##// END OF EJS Templates
Raspi2-3_GenImage
RSS

Cloner depuis https://github.com/drtyhlpr/rpi23-gen-image.git

Merge branch 'pull' into burn
Unknown -
r671:ae0c8abd9bbc Fusion
parent child
Show More
Show file before | Show file after | Hide comments
@@ -1,565 +1,566
1 1 # rpi23-gen-image
2 2 ## Introduction
3 3 `rpi23-gen-image.sh` is an advanced Debian Linux bootstrapping shell script for generating Debian OS images for all Raspberry Pi computers. The script at this time supports the bootstrapping of the Debian (armhf/armel) releases `stretch` and `buster`. Raspberry Pi 0/1/2/3 images are generated for 32-bit mode only. Raspberry Pi 3 supports 64-bit images that can be generated using custom configuration parameters (```templates/rpi3-stretch-arm64-4.14.y```).
4 4
5 5 ## Build dependencies
6 6 The following list of Debian packages must be installed on the build system because they are essentially required for the bootstrapping process. The script will check if all required packages are installed and missing packages will be installed automatically if confirmed by the user.
7 7
8 8 ```debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo```
9 9
10 10 It is recommended to configure the `rpi23-gen-image.sh` script to build and install the latest Raspberry Pi Linux kernel. For the Raspberry 3 this is mandatory. Kernel compilation and linking will be performed on the build system using an ARM (armhf/armel) cross-compiler toolchain.
11 11
12 12 The script has been tested using the default `crossbuild-essential-armhf` and `crossbuild-essential-armel` toolchain meta packages on Debian Linux `stretch` build systems. Please check the [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains) for further information.
13 13
14 14 ## Command-line parameters
15 15 The script accepts certain command-line parameters to enable or disable specific OS features, services and configuration settings. These parameters are passed to the `rpi23-gen-image.sh` script via (simple) shell-variables. Unlike environment shell-variables (simple) shell-variables are defined at the beginning of the command-line call of the `rpi23-gen-image.sh` script.
16 16
17 17 ##### Command-line examples:
18 18 ```shell
19 19 ENABLE_UBOOT=true ./rpi23-gen-image.sh
20 20 ENABLE_CONSOLE=false ENABLE_IPV6=false ./rpi23-gen-image.sh
21 21 ENABLE_WM=xfce4 ENABLE_FBTURBO=true ENABLE_MINBASE=true ./rpi23-gen-image.sh
22 22 ENABLE_HARDNET=true ENABLE_IPTABLES=true /rpi23-gen-image.sh
23 23 APT_SERVER=ftp.de.debian.org APT_PROXY="http://127.0.0.1:3142/" ./rpi23-gen-image.sh
24 24 ENABLE_MINBASE=true ./rpi23-gen-image.sh
25 25 BUILD_KERNEL=true ENABLE_MINBASE=true ENABLE_IPV6=false ./rpi23-gen-image.sh
26 26 BUILD_KERNEL=true KERNELSRC_DIR=/tmp/linux ./rpi23-gen-image.sh
27 27 ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
28 28 ENABLE_CRYPTFS=true CRYPTFS_PASSWORD=changeme EXPANDROOT=false ENABLE_MINBASE=true ENABLE_REDUCE=true ENABLE_MINGPU=true BUILD_KERNEL=true ./rpi23-gen-image.sh
29 29 RELEASE=stretch BUILD_KERNEL=true ./rpi23-gen-image.sh
30 30 RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
31 31 RELEASE=stretch RPI_MODEL=3 ENABLE_WIRELESS=true ENABLE_MINBASE=true BUILD_KERNEL=true ./rpi23-gen-image.sh
32 32 ```
33 33
34 34 ## Configuration template files
35 35 To avoid long lists of command-line parameters and to help to store the favourite parameter configurations the `rpi23-gen-image.sh` script supports so called configuration template files (`CONFIG_TEMPLATE`=template). These are simple text files located in the `./templates` directory that contain the list of configuration parameters that will be used. New configuration template files can be added to the `./templates` directory.
