memory allocation size: 16MB (no X)
224 # Setup minimal GPU memory allocation size: 16MB (no X)
174 if [ "$ENABLE_MINGPU" = true ] ; then
225 if [ "$ENABLE_MINGPU" = true ] ; then
175 echo "gpu_mem=16" >> "${BOOT_DIR}/config.txt"
226 echo "gpu_mem=16" >> "${BOOT_DIR}/config.txt"
176 fi
227 fi
177
228
178 # Setup boot with initramfs
229 # Setup boot with initramfs
179 if [ "$ENABLE_INITRAMFS" = true ] ; then
230 if [ "$ENABLE_INITRAMFS" = true ] ; then
180 echo "initramfs initramfs-${KERNEL_VERSION} followkernel" >> "${BOOT_DIR}/config.txt"
231 echo "initramfs initramfs-${KERNEL_VERSION} followkernel" >> "${BOOT_DIR}/config.txt"
181 fi
232 fi
182
233
183 # Create firmware configuration and cmdline symlinks
234 # Create firmware configuration and cmdline symlinks
184 ln -sf firmware/config.txt "${R}/boot/config.txt"
235 ln -sf firmware/config.txt "${R}/boot/config.txt"
185 ln -sf firmware/cmdline.txt "${R}/boot/cmdline.txt"
236 ln -sf firmware/cmdline.txt "${R}/boot/cmdline.txt"
186
237
187 # Install and setup kernel modules to load at boot
238 # Install and setup kernel modules to load at boot
188 mkdir -p "${LIB_DIR}/modules-load.d/"
239 mkdir -p "${LIB_DIR}/modules-load.d/"
189 install_readonly files/modules/rpi2.conf "${LIB_DIR}/modules-load.d/rpi2.conf"
240 install_readonly files/modules/rpi2.conf "${LIB_DIR}/modules-load.d/rpi2.conf"
190
241
191 # Load hardware random module at boot
242 # Load hardware random module at boot
192 if [ "$ENABLE_HWRANDOM" = true ] && [ "$BUILD_KERNEL" = false ] ; then
243 if [ "$ENABLE_HWRANDOM" = true ] && [ "$BUILD_KERNEL" = false ] ; then
193 sed -i "s/^# bcm2708_rng/bcm2708_rng/" "${LIB_DIR}/modules-load.d/rpi2.conf"
244 sed -i "s/^# bcm2708_rng/bcm2708_rng/" "${LIB_DIR}/modules-load.d/rpi2.conf"
194 fi
245 fi
195
246
196 # Load sound module at boot
247 # Load sound module at boot
197 if [ "$ENABLE_SOUND" = true ] ; then
248 if [ "$ENABLE_SOUND" = true ] ; then
198 sed -i "s/^# snd_bcm2835/snd_bcm2835/" "${LIB_DIR}/modules-load.d/rpi2.conf"
249 sed -i "s/^# snd_bcm2835/snd_bcm2835/" "${LIB_DIR}/modules-load.d/rpi2.conf"
199 else
250 else
200 echo "dtparam=audio=off" >> "${BOOT_DIR}/config.txt"
251 echo "dtparam=audio=off" >> "${BOOT_DIR}/config.txt"
201 fi
252 fi
202
253
203 # Enable I2C interface
254 # Enable I2C interface
204 if [ "$ENABLE_I2C" = true ] ; then
255 if [ "$ENABLE_I2C" = true ] ; then
205 echo "dtparam=i2c_arm=on" >> "${BOOT_DIR}/config.txt"
256 echo "dtparam=i2c_arm=on" >> "${BOOT_DIR}/config.txt"
206 sed -i "s/^# i2c-bcm2708/i2c-bcm2708/" "${LIB_DIR}/modules-load.d/rpi2.conf"
257 sed -i "s/^# i2c-bcm2708/i2c-bcm2708/" "${LIB_DIR}/modules-load.d/rpi2.conf"
207 sed -i "s/^# i2c-dev/i2c-dev/" "${LIB_DIR}/modules-load.d/rpi2.conf"
258 sed -i "s/^# i2c-dev/i2c-dev/" "${LIB_DIR}/modules-load.d/rpi2.conf"
208 fi
259 fi
209
260
210 # Enable SPI interface
261 # Enable SPI interface
211 if [ "$ENABLE_SPI" = true ] ; then
262 if [ "$ENABLE_SPI" = true ] ; then
212 echo "dtparam=spi=on" >> "${BOOT_DIR}/config.txt"
263 echo "dtparam=spi=on" >> "${BOOT_DIR}/config.txt"
213 echo "spi-bcm2708" >> "${LIB_DIR}/modules-load.d/rpi2.conf"
264 echo "spi-bcm2708" >> "${LIB_DIR}/modules-load.d/rpi2.conf"
214 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ]; then
265 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ]; then
215 sed -i "s/spi-bcm2708/spi-bcm2835/" "${LIB_DIR}/modules-load.d/rpi2.conf"
266 sed -i "s/spi-bcm2708/spi-bcm2835/" "${LIB_DIR}/modules-load.d/rpi2.conf"
216 fi
267 fi
217 fi
268 fi
218
269
219 # Disable RPi2/3 under-voltage warnings
270 # Disable RPi2/3 under-voltage warnings
220 if [ -n "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
271 if [ -n "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
221 echo "avoid_warnings=${DISABLE_UNDERVOLT_WARNINGS}" >> "${BOOT_DIR}/config.txt"
272 echo "avoid_warnings=${DISABLE_UNDERVOLT_WARNINGS}" >> "${BOOT_DIR}/config.txt"
222 fi
273 fi
223
274
224 # Install kernel modules blacklist
275 # Install kernel modules blacklist
225 mkdir -p "${ETC_DIR}/modprobe.d/"
276 mkdir -p "${ETC_DIR}/modprobe.d/"
226 install_readonly files/modules/raspi-blacklist.conf "${ETC_DIR}/modprobe.d/raspi-blacklist.conf"
277 install_readonly files/modules/raspi-blacklist.conf "${ETC_DIR}/modprobe.d/raspi-blacklist.conf"
227
278
228 # Install sysctl.d configuration files
279 # Install sysctl.d configuration files
229 install_readonly files/sysctl.d/81-rpi-vm.conf "${ETC_DIR}/sysctl.d/81-rpi-vm.conf"
280 install_readonly files/sysctl.d/81-rpi-vm.conf "${ETC_DIR}/sysctl.d/81-rpi-vm.conf"
@@ -1,132 +1,146
1 #
1 #
2 # Setup Networking
2 # Setup Networking
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 # Install and setup hostname
8 # Install and setup hostname
9 install_readonly files/network/hostname "${ETC_DIR}/hostname"
9 install_readonly files/network/hostname "${ETC_DIR}/hostname"
10 sed -i "s/^RaspberryPI/${HOSTNAME}/" "${ETC_DIR}/hostname"
10 sed -i "s/^RaspberryPI/${HOSTNAME}/" "${ETC_DIR}/hostname"
11
11
12 # Install and setup hosts
12 # Install and setup hosts
13 install_readonly files/network/hosts "${ETC_DIR}/hosts"
13 install_readonly files/network/hosts "${ETC_DIR}/hosts"
14 sed -i "s/RaspberryPI/${HOSTNAME}/" "${ETC_DIR}/hosts"
14 sed -i "s/RaspberryPI/${HOSTNAME}/" "${ETC_DIR}/hosts"
15
15
16 # Setup hostname entry with static IP
16 # Setup hostname entry with static IP
17 if [ "$NET_ADDRESS" != "" ] ; then
17 if [ "$NET_ADDRESS" != "" ] ; then
18 NET_IP=$(echo "${NET_ADDRESS}" | cut -f 1 -d'/')
18 NET_IP=$(echo "${NET_ADDRESS}" | cut -f 1 -d'/')
19 sed -i "s/^127.0.1.1/${NET_IP}/" "${ETC_DIR}/hosts"
19 sed -i "s/^127.0.1.1/${NET_IP}/" "${ETC_DIR}/hosts"
20 fi
20 fi
21
21
22 # Remove IPv6 hosts
22 # Remove IPv6 hosts
23 if [ "$ENABLE_IPV6" = false ] ; then
23 if [ "$ENABLE_IPV6" = false ] ; then
24 sed -i -e "/::[1-9]/d" -e "/^$/d" "${ETC_DIR}/hosts"
24 sed -i -e "/::[1-9]/d" -e "/^$/d" "${ETC_DIR}/hosts"
25 fi
25 fi
26
26
27 # Install hint about network configuration
27 # Install hint about network configuration
28 install_readonly files/network/interfaces "${ETC_DIR}/network/interfaces"
28 install_readonly files/network/interfaces "${ETC_DIR}/network/interfaces"
29
29
30 # Install configuration for interface eth0
30 # Install configuration for interface eth0
31 install_readonly files/network/eth.network "${ETC_DIR}/systemd/network/eth.network"
31 install_readonly files/network/eth.network "${ETC_DIR}/systemd/network/eth.network"
32
32
33 # Install configuration for interface wl*
33 # Install configuration for interface wl*
34 install_readonly files/network/wlan.network "${ETC_DIR}/systemd/network/wlan.network"
34 install_readonly files/network/wlan.network "${ETC_DIR}/systemd/network/wlan.network"
35
35
36 #always with dhcp since wpa_supplicant integration is missing
36 #always with dhcp since wpa_supplicant integration is missing
37 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/wlan.network"
37 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/wlan.network"
38
38
39 if [ "$ENABLE_DHCP" = true ] ; then
39 if [ "$ENABLE_DHCP" = true ] ; then
40 # Enable DHCP configuration for interface eth0
40 # Enable DHCP configuration for interface eth0
41 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/eth.network"
41 sed -i -e "s/DHCP=.*/DHCP=yes/" -e "/DHCP/q" "${ETC_DIR}/systemd/network/eth.network"
42
42
43 # Set DHCP configuration to IPv4 only
43 # Set DHCP configuration to IPv4 only
44 if [ "$ENABLE_IPV6" = false ] ; then
44 if [ "$ENABLE_IPV6" = false ] ; then
45 sed -i "s/DHCP=.*/DHCP=v4/" "${ETC_DIR}/systemd/network/eth.network"
45 sed -i "s/DHCP=.*/DHCP=v4/" "${ETC_DIR}/systemd/network/eth.network"
46 fi
46 fi
47
47
48 else # ENABLE_DHCP=false
48 else # ENABLE_DHCP=false
49 # Set static network configuration for interface eth0
49 # Set static network configuration for interface eth0
50 sed -i\
50 sed -i\
51 -e "s|DHCP=.*|DHCP=no|"\
51 -e "s|DHCP=.*|DHCP=no|"\
52 -e "s|Address=\$|Address=${NET_ADDRESS}|"\
52 -e "s|Address=\$|Address=${NET_ADDRESS}|"\
53 -e "s|Gateway=\$|Gateway=${NET_GATEWAY}|"\
53 -e "s|Gateway=\$|Gateway=${NET_GATEWAY}|"\
54 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_DNS_1}|"\
54 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_DNS_1}|"\
55 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_DNS_2}|"\
55 -e "0,/DNS=\$/ s|DNS=\$|DNS=${NET_DNS_2}|"\
56 -e "s|Domains=\$|Domains=${NET_DNS_DOMAINS}|"\
56 -e "s|Domains=\$|Domains=${NET_DNS_DOMAINS}|"\
57 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_NTP_1}|"\
57 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_NTP_1}|"\
58 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_NTP_2}|"\
58 -e "0,/NTP=\$/ s|NTP=\$|NTP=${NET_NTP_2}|"\
59 "${ETC_DIR}/systemd/network/eth.network"
59 "${ETC_DIR}/systemd/network/eth.network"
60
61 if [ "$CRYPTFS_DROPBEAR" = true ] ; then
62 # Get cdir from NET_ADDRESS e.g. 24
63 cdir=$(${NET_ADDRESS} | cut -d '/' -f2)
64
65 # Convert cdir ro netmask e.g. 24 to 255.255.255.0
66 NET_MASK=$(cdr2mask "$cdir")
67
68 # Write static ip settings to "${ETC_DIR}"/initramfs-tools/initramfs.conf
69 sed -i "\$aIP=${NET_ADDRESS}::${NET_GATEWAY}:${NET_MASK}:${HOSTNAME}:" "${ETC_DIR}"/initramfs-tools/initramfs.conf
70
71 # Regenerate initramfs
72 chroot_exec mkinitramfs -o "/boot/firmware/initramfs-${KERNEL_VERSION}" "${KERNEL_VERSION}"
73 fi
60 fi
74 fi
61
75
62 # Remove empty settings from network configuration
76 # Remove empty settings from network configuration
63 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/eth.network"
77 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/eth.network"
64 # Remove empty settings from wlan configuration
78 # Remove empty settings from wlan configuration
65 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/wlan.network"
79 sed -i "/.*=\$/d" "${ETC_DIR}/systemd/network/wlan.network"
66
80
67 # Move systemd network configuration if required by Debian release
81 # Move systemd network configuration if required by Debian release
68 mv -v "${ETC_DIR}/systemd/network/eth.network" "${LIB_DIR}/systemd/network/10-eth.network"
82 mv -v "${ETC_DIR}/systemd/network/eth.network" "${LIB_DIR}/systemd/network/10-eth.network"
69 # If WLAN is enabled copy wlan configuration too
83 # If WLAN is enabled copy wlan configuration too
70 if [ "$ENABLE_WIRELESS" = true ] ; then
84 if [ "$ENABLE_WIRELESS" = true ] ; then
71 mv -v "${ETC_DIR}/systemd/network/wlan.network" "${LIB_DIR}/systemd/network/11-wlan.network"
85 mv -v "${ETC_DIR}/systemd/network/wlan.network" "${LIB_DIR}/systemd/network/11-wlan.network"
72 fi
86 fi
73 rm -fr "${ETC_DIR}/systemd/network"
87 rm -fr "${ETC_DIR}/systemd/network"
74
88
75 # Enable systemd-networkd service
89 # Enable systemd-networkd service
76 chroot_exec systemctl enable systemd-networkd
90 chroot_exec systemctl enable systemd-networkd
77
91
78 # Install host.conf resolver configuration
92 # Install host.conf resolver configuration
79 install_readonly files/network/host.conf "${ETC_DIR}/host.conf"
93 install_readonly files/network/host.conf "${ETC_DIR}/host.conf"
80
94
81 # Enable network stack hardening
95 # Enable network stack hardening
82 if [ "$ENABLE_HARDNET" = true ] ; then
96 if [ "$ENABLE_HARDNET" = true ] ; then
83 # Install sysctl.d configuration files
97 # Install sysctl.d configuration files
84 install_readonly files/sysctl.d/82-rpi-net-hardening.conf "${ETC_DIR}/sysctl.d/82-rpi-net-hardening.conf"
98 install_readonly files/sysctl.d/82-rpi-net-hardening.conf "${ETC_DIR}/sysctl.d/82-rpi-net-hardening.conf"
85
99
86 # Setup resolver warnings about spoofed addresses
100 # Setup resolver warnings about spoofed addresses
87 sed -i "s/^# spoof warn/spoof warn/" "${ETC_DIR}/host.conf"
101 sed -i "s/^# spoof warn/spoof warn/" "${ETC_DIR}/host.conf"
88 fi
102 fi
89
103
90 # Enable time sync
104 # Enable time sync
91 if [ "$NET_NTP_1" != "" ] ; then
105 if [ "$NET_NTP_1" != "" ] ; then
92 chroot_exec systemctl enable systemd-timesyncd.service
106 chroot_exec systemctl enable systemd-timesyncd.service
93 fi
107 fi
94
108
95 # Download the firmware binary blob required to use the RPi3 wireless interface
109 # Download the firmware binary blob required to use the RPi3 wireless interface
96 if [ "$ENABLE_WIRELESS" = true ] ; then
110 if [ "$ENABLE_WIRELESS" = true ] ; then
97 if [ ! -d "${WLAN_FIRMWARE_DIR}" ] ; then
111 if [ ! -d "${WLAN_FIRMWARE_DIR}" ] ; then
98 mkdir -p "${WLAN_FIRMWARE_DIR}"
112 mkdir -p "${WLAN_FIRMWARE_DIR}"
99 fi
113 fi
100
114
101 # Create temporary directory for firmware binary blob
115 # Create temporary directory for firmware binary blob
102 temp_dir=$(as_nobody mktemp -d)
116 temp_dir=$(as_nobody mktemp -d)
103
117
104 # Fetch firmware binary blob for RPI3B+
118 # Fetch firmware binary blob for RPI3B+
105 if [ "$RPI_MODEL" = 3P ] ; then