36 36
37 37 ##### Command-line examples:
38 38 ```shell
39 39 CONFIG_TEMPLATE=rpi3stretch ./rpi23-gen-image.sh
40 40 CONFIG_TEMPLATE=rpi2stretch ./rpi23-gen-image.sh
41 41 ```
42 42
43 43 ## Supported parameters and settings
44 44 #### APT settings:
45 45 ##### `APT_SERVER`="ftp.debian.org"
46 46 Set Debian packages server address. Choose a server from the list of Debian worldwide [mirror sites](https://www.debian.org/mirror/list). Using a nearby server will probably speed-up all required downloads within the bootstrapping process.
47 47
48 48 ##### `APT_PROXY`=""
49 49 Set Proxy server address. Using a local Proxy-Cache like `apt-cacher-ng` will speed-up the bootstrapping process because all required Debian packages will only be downloaded from the Debian mirror site once. If `apt-cacher-ng` is running on default `http://127.0.0.1:3142` it is autodetected and you don't need to set this.
50 50
51 51 ##### `KEEP_APT_PROXY`=false
52 52 Keep the APT_PROXY settings used in the bootsrapping process in the generated image.
53 53
54 54 ##### `APT_INCLUDES`=""
55 55 A comma-separated list of additional packages to be installed by debootstrap during bootstrapping.
56 56
57 57 ##### `APT_INCLUDES_LATE`=""
58 58 A comma-separated list of additional packages to be installed by apt after bootstrapping and after APT sources are set up. This is useful for packages with pre-depends, which debootstrap do not handle well.
59 59
60 60 ---
61 61
62 62 #### General system settings:
63 63 ##### `SET_ARCH`=32
64 64 Set Architecture to default 32bit. If you want to compile 64-bit (RPI3 or RPI3+) set it to `64`. This option will set every needed cross-compiler or board specific option for a successful build.
65 65
66 66 ##### `RPI_MODEL`=2
67 67 Specify the target Raspberry Pi hardware model. The script at this time supports the following Raspberry Pi models:
68 68 - `0` = Raspberry Pi 0 and Raspberry Pi 0 W
69 69 - `1` = Raspberry Pi 1 model A and B
70 70 - `1P` = Raspberry Pi 1 model B+ and A+
71 71 - `2` = Raspberry Pi 2 model B
72 72 - `3` = Raspberry Pi 3 model B
73 73 - `3P` = Raspberry Pi 3 model B+
74 74
75 75 ##### `RELEASE`="buster"
76 76 Set the desired Debian release name. The script at this time supports the bootstrapping of the Debian releases `stretch` and `buster`.
77 77
78 78 ##### `RELEASE_ARCH`="armhf"
79 79 Set the desired Debian release architecture.
80 80
81 81 ##### `HOSTNAME`="rpi$RPI_MODEL-$RELEASE"
82 82 Set system hostname. It's recommended that the hostname is unique in the corresponding subnet.
83 83
84 84 ##### `PASSWORD`="raspberry"
85 85 Set system `root` password. It's **STRONGLY** recommended that you choose a custom password.
86 86
87 87 ##### `USER_PASSWORD`="raspberry"
88 88 Set password for the created non-root user `USER_NAME`=pi. Ignored if `ENABLE_USER`=false. It's **STRONGLY** recommended that you choose a custom password.
89 89
90 90 ##### `DEFLOCAL`="en_US.UTF-8"
91 91 Set default system locale. This setting can also be changed inside the running OS using the `dpkg-reconfigure locales` command. Please note that on using this parameter the script will automatically install the required packages `locales`, `keyboard-configuration` and `console-setup`.
92 92
93 93 ##### `TIMEZONE`="Europe/Berlin"
94 94 Set default system timezone. All available timezones can be found in the `/usr/share/zoneinfo/` directory. This setting can also be changed inside the running OS using the `dpkg-reconfigure tzdata` command.
95 95
96 96 ##### `EXPANDROOT`=true
97 97 Expand the root partition and filesystem automatically on first boot.
98 98
99 99 ##### `ENABLE_DPHYSSWAP`=true
100 100 Enable swap. The size of the swapfile is chosen relative to the size of the root partition. It'll use the `dphys-swapfile` package for that.
101 101
102 102 ##### `ENABLE_QEMU`=false
103 103 Generate kernel (`vexpress_defconfig`), file system image (`qcow2`) and DTB files that can be used for QEMU full system emulation (`vexpress-A15`). The output files are stored in the `$(pwd)/images/qemu` directory. You can find more information about running the generated image in the QEMU section of this readme file.
104 104
105 105 ---
106 106
107 107 #### Keyboard settings:
108 108 These options are used to configure keyboard layout in `/etc/default/keyboard` for console and Xorg. These settings can also be changed inside the running OS using the `dpkg-reconfigure keyboard-configuration` command.
109 109
110 110 ##### `XKB_MODEL`=""
111 111 Set the name of the model of your keyboard type.
112 112
113 113 ##### `XKB_LAYOUT`=""
114 114 Set the supported keyboard layout(s).
115 115
116 116 ##### `XKB_VARIANT`=""
117 117 Set the supported variant(s) of the keyboard layout(s).
118 118
119 119 ##### `XKB_OPTIONS`=""
120 120 Set extra xkb configuration options.
121 121
122 122 ---
123 123
124 124 #### Networking settings (DHCP):
125 125 This parameter is used to set up networking auto-configuration in `/etc/systemd/network/eth.network`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.`
126 126
127 127 ##### `ENABLE_DHCP`=true
128 128 Set the system to use DHCP. This requires an DHCP server.
129 129
130 130 ---
131 131
132 132 #### Networking settings (static):
133 133 These parameters are used to set up a static networking configuration in `/etc/systemd/network/eth.network`. The following static networking parameters are only supported if `ENABLE_DHCP` was set to `false`. The default location of network configuration files in the Debian `stretch` release was changed to `/lib/systemd/network`.
134 134
135 135 ##### `NET_ADDRESS`=""
136 136 Set a static IPv4 or IPv6 address and its prefix, separated by "/", eg. "192.169.0.3/24".
137 137
138 138 ##### `NET_GATEWAY`=""
139 139 Set the IP address for the default gateway.
140 140
141 141 ##### `NET_DNS_1`=""
142 142 Set the IP address for the first DNS server.
143 143
144 144 ##### `NET_DNS_2`=""
145 145 Set the IP address for the second DNS server.
146 146
147 147 ##### `NET_DNS_DOMAINS`=""
148 148 Set the default DNS search domains to use for non fully qualified hostnames.
149 149
150 150 ##### `NET_NTP_1`=""
151 151 Set the IP address for the first NTP server.
152 152
153 153 ##### `NET_NTP_2`=""
154 154 Set the IP address for the second NTP server.
155 155
156 156 ---
157 157
158 158 #### Basic system features:
159 159 ##### `ENABLE_CONSOLE`=true
160 160 Enable serial console interface. Recommended if no monitor or keyboard is connected to the RPi2/3. In case of problems fe. if the network (auto) configuration failed - the serial console can be used to access the system. On RPI `0` `3` `3P` the CPU speed is locked at lowest speed.
161 161
162 162 ##### `ENABLE_PRINTK`=false
163 163 Enables printing kernel messages to konsole. printk is `3 4 1 3` as in raspbian.
164 164
165 165 ##### `ENABLE_BLUETOOTH`=false
166 166 Enable onboard Bluetooth interface on the RPi0/3/3P. See: [Configuring the GPIO serial port on Raspbian jessie and stretch](https://spellfoundry.com/2016/05/29/configuring-gpio-serial-port-raspbian-jessie-including-pi-3/).