119 if [ "$RPI_MODEL" = 3P ] ; then
106 # Fetch firmware binary blob for RPi3P
120 # Fetch firmware binary blob for RPi3P
107 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.bin"
121 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.bin"
108 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.txt"
122 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.txt"
109 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.clm_blob" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.clm_blob"
123 as_nobody wget -q -O "${temp_dir}/brcmfmac43455-sdio.clm_blob" "${WLAN_FIRMWARE_URL}/brcmfmac43455-sdio.clm_blob"
110
124
111 # Move downloaded firmware binary blob
125 # Move downloaded firmware binary blob
112 mv "${temp_dir}/brcmfmac43455-sdio."* "${WLAN_FIRMWARE_DIR}/"
126 mv "${temp_dir}/brcmfmac43455-sdio."* "${WLAN_FIRMWARE_DIR}/"
113
127
114 # Set permissions of the firmware binary blob
128 # Set permissions of the firmware binary blob
115 chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43455-sdio."*
129 chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43455-sdio."*
116 chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43455-sdio."*
130 chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43455-sdio."*
117 elif [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 0 ] ; then
131 elif [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 0 ] ; then
118 # Fetch firmware binary blob for RPi3
132 # Fetch firmware binary blob for RPi3
119 as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.bin"
133 as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.bin" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.bin"
120 as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.txt"
134 as_nobody wget -q -O "${temp_dir}/brcmfmac43430-sdio.txt" "${WLAN_FIRMWARE_URL}/brcmfmac43430-sdio.txt"
121
135
122 # Move downloaded firmware binary blob
136 # Move downloaded firmware binary blob
123 mv "${temp_dir}/brcmfmac43430-sdio."* "${WLAN_FIRMWARE_DIR}/"
137 mv "${temp_dir}/brcmfmac43430-sdio."* "${WLAN_FIRMWARE_DIR}/"
124
138
125 # Set permissions of the firmware binary blob
139 # Set permissions of the firmware binary blob
126 chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
140 chown root:root "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
127 chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
141 chmod 600 "${WLAN_FIRMWARE_DIR}/brcmfmac43430-sdio."*
128 fi
142 fi
129
143
130 # Remove temporary directory for firmware binary blob
144 # Remove temporary directory for firmware binary blob
131 rm -fr "${temp_dir}"
145 rm -fr "${temp_dir}"
132 fi
146 fi
@@ -1,48 +1,54
1 #
1 #
2 # Setup Firewall
2 # Setup Firewall
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 if [ "$ENABLE_IPTABLES" = true ] ; then
8 if [ "$ENABLE_IPTABLES" = true ] ; then
9 # Create iptables configuration directory
9 # Create iptables configuration directory
10 mkdir -p "${ETC_DIR}/iptables"
10 mkdir -p "${ETC_DIR}/iptables"
11
11
12 # make sure iptables-legacy is the used alternatives
12 if [ "$KERNEL_NF" = false ] ; then
13 #iptables-save and -restore are slaves of iptables and thus are set accordingly
13 #iptables-save and -restore are slaves of iptables and thus are set accordingly
14 chroot_exec update-alternatives --verbose --set iptables /usr/sbin/iptables-legacy
14 chroot_exec update-alternatives --verbose --set iptables /usr/sbin/iptables-legacy
15 fi
15
16
16 # Install iptables systemd service
17 # Install iptables systemd service
17 install_readonly files/iptables/iptables.service "${ETC_DIR}/systemd/system/iptables.service"
18 install_readonly files/iptables/iptables.service "${ETC_DIR}/systemd/system/iptables.service"
18
19
19 # Install flush-table script called by iptables service
20 # Install flush-table script called by iptables service
20 install_exec files/iptables/flush-iptables.sh "${ETC_DIR}/iptables/flush-iptables.sh"
21 install_exec files/iptables/flush-iptables.sh "${ETC_DIR}/iptables/flush-iptables.sh"
21
22
22 # Install iptables rule file
23 # Install iptables rule file
23 install_readonly files/iptables/iptables.rules "${ETC_DIR}/iptables/iptables.rules"
24 install_readonly files/iptables/iptables.rules "${ETC_DIR}/iptables/iptables.rules"
24
25
25 # Reload systemd configuration and enable iptables service
26 # Reload systemd configuration and enable iptables service
26 chroot_exec systemctl daemon-reload
27 chroot_exec systemctl daemon-reload
27 chroot_exec systemctl enable iptables.service
28 chroot_exec systemctl enable iptables.service
28
29
29 if [ "$ENABLE_IPV6" = true ] ; then
30 if [ "$ENABLE_IPV6" = true ] ; then
31 if [ "$KERNEL_NF" = false ] ; then
32 #iptables-save and -restore are slaves of iptables and thus are set accordingly
33 chroot_exec update-alternatives --verbose --set ip6tables /usr/sbin/ip6tables-legacy
34 fi
35
30 # Install ip6tables systemd service
36 # Install ip6tables systemd service
31 install_readonly files/iptables/ip6tables.service "${ETC_DIR}/systemd/system/ip6tables.service"
37 install_readonly files/iptables/ip6tables.service "${ETC_DIR}/systemd/system/ip6tables.service"
32
38
33 # Install ip6tables file
39 # Install ip6tables file
34 install_exec files/iptables/flush-ip6tables.sh "${ETC_DIR}/iptables/flush-ip6tables.sh"
40 install_exec files/iptables/flush-ip6tables.sh "${ETC_DIR}/iptables/flush-ip6tables.sh"
35
41
36 install_readonly files/iptables/ip6tables.rules "${ETC_DIR}/iptables/ip6tables.rules"
42 install_readonly files/iptables/ip6tables.rules "${ETC_DIR}/iptables/ip6tables.rules"
37
43
38 # Reload systemd configuration and enable iptables service
44 # Reload systemd configuration and enable iptables service
39 chroot_exec systemctl daemon-reload
45 chroot_exec systemctl daemon-reload
40 chroot_exec systemctl enable ip6tables.service
46 chroot_exec systemctl enable ip6tables.service
41 fi
47 fi
42
48
43 if [ "$ENABLE_SSHD" = false ] ; then
49 if [ "$ENABLE_SSHD" = false ] ; then
44 # Remove SSHD related iptables rules
50 # Remove SSHD related iptables rules
45 sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/iptables.rules" 2> /dev/null
51 sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/iptables.rules" 2> /dev/null
46 sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/ip6tables.rules" 2> /dev/null
52 sed -i "/^#/! {/SSH/ s/^/# /}" "${ETC_DIR}/iptables/ip6tables.rules" 2> /dev/null
47 fi
53 fi
48 fi
54 fi
@@ -1,29 +1,24
1 #
1 #
2 # Setup users and security settings
2 # Setup users and security settings
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 # Generate crypt(3) password string
8 # Generate crypt(3) password string
9 ENCRYPTED_PASSWORD=$(mkpasswd -m sha-512 "${PASSWORD}")
9 ENCRYPTED_PASSWORD=$(mkpasswd -m sha-512 "${PASSWORD}")
10 ENCRYPTED_USER_PASSWORD=$(mkpasswd -m sha-512 "${USER_PASSWORD}")
10 ENCRYPTED_USER_PASSWORD=$(mkpasswd -m sha-512 "${USER_PASSWORD}")
11
11
12 # Setup default user
12 # Setup default user
13 if [ "$ENABLE_USER" = true ] ; then
13 if [ "$ENABLE_USER" = true ] ; then
14 chroot_exec adduser --gecos "$USER_NAME" --add_extra_groups --disabled-password "$USER_NAME"
14 chroot_exec adduser --gecos "$USER_NAME" --add_extra_groups --disabled-password "$USER_NAME"
15 chroot_exec usermod -a -G sudo -p "${ENCRYPTED_USER_PASSWORD}" "$USER_NAME"
15 chroot_exec usermod -a -G sudo -p "${ENCRYPTED_USER_PASSWORD}" "$USER_NAME"
16 fi
16 fi
17
17
18 # Setup root password or not
18 # Setup root password or not
19 if [ "$ENABLE_ROOT" = true ] ; then
19 if [ "$ENABLE_ROOT" = true ] ; then
20 chroot_exec usermod -p "${ENCRYPTED_PASSWORD}" root
20 chroot_exec usermod -p "${ENCRYPTED_PASSWORD}" root
21 else
21 else
22 # Set no root password to disable root login
22 # Set no root password to disable root login
23 chroot_exec usermod -p \'!\' root
23 chroot_exec usermod -p \'!\' root
24 fi
24 fi
25
26 # Enable serial console systemd style
27 if [ "$ENABLE_CONSOLE" = true ] ; then
28 chroot_exec systemctl enable serial-getty\@ttyAMA0.service
29 fi
@@ -1,100 +1,105
1 #
1 #
2 # Build and Setup U-Boot
2 # Build and Setup U-Boot
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 # Fetch and build U-Boot bootloader
8 # Fetch and build U-Boot bootloader
9 if [ "$ENABLE_UBOOT" = true ] ; then
9 if [ "$ENABLE_UBOOT" = true ] ; then
10 # Install c/c++ build environment inside the chroot
10 # Install c/c++ build environment inside the chroot
11 chroot_install_cc
11 chroot_install_cc
12
12
13 # Copy existing U-Boot sources into chroot directory
13 # Copy existing U-Boot sources into chroot directory
14 if [ -n "$UBOOTSRC_DIR" ] && [ -d "$UBOOTSRC_DIR" ] ; then
14 if [ -n "$UBOOTSRC_DIR" ] && [ -d "$UBOOTSRC_DIR" ] ; then
15 # Copy local U-Boot sources
15 # Copy local U-Boot sources
16 cp -r "${UBOOTSRC_DIR}" "${R}/tmp"
16 cp -r "${UBOOTSRC_DIR}" "${R}/tmp"
17 else
17 else
18 # Create temporary directory for U-Boot sources
18 # Create temporary directory for U-Boot sources
19 temp_dir=$(as_nobody mktemp -d)
19 temp_dir=$(as_nobody mktemp -d)
20
20
21 # Fetch U-Boot sources
21 # Fetch U-Boot sources
22 as_nobody git -C "${temp_dir}" clone "${UBOOT_URL}"
22 as_nobody git -C "${temp_dir}" clone "${UBOOT_URL}"
23
23
24 # Copy downloaded U-Boot sources
24 # Copy downloaded U-Boot sources
25 mv "${temp_dir}/u-boot" "${R}/tmp/"
25 mv "${temp_dir}/u-boot" "${R}/tmp/"
26
26
27 # Set permissions of the U-Boot sources
27 # Set permissions of the U-Boot sources
28 chown -R root:root "${R}/tmp/u-boot"
28 chown -R root:root "${R}/tmp/u-boot"
29
29
30 # Remove temporary directory for U-Boot sources
30 # Remove temporary directory for U-Boot sources
31 rm -fr "${temp_dir}"
31 rm -fr "${temp_dir}"
32 fi
32 fi
33
33
34 # Build and install U-Boot inside chroot
34 # Build and install U-Boot inside chroot
35 chroot_exec make -j"${KERNEL_THREADS}" -C /tmp/u-boot/ "${UBOOT_CONFIG}" all
35 chroot_exec make -j"${KERNEL_THREADS}" -C /tmp/u-boot/ "${UBOOT_CONFIG}" all
36
36
37 # Copy compiled bootloader binary and set config.txt to load it
37 # Copy compiled bootloader binary and set config.txt to load it
38 install_exec "${R}/tmp/u-boot/tools/mkimage" "${R}/usr/sbin/mkimage"
38 install_exec "${R}/tmp/u-boot/tools/mkimage" "${R}/usr/sbin/mkimage"
39 install_readonly "${R}/tmp/u-boot/u-boot.bin" "${BOOT_DIR}/u-boot.bin"
39 install_readonly "${R}/tmp/u-boot/u-boot.bin" "${BOOT_DIR}/u-boot.bin"
40 printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> "${BOOT_DIR}/config.txt"
40 printf "\n# boot u-boot kernel\nkernel=u-boot.bin\n" >> "${BOOT_DIR}/config.txt"
41
41
42 # Install and setup U-Boot command file
42 # Install and setup U-Boot command file
43 install_readonly files/boot/uboot.mkimage "${BOOT_DIR}/uboot.mkimage"
43 install_readonly files/boot/uboot.mkimage "${BOOT_DIR}/uboot.mkimage"
44 printf "# Set the kernel boot command line\nsetenv bootargs \"earlyprintk ${CMDLINE}\"\n\n$(cat "${BOOT_DIR}"/uboot.mkimage)" > "${BOOT_DIR}/uboot.mkimage"
44 printf "# Set the kernel boot command line\nsetenv bootargs \"earlyprintk ${CMDLINE}\"\n\n$(cat "${BOOT_DIR}"/uboot.mkimage)" > "${BOOT_DIR}/uboot.mkimage"
45
45
46 if [ "$ENABLE_INITRAMFS" = true ] ; then
46 if [ "$ENABLE_INITRAMFS" = true ] ; then
47 # Convert generated initramfs for U-Boot using mkimage
47 # Convert generated initramfs for U-Boot using mkimage
48 chroot_exec /usr/sbin/mkimage -A "${KERNEL_ARCH}" -T ramdisk -C none -n "initramfs-${KERNEL_VERSION}" -d "/boot/firmware/initramfs-${KERNEL_VERSION}" "/boot/firmware/initramfs-${KERNEL_VERSION}.uboot"
48 chroot_exec /usr/sbin/mkimage -A "${KERNEL_ARCH}" -T ramdisk -C none -n "initramfs-${KERNEL_VERSION}" -d "/boot/firmware/initramfs-${KERNEL_VERSION}" "/boot/firmware/initramfs-${KERNEL_VERSION}.uboot"
49
49
50 # Remove original initramfs file
50 # Remove original initramfs file
51 rm -f "${BOOT_DIR}/initramfs-${KERNEL_VERSION}"
51 rm -f "${BOOT_DIR}/initramfs-${KERNEL_VERSION}"
52
52
53 # Configure U-Boot to load generated initramfs
53 # Configure U-Boot to load generated initramfs
54 printf "# Set initramfs file\nsetenv initramfs initramfs-${KERNEL_VERSION}.uboot\n\n$(cat "${BOOT_DIR}"/uboot.mkimage)" > "${BOOT_DIR}/uboot.mkimage"
54 printf "# Set initramfs file\nsetenv initramfs initramfs-${KERNEL_VERSION}.uboot\n\n$(cat "${BOOT_DIR}"/uboot.mkimage)" > "${BOOT_DIR}/uboot.mkimage"
55 printf "\nbootz \${kernel_addr_r} \${ramdisk_addr_r} \${fdt_addr_r}" >> "${BOOT_DIR}/uboot.mkimage"
55 printf "\nbootz \${kernel_addr_r} \${ramdisk_addr_r} \${fdt_addr_r}" >> "${BOOT_DIR}/uboot.mkimage"
56 else # ENABLE_INITRAMFS=false
56 else # ENABLE_INITRAMFS=false
57 # Remove initramfs from U-Boot mkfile
57 # Remove initramfs from U-Boot mkfile
58 sed -i '/.*initramfs.*/d' "${BOOT_DIR}/uboot.mkimage"
58 sed -i '/.*initramfs.*/d' "${BOOT_DIR}/uboot.mkimage"
59
59