167 167
168 168 ##### `ENABLE_MINIUART_OVERLAY`=false
169 169 Enable Bluetooth to use this. Adds overlay to swap UART0 with UART1. Enabling (slower) Bluetooth and full speed serial console. - RPI `0` `3` `3P` have a fast `hardware UART0` (ttyAMA0) and a `mini UART1` (ttyS0)! RPI `1` `1P` `2` only have a `hardware UART0`. `UART0` is considered better, because is faster and more stable than `mini UART1`. By default the Bluetooth modem is mapped to the `hardware UART0` and `mini UART` is used for console. The `mini UART` is a problem for the serial console, because its baudrate depends on the CPU frequency, which is changing on runtime. Resulting in a volatile baudrate and thus in an unusable serial console.
170 170
171 171 ##### `ENABLE_TURBO`=false
172 172 Enable Turbo mode. This setting locks cpu at the highest frequency. As setting ENABLE_CONSOLE=true locks RPI to lowest CPU speed, this is can be used additionally to lock cpu hat max speed. Need a good power supply and probably cooling for the Raspberry PI.
173 173
174 174 ##### `ENABLE_I2C`=false
175 175 Enable I2C interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
176 176
177 177 ##### `ENABLE_SPI`=false
178 178 Enable SPI interface on the RPi 0/1/2/3. Please check the [RPi 0/1/2/3 pinout diagrams](https://elinux.org/RPi_Low-level_peripherals) to connect the right GPIO pins.
179 179
180 180 ##### `ENABLE_IPV6`=true
181 181 Enable IPv6 support. The network interface configuration is managed via systemd-networkd.
182 182
183 183 ##### `ENABLE_SSHD`=true
184 184 Install and enable OpenSSH service. The default configuration of the service doesn't allow `root` to login. Please use the user `pi` instead and `su -` or `sudo` to execute commands as root.
185 185
186 186 ##### `ENABLE_NONFREE`=false
187 187 Allow the installation of non-free Debian packages that do not comply with the DFSG. This is required to install closed-source firmware binary blobs.
188 188
189 189 ##### `ENABLE_WIRELESS`=false
190 190 Download and install the [closed-source firmware binary blob](https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm) that is required to run the internal wireless interface of the Raspberry Pi model `3`. This parameter is ignored if the specified `RPI_MODEL` is not `3`.
191 191
192 192 ##### `ENABLE_RSYSLOG`=true
193 193 If set to false, disable and uninstall rsyslog (so logs will be available only in journal files)
194 194
195 195 ##### `ENABLE_SOUND`=true
196 196 Enable sound hardware and install Advanced Linux Sound Architecture.
197 197
198 198 ##### `ENABLE_HWRANDOM`=true
199 199 Enable Hardware Random Number Generator. Strong random numbers are important for most network-based communications that use encryption. It's recommended to be enabled.
200 200
201 201 ##### `ENABLE_MINGPU`=false
202 202 Minimize the amount of shared memory reserved for the GPU. It doesn't seem to be possible to fully disable the GPU.
203 203
204 204 ##### `ENABLE_DBUS`=true
205 205 Install and enable D-Bus message bus. Please note that systemd should work without D-bus but it's recommended to be enabled.
206 206
207 207 ##### `ENABLE_XORG`=false
208 208 Install Xorg open-source X Window System.
209 209
210 210 ##### `ENABLE_WM`=""
211 211 Install a user-defined window manager for the X Window System. To make sure all X related package dependencies are getting installed `ENABLE_XORG` will automatically get enabled if `ENABLE_WM` is used. The `rpi23-gen-image.sh` script has been tested with the following list of window managers: `blackbox`, `openbox`, `fluxbox`, `jwm`, `dwm`, `xfce4`, `awesome`.
212 212
213 213 ##### `ENABLE_SYSVINIT`=false
214 214 Support for halt,init,poweroff,reboot,runlevel,shutdown,telinit commands
215 215
216 216 ---
217 217
218 218 #### Advanced system features:
219 219 ##### `ENABLE_KEYGEN`=false
220 220 Recover your lost codec license
221
221 222 ##### `ENABLE_SYSTEMDSWAP`=false
222 223 Enables [Systemd-swap service](https://github.com/Nefelim4ag/systemd-swap). Usefull if `KERNEL_ZSWAP` is enabled.