60 if [ "$BUILD_KERNEL" = false ] ; then
60 if [ "$BUILD_KERNEL" = false ] ; then
61 # Remove dtbfile from U-Boot mkfile
61 # Remove dtbfile from U-Boot mkfile
62 sed -i '/.*dtbfile.*/d' "${BOOT_DIR}/uboot.mkimage"
62 sed -i '/.*dtbfile.*/d' "${BOOT_DIR}/uboot.mkimage"
63 printf "\nbootz \${kernel_addr_r}" >> "${BOOT_DIR}/uboot.mkimage"
63 printf "\nbootz \${kernel_addr_r}" >> "${BOOT_DIR}/uboot.mkimage"
64 else
64 else
65 printf "\nbootz \${kernel_addr_r} - \${fdt_addr_r}" >> "${BOOT_DIR}/uboot.mkimage"
65 printf "\nbootz \${kernel_addr_r} - \${fdt_addr_r}" >> "${BOOT_DIR}/uboot.mkimage"
66 fi
66 fi
67 fi
67 fi
68
68
69 if [ "$SET_ARCH" = 64 ] ; then
69 if [ "$SET_ARCH" = 64 ] ; then
70 echo "Setting up config.txt to boot 64bit uboot"
70 echo "Setting up config.txt to boot 64bit uboot"
71 {
71 {
72 printf "\n# 64bit-mode"
72 printf "\n# 64bit-mode"
73 printf "\n# arm_control=0x200 is deprecated https://www.raspberrypi.org/documentation/configuration/config-txt/misc.md"
73 printf "\n# arm_control=0x200 is deprecated https://www.raspberrypi.org/documentation/configuration/config-txt/misc.md"
74 printf "\narm_64bit=1"
74 printf "\narm_64bit=1"
75 } >> "${BOOT_DIR}/config.txt"
75 } >> "${BOOT_DIR}/config.txt"
76
76
77 #in 64bit uboot booti is used instead of bootz [like in KERNEL_BIN_IMAGE=zImage (armv7)|| Image(armv8)]
77 #in 64bit uboot booti is used instead of bootz [like in KERNEL_BIN_IMAGE=zImage (armv7)|| Image(armv8)]
78 sed -i "s|bootz|booti|g" "${BOOT_DIR}/uboot.mkimage"
78 sed -i "s|bootz|booti|g" "${BOOT_DIR}/uboot.mkimage"
79 fi
79 fi
80
80
81 # instead of sd, boot from usb device
82 if [ "$ENABLE_UBOOTUSB" = true ] ; then
83 sed -i "s|mmc|usb|g" "${BOOT_DIR}/uboot.mkimage"
84 fi
85
81 # Set mkfile to use the correct dtb file
86 # Set mkfile to use the correct dtb file
82 sed -i "s|bcm2709-rpi-2-b.dtb|${DTB_FILE}|" "${BOOT_DIR}/uboot.mkimage"
87 sed -i "s|bcm2709-rpi-2-b.dtb|${DTB_FILE}|" "${BOOT_DIR}/uboot.mkimage"
83
88
84 # Set mkfile to use the correct mach id
89 # Set mkfile to use the correct mach id
85 if [ "$ENABLE_QEMU" = true ] ; then
90 if [ "$ENABLE_QEMU" = true ] ; then
86 sed -i "s/^\(setenv machid \).*/\10x000008e0/" "${BOOT_DIR}/uboot.mkimage"
91 sed -i "s/^\(setenv machid \).*/\10x000008e0/" "${BOOT_DIR}/uboot.mkimage"
87 fi
92 fi
88
93
89 # Set mkfile to use kernel image
94 # Set mkfile to use kernel image
90 sed -i "s|kernel7.img|${KERNEL_IMAGE}|" "${BOOT_DIR}/uboot.mkimage"
95 sed -i "s|kernel7.img|${KERNEL_IMAGE}|" "${BOOT_DIR}/uboot.mkimage"
91
96
92 # Remove all leading blank lines
97 # Remove all leading blank lines
93 sed -i "/./,\$!d" "${BOOT_DIR}/uboot.mkimage"
98 sed -i "/./,\$!d" "${BOOT_DIR}/uboot.mkimage"
94
99
95 # Generate U-Boot bootloader image
100 # Generate U-Boot bootloader image
96 chroot_exec /usr/sbin/mkimage -A "${KERNEL_ARCH}" -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi${RPI_MODEL}" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
101 chroot_exec /usr/sbin/mkimage -A "${KERNEL_ARCH}" -O linux -T script -C none -a 0x00000000 -e 0x00000000 -n "RPi${RPI_MODEL}" -d /boot/firmware/uboot.mkimage /boot/firmware/boot.scr
97
102
98 # Remove U-Boot sources
103 # Remove U-Boot sources
99 rm -fr "${R}/tmp/u-boot"
104 rm -fr "${R}/tmp/u-boot"
100 fi
105 fi
@@ -1,53 +1,56
1 #
1 #
2 # Setup videocore - Raspberry Userland
2 # Setup videocore - Raspberry Userland
3 #
3 #
4
4
5 # Load utility functions
5 # Load utility functions
6 . ./functions.sh
6 . ./functions.sh
7
7
8 if [ "$ENABLE_VIDEOCORE" = true ] ; then
8 if [ "$ENABLE_VIDEOCORE" = true ] ; then
9 # Copy existing videocore sources into chroot directory
9 # Copy existing videocore sources into chroot directory
10 if [ -n "$VIDEOCORESRC_DIR" ] && [ -d "$VIDEOCORESRC_DIR" ] ; then
10 if [ -n "$VIDEOCORESRC_DIR" ] && [ -d "$VIDEOCORESRC_DIR" ] ; then
11 # Copy local videocore sources
11 # Copy local videocore sources
12 cp -r "${VIDEOCORESRC_DIR}" "${R}/tmp/userland"
12 cp -r "${VIDEOCORESRC_DIR}" "${R}/tmp/userland"
13 else
13 else
14 # Create temporary directory for videocore sources
14 # Create temporary directory for videocore sources
15 temp_dir=$(as_nobody mktemp -d)
15 temp_dir=$(as_nobody mktemp -d)
16
16
17 # Fetch videocore sources
17 # Fetch videocore sources
18 as_nobody git -C "${temp_dir}" clone "${VIDEOCORE_URL}"
18 as_nobody git -C "${temp_dir}" clone "${VIDEOCORE_URL}"
19
19
20 # Copy downloaded videocore sources
20 # Copy downloaded videocore sources
21 mv "${temp_dir}/userland" "${R}/tmp/"
21 mv "${temp_dir}/userland" "${R}/tmp/"
22
22
23 # Set permissions of the U-Boot sources
23 # Set permissions of the U-Boot sources
24 chown -R root:root "${R}/tmp/userland"
24 chown -R root:root "${R}/tmp/userland"
25
25
26 # Remove temporary directory for U-Boot sources
26 # Remove temporary directory for U-Boot sources
27 rm -fr "${temp_dir}"
27 rm -fr "${temp_dir}"
28 fi
28 fi
29
29
30 # Create build dir
30 # Create build dir
31 mkdir "${R}"/tmp/userland/build
31 mkdir "${R}"/tmp/userland/build
32
32
33 # push us to build directory
33 # push us to build directory
34 cd "${R}"/tmp/userland/build
34 cd "${R}"/tmp/userland/build
35
35
36 if [ "$RELEASE_ARCH" = "arm64" ] ; then
36 if [ "$RELEASE_ARCH" = "arm64" ] ; then
37 cmake -DCMAKE_SYSTEM_NAME=Linux -DCMAKE_BUILD_TYPE=release -DARM64=ON -DCMAKE_C_COMPILER=aarch64-linux-gnu-gcc -DCMAKE_CXX_COMPILER=aarch64-linux-gnu-g++ -DCMAKE_ASM_COMPILER=aarch64-linux-gnu-gcc -DCMAKE_C_FLAGS="${CMAKE_C_FLAGS} -U_FORTIFY_SOURCE" -DCMAKE_ASM_FLAGS="${CMAKE_ASM_FLAGS} -c" -DVIDEOCORE_BUILD_DIR="${R}" "${R}/tmp/userland"
37 cmake -DCMAKE_SYSTEM_NAME=Linux -DCMAKE_BUILD_TYPE=release -DARM64=ON -DCMAKE_C_COMPILER=aarch64-linux-gnu-gcc -DCMAKE_CXX_COMPILER=aarch64-linux-gnu-g++ -DCMAKE_ASM_COMPILER=aarch64-linux-gnu-gcc -DCMAKE_C_FLAGS="${CMAKE_C_FLAGS} -U_FORTIFY_SOURCE" -DCMAKE_ASM_FLAGS="${CMAKE_ASM_FLAGS} -c" -DVIDEOCORE_BUILD_DIR="${R}" "${R}/tmp/userland"
38 fi
38 fi
39
39
40 if [ "$RELEASE_ARCH" = "armel" ] ; then
40 if [ "$RELEASE_ARCH" = "armel" ] ; then
41 cmake -DCMAKE_SYSTEM_NAME=Linux -DCMAKE_BUILD_TYPE=release -DCMAKE_C_COMPILER=arm-linux-gnueabi-gcc -DCMAKE_CXX_COMPILER=arm-linux-gnueabi-g++ -DCMAKE_ASM_COMPILER=arm-linux-gnueabi-gcc -DCMAKE_C_FLAGS="${CMAKE_C_FLAGS} -U_FORTIFY_SOURCE" -DCMAKE_ASM_FLAGS="${CMAKE_ASM_FLAGS} -c" -DCMAKE_SYSTEM_PROCESSOR="arm" -DVIDEOCORE_BUILD_DIR="${R}" "${R}/tmp/userland"
41 cmake -DCMAKE_SYSTEM_NAME=Linux -DCMAKE_BUILD_TYPE=release -DCMAKE_C_COMPILER=arm-linux-gnueabi-gcc -DCMAKE_CXX_COMPILER=arm-linux-gnueabi-g++ -DCMAKE_ASM_COMPILER=arm-linux-gnueabi-gcc -DCMAKE_C_FLAGS="${CMAKE_C_FLAGS} -U_FORTIFY_SOURCE" -DCMAKE_ASM_FLAGS="${CMAKE_ASM_FLAGS} -c" -DCMAKE_SYSTEM_PROCESSOR="arm" -DVIDEOCORE_BUILD_DIR="${R}" "${R}/tmp/userland"
42 fi
42 fi
43
43
44 if [ "$RELEASE_ARCH" = "armhf" ] ; then
44 if [ "$RELEASE_ARCH" = "armhf" ] ; then
45 cmake -DCMAKE_SYSTEM_NAME=Linux -DCMAKE_BUILD_TYPE=release -DCMAKE_TOOLCHAIN_FILE="${R}"/tmp/userland/makefiles/cmake/toolchains/arm-linux-gnueabihf.cmake -DVIDEOCORE_BUILD_DIR="${R}" "${R}/tmp/userland"
45 cmake -DCMAKE_SYSTEM_NAME=Linux -DCMAKE_BUILD_TYPE=release -DCMAKE_TOOLCHAIN_FILE="${R}"/tmp/userland/makefiles/cmake/toolchains/arm-linux-gnueabihf.cmake -DVIDEOCORE_BUILD_DIR="${R}" "${R}/tmp/userland"
46 fi
46 fi
47
47
48 #build userland
48 #build userland
49 make -j "$(nproc)"
49 make -j "$(nproc)"
50
50
51 #back to root of scriptdir
51 #back to root of scriptdir
52 cd "${WORKDIR}"
52 cd "${WORKDIR}"
53
54 # Remove videocore sources
55 rm -fr "${R}"/tmp/userland/
53 fi
56 fi
@@ -1,8 +1,8
1 deb http://ftp.debian.org/debian jessie main contrib
1 deb http://ftp.debian.org/debian stretch main contrib
2 #deb-src http://ftp.debian.org/debian jessie main contrib
2 #deb-src http://ftp.debian.org/debian stretch main contrib
3
3
4 deb http://ftp.debian.org/debian/ jessie-updates main contrib
4 deb http://ftp.debian.org/debian/ stretch-updates main contrib
5 #deb-src http://ftp.debian.org/debian/ jessie-updates main contrib
5 #deb-src http://ftp.debian.org/debian/ stretch-updates main contrib
6
6
7 deb http://security.debian.org/ jessie/updates main contrib
7 deb http://security.debian.org/ stretch/updates main contrib
8 #deb-src http://security.debian.org/ jessie/updates main contrib
8 #deb-src http://security.debian.org/ stretch/updates main contrib
@@ -1,68 +1,76
1 logger -t "rc.firstboot" "Expanding root partition"
1 logger -t "rc.firstboot" "Expanding root partition"
2
2
3 # Detect root partition device
3 # Detect root partition device
4 ROOT_PART=$(mount | sed -n 's|^/dev/\(.*\) on / .*|\1|p')
4 ROOT_PART=$(mount | sed -n 's|^/dev/\(.*\) on / .*|\1|p')
5 if [ -z "$ROOT_PART" ] ; then
5 if [ -z "$ROOT_PART" ] ; then
6 log_warning_msg "unable to detect root partition device"
6 log_warning_msg "unable to detect root partition device"
7 return 1
7 return 1
8 fi
8 fi
9
9
10 # Extract root device name
10 # Extract root device name
11 case "${ROOT_PART}" in
11 case "${ROOT_PART}" in
12 mmcblk0*) ROOT_DEV=mmcblk0 ;;
12 mmcblk0*) ROOT_DEV=mmcblk0 ;;
13 sda*) ROOT_DEV=sda ;;
13 sda*) ROOT_DEV=sda ;;
14 esac
14 esac
15
15
16 # Check detected root partition name
16 # Check detected root partition name
17 PART_NUM=$(echo ${ROOT_PART} | grep -o '[1-9][0-9]*$')
17 PART_NUM=$(echo ${ROOT_PART} | grep -o '[1-9][0-9]*$')
18 if [ "$PART_NUM" = "$ROOT_PART" ] ; then
18 if [ "$PART_NUM" = "$ROOT_PART" ] ; then
19 logger -t "rc.firstboot" "$ROOT_PART is not an SD card. Don't know how to expand"
19 logger -t "rc.firstboot" "$ROOT_PART is not an SD card. Don't know how to expand"
20 return 0
20 return 0
21 fi
21 fi
22
22
23 # NOTE: the NOOBS partition layout confuses parted. For now, let's only
23 # NOTE: the NOOBS partition layout confuses parted. For now, let's only
24 # agree to work with a sufficiently simple partition layout
24 # agree to work with a sufficiently simple partition layout
25 if [ "$PART_NUM" -gt 2 ] ; then
25 if [ "$PART_NUM" -gt 2 ] ; then
26 logger -t "rc.firstboot" "Your partition layout is not currently supported by this tool."
26 logger -t "rc.firstboot" "Your partition layout is not currently supported by this tool."
27 return 0
27 return 0
28 fi
28 fi
29
29
30 # Check if last partition number
30 # Check if last partition number
31 LAST_PART_NUM=$(parted /dev/${ROOT_DEV} -ms unit s p | tail -n 1 | cut -f 1 -d:)
31 LAST_PART_NUM=$(parted /dev/${ROOT_DEV} -ms unit s p | tail -n 1 | cut -f 1 -d:)
32 if [ $LAST_PART_NUM -ne $PART_NUM ]; then
32 if [ $LAST_PART_NUM -ne $PART_NUM ]; then
33 logger -t "rc.firstboot" "$ROOT_PART is not the last partition. Don't know how to expand"
33 logger -t "rc.firstboot" "$ROOT_PART is not the last partition. Don't know how to expand"
34 return 0
34 return 0
35 fi
35 fi
36
36
37 # Get the starting offset of the root partition
37 # Get the starting offset of the root partition
38 PART_START=$(parted /dev/${ROOT_DEV} -ms unit s p | grep "^${PART_NUM}" | cut -f 2 -d: | sed 's/[^0-9]//g')
38 PART_START=$(parted /dev/${ROOT_DEV} -ms unit s p | grep "^${PART_NUM}" | cut -f 2 -d: | sed 's/[^0-9]//g')
39 if [ -z "$PART_START" ] ; then
39 if [ -z "$PART_START" ] ; then
40 logger -t "rc.firstboot" "${ROOT_DEV} unable to get starting sector of the partition"
40 logger -t "rc.firstboot" "${ROOT_DEV} unable to get starting sector of the partition"
41 return 1
41 return 1
42 fi
42 fi
43
43
44 # Get the possible last sector for the root partition
44 # Get the possible last sector for the root partition
45 PART_LAST=$(fdisk -l /dev/${ROOT_DEV} | grep '^Disk.*sectors' | awk '{ print $7 - 1 }')
45 PART_LAST=$(fdisk -l /dev/${ROOT_DEV} | grep '^Disk.*sectors' | awk '{ print $7 - 1 }')
46 if [ -z "$PART_LAST" ] ; then
46 if [ -z "$PART_LAST" ] ; then
47 logger -t "rc.firstboot" "${ROOT_DEV} unable to get last sector of the partition"
47 logger -t "rc.firstboot" "${ROOT_DEV} unable to get last sector of the partition"
48 return 1
48 return 1
49 fi
49 fi
50
50
51 ### Since rc.local is run with "sh -e", let's add "|| true" to prevent premature exit
51 ### Since rc.local is run with "sh -e", let's add "|| true" to prevent premature exit
52 fdisk /dev/${ROOT_DEV} <<EOF2 || true
52 fdisk /dev/${ROOT_DEV} <<EOF2 || true
53 p
53 p
54 d
54 d
55 $PART_NUM
55 $PART_NUM
56 n
56 n
57 p
57 p
58 $PART_NUM
58 $PART_NUM
59 $PART_START
59 $PART_START
60 $PART_LAST
60 $PART_LAST
61 p
61 p
62 w
62 w
63 EOF2
63 EOF2
64
64
65 # Reload the partition table, resize root filesystem then remove resizing code from this file
65 # Reload the partition table, resize root filesystem then remove resizing code from this file
66 partprobe &&
66 partprobe &&
67 resize2fs /dev/${ROOT_PART} &&
67 resize2fs /dev/${ROOT_PART} &&
68 logger -t "rc.firstboot" "Root partition successfully resized."
68 logger -t "rc.firstboot" "Root partition successfully resized."
69
70 # Restart dphys-swapfile service if it exists
71 if systemctl list-units | grep -q dphys-swapfile ; then
72 if systemctl is-enabled dphys-swapfile ; then
73 logger -t "rc.firstboot" "Restarting dphys-swapfile"
74 systemctl restart dphys-swapfile
75 fi
76 fi
@@ -1,31 +1,32
1 logger -t "rc.firstboot" "Regenerating initramfs to remove encrypted root partition auto-expand"
1 logger -t "rc.firstboot" "Regenerating initramfs to remove encrypted root partition auto-expand"
2
2
3 KERNEL_VERSION=$(uname -r)
3 KERNEL_VERSION=$(uname -r)
4 KERNEL_ARCH=$(uname -m)
4 KERNEL_ARCH=$(uname -m)
5 INITRAMFS="/boot/firmware/initramfs-${KERNEL_VERSION}"
5 INITRAMFS="/boot/firmware/initramfs-${KERNEL_VERSION}"
6 INITRAMFS_UBOOT="${INITRAMFS}.uboot"
6 INITRAMFS_UBOOT="${INITRAMFS}.uboot"
7
7
8 # Extract kernel arch
8 # Extract kernel arch
9 case "${KERNEL_ARCH}" in
9 case "${KERNEL_ARCH}" in
10 arm*) KERNEL_ARCH=arm ;;
10 arm*) KERNEL_ARCH=arm ;;
11 aarch64) KERNEL_ARCH=arm64 ;;
11 esac
12 esac
12
13
13 # Regenerate initramfs
14 # Regenerate initramfs
14 if [ -r "${INITRAMFS}" ] ; then
15 if [ -r "${INITRAMFS}" ] ; then
15 rm -f /etc/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs
16 rm -f /etc/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs
16 rm -f /etc/initramfs-tools/scripts/local-premount/expand-premount
17 rm -f /etc/initramfs-tools/scripts/local-premount/expand-premount
17 rm -f /etc/initramfs-tools/hooks/expand-tools
18 rm -f /etc/initramfs-tools/hooks/expand-tools
18 rm -f "${INITRAMFS}"
19 rm -f "${INITRAMFS}"
19 mkinitramfs -o "${INITRAMFS}" "${KERNEL_VERSION}"
20 mkinitramfs -o "${INITRAMFS}" "${KERNEL_VERSION}"
20 fi
21 fi
21
22
22 # Convert generated initramfs for U-Boot using mkimage
23 # Convert generated initramfs for U-Boot using mkimage
23 if [ -r "${INITRAMFS_UBOOT}" ] ; then
24 if [ -r "${INITRAMFS_UBOOT}" ] ; then
24 rm -f /etc/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs
25 rm -f /etc/initramfs-tools/scripts/init-premount/expand_encrypted_rootfs
25 rm -f /etc/initramfs-tools/scripts/local-premount/expand-premount
26 rm -f /etc/initramfs-tools/scripts/local-premount/expand-premount
26 rm -f /etc/initramfs-tools/hooks/expand-tools
27 rm -f /etc/initramfs-tools/hooks/expand-tools
27 rm -f "${INITRAMFS_UBOOT}"
28 rm -f "${INITRAMFS_UBOOT}"
28 mkinitramfs -o "${INITRAMFS}" "${KERNEL_VERSION}"
29 mkinitramfs -o "${INITRAMFS}" "${KERNEL_VERSION}"
29 mkimage -A "${KERNEL_ARCH}" -T ramdisk -C none -n "initramfs-${KERNEL_VERSION}" -d "${INITRAMFS}" "${INITRAMFS_UBOOT}"
30 mkimage -A "${KERNEL_ARCH}" -T ramdisk -C none -n "initramfs-${KERNEL_VERSION}" -d "${INITRAMFS}" "${INITRAMFS_UBOOT}"
30 rm -f "${INITRAMFS}"
31 rm -f "${INITRAMFS}"
31 fi
32 fi
@@ -1,77 +1,116
1 # This file contains utility functions used by rpi23-gen-image.sh
1 # This file contains utility functions used by rpi23-gen-image.sh
2
2
3 cleanup (){
3 cleanup (){
4 set +x
4 set +x
5 set +e
5 set +e
6
6
7 # Remove exports from nexmon
8 unset KERNEL
9 unset ARCH
10 unset SUBARCH
11 unset CCPLUGIN
12 unset ZLIBFLATE
13 unset Q
14 unset NEXMON_SETUP_ENV
15 unset HOSTUNAME
16 unset PLATFORMUNAME
17
7 # Identify and kill all processes still using files
18 # Identify and kill all processes still using files
8 echo "killing processes using mount point ..."
19 echo "killing processes using mount point ..."
9 fuser -k "${R}"
20 fuser -k "${R}"
10 sleep 3
21 sleep 3
11 fuser -9 -k -v "${R}"
22 fuser -9 -k -v "${R}"
12
23
13 # Clean up temporary .password file
24 # Clean up temporary .password file
14 if [ -r ".password" ] ; then
25 if [ -r ".password" ] ; then
15 shred -zu .password
26 shred -zu .password
16 fi
27 fi
17
28
18 # Clean up all temporary mount points
29 # Clean up all temporary mount points
19 echo "removing temporary mount points ..."
30 echo "removing temporary mount points ..."
20 umount -l "${R}/proc" 2> /dev/null
31 umount -l "${R}/proc" 2> /dev/null
21 umount -l "${R}/sys" 2> /dev/null
32 umount -l "${R}/sys" 2> /dev/null
22 umount -l "${R}/dev/pts" 2> /dev/null
33 umount -l "${R}/dev/pts" 2> /dev/null
23 umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null
34 umount "$BUILDDIR/mount/boot/firmware" 2> /dev/null
24 umount "$BUILDDIR/mount" 2> /dev/null
35 umount "$BUILDDIR/mount" 2> /dev/null
25 cryptsetup close "${CRYPTFS_MAPPING}" 2> /dev/null
36 cryptsetup close "${CRYPTFS_MAPPING}" 2> /dev/null
26 losetup -d "$ROOT_LOOP" 2> /dev/null
37 losetup -d "$ROOT_LOOP" 2> /dev/null
27 losetup -d "$FRMW_LOOP" 2> /dev/null
38 losetup -d "$FRMW_LOOP" 2> /dev/null
28 trap - 0 1 2 3 6
39 trap - 0 1 2 3 6
29 }
40 }
30
41
31 chroot_exec() {
42 chroot_exec() {
32 # Exec command in chroot
43 # Exec command in chroot
33 LANG=C LC_ALL=C DEBIAN_FRONTEND=noninteractive chroot "${R}" "$@"
44 LANG=C LC_ALL=C DEBIAN_FRONTEND=noninteractive chroot "${R}" "$@"
34 }
45 }
35
46
36 as_nobody() {
47 as_nobody() {
37 # Exec command as user nobody
48 # Exec command as user nobody
38 sudo -E -u nobody LANG=C LC_ALL=C "$@"
49 sudo -E -u nobody LANG=C LC_ALL=C "$@"
39 }
50 }
40
51
41 install_readonly() {
52 install_readonly() {
42 # Install file with user read-only permissions
53 # Install file with user read-only permissions
43 install -o root -g root -m 644 "$@"
54 install -o root -g root -m 644 "$@"
44 }
55 }
45
56
46 install_exec() {
57 install_exec() {
47 # Install file with root exec permissions
58 # Install file with root exec permissions
48 install -o root -g root -m 744 "$@"
59 install -o root -g root -m 744 "$@"
49 }
60 }
50
61
51 use_template () {
62 use_template () {
52 # Test if configuration template file exists
63 # Test if configuration template file exists
53 if [ ! -r "./templates/${CONFIG_TEMPLATE}" ] ; then
64 if [ ! -r "./templates/${CONFIG_TEMPLATE}" ] ; then
54 echo "error: configuration template ${CONFIG_TEMPLATE} not found"
65 echo "error: configuration template ${CONFIG_TEMPLATE} not found"
55 exit 1
66 exit 1
56 fi
67 fi
57
68
58 # Load template configuration parameters
69 # Load template configuration parameters
59 . "./templates/${CONFIG_TEMPLATE}"
70 . "./templates/${CONFIG_TEMPLATE}"
60 }
71 }
61
72
62 chroot_install_cc() {
73 chroot_install_cc() {
63 # Install c/c++ build environment inside the chroot
74 # Install c/c++ build environment inside the chroot
64 if [ -z "${COMPILER_PACKAGES}" ] ; then
75 if [ -z "${COMPILER_PACKAGES}" ] ; then
65 COMPILER_PACKAGES=$(chroot_exec apt-get -s install g++ make bc | grep "^Inst " | awk -v ORS=" " '{ print $2 }')
76 COMPILER_PACKAGES=$(chroot_exec apt-get -s install g++ make bc | grep "^Inst " | awk -v ORS=" " '{ print $2 }')
66 # Install COMPILER_PACKAGES in chroot
77 # Install COMPILER_PACKAGES in chroot - NEVER do "${COMPILER_PACKAGES}" -> breaks uboot
67 chroot_exec apt-get -q -y --allow-unauthenticated --no-install-recommends install "${COMPILER_PACKAGES}"
78 chroot_exec apt-get -q -y --allow-unauthenticated --no-install-recommends install ${COMPILER_PACKAGES}
68 fi
79 fi
69 }
80 }
70
81
71 chroot_remove_cc() {
82 chroot_remove_cc() {
72 # Remove c/c++ build environment from the chroot
83 # Remove c/c++ build environment from the chroot
73 if [ -n "${COMPILER_PACKAGES}" ] ; then
84 if [ -n "${COMPILER_PACKAGES}" ] ; then
74 chroot_exec apt-get -qq -y --auto-remove purge "${COMPILER_PACKAGES}"
85 chroot_exec apt-get -qq -y --auto-remove purge ${COMPILER_PACKAGES}
75 COMPILER_PACKAGES=""
86 COMPILER_PACKAGES=""
76 fi
87 fi
77 }
88 }
89
90 # https://serverfault.com/a/682849 - converts e.g. /24 to 255.255.255.0
91 cdr2mask ()
92 {
93 # Number of args to shift, 255..255, first non-255 byte, zeroes
94 set -- $(( 5 - ($1 / 8) )) 255 255 255 255 $(( (255 << (8 - ($1 % 8))) & 255 )) 0 0 0
95 [ $1 -gt 1 ] && shift $1 || shift
96 echo ${1-0}.${2-0}.${3-0}.${4-0}
97 }
98
99 # GPL v2.0 - #https://github.com/sakaki-/bcmrpi3-kernel-bis/blob/master/conform_config.sh
100 set_kernel_config() {
101 # flag as $1, value to set as $2, config must exist at "./.config"
102 TGT="CONFIG_${1#CONFIG_}"
103 REP="${2}"
104 if grep -q "^${TGT}[^_]" .config; then
105 sed -i "s/^\(${TGT}=.*\|# ${TGT} is not set\)/${TGT}=${REP}/" .config
106 else
107 echo "${TGT}"="${2}" >> .config
108 fi
109 }
110
111 # unset kernel config parameter
112 unset_kernel_config() {
113 # unsets flag with the value of $1, config must exist at "./.config"
114 TGT="CONFIG_${1#CONFIG_}"
115 sed -i "s/^${TGT}=.*/# ${TGT} is not set/" .config
116 } No newline at end of file
@@ -1,813 +1,873
1 #!/bin/sh
1 #!/bin/sh
2 ########################################################################
2 ########################################################################
3 # rpi23-gen-image.sh 2015-2017
3 # rpi23-gen-image.sh 2015-2017
4 #
4 #
5 # Advanced Debian "stretch" and "buster" bootstrap script for Raspberry Pi
5 # Advanced Debian "stretch" and "buster" bootstrap script for Raspberry Pi
6 #
6 #
7 # This program is free software; you can redistribute it and/or
7 # This program is free software; you can redistribute it and/or
8 # modify it under the terms of the GNU General Public License
8 # modify it under the terms of the GNU General Public License
9 # as published by the Free Software Foundation; either version 2
9 # as published by the Free Software Foundation; either version 2
10 # of the License, or (at your option) any later version.
10 # of the License, or (at your option) any later version.
11 #
11 #
12 # Copyright (C) 2015 Jan Wagner <mail@jwagner.eu>
12 # Copyright (C) 2015 Jan Wagner <mail@jwagner.eu>
13 #
13 #
14 # Big thanks for patches and enhancements by 20+ github contributors!
14 # Big thanks for patches and enhancements by 20+ github contributors!
15 ########################################################################
15 ########################################################################
16
16
17 # Are we running as root?
17 # Are we running as root?
18 if [ "$(id -u)" -ne "0" ] ; then
18 if [ "$(id -u)" -ne "0" ] ; then
19 echo "error: this script must be executed with root privileges!"
19 echo "error: this script must be executed with root privileges!"
20 exit 1
20 exit 1
21 fi
21 fi
22
22
23 # Check if ./functions.sh script exists
23 # Check if ./functions.sh script exists
24 if [ ! -r "./functions.sh" ] ; then
24 if [ ! -r "./functions.sh" ] ; then
25 echo "error: './functions.sh' required script not found!"
25 echo "error: './functions.sh' required script not found!"
26 exit 1
26 exit 1
27 fi
27 fi
28
28
29 # Load utility functions
29 # Load utility functions
30 . ./functions.sh
30 . ./functions.sh
31
31
32 # Load parameters from configuration template file
32 # Load parameters from configuration template file
33 if [ -n "$CONFIG_TEMPLATE" ] ; then
33 if [ -n "$CONFIG_TEMPLATE" ] ; then
34 use_template
34 use_template
35 fi
35 fi
36
36
37 # Introduce settings
37 # Introduce settings
38 set -e
38 set -e
39 echo -n -e "\n#\n# RPi 0/1/2/3 Bootstrap Settings\n#\n"
39 echo -n -e "\n#\n# RPi 0/1/2/3 Bootstrap Settings\n#\n"
40 set -x
40 set -x
41
41
42 # Raspberry Pi model configuration
42 # Raspberry Pi model configuration
43 RPI_MODEL=${RPI_MODEL:=2}
43 RPI_MODEL=${RPI_MODEL:=2}
44
44
45 # Debian release
45 # Debian release
46 RELEASE=${RELEASE:=buster}
46 RELEASE=${RELEASE:=buster}
47
47
48 # Kernel Branch
48 # Kernel Branch
49 KERNEL_BRANCH=${KERNEL_BRANCH:=""}
49 KERNEL_BRANCH=${KERNEL_BRANCH:=""}
50
50
51 # URLs
51 # URLs
52 KERNEL_URL=${KERNEL_URL:=https://github.com/raspberrypi/linux}
52 KERNEL_URL=${KERNEL_URL:=https://github.com/raspberrypi/linux}
53 FIRMWARE_URL=${FIRMWARE_URL:=https://github.com/raspberrypi/firmware/raw/master/boot}
53 FIRMWARE_URL=${FIRMWARE_URL:=https://github.com/raspberrypi/firmware/raw/master/boot}
54 WLAN_FIRMWARE_URL=${WLAN_FIRMWARE_URL:=https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm}
54 WLAN_FIRMWARE_URL=${WLAN_FIRMWARE_URL:=https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm}
55 COLLABORA_URL=${COLLABORA_URL:=https://repositories.collabora.co.uk/debian}
55 COLLABORA_URL=${COLLABORA_URL:=https://repositories.collabora.co.uk/debian}
56 FBTURBO_URL=${FBTURBO_URL:=https://github.com/ssvb/xf86-video-fbturbo.git}
56 FBTURBO_URL=${FBTURBO_URL:=https://github.com/ssvb/xf86-video-fbturbo.git}
57 UBOOT_URL=${UBOOT_URL:=https://git.denx.de/u-boot.git}
57 UBOOT_URL=${UBOOT_URL:=https://git.denx.de/u-boot.git}
58 VIDEOCORE_URL=${VIDEOCORE_URL:=https://github.com/raspberrypi/userland}
58 VIDEOCORE_URL=${VIDEOCORE_URL:=https://github.com/raspberrypi/userland}
59 BLUETOOTH_URL=${BLUETOOTH_URL:=https://github.com/RPi-Distro/pi-bluetooth.git}
59 BLUETOOTH_URL=${BLUETOOTH_URL:=https://github.com/RPi-Distro/pi-bluetooth.git}
60 NEXMON_URL=${NEXMON_URL:=https://github.com/seemoo-lab/nexmon.git}
61 SYSTEMDSWAP_URL=${SYSTEMDSWAP_URL:=https://github.com/Nefelim4ag/systemd-swap.git}
62
63 # Kernel deb packages for 32bit kernel
64 RPI_32_KERNEL_URL=${RPI_32_KERNEL_URL:=https://github.com/hypriot/rpi-kernel/releases/download/v4.14.34/raspberrypi-kernel_20180422-141901_armhf.deb}
65 RPI_32_KERNELHEADER_URL=${RPI_32_KERNELHEADER_URL:=https://github.com/hypriot/rpi-kernel/releases/download/v4.14.34/raspberrypi-kernel-headers_20180422-141901_armhf.deb}
66 # Kernel has KVM and zswap enabled - use if KERNEL_* parameters and precompiled kernel are used
67 RPI3_64_BIS_KERNEL_URL=${RPI3_64_BIS_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel-bis/releases/download/4.14.80.20181113/bcmrpi3-kernel-bis-4.14.80.20181113.tar.xz}
68 # Default precompiled 64bit kernel
69 RPI3_64_DEF_KERNEL_URL=${RPI3_64_DEF_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel/releases/download/4.14.80.20181113/bcmrpi3-kernel-4.14.80.20181113.tar.xz}
70 # Generic
71 RPI3_64_KERNEL_URL=${RPI3_64_KERNEL_URL:=$RPI3_64_DEF_KERNEL_URL}
72 # Kali kernel src - used if ENABLE_NEXMON=true (they patch the wlan kernel modul)
73 KALI_KERNEL_URL=${KALI_KERNEL_URL:=https://github.com/Re4son/re4son-raspberrypi-linux.git}
60
74
61 # Build directories
75 # Build directories
62 WORKDIR=$(pwd)
76 WORKDIR=$(pwd)
63 BASEDIR=${BASEDIR:=${WORKDIR}/images/${RELEASE}}
77 BASEDIR=${BASEDIR:=${WORKDIR}/images/${RELEASE}}
64 BUILDDIR="${BASEDIR}/build"
78 BUILDDIR="${BASEDIR}/build"
65
79
66 # Chroot directories
80 # Chroot directories
67 R="${BUILDDIR}/chroot"
81 R="${BUILDDIR}/chroot"
68 ETC_DIR="${R}/etc"
82 ETC_DIR="${R}/etc"
69 LIB_DIR="${R}/lib"
83 LIB_DIR="${R}/lib"
70 BOOT_DIR="${R}/boot/firmware"
84 BOOT_DIR="${R}/boot/firmware"
71 KERNEL_DIR="${R}/usr/src/linux"
85 KERNEL_DIR="${R}/usr/src/linux"
72 WLAN_FIRMWARE_DIR="${LIB_DIR}/firmware/brcm"
86 WLAN_FIRMWARE_DIR="${LIB_DIR}/firmware/brcm"
73 BLUETOOTH_FIRMWARE_DIR="${ETC_DIR}/firmware/bt"
87 BLUETOOTH_FIRMWARE_DIR="${ETC_DIR}/firmware/bt"
74
88
75 # Firmware directory: Blank if download from github
89 # Firmware directory: Blank if download from github
76 RPI_FIRMWARE_DIR=${RPI_FIRMWARE_DIR:=""}
90 RPI_FIRMWARE_DIR=${RPI_FIRMWARE_DIR:=""}
77
91
78 # General settings
92 # General settings
79 SET_ARCH=${SET_ARCH:=32}
93 SET_ARCH=${SET_ARCH:=32}
80 HOSTNAME=${HOSTNAME:=rpi${RPI_MODEL}-${RELEASE}}
94 HOSTNAME=${HOSTNAME:=rpi${RPI_MODEL}-${RELEASE}}
81 PASSWORD=${PASSWORD:=raspberry}
95 PASSWORD=${PASSWORD:=raspberry}
82 USER_PASSWORD=${USER_PASSWORD:=raspberry}
96 USER_PASSWORD=${USER_PASSWORD:=raspberry}
83 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
97 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
84 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
98 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
85 EXPANDROOT=${EXPANDROOT:=true}
99 EXPANDROOT=${EXPANDROOT:=true}
86 ENABLE_DPHYSSWAP=${ENABLE_DPHYSSWAP:=true}
100 ENABLE_DPHYSSWAP=${ENABLE_DPHYSSWAP:=true}
87
101
88 # Keyboard settings
102 # Keyboard settings
89 XKB_MODEL=${XKB_MODEL:=""}
103 XKB_MODEL=${XKB_MODEL:=""}
90 XKB_LAYOUT=${XKB_LAYOUT:=""}
104 XKB_LAYOUT=${XKB_LAYOUT:=""}
91 XKB_VARIANT=${XKB_VARIANT:=""}
105 XKB_VARIANT=${XKB_VARIANT:=""}
92 XKB_OPTIONS=${XKB_OPTIONS:=""}
106 XKB_OPTIONS=${XKB_OPTIONS:=""}
93
107
94 # Network settings (DHCP)
108 # Network settings (DHCP)
95 ENABLE_DHCP=${ENABLE_DHCP:=true}
109 ENABLE_DHCP=${ENABLE_DHCP:=true}
96
110
97 # Network settings (static)