223 224
224 225 ##### `ENABLE_MINBASE`=false
225 226 Use debootstrap script variant `minbase` which only includes essential packages and apt. This will reduce the disk usage by about 65 MB.
226 227
227 228 ##### `ENABLE_REDUCE`=false
228 229 Reduce the disk space usage by deleting packages and files. See `REDUCE_*` parameters for detailed information.
229 230
230 231 ##### `ENABLE_UBOOT`=false
231 232 Replace the default RPi 0/1/2/3 second stage bootloader (bootcode.bin) with [U-Boot bootloader](https://git.denx.de/?p=u-boot.git;a=summary). U-Boot can boot images via the network using the BOOTP/TFTP protocol.
232 233
233 234 ##### `UBOOTSRC_DIR`=""
234 235 Path to a directory (`u-boot`) of [U-Boot bootloader sources](https://git.denx.de/?p=u-boot.git;a=summary) that will be copied, configured, build and installed inside the chroot.
235 236
236 237 ##### `ENABLE_FBTURBO`=false
237 238 Install and enable the [hardware accelerated Xorg video driver](https://github.com/ssvb/xf86-video-fbturbo) `fbturbo`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
238 239
239 240 ##### `FBTURBOSRC_DIR`=""
240 241 Path to a directory (`xf86-video-fbturbo`) of [hardware accelerated Xorg video driver sources](https://github.com/ssvb/xf86-video-fbturbo) that will be copied, configured, build and installed inside the chroot.
241 242
242 243 ##### `ENABLE_VIDEOCORE`=false
243 244 Install and enable the [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) `vcgencmd`. Please note that this driver is currently limited to hardware accelerated window moving and scrolling.
244 245
245 246 ##### `VIDEOCORESRC_DIR`=""
246 247 Path to a directory (`userland`) of [ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot.
247 248
248 249 ##### `ENABLE_NEXMON`=false
249 250 Install and enable the [Source code for a C-based firmware patching framework for Broadcom/Cypress WiFi chips that enables you to write your own firmware patches, for example, to enable monitor mode with radiotap headers and frame injection](https://github.com/seemoo-lab/nexmon.git).
250 251
251 252 ##### `NEXMONSRC_DIR`=""
252 253 Path to a directory (`nexmon`) of [Source code for ARM side libraries for interfacing to Raspberry Pi GPU](https://github.com/raspberrypi/userland) that will be copied, configured, build and installed inside the chroot.
253 254
254 255 ##### `ENABLE_IPTABLES`=false
255 256 Enable iptables IPv4/IPv6 firewall. Simplified ruleset: Allow all outgoing connections. Block all incoming connections except to OpenSSH service.
256 257
257 258 ##### `ENABLE_USER`=true
258 259 Create non-root user with password `USER_PASSWORD`=raspberry. Unless overridden with `USER_NAME`=user, the username will be `pi`.
259 260
260 261 ##### `USER_NAME`=pi
261 262 Non-root user to create. Ignored if `ENABLE_USER`=false
262 263
263 264 ##### `ENABLE_ROOT`=false
264 265 Set root user password so root login will be enabled
265 266
266 267 ##### `ENABLE_HARDNET`=false
267 268 Enable IPv4/IPv6 network stack hardening settings.
268 269
269 270 ##### `ENABLE_SPLITFS`=false
270 271 Enable having root partition on an USB drive by creating two image files: one for the `/boot/firmware` mount point, and another for `/`.
271 272
272 273 ##### `CHROOT_SCRIPTS`=""
273 274 Path to a directory with scripts that should be run in the chroot before the image is finally built. Every executable file in this directory is run in lexicographical order.
274 275
275 276 ##### `ENABLE_INITRAMFS`=false
276 277 Create an initramfs that that will be loaded during the Linux startup process. `ENABLE_INITRAMFS` will automatically get enabled if `ENABLE_CRYPTFS`=true. This parameter will be ignored if `BUILD_KERNEL`=false.