111 # Network settings (static)
98 NET_ADDRESS=${NET_ADDRESS:=""}
112 NET_ADDRESS=${NET_ADDRESS:=""}
99 NET_GATEWAY=${NET_GATEWAY:=""}
113 NET_GATEWAY=${NET_GATEWAY:=""}
100 NET_DNS_1=${NET_DNS_1:=""}
114 NET_DNS_1=${NET_DNS_1:=""}
101 NET_DNS_2=${NET_DNS_2:=""}
115 NET_DNS_2=${NET_DNS_2:=""}
102 NET_DNS_DOMAINS=${NET_DNS_DOMAINS:=""}
116 NET_DNS_DOMAINS=${NET_DNS_DOMAINS:=""}
103 NET_NTP_1=${NET_NTP_1:=""}
117 NET_NTP_1=${NET_NTP_1:=""}
104 NET_NTP_2=${NET_NTP_2:=""}
118 NET_NTP_2=${NET_NTP_2:=""}
105
119
106 # APT settings
120 # APT settings
107 APT_PROXY=${APT_PROXY:=""}
121 APT_PROXY=${APT_PROXY:=""}
108 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
122 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
123 KEEP_APT_PROXY=${KEEP_APT_PROXY:=false}
109
124
110 # Feature settings
125 # Feature settings
111 ENABLE_PRINTK=${ENABLE_PRINTK:=false}
126 ENABLE_PRINTK=${ENABLE_PRINTK:=false}
112 ENABLE_BLUETOOTH=${ENABLE_BLUETOOTH:=false}
127 ENABLE_BLUETOOTH=${ENABLE_BLUETOOTH:=false}
113 ENABLE_MINIUART_OVERLAY=${ENABLE_MINIUART_OVERLAY:=false}
128 ENABLE_MINIUART_OVERLAY=${ENABLE_MINIUART_OVERLAY:=false}
114 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
129 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
115 ENABLE_I2C=${ENABLE_I2C:=false}
130 ENABLE_I2C=${ENABLE_I2C:=false}
116 ENABLE_SPI=${ENABLE_SPI:=false}
131 ENABLE_SPI=${ENABLE_SPI:=false}
117 ENABLE_IPV6=${ENABLE_IPV6:=true}
132 ENABLE_IPV6=${ENABLE_IPV6:=true}
118 ENABLE_SSHD=${ENABLE_SSHD:=true}
133 ENABLE_SSHD=${ENABLE_SSHD:=true}
119 ENABLE_NONFREE=${ENABLE_NONFREE:=false}
134 ENABLE_NONFREE=${ENABLE_NONFREE:=false}
120 ENABLE_WIRELESS=${ENABLE_WIRELESS:=false}
135 ENABLE_WIRELESS=${ENABLE_WIRELESS:=false}
121 ENABLE_SOUND=${ENABLE_SOUND:=true}
136 ENABLE_SOUND=${ENABLE_SOUND:=true}
122 ENABLE_DBUS=${ENABLE_DBUS:=true}
137 ENABLE_DBUS=${ENABLE_DBUS:=true}
123 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
138 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
124 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
139 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
125 ENABLE_XORG=${ENABLE_XORG:=false}
140 ENABLE_XORG=${ENABLE_XORG:=false}
126 ENABLE_WM=${ENABLE_WM:=""}
141 ENABLE_WM=${ENABLE_WM:=""}
127 ENABLE_RSYSLOG=${ENABLE_RSYSLOG:=true}
142 ENABLE_RSYSLOG=${ENABLE_RSYSLOG:=true}
128 ENABLE_USER=${ENABLE_USER:=true}
143 ENABLE_USER=${ENABLE_USER:=true}
129 USER_NAME=${USER_NAME:="pi"}
144 USER_NAME=${USER_NAME:="pi"}
130 ENABLE_ROOT=${ENABLE_ROOT:=false}
145 ENABLE_ROOT=${ENABLE_ROOT:=false}
131 ENABLE_QEMU=${ENABLE_QEMU:=false}
146 ENABLE_QEMU=${ENABLE_QEMU:=false}
132 ENABLE_SYSVINIT=${ENABLE_SYSVINIT:=false}
147 ENABLE_SYSVINIT=${ENABLE_SYSVINIT:=false}
133
148
134 # SSH settings
149 # SSH settings
135 SSH_ENABLE_ROOT=${SSH_ENABLE_ROOT:=false}
150 SSH_ENABLE_ROOT=${SSH_ENABLE_ROOT:=false}
136 SSH_DISABLE_PASSWORD_AUTH=${SSH_DISABLE_PASSWORD_AUTH:=false}
151 SSH_DISABLE_PASSWORD_AUTH=${SSH_DISABLE_PASSWORD_AUTH:=false}
137 SSH_LIMIT_USERS=${SSH_LIMIT_USERS:=false}
152 SSH_LIMIT_USERS=${SSH_LIMIT_USERS:=false}
138 SSH_ROOT_PUB_KEY=${SSH_ROOT_PUB_KEY:=""}
153 SSH_ROOT_PUB_KEY=${SSH_ROOT_PUB_KEY:=""}
139 SSH_USER_PUB_KEY=${SSH_USER_PUB_KEY:=""}
154 SSH_USER_PUB_KEY=${SSH_USER_PUB_KEY:=""}
140
155
141 # Advanced settings
156 # Advanced settings
157 ENABLE_SYSTEMDSWAP=${ENABLE_SYSTEMDSWAP:=false}
142 ENABLE_MINBASE=${ENABLE_MINBASE:=false}
158 ENABLE_MINBASE=${ENABLE_MINBASE:=false}
143 ENABLE_REDUCE=${ENABLE_REDUCE:=false}
159 ENABLE_REDUCE=${ENABLE_REDUCE:=false}
144 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
160 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
145 UBOOTSRC_DIR=${UBOOTSRC_DIR:=""}
161 UBOOTSRC_DIR=${UBOOTSRC_DIR:=""}
162 ENABLE_UBOOTUSB=${ENABLE_UBOOTUSB=false}
146 ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
163 ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
147 ENABLE_VIDEOCORE=${ENABLE_VIDEOCORE:=false}
164 ENABLE_VIDEOCORE=${ENABLE_VIDEOCORE:=false}
165 ENABLE_NEXMON=${ENABLE_NEXMON:=false}
148 VIDEOCORESRC_DIR=${VIDEOCORESRC_DIR:=""}
166 VIDEOCORESRC_DIR=${VIDEOCORESRC_DIR:=""}
149 FBTURBOSRC_DIR=${FBTURBOSRC_DIR:=""}
167 FBTURBOSRC_DIR=${FBTURBOSRC_DIR:=""}
168 NEXMONSRC_DIR=${NEXMONSRC_DIR:=""}
150 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
169 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
151 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
170 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
152 ENABLE_SPLITFS=${ENABLE_SPLITFS:=false}
171 ENABLE_SPLITFS=${ENABLE_SPLITFS:=false}
153 ENABLE_INITRAMFS=${ENABLE_INITRAMFS:=false}
172 ENABLE_INITRAMFS=${ENABLE_INITRAMFS:=false}
154 ENABLE_IFNAMES=${ENABLE_IFNAMES:=true}
173 ENABLE_IFNAMES=${ENABLE_IFNAMES:=true}
174 ENABLE_SPLASH=${ENABLE_SPLASH:=true}
175 ENABLE_LOGO=${ENABLE_LOGO:=true}
176 ENABLE_SILENT_BOOT=${ENABLE_SILENT_BOOT=false}
155 DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS:=}
177 DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS:=}
156
178
157 # Kernel compilation settings
179 # Kernel compilation settings
158 BUILD_KERNEL=${BUILD_KERNEL:=true}
180 BUILD_KERNEL=${BUILD_KERNEL:=true}
159 KERNEL_REDUCE=${KERNEL_REDUCE:=false}
181 KERNEL_REDUCE=${KERNEL_REDUCE:=false}
160 KERNEL_THREADS=${KERNEL_THREADS:=1}
182 KERNEL_THREADS=${KERNEL_THREADS:=1}
161 KERNEL_HEADERS=${KERNEL_HEADERS:=true}
183 KERNEL_HEADERS=${KERNEL_HEADERS:=true}
162 KERNEL_MENUCONFIG=${KERNEL_MENUCONFIG:=false}
184 KERNEL_MENUCONFIG=${KERNEL_MENUCONFIG:=false}
163 KERNEL_REMOVESRC=${KERNEL_REMOVESRC:=true}
185 KERNEL_REMOVESRC=${KERNEL_REMOVESRC:=true}
164 KERNEL_OLDDEFCONFIG=${KERNEL_OLDDEFCONFIG:=false}
186 KERNEL_OLDDEFCONFIG=${KERNEL_OLDDEFCONFIG:=false}
165 KERNEL_CCACHE=${KERNEL_CCACHE:=false}
187 KERNEL_CCACHE=${KERNEL_CCACHE:=false}
188 KERNEL_ZSWAP=${KERNEL_ZSWAP:=false}
189 KERNEL_VIRT=${KERNEL_VIRT:=false}
190 KERNEL_BPF=${KERNEL_BPF:=false}
191 KERNEL_DEFAULT_GOV=${KERNEL_DEFAULT_GOV:=powersave}
192 KERNEL_SECURITY=${KERNEL_SECURITY:=false}
193 KERNEL_NF=${KERNEL_NF:=false}
166
194
167 # Kernel compilation from source directory settings
195 # Kernel compilation from source directory settings
168 KERNELSRC_DIR=${KERNELSRC_DIR:=""}
196 KERNELSRC_DIR=${KERNELSRC_DIR:=""}
169 KERNELSRC_CLEAN=${KERNELSRC_CLEAN:=false}
197 KERNELSRC_CLEAN=${KERNELSRC_CLEAN:=false}
170 KERNELSRC_CONFIG=${KERNELSRC_CONFIG:=true}
198 KERNELSRC_CONFIG=${KERNELSRC_CONFIG:=true}
171 KERNELSRC_PREBUILT=${KERNELSRC_PREBUILT:=false}
199 KERNELSRC_PREBUILT=${KERNELSRC_PREBUILT:=false}
172
200
173 # Reduce disk usage settings
201 # Reduce disk usage settings
174 REDUCE_APT=${REDUCE_APT:=true}
202 REDUCE_APT=${REDUCE_APT:=true}
175 REDUCE_DOC=${REDUCE_DOC:=true}
203 REDUCE_DOC=${REDUCE_DOC:=true}
176 REDUCE_MAN=${REDUCE_MAN:=true}
204 REDUCE_MAN=${REDUCE_MAN:=true}
177 REDUCE_VIM=${REDUCE_VIM:=false}
205 REDUCE_VIM=${REDUCE_VIM:=false}
178 REDUCE_BASH=${REDUCE_BASH:=false}
206 REDUCE_BASH=${REDUCE_BASH:=false}
179 REDUCE_HWDB=${REDUCE_HWDB:=true}
207 REDUCE_HWDB=${REDUCE_HWDB:=true}
180 REDUCE_SSHD=${REDUCE_SSHD:=true}
208 REDUCE_SSHD=${REDUCE_SSHD:=true}
181 REDUCE_LOCALE=${REDUCE_LOCALE:=true}
209 REDUCE_LOCALE=${REDUCE_LOCALE:=true}
182
210
183 # Encrypted filesystem settings
211 # Encrypted filesystem settings
184 ENABLE_CRYPTFS=${ENABLE_CRYPTFS:=false}
212 ENABLE_CRYPTFS=${ENABLE_CRYPTFS:=false}
185 CRYPTFS_PASSWORD=${CRYPTFS_PASSWORD:=""}
213 CRYPTFS_PASSWORD=${CRYPTFS_PASSWORD:=""}
186 CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
214 CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
187 CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64:sha512"}
215 CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64:sha512"}
188 CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512}
216 CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512}
217 #Dropbear-initramfs supports unlocking encrypted filesystem via SSH on bootup
218 CRYPTFS_DROPBEAR=${CRYPTFS_DROPBEAR:=false}
219 #Provide your own Dropbear Public RSA-OpenSSH Key otherwise it will be generated
220 CRYPTFS_DROPBEAR_PUBKEY=${CRYPTFS_DROPBEAR_PUBKEY:=""}
189
221
190 # Chroot scripts directory
222 # Chroot scripts directory
191 CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
223 CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
192
224
193 # Packages required in the chroot build environment
225 # Packages required in the chroot build environment
194 APT_INCLUDES=${APT_INCLUDES:=""}
226 APT_INCLUDES=${APT_INCLUDES:=""}
195 APT_INCLUDES="${APT_INCLUDES},apt-transport-https,apt-utils,ca-certificates,debian-archive-keyring,dialog,sudo,systemd,sysvinit-utils,locales,keyboard-configuration,console-setup,libnss-systemd"
227 APT_INCLUDES="${APT_INCLUDES},apt-transport-https,apt-utils,ca-certificates,debian-archive-keyring,dialog,sudo,systemd,sysvinit-utils,locales,keyboard-configuration,console-setup,libnss-systemd"
196
228
197 # Packages to exclude from chroot build environment
229 # Packages to exclude from chroot build environment
198 APT_EXCLUDES=${APT_EXCLUDES:=""}
230 APT_EXCLUDES=${APT_EXCLUDES:=""}
199
231
200 # Packages required for bootstrapping
232 # Packages required for bootstrapping
201 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo"
233 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo"
202 MISSING_PACKAGES=""
234 MISSING_PACKAGES=""
203
235
204 # Packages installed for c/c++ build environment in chroot (keep empty)
236 # Packages installed for c/c++ build environment in chroot (keep empty)
205 COMPILER_PACKAGES=""
237 COMPILER_PACKAGES=""
206
238
207 set +x
208
209 #Check if apt-cacher-ng has port 3142 open and set APT_PROXY
239 # Check if apt-cacher-ng has port 3142 open and set APT_PROXY
210 APT_CACHER_RUNNING=$(lsof -i :3142 | grep apt-cacher-ng | cut -d ' ' -f3 | uniq)
240 APT_CACHER_RUNNING=$(lsof -i :3142 | cut -d ' ' -f3 | uniq | sed '/^\s*$/d')
211 if [ -n "${APT_CACHER_RUNNING}" ] ; then
241 if [ "${APT_CACHER_RUNNING}" = "apt-cacher-ng" ] ; then
212 APT_PROXY=http://127.0.0.1:3142/
242 APT_PROXY=http://127.0.0.1:3142/
213 fi
243 fi
214
244
215 # Setup architecture specific settings
245 # Setup architecture specific settings
216 if [ -n "$SET_ARCH" ] ; then
246 if [ -n "$SET_ARCH" ] ; then
217 # 64-bit configuration
247 # 64-bit configuration
218 if [ "$SET_ARCH" = 64 ] ; then
248 if [ "$SET_ARCH" = 64 ] ; then
219 # General 64-bit depended settings
249 # General 64-bit depended settings
220 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-aarch64-static}
250 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-aarch64-static}
221 KERNEL_ARCH=${KERNEL_ARCH:=arm64}
251 KERNEL_ARCH=${KERNEL_ARCH:=arm64}
222 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="Image"}
252 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="Image"}
223
253
224 # Raspberry Pi model specific settings
254 # Raspberry Pi model specific settings
225 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
255 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
226 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-arm64"
256 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-arm64"
227 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi3_defconfig}
257 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi3_defconfig}
228 RELEASE_ARCH=${RELEASE_ARCH:=arm64}
258 RELEASE_ARCH=${RELEASE_ARCH:=arm64}
229 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel8.img}
259 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel8.img}
230 CROSS_COMPILE=${CROSS_COMPILE:=aarch64-linux-gnu-}
260 CROSS_COMPILE=${CROSS_COMPILE:=aarch64-linux-gnu-}
231 else
261 else
232 echo "error: Only Raspberry PI 3 and 3B+ support 64-bit"
262 echo "error: Only Raspberry PI 3 and 3B+ support 64-bit"
233 exit 1
263 exit 1
234 fi
264 fi
235 fi
265 fi
236
266
237 # 32-bit configuration
267 # 32-bit configuration
238 if [ "$SET_ARCH" = 32 ] ; then
268 if [ "$SET_ARCH" = 32 ] ; then
239 # General 32-bit dependend settings
269 # General 32-bit dependend settings
240 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-arm-static}
270 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-arm-static}
241 KERNEL_ARCH=${KERNEL_ARCH:=arm}
271 KERNEL_ARCH=${KERNEL_ARCH:=arm}
242 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="zImage"}
272 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="zImage"}
243
273
244 # Raspberry Pi model specific settings
274 # Raspberry Pi model specific settings
245 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 1 ] || [ "$RPI_MODEL" = 1P ] ; then
275 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 1 ] || [ "$RPI_MODEL" = 1P ] ; then
246 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armel"
276 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armel"
247 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi_defconfig}
277 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi_defconfig}
248 RELEASE_ARCH=${RELEASE_ARCH:=armel}
278 RELEASE_ARCH=${RELEASE_ARCH:=armel}
249 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel.img}
279 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel.img}
250 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabi-}
280 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabi-}
251 fi
281 fi
252
282
253 # Raspberry Pi model specific settings
283 # Raspberry Pi model specific settings
254 if [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
284 if [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
255 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armhf"
285 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armhf"
256 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2709_defconfig}
286 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2709_defconfig}
257 RELEASE_ARCH=${RELEASE_ARCH:=armhf}
287 RELEASE_ARCH=${RELEASE_ARCH:=armhf}
258 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7.img}
288 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7.img}
259 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabihf-}
289 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabihf-}
260 fi
290 fi
261 fi
291 fi
262 #SET_ARCH not set
292 # SET_ARCH not set
263 else
293 else
264 echo "error: Please set '32' or '64' as value for SET_ARCH"
294 echo "error: Please set '32' or '64' as value for SET_ARCH"
265 exit 1
295 exit 1
266 fi
296 fi
267 # Device specific configuration and U-Boot configuration
297 # Device specific configuration and U-Boot configuration
268 case "$RPI_MODEL" in
298 case "$RPI_MODEL" in
269 0)
299 0)
270 DTB_FILE=${DTB_FILE:=bcm2708-rpi-0-w.dtb}
300 DTB_FILE=${DTB_FILE:=bcm2708-rpi-0-w.dtb}
271 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
301 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
272 ;;
302 ;;
273 1)
303 1)
274 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b.dtb}
304 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b.dtb}
275 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
305 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
276 ;;
306 ;;
277 1P)
307 1P)
278 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b-plus.dtb}
308 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b-plus.dtb}
279 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
309 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
280 ;;
310 ;;
281 2)
311 2)
282 DTB_FILE=${DTB_FILE:=bcm2709-rpi-2-b.dtb}
312 DTB_FILE=${DTB_FILE:=bcm2709-rpi-2-b.dtb}
283 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_2_defconfig}
313 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_2_defconfig}
284 ;;
314 ;;
285 3)
315 3)
286 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
316 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
287 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
317 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
288 ;;
318 ;;
289 3P)
319 3P)
290 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
320 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
291 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
321 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
292 ;;
322 ;;
293 *)
323 *)
294 echo "error: Raspberry Pi model $RPI_MODEL is not supported!"
324 echo "error: Raspberry Pi model $RPI_MODEL is not supported!"
295 exit 1
325 exit 1
296 ;;
326 ;;
297 esac
327 esac
298
328
329 if [ "$ENABLE_UBOOTUSB" = true ] ; then
330 if [ "$ENABLE_UBOOT" = false ] ; then
331 echo "error: Enabling UBOOTUSB requires u-boot to be enabled"
332 exit 1
333 fi
334 if [ "$RPI_MODEL" != 3 ] || [ "$RPI_MODEL" != 3P ] ; then
335 echo "error: Enabling UBOOTUSB requires Raspberry 3"
336 exit 1
337 fi
338 fi
339
299 # Raspberry PI 0,3,3P with Bluetooth and Wifi onboard
340 # Raspberry PI 0,3,3P with Bluetooth and Wifi onboard
300 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
341 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
301 # Include bluetooth packages on supported boards
342 # Include bluetooth packages on supported boards
302 if [ "$ENABLE_BLUETOOTH" = true ] && [ "$ENABLE_CONSOLE" = false ]; then
343 if [ "$ENABLE_BLUETOOTH" = true ] ; then
303 APT_INCLUDES="${APT_INCLUDES},bluetooth,bluez"
344 APT_INCLUDES="${APT_INCLUDES},bluetooth,bluez"
304 fi
345 fi
346 if [ "$ENABLE_WIRELESS" = true ] ; then
347 APT_INCLUDES="${APT_INCLUDES},wireless-tools,crda,wireless-regdb"
348 fi
305 else # Raspberry PI 1,1P,2 without Wifi and bluetooth onboard
349 else # Raspberry PI 1,1P,2 without Wifi and bluetooth onboard
306 # Check if the internal wireless interface is not supported by the RPi model
350 # Check if the internal wireless interface is not supported by the RPi model
307 if [ "$ENABLE_WIRELESS" = true ] || [ "$ENABLE_BLUETOOTH" = true ]; then
351 if [ "$ENABLE_WIRELESS" = true ] || [ "$ENABLE_BLUETOOTH" = true ]; then
308 echo "error: The selected Raspberry Pi model has no integrated interface for wireless or bluetooth"
352 echo "error: The selected Raspberry Pi model has no integrated interface for wireless or bluetooth"
309 exit 1
353 exit 1
310 fi
354 fi
311 fi
355 fi
312
356
357 if [ "$BUILD_KERNEL" = false ] && [ "$ENABLE_NEXMON" = true ]; then
358 echo "error: You have to compile kernel sources, if you want to enable nexmon"
359 exit 1
360 fi
361
313 # Prepare date string for default image file name
362 # Prepare date string for default image file name
314 DATE="$(date +%Y-%m-%d)"
363 DATE="$(date +%Y-%m-%d)"
315 if [ -z "$KERNEL_BRANCH" ] ; then
364 if [ -z "$KERNEL_BRANCH" ] ; then
316 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
365 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
317 else
366 else
318 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
367 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
319 fi
368 fi
320
369
321 # Check if DISABLE_UNDERVOLT_WARNINGS parameter value is supported
370 # Check if DISABLE_UNDERVOLT_WARNINGS parameter value is supported
322 if [ -n "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
371 if [ -n "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
323 if [ "$DISABLE_UNDERVOLT_WARNINGS" != 1 ] && [ "$DISABLE_UNDERVOLT_WARNINGS" != 2 ] ; then
372 if [ "$DISABLE_UNDERVOLT_WARNINGS" != 1 ] && [ "$DISABLE_UNDERVOLT_WARNINGS" != 2 ] ; then
324 echo "error: DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS} is not supported"
373 echo "error: DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS} is not supported"
325 exit 1
374 exit 1
326 fi
375 fi
327 fi
376 fi
328
377
329 # Add cmake to compile videocore sources
378 # Add cmake to compile videocore sources
330 if [ "$ENABLE_VIDEOCORE" = true ] ; then
379 if [ "$ENABLE_VIDEOCORE" = true ] ; then
331 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cmake"
380 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cmake"
332 fi
381 fi
333
382
383 # Add deps for nexmon
384 if [ "$ENABLE_NEXMON" = true ] ; then
385 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libgmp3-dev gawk qpdf bison flex make autoconf automake build-essential libtool"
386 fi
387
334 # Add libncurses5 to enable kernel menuconfig
388 # Add libncurses5 to enable kernel menuconfig
335 if [ "$KERNEL_MENUCONFIG" = true ] ; then
389 if [ "$KERNEL_MENUCONFIG" = true ] ; then
336 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libncurses-dev"
390 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libncurses-dev"
337 fi
391 fi
338
392
339 # Add ccache compiler cache for (faster) kernel cross (re)compilation
393 # Add ccache compiler cache for (faster) kernel cross (re)compilation
340 if [ "$KERNEL_CCACHE" = true ] ; then
394 if [ "$KERNEL_CCACHE" = true ] ; then
341 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} ccache"
395 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} ccache"
342 fi
396 fi
343
397
344 # Add cryptsetup package to enable filesystem encryption
398 # Add cryptsetup package to enable filesystem encryption
345 if [ "$ENABLE_CRYPTFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
399 if [ "$ENABLE_CRYPTFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
346 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
400 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
347 APT_INCLUDES="${APT_INCLUDES},cryptsetup,busybox,console-setup"
401 APT_INCLUDES="${APT_INCLUDES},cryptsetup,busybox,console-setup"
348
402
403 # If cryptfs,dropbear and initramfs are enabled include dropbear-initramfs package
404 if [ "$CRYPTFS_DROPBEAR" = true ] && [ "$ENABLE_INITRAMFS" = true ]; then
405 APT_INCLUDES="${APT_INCLUDES},dropbear-initramfs"
406 fi
407
349 if [ -z "$CRYPTFS_PASSWORD" ] ; then
408 if [ -z "$CRYPTFS_PASSWORD" ] ; then
350 echo "error: no password defined (CRYPTFS_PASSWORD)!"
409 echo "error: no password defined (CRYPTFS_PASSWORD)!"
351 exit 1
410 exit 1
352 fi
411 fi
353 ENABLE_INITRAMFS=true
412 ENABLE_INITRAMFS=true
354 fi
413 fi
355
414
356 # Add initramfs generation tools
415 # Add initramfs generation tools
357 if [ "$ENABLE_INITRAMFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
416 if [ "$ENABLE_INITRAMFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
358 APT_INCLUDES="${APT_INCLUDES},initramfs-tools"
417 APT_INCLUDES="${APT_INCLUDES},initramfs-tools"
359 fi
418 fi
360
419
361 # Add device-tree-compiler required for building the U-Boot bootloader
420 # Add device-tree-compiler required for building the U-Boot bootloader
362 if [ "$ENABLE_UBOOT" = true ] ; then
421 if [ "$ENABLE_UBOOT" = true ] ; then
363 APT_INCLUDES="${APT_INCLUDES},device-tree-compiler,bison,flex,bc"
422 APT_INCLUDES="${APT_INCLUDES},device-tree-compiler,bison,flex,bc"
364 fi
423 fi
365
424
366 if [ "$ENABLE_BLUETOOTH" = true ] ; then
367 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
368 if [ "$ENABLE_CONSOLE" = false ] ; then
369 APT_INCLUDES="${APT_INCLUDES},bluetooth,bluez"
370 fi
371 fi
372 fi
373
374 # Check if root SSH (v2) public key file exists
425 # Check if root SSH (v2) public key file exists
375 if [ -n "$SSH_ROOT_PUB_KEY" ] ; then
426 if [ -n "$SSH_ROOT_PUB_KEY" ] ; then
376 if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then
427 if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then
377 echo "error: '$SSH_ROOT_PUB_KEY' specified SSH public key file not found (SSH_ROOT_PUB_KEY)!"
428 echo "error: '$SSH_ROOT_PUB_KEY' specified SSH public key file not found (SSH_ROOT_PUB_KEY)!"
378 exit 1
429 exit 1
379 fi
430 fi
380 fi
431 fi
381
432
382 # Check if $USER_NAME SSH (v2) public key file exists
433 # Check if $USER_NAME SSH (v2) public key file exists
383 if [ -n "$SSH_USER_PUB_KEY" ] ; then
434 if [ -n "$SSH_USER_PUB_KEY" ] ; then
384 if [ ! -f "$SSH_USER_PUB_KEY" ] ; then
435 if [ ! -f "$SSH_USER_PUB_KEY" ] ; then
385 echo "error: '$SSH_USER_PUB_KEY' specified SSH public key file not found (SSH_USER_PUB_KEY)!"
436 echo "error: '$SSH_USER_PUB_KEY' specified SSH public key file not found (SSH_USER_PUB_KEY)!"
386 exit 1
437 exit 1
387 fi
438 fi
388 fi
439 fi
389
440
441 if [ "$ENABLE_NEXMON" = true ] && [ -n "$KERNEL_BRANCH" ] ; then
442 echo "error: Please unset KERNEL_BRANCH if using ENABLE_NEXMON"
443 exit 1
444 fi
445
390 # Check if all required packages are installed on the build system
446 # Check if all required packages are installed on the build system
391 for package in $REQUIRED_PACKAGES ; do
447 for package in $REQUIRED_PACKAGES ; do
392 if [ "$(dpkg-query -W -f='${Status}' "$package")" != "install ok installed" ] ; then
448 if [ "$(dpkg-query -W -f='${Status}' "$package")" != "install ok installed" ] ; then
393 MISSING_PACKAGES="${MISSING_PACKAGES} $package"
449 MISSING_PACKAGES="${MISSING_PACKAGES} $package"
394 fi
450 fi
395 done
451 done
396
452
397 # If there are missing packages ask confirmation for install, or exit
453 # If there are missing packages ask confirmation for install, or exit
398 if [ -n "$MISSING_PACKAGES" ] ; then
454 if [ -n "$MISSING_PACKAGES" ] ; then
399 echo "the following packages needed by this script are not installed:"
455 echo "the following packages needed by this script are not installed:"
400 echo "$MISSING_PACKAGES"
456 echo "$MISSING_PACKAGES"
401
457
402 printf "\ndo you want to install the missing packages right now? [y/n] "
458 printf "\ndo you want to install the missing packages right now? [y/n] "
403 read -r confirm
459 read -r confirm
404 [ "$confirm" != "y" ] && exit 1
460 [ "$confirm" != "y" ] && exit 1
405
461
406 # Make sure all missing required packages are installed
462 # Make sure all missing required packages are installed
407 apt-get -qq -y install `echo "${MISSING_PACKAGES}" | sed "s/ //"`
463 apt-get -qq -y install `echo "${MISSING_PACKAGES}" | sed "s/ //"`
408 fi
464 fi
409
465
410 # Check if ./bootstrap.d directory exists
466 # Check if ./bootstrap.d directory exists
411 if [ ! -d "./bootstrap.d/" ] ; then
467 if [ ! -d "./bootstrap.d/" ] ; then
412 echo "error: './bootstrap.d' required directory not found!"
468 echo "error: './bootstrap.d' required directory not found!"
413 exit 1
469 exit 1
414 fi
470 fi
415
471
416 # Check if ./files directory exists
472 # Check if ./files directory exists
417 if [ ! -d "./files/" ] ; then
473 if [ ! -d "./files/" ] ; then
418 echo "error: './files' required directory not found!"
474 echo "error: './files' required directory not found!"
419 exit 1
475 exit 1
420 fi
476 fi
421
477
422 # Check if specified KERNELSRC_DIR directory exists
478 # Check if specified KERNELSRC_DIR directory exists
423 if [ -n "$KERNELSRC_DIR" ] && [ ! -d "$KERNELSRC_DIR" ] ; then
479 if [ -n "$KERNELSRC_DIR" ] && [ ! -d "$KERNELSRC_DIR" ] ; then
424 echo "error: '${KERNELSRC_DIR}' specified directory not found (KERNELSRC_DIR)!"
480 echo "error: '${KERNELSRC_DIR}' specified directory not found (KERNELSRC_DIR)!"