277 278
278 279 ##### `ENABLE_IFNAMES`=true
279 280 Enable automatic assignment of predictable, stable network interface names for all local Ethernet, WLAN interfaces. This might create complex and long interface names.
280 281
281 282 ##### `ENABLE_SPLASH`=true
282 283 Enable default Raspberry Pi boot up rainbow splash screen.
283 284
284 285 ##### `ENABLE_LOGO`=true
285 286 Enable default Raspberry Pi console logo (image of four raspberries in the top left corner).
286 287
287 288 ##### `ENABLE_SILENT_BOOT`=false
288 289 Set the verbosity of console messages shown during boot up to a strict minimum.
289 290
290 291 ##### `DISABLE_UNDERVOLT_WARNINGS`=
291 292 Disable RPi2/3 under-voltage warnings and overlays. Setting the parameter to `1` will disable the warning overlay. Setting it to `2` will additionally allow RPi2/3 turbo mode when low-voltage is present.
292 293
293 294 ---
294 295
295 296 #### SSH settings:
296 297 ##### `SSH_ENABLE_ROOT`=false
297 298 Enable password-based root login via SSH. This may be a security risk with the default password set, use only in trusted environments. `ENABLE_ROOT` must be set to `true`.
298 299
299 300 ##### `SSH_DISABLE_PASSWORD_AUTH`=false
300 301 Disable password-based SSH authentication. Only public key based SSH (v2) authentication will be supported.
301 302
302 303 ##### `SSH_LIMIT_USERS`=false
303 304 Limit the users that are allowed to login via SSH. Only allow user `USER_NAME`=pi and root if `SSH_ENABLE_ROOT`=true to login. This parameter will be ignored if `dropbear` SSH is used (`REDUCE_SSHD`=true).
304 305
305 306 ##### `SSH_ROOT_PUB_KEY`=""
306 307 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `root`. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported. `ENABLE_ROOT` **and** `SSH_ENABLE_ROOT` must be set to `true`.
307 308
308 309 ##### `SSH_USER_PUB_KEY`=""
309 310 Add SSH (v2) public key(s) from specified file to `authorized_keys` file to enable public key based SSH (v2) authentication of user `USER_NAME`=pi. The specified file can also contain multiple SSH (v2) public keys. SSH protocol version 1 is not supported.
310 311
311 312 ---
312 313
313 314 #### Kernel compilation:
314 315 ##### `BUILD_KERNEL`=true
315 316 Build and install the latest RPi 0/1/2/3 Linux kernel. Currently only the default RPi 0/1/2/3 kernel configuration is used.
316 317
317 318 ##### `CROSS_COMPILE`="arm-linux-gnueabihf-"
318 319 This sets the cross-compile environment for the compiler.
319 320
320 321 ##### `KERNEL_BTRFS`="false"
321 322 enable btrfs kernel support
322 323
323 324 ##### `KERNEL_POEHAT`="false"
324 325 enable Enable RPI POE HAT fan kernel support
325 326
326 327 ##### `KERNEL_NSPAWN`="false"
327 328 Enable per-interface network priority control - for systemd-nspawn
328 329
329 330 ##### `KERNEL_DHKEY`="true"
330 331 Diffie-Hellman operations on retained keys - required for >keyutils-1.6
331 332
332 333 ##### `KERNEL_ARCH`="arm"
333 334 This sets the kernel architecture for the compiler.
334 335
335 336 ##### `KERNEL_IMAGE`="kernel7.img"
336 337 Name of the image file in the boot partition. If not set, `KERNEL_IMAGE` will be set to "kernel8.img" automatically if building for arm64.
337 338
338 339 ##### `KERNEL_BRANCH`=""
339 340 Name of the requested branch from the GIT location for the RPi Kernel. Default is using the current default branch from the GIT site.
340 341
341 342 ##### `QEMU_BINARY`="/usr/bin