425 exit 1
481 exit 1
426 fi
482 fi
427
483
428 # Check if specified UBOOTSRC_DIR directory exists
484 # Check if specified UBOOTSRC_DIR directory exists
429 if [ -n "$UBOOTSRC_DIR" ] && [ ! -d "$UBOOTSRC_DIR" ] ; then
485 if [ -n "$UBOOTSRC_DIR" ] && [ ! -d "$UBOOTSRC_DIR" ] ; then
430 echo "error: '${UBOOTSRC_DIR}' specified directory not found (UBOOTSRC_DIR)!"
486 echo "error: '${UBOOTSRC_DIR}' specified directory not found (UBOOTSRC_DIR)!"
431 exit 1
487 exit 1
432 fi
488 fi
433
489
434 # Check if specified VIDEOCORESRC_DIR directory exists
490 # Check if specified VIDEOCORESRC_DIR directory exists
435 if [ -n "$VIDEOCORESRC_DIR" ] && [ ! -d "$VIDEOCORESRC_DIR" ] ; then
491 if [ -n "$VIDEOCORESRC_DIR" ] && [ ! -d "$VIDEOCORESRC_DIR" ] ; then
436 echo "error: '${VIDEOCORESRC_DIR}' specified directory not found (VIDEOCORESRC_DIR)!"
492 echo "error: '${VIDEOCORESRC_DIR}' specified directory not found (VIDEOCORESRC_DIR)!"
437 exit 1
493 exit 1
438 fi
494 fi
439
495
440 # Check if specified FBTURBOSRC_DIR directory exists
496 # Check if specified FBTURBOSRC_DIR directory exists
441 if [ -n "$FBTURBOSRC_DIR" ] && [ ! -d "$FBTURBOSRC_DIR" ] ; then
497 if [ -n "$FBTURBOSRC_DIR" ] && [ ! -d "$FBTURBOSRC_DIR" ] ; then
442 echo "error: '${FBTURBOSRC_DIR}' specified directory not found (FBTURBOSRC_DIR)!"
498 echo "error: '${FBTURBOSRC_DIR}' specified directory not found (FBTURBOSRC_DIR)!"
443 exit 1
499 exit 1
444 fi
500 fi
445
501
502 # Check if specified NEXMONSRC_DIR directory exists
503 if [ -n "$NEXMONSRC_DIR" ] && [ ! -d "$NEXMONSRC_DIR" ] ; then
504 echo "error: '${NEXMONSRC_DIR}' specified directory not found (NEXMONSRC_DIR)!"
505 exit 1
506 fi
507
446 # Check if specified CHROOT_SCRIPTS directory exists
508 # Check if specified CHROOT_SCRIPTS directory exists
447 if [ -n "$CHROOT_SCRIPTS" ] && [ ! -d "$CHROOT_SCRIPTS" ] ; then
509 if [ -n "$CHROOT_SCRIPTS" ] && [ ! -d "$CHROOT_SCRIPTS" ] ; then
448 echo "error: ${CHROOT_SCRIPTS} specified directory not found (CHROOT_SCRIPTS)!"
510 echo "error: ${CHROOT_SCRIPTS} specified directory not found (CHROOT_SCRIPTS)!"
449 exit 1
511 exit 1
450 fi
512 fi
451
513
452 # Check if specified device mapping already exists (will be used by cryptsetup)
514 # Check if specified device mapping already exists (will be used by cryptsetup)
453 if [ -r "/dev/mapping/${CRYPTFS_MAPPING}" ] ; then
515 if [ -r "/dev/mapping/${CRYPTFS_MAPPING}" ] ; then
454 echo "error: mapping /dev/mapping/${CRYPTFS_MAPPING} already exists, not proceeding"
516 echo "error: mapping /dev/mapping/${CRYPTFS_MAPPING} already exists, not proceeding"
455 exit 1
517 exit 1
456 fi
518 fi
457
519
458 # Don't clobber an old build
520 # Don't clobber an old build
459 if [ -e "$BUILDDIR" ] ; then
521 if [ -e "$BUILDDIR" ] ; then
460 echo "error: directory ${BUILDDIR} already exists, not proceeding"
522 echo "error: directory ${BUILDDIR} already exists, not proceeding"
461 exit 1
523 exit 1
462 fi
524 fi
463
525
464 # Setup chroot directory
526 # Setup chroot directory
465 mkdir -p "${R}"
527 mkdir -p "${R}"
466
528
467 # Check if build directory has enough of free disk space >512MB
529 # Check if build directory has enough of free disk space >512MB
468 if [ "$(df --output=avail "${BUILDDIR}" | sed "1d")" -le "524288" ] ; then
530 if [ "$(df --output=avail "${BUILDDIR}" | sed "1d")" -le "524288" ] ; then
469 echo "error: ${BUILDDIR} not enough space left to generate the output image!"
531 echo "error: ${BUILDDIR} not enough space left to generate the output image!"
470 exit 1
532 exit 1
471 fi
533 fi
472
534
473 set -x
535 set -x
474
536
475 # Call "cleanup" function on various signals and errors
537 # Call "cleanup" function on various signals and errors
476 trap cleanup 0 1 2 3 6
538 trap cleanup 0 1 2 3 6
477
539
478 # Add required packages for the minbase installation
540 # Add required packages for the minbase installation
479 if [ "$ENABLE_MINBASE" = true ] ; then
541 if [ "$ENABLE_MINBASE" = true ] ; then
480 APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools,ifupdown"
542 APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools,ifupdown"
481 fi
543 fi
482
544
483 # Add parted package, required to get partprobe utility
545 # Add parted package, required to get partprobe utility
484 if [ "$EXPANDROOT" = true ] ; then
546 if [ "$EXPANDROOT" = true ] ; then
485 APT_INCLUDES="${APT_INCLUDES},parted"
547 APT_INCLUDES="${APT_INCLUDES},parted"
486 fi
548 fi
487
549
488 # Add dphys-swapfile package, required to enable swap
550 # Add dphys-swapfile package, required to enable swap
489 if [ "$ENABLE_DPHYSSWAP" = true ] ; then
551 if [ "$ENABLE_DPHYSSWAP" = true ] ; then
490 APT_INCLUDES="${APT_INCLUDES},dphys-swapfile"
552 APT_INCLUDES="${APT_INCLUDES},dphys-swapfile"
491 fi
553 fi
492
554
493 # Add dbus package, recommended if using systemd
555 # Add dbus package, recommended if using systemd
494 if [ "$ENABLE_DBUS" = true ] ; then
556 if [ "$ENABLE_DBUS" = true ] ; then
495 APT_INCLUDES="${APT_INCLUDES},dbus"
557 APT_INCLUDES="${APT_INCLUDES},dbus"
496 fi
558 fi
497
559
498 # Add iptables IPv4/IPv6 package
560 # Add iptables IPv4/IPv6 package
499 if [ "$ENABLE_IPTABLES" = true ] ; then
561 if [ "$ENABLE_IPTABLES" = true ] ; then
500 APT_INCLUDES="${APT_INCLUDES},iptables,iptables-persistent"
562 APT_INCLUDES="${APT_INCLUDES},iptables,iptables-persistent"
501 fi
563 fi
564 # Add apparmor for KERNEL_SECURITY
565 if [ "$KERNEL_SECURITY" = true ] ; then
566 APT_INCLUDES="${APT_INCLUDES},apparmor,apparmor-utils,apparmor-profiles,apparmor-profiles-extra,libapparmor-perl"
567 fi
502
568
503 # Add openssh server package
569 # Add openssh server package
504 if [ "$ENABLE_SSHD" = true ] ; then
570 if [ "$ENABLE_SSHD" = true ] ; then
505 APT_INCLUDES="${APT_INCLUDES},openssh-server"
571 APT_INCLUDES="${APT_INCLUDES},openssh-server"
506 fi
572 fi
507
573
508 # Add alsa-utils package
574 # Add alsa-utils package
509 if [ "$ENABLE_SOUND" = true ] ; then
575 if [ "$ENABLE_SOUND" = true ] ; then
510 APT_INCLUDES="${APT_INCLUDES},alsa-utils"
576 APT_INCLUDES="${APT_INCLUDES},alsa-utils"
511 fi
577 fi
512
578
513 # Add rng-tools package
579 # Add rng-tools package
514 if [ "$ENABLE_HWRANDOM" = true ] ; then
580 if [ "$ENABLE_HWRANDOM" = true ] ; then
515 APT_INCLUDES="${APT_INCLUDES},rng-tools"
581 APT_INCLUDES="${APT_INCLUDES},rng-tools"
516 fi
582 fi
517
583
518 # Add fbturbo video driver
584 # Add fbturbo video driver
519 if [ "$ENABLE_FBTURBO" = true ] ; then
585 if [ "$ENABLE_FBTURBO" = true ] ; then
520 # Enable xorg package dependencies
586 # Enable xorg package dependencies
521 ENABLE_XORG=true
587 ENABLE_XORG=true
522 fi
588 fi
523
589
524 # Add user defined window manager package
590 # Add user defined window manager package
525 if [ -n "$ENABLE_WM" ] ; then
591 if [ -n "$ENABLE_WM" ] ; then
526 APT_INCLUDES="${APT_INCLUDES},${ENABLE_WM}"
592 APT_INCLUDES="${APT_INCLUDES},${ENABLE_WM}"
527
593
528 # Enable xorg package dependencies
594 # Enable xorg package dependencies
529 ENABLE_XORG=true
595 ENABLE_XORG=true
530 fi
596 fi
531
597
532 # Add xorg package
598 # Add xorg package
533 if [ "$ENABLE_XORG" = true ] ; then
599 if [ "$ENABLE_XORG" = true ] ; then
534 APT_INCLUDES="${APT_INCLUDES},xorg,dbus-x11"
600 APT_INCLUDES="${APT_INCLUDES},xorg,dbus-x11"
535 fi
601 fi
536
602
537 # Replace selected packages with smaller clones
603 # Replace selected packages with smaller clones
538 if [ "$ENABLE_REDUCE" = true ] ; then
604 if [ "$ENABLE_REDUCE" = true ] ; then
539 # Add levee package instead of vim-tiny
605 # Add levee package instead of vim-tiny
540 if [ "$REDUCE_VIM" = true ] ; then
606 if [ "$REDUCE_VIM" = true ] ; then
541 APT_INCLUDES="$(echo ${APT_INCLUDES} | sed "s/vim-tiny/levee/")"
607 APT_INCLUDES="$(echo ${APT_INCLUDES} | sed "s/vim-tiny/levee/")"
542 fi
608 fi
543
609
544 # Add dropbear package instead of openssh-server
610 # Add dropbear package instead of openssh-server
545 if [ "$REDUCE_SSHD" = true ] ; then
611 if [ "$REDUCE_SSHD" = true ] ; then
546 APT_INCLUDES="$(echo "${APT_INCLUDES}" | sed "s/openssh-server/dropbear/")"
612 APT_INCLUDES="$(echo "${APT_INCLUDES}" | sed "s/openssh-server/dropbear/")"
547 fi
613 fi
548 fi
614 fi
549
615
550 # Configure systemd-sysv exclude to make halt/reboot/shutdown scripts available
616 # Configure systemd-sysv exclude to make halt/reboot/shutdown scripts available
551 if [ "$ENABLE_SYSVINIT" = false ] ; then
617 if [ "$ENABLE_SYSVINIT" = false ] ; then
552 APT_EXCLUDES="--exclude=${APT_EXCLUDES},init,systemd-sysv"
618 APT_EXCLUDES="--exclude=${APT_EXCLUDES},init,systemd-sysv"
553 fi
619 fi
554
620
555 # Check if kernel is getting compiled
556 if [ "$BUILD_KERNEL" = false ] ; then
557 echo "Downloading precompiled kernel"
558 echo "error: not configured"
559 exit 1;
560 # BUILD_KERNEL=true
561 else
562 echo "No precompiled kernel repositories were added"
563 fi
564
565 # Configure kernel sources if no KERNELSRC_DIR
621 # Configure kernel sources if no KERNELSRC_DIR
566 if [ "$BUILD_KERNEL" = true ] && [ -z "$KERNELSRC_DIR" ] ; then
622 if [ "$BUILD_KERNEL" = true ] && [ -z "$KERNELSRC_DIR" ] ; then
567 KERNELSRC_CONFIG=true
623 KERNELSRC_CONFIG=true
568 fi
624 fi
569
625
570 # Configure reduced kernel
626 # Configure reduced kernel
571 if [ "$KERNEL_REDUCE" = true ] ; then
627 if [ "$KERNEL_REDUCE" = true ] ; then
572 KERNELSRC_CONFIG=false
628 KERNELSRC_CONFIG=false
573 fi
629 fi
574
630
575 # Configure qemu compatible kernel
631 # Configure qemu compatible kernel
576 if [ "$ENABLE_QEMU" = true ] ; then
632 if [ "$ENABLE_QEMU" = true ] ; then
577 DTB_FILE=vexpress-v2p-ca15_a7.dtb
633 DTB_FILE=vexpress-v2p-ca15_a7.dtb
578 UBOOT_CONFIG=vexpress_ca15_tc2_defconfig
634 UBOOT_CONFIG=vexpress_ca15_tc2_defconfig
579 KERNEL_DEFCONFIG="vexpress_defconfig"
635 KERNEL_DEFCONFIG="vexpress_defconfig"
580 if [ "$KERNEL_MENUCONFIG" = false ] ; then
636 if [ "$KERNEL_MENUCONFIG" = false ] ; then
581 KERNEL_OLDDEFCONFIG=true
637 KERNEL_OLDDEFCONFIG=true
582 fi
638 fi
583 fi
639 fi
584
640
585 # Execute bootstrap scripts
641 # Execute bootstrap scripts
586 for SCRIPT in bootstrap.d/*.sh; do
642 for SCRIPT in bootstrap.d/*.sh; do
587 head -n 3 "$SCRIPT"
643 head -n 3 "$SCRIPT"
588 . "$SCRIPT"
644 . "$SCRIPT"
589 done
645 done
590
646
591 ## Execute custom bootstrap scripts
647 ## Execute custom bootstrap scripts
592 if [ -d "custom.d" ] ; then
648 if [ -d "custom.d" ] ; then
593 for SCRIPT in custom.d/*.sh; do
649 for SCRIPT in custom.d/*.sh; do
594 . "$SCRIPT"
650 . "$SCRIPT"
595 done
651 done
596 fi
652 fi
597
653
598 # Execute custom scripts inside the chroot
654 # Execute custom scripts inside the chroot
599 if [ -n "$CHROOT_SCRIPTS" ] && [ -d "$CHROOT_SCRIPTS" ] ; then
655 if [ -n "$CHROOT_SCRIPTS" ] && [ -d "$CHROOT_SCRIPTS" ] ; then
600 cp -r "${CHROOT_SCRIPTS}" "${R}/chroot_scripts"
656 cp -r "${CHROOT_SCRIPTS}" "${R}/chroot_scripts"
601 chroot_exec /bin/bash -x <<'EOF'
657 chroot_exec /bin/bash -x <<'EOF'
602 for SCRIPT in /chroot_scripts/* ; do
658 for SCRIPT in /chroot_scripts/* ; do
603 if [ -f $SCRIPT -a -x $SCRIPT ] ; then
659 if [ -f $SCRIPT -a -x $SCRIPT ] ; then
604 $SCRIPT
660 $SCRIPT
605 fi
661 fi
606 done
662 done
607 EOF
663 EOF
608 rm -rf "${R}/chroot_scripts"
664 rm -rf "${R}/chroot_scripts"
609 fi
665 fi
610
666
611 # Remove c/c++ build environment from the chroot
667 # Remove c/c++ build environment from the chroot
612 chroot_remove_cc
668 chroot_remove_cc
613
669
614 # Generate required machine-id
670 # Generate required machine-id
615 MACHINE_ID=$(dbus-uuidgen)
671 MACHINE_ID=$(dbus-uuidgen)
616 echo -n "${MACHINE_ID}" > "${R}/var/lib/dbus/machine-id"
672 echo -n "${MACHINE_ID}" > "${R}/var/lib/dbus/machine-id"
617 echo -n "${MACHINE_ID}" > "${ETC_DIR}/machine-id"
673 echo -n "${MACHINE_ID}" > "${ETC_DIR}/machine-id"
618
674
619 # APT Cleanup
675 # APT Cleanup
620 chroot_exec apt-get -y clean
676 chroot_exec apt-get -y clean
621 chroot_exec apt-get -y autoclean
677 chroot_exec apt-get -y autoclean
622 chroot_exec apt-get -y autoremove
678 chroot_exec apt-get -y autoremove
623
679
624 # Unmount mounted filesystems
680 # Unmount mounted filesystems
625 umount -l "${R}/proc"
681 umount -l "${R}/proc"
626 umount -l "${R}/sys"
682 umount -l "${R}/sys"
627
683
628 # Clean up directories
684 # Clean up directories
629 rm -rf "${R}/run/*"
685 rm -rf "${R}/run/*"
630 rm -rf "${R}/tmp/*"
686 rm -rf "${R}/tmp/*"
631
687
688 # Clean up APT proxy settings
689 if [ "$KEEP_APT_PROXY" = false ] ; then
690 rm -f "${ETC_DIR}/apt/apt.conf.d/10proxy"
691 fi
692
632 # Clean up files
693 # Clean up files
633 rm -f "${ETC_DIR}/ssh/ssh_host_*"
694 rm -f "${ETC_DIR}/ssh/ssh_host_*"
634 rm -f "${ETC_DIR}/dropbear/dropbear_*"
695 rm -f "${ETC_DIR}/dropbear/dropbear_*"
635 rm -f "${ETC_DIR}/apt/sources.list.save"
696 rm -f "${ETC_DIR}/apt/sources.list.save"
636 rm -f "${ETC_DIR}/resolvconf/resolv.conf.d/original"
697 rm -f "${ETC_DIR}/resolvconf/resolv.conf.d/original"
637 rm -f "${ETC_DIR}/*-"
698 rm -f "${ETC_DIR}/*-"
638 rm -f "${ETC_DIR}/apt/apt.conf.d/10proxy"
639 rm -f "${ETC_DIR}/resolv.conf"
699 rm -f "${ETC_DIR}/resolv.conf"
640 rm -f "${R}/root/.bash_history"
700 rm -f "${R}/root/.bash_history"
641 rm -f "${R}/var/lib/urandom/random-seed"
701 rm -f "${R}/var/lib/urandom/random-seed"
642 rm -f "${R}/initrd.img"
702 rm -f "${R}/initrd.img"
643 rm -f "${R}/vmlinuz"
703 rm -f "${R}/vmlinuz"
644 rm -f "${R}${QEMU_BINARY}"
704 rm -f "${R}${QEMU_BINARY}"
645
705
646 if [ "$ENABLE_QEMU" = true ] ; then
706 if [ "$ENABLE_QEMU" = true ] ; then
647 # Setup QEMU directory
707 # Setup QEMU directory
648 mkdir "${BASEDIR}/qemu"
708 mkdir "${BASEDIR}/qemu"
649
709
650 # Copy kernel image to QEMU directory
710 # Copy kernel image to QEMU directory
651 install_readonly "${BOOT_DIR}/${KERNEL_IMAGE}" "${BASEDIR}/qemu/${KERNEL_IMAGE}"
711 install_readonly "${BOOT_DIR}/${KERNEL_IMAGE}" "${BASEDIR}/qemu/${KERNEL_IMAGE}"
652
712
653 # Copy kernel config to QEMU directory
713 # Copy kernel config to QEMU directory
654 install_readonly "${R}/boot/config-${KERNEL_VERSION}" "${BASEDIR}/qemu/config-${KERNEL_VERSION}"
714 install_readonly "${R}/boot/config-${KERNEL_VERSION}" "${BASEDIR}/qemu/config-${KERNEL_VERSION}"
655
715
656 # Copy kernel dtbs to QEMU directory
716 # Copy kernel dtbs to QEMU directory
657 for dtb in "${BOOT_DIR}/"*.dtb ; do
717 for dtb in "${BOOT_DIR}/"*.dtb ; do
658 if [ -f "${dtb}" ] ; then
718 if [ -f "${dtb}" ] ; then
659 install_readonly "${dtb}" "${BASEDIR}/qemu/"
719 install_readonly "${dtb}" "${BASEDIR}/qemu/"
660 fi
720 fi
661 done
721 done
662
722
663 # Copy kernel overlays to QEMU directory
723 # Copy kernel overlays to QEMU directory
664 if [ -d "${BOOT_DIR}/overlays" ] ; then
724 if [ -d "${BOOT_DIR}/overlays" ] ; then
665 # Setup overlays dtbs directory
725 # Setup overlays dtbs directory
666 mkdir "${BASEDIR}/qemu/overlays"
726 mkdir "${BASEDIR}/qemu/overlays"
667
727
668 for dtb in "${BOOT_DIR}/overlays/"*.dtb ; do
728 for dtb in "${BOOT_DIR}/overlays/"*.dtb ; do
669 if [ -f "${dtb}" ] ; then
729 if [ -f "${dtb}" ] ; then
670 install_readonly "${dtb}" "${BASEDIR}/qemu/overlays/"
730 install_readonly "${dtb}" "${BASEDIR}/qemu/overlays/"
671 fi
731 fi
672 done
732 done
673 fi
733 fi
674
734
675 # Copy u-boot files to QEMU directory
735 # Copy u-boot files to QEMU directory
676 if [ "$ENABLE_UBOOT" = true ] ; then
736 if [ "$ENABLE_UBOOT" = true ] ; then
677 if [ -f "${BOOT_DIR}/u-boot.bin" ] ; then
737 if [ -f "${BOOT_DIR}/u-boot.bin" ] ; then
678 install_readonly "${BOOT_DIR}/u-boot.bin" "${BASEDIR}/qemu/u-boot.bin"
738 install_readonly "${BOOT_DIR}/u-boot.bin" "${BASEDIR}/qemu/u-boot.bin"
679 fi
739 fi
680 if [ -f "${BOOT_DIR}/uboot.mkimage" ] ; then
740 if [ -f "${BOOT_DIR}/uboot.mkimage" ] ; then
681 install_readonly "${BOOT_DIR}/uboot.mkimage" "${BASEDIR}/qemu/uboot.mkimage"
741 install_readonly "${BOOT_DIR}/uboot.mkimage" "${BASEDIR}/qemu/uboot.mkimage"
682 fi
742 fi
683 if [ -f "${BOOT_DIR}/boot.scr" ] ; then
743 if [ -f "${BOOT_DIR}/boot.scr" ] ; then
684 install_readonly "${BOOT_DIR}/boot.scr" "${BASEDIR}/qemu/boot.scr"
744 install_readonly "${BOOT_DIR}/boot.scr" "${BASEDIR}/qemu/boot.scr"
685 fi
745 fi
686 fi
746 fi
687
747
688 # Copy initramfs to QEMU directory
748 # Copy initramfs to QEMU directory
689 if [ -f "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" ] ; then
749 if [ -f "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" ] ; then
690 install_readonly "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" "${BASEDIR}/qemu/initramfs-${KERNEL_VERSION}"
750 install_readonly "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" "${BASEDIR}/qemu/initramfs-${KERNEL_VERSION}"
691 fi
751 fi
692 fi
752 fi
693
753
694 # Calculate size of the chroot directory in KB
754 # Calculate size of the chroot directory in KB
695 CHROOT_SIZE=$(expr "$(du -s "${R}" | awk '{ print $1 }')")
755 CHROOT_SIZE=$(expr "$(du -s "${R}" | awk '{ print $1 }')")
696
756
697 # Calculate the amount of needed 512 Byte sectors
757 # Calculate the amount of needed 512 Byte sectors
698 TABLE_SECTORS=$(expr 1 \* 1024 \* 1024 \/ 512)
758 TABLE_SECTORS=$(expr 1 \* 1024 \* 1024 \/ 512)
699 FRMW_SECTORS=$(expr 64 \* 1024 \* 1024 \/ 512)
759 FRMW_SECTORS=$(expr 64 \* 1024 \* 1024 \/ 512)
700 ROOT_OFFSET=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}")
760 ROOT_OFFSET=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}")
701
761
702 # The root partition is EXT4
762 # The root partition is EXT4
703 # This means more space than the actual used space of the chroot is used.
763 # This means more space than the actual used space of the chroot is used.
704 # As overhead for journaling and reserved blocks 35% are added.
764 # As overhead for journaling and reserved blocks 35% are added.
705 ROOT_SECTORS=$(expr "$(expr "${CHROOT_SIZE}" + "${CHROOT_SIZE}" \/ 100 \* 35)" \* 1024 \/ 512)
765 ROOT_SECTORS=$(expr "$(expr "${CHROOT_SIZE}" + "${CHROOT_SIZE}" \/ 100 \* 35)" \* 1024 \/ 512)
706
766
707 # Calculate required image size in 512 Byte sectors
767 # Calculate required image size in 512 Byte sectors
708 IMAGE_SECTORS=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}")
768 IMAGE_SECTORS=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}")
709
769
710 # Prepare image file
770 # Prepare image file
711 if [ "$ENABLE_SPLITFS" = true ] ; then
771 if [ "$ENABLE_SPLITFS" = true ] ; then
712 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count="${TABLE_SECTORS}"
772 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count="${TABLE_SECTORS}"
713 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count=0 seek="${FRMW_SECTORS}"
773 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count=0 seek="${FRMW_SECTORS}"
714 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count="${TABLE_SECTORS}"
774 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count="${TABLE_SECTORS}"
715 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count=0 seek="${ROOT_SECTORS}"
775 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count=0 seek="${ROOT_SECTORS}"
716
776
717 # Write firmware/boot partition tables
777 # Write firmware/boot partition tables
718 sfdisk -q -L -uS -f "$IMAGE_NAME-frmw.img" 2> /dev/null <<EOM
778 sfdisk -q -L -uS -f "$IMAGE_NAME-frmw.img" 2> /dev/null <<EOM
719 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
779 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
720 EOM
780 EOM
721
781
722 # Write root partition table
782 # Write root partition table
723 sfdisk -q -L -uS -f "$IMAGE_NAME-root.img" 2> /dev/null <<EOM
783 sfdisk -q -L -uS -f "$IMAGE_NAME-root.img" 2> /dev/null <<EOM
724 ${TABLE_SECTORS},${ROOT_SECTORS},83
784 ${TABLE_SECTORS},${ROOT_SECTORS},83
725 EOM
785 EOM
726
786
727 # Setup temporary loop devices
787 # Setup temporary loop devices
728 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME"-frmw.img)"
788 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME"-frmw.img)"
729 ROOT_LOOP="$(losetup -o 1M -f --show "$IMAGE_NAME"-root.img)"
789 ROOT_LOOP="$(losetup -o 1M -f --show "$IMAGE_NAME"-root.img)"
730 else # ENABLE_SPLITFS=false
790 else # ENABLE_SPLITFS=false
731 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count="${TABLE_SECTORS}"
791 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count="${TABLE_SECTORS}"
732 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count=0 seek="${IMAGE_SECTORS}"
792 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count=0 seek="${IMAGE_SECTORS}"
733
793
734 # Write partition table
794 # Write partition table
735 sfdisk -q -L -uS -f "$IMAGE_NAME.img" 2> /dev/null <<EOM
795 sfdisk -q -L -uS -f "$IMAGE_NAME.img" 2> /dev/null <<EOM
736 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
796 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
737 ${ROOT_OFFSET},${ROOT_SECTORS},83
797 ${ROOT_OFFSET},${ROOT_SECTORS},83
738 EOM
798 EOM
739
799
740 # Setup temporary loop devices
800 # Setup temporary loop devices
741 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME".img)"
801 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME".img)"
742 ROOT_LOOP="$(losetup -o 65M -f --show "$IMAGE_NAME".img)"
802 ROOT_LOOP="$(losetup -o 65M -f --show "$IMAGE_NAME".img)"
743 fi
803 fi
744
804
745 if [ "$ENABLE_CRYPTFS" = true ] ; then
805 if [ "$ENABLE_CRYPTFS" = true ] ; then
746 # Create dummy ext4 fs
806 # Create dummy ext4 fs
747 mkfs.ext4 "$ROOT_LOOP"
807 mkfs.ext4 "$ROOT_LOOP"
748
808
749 # Setup password keyfile
809 # Setup password keyfile
750 touch .password
810 touch .password
751 chmod 600 .password
811 chmod 600 .password
752 echo -n ${CRYPTFS_PASSWORD} > .password
812 echo -n ${CRYPTFS_PASSWORD} > .password
753
813
754 # Initialize encrypted partition
814 # Initialize encrypted partition
755 echo "YES" | cryptsetup luksFormat "${ROOT_LOOP}" -c "${CRYPTFS_CIPHER}" -s "${CRYPTFS_XTSKEYSIZE}" .password
815 echo "YES" | cryptsetup luksFormat "${ROOT_LOOP}" -c "${CRYPTFS_CIPHER}" -s "${CRYPTFS_XTSKEYSIZE}" .password
756
816
757 # Open encrypted partition and setup mapping
817 # Open encrypted partition and setup mapping
758 cryptsetup luksOpen "${ROOT_LOOP}" -d .password "${CRYPTFS_MAPPING}"
818 cryptsetup luksOpen "${ROOT_LOOP}" -d .password "${CRYPTFS_MAPPING}"
759
819
760 # Secure delete password keyfile
820 # Secure delete password keyfile
761 shred -zu .password
821 shred -zu .password
762
822
763 # Update temporary loop device
823 # Update temporary loop device
764 ROOT_LOOP="/dev/mapper/${CRYPTFS_MAPPING}"
824 ROOT_LOOP="/dev/mapper/${CRYPTFS_MAPPING}"
765
825
766 # Wipe encrypted partition (encryption cipher is used for randomness)
826 # Wipe encrypted partition (encryption cipher is used for randomness)
767 dd if=/dev/zero of="${ROOT_LOOP}" bs=512 count="$(blockdev --getsz "${ROOT_LOOP}")"
827 dd if=/dev/zero of="${ROOT_LOOP}" bs=512 count="$(blockdev --getsz "${ROOT_LOOP}")"
768 fi
828 fi
769
829
770 # Build filesystems
830 # Build filesystems
771 mkfs.vfat "$FRMW_LOOP"
831 mkfs.vfat "$FRMW_LOOP"
772 mkfs.ext4 "$ROOT_LOOP"
832 mkfs.ext4 "$ROOT_LOOP"
773
833
774 # Mount the temporary loop devices
834 # Mount the temporary loop devices
775 mkdir -p "$BUILDDIR/mount"
835 mkdir -p "$BUILDDIR/mount"
776 mount "$ROOT_LOOP" "$BUILDDIR/mount"
836 mount "$ROOT_LOOP" "$BUILDDIR/mount"
777
837
778 mkdir -p "$BUILDDIR/mount/boot/firmware"
838 mkdir -p "$BUILDDIR/mount/boot/firmware"
779 mount "$FRMW_LOOP" "$BUILDDIR/mount/boot/firmware"
839 mount "$FRMW_LOOP" "$BUILDDIR/mount/boot/firmware"
780
840
781 # Copy all files from the chroot to the loop device mount point directory
841 # Copy all files from the chroot to the loop device mount point directory
782 rsync -a "${R}/" "$BUILDDIR/mount/"
842 rsync -a "${R}/" "$BUILDDIR/mount/"
783
843
784 # Unmount all temporary loop devices and mount points
844 # Unmount all temporary loop devices and mount points
785 cleanup
845 cleanup
786
846
787 # Create block map file(s) of image(s)
847 # Create block map file(s) of image(s)
788 if [ "$ENABLE_SPLITFS" = true ] ; then
848 if [ "$ENABLE_SPLITFS" = true ] ; then
789 # Create block map files for "bmaptool"
849 # Create block map files for "bmaptool"
790 bmaptool create -o "$IMAGE_NAME-frmw.bmap" "$IMAGE_NAME-frmw.img"
850 bmaptool create -o "$IMAGE_NAME-frmw.bmap" "$IMAGE_NAME-frmw.img"
791 bmaptool create -o "$IMAGE_NAME-root.bmap" "$IMAGE_NAME-root.img"
851 bmaptool create -o "$IMAGE_NAME-root.bmap" "$IMAGE_NAME-root.img"
792
852
793 # Image was successfully created
853 # Image was successfully created
794 echo "$IMAGE_NAME-frmw.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
854 echo "$IMAGE_NAME-frmw.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
795 echo "$IMAGE_NAME-root.img ($(expr \( "${TABLE_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
855 echo "$IMAGE_NAME-root.img ($(expr \( "${TABLE_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
796 else
856 else
797 # Create block map file for "bmaptool"
857 # Create block map file for "bmaptool"
798 bmaptool create -o "$IMAGE_NAME.bmap" "$IMAGE_NAME.img"
858 bmaptool create -o "$IMAGE_NAME.bmap" "$IMAGE_NAME.img"
799
859
800 # Image was successfully created
860 # Image was successfully created
801 echo "$IMAGE_NAME.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
861 echo "$IMAGE_NAME.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
802
862
803 # Create qemu qcow2 image
863 # Create qemu qcow2 image
804 if [ "$ENABLE_QEMU" = true ] ; then
864 if [ "$ENABLE_QEMU" = true ] ; then
805 QEMU_IMAGE=${QEMU_IMAGE:=${BASEDIR}/qemu/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
865 QEMU_IMAGE=${QEMU_IMAGE:=${BASEDIR}/qemu/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
806 QEMU_SIZE=16G
866 QEMU_SIZE=16G
807
867
808 qemu-img convert -f raw -O qcow2 "$IMAGE_NAME".img "$QEMU_IMAGE".qcow2
868 qemu-img convert -f raw -O qcow2 "$IMAGE_NAME".img "$QEMU_IMAGE".qcow2
809 qemu-img resize "$QEMU_IMAGE".qcow2 $QEMU_SIZE
869 qemu-img resize "$QEMU_IMAGE".qcow2 $QEMU_SIZE
810
870
811 echo "$QEMU_IMAGE.qcow2 ($QEMU_SIZE)" ": successfully created"
871 echo "$QEMU_IMAGE.qcow2 ($QEMU_SIZE)" ": successfully created"
812 fi
872 fi
813 fi
873 fi
General Comments 0
Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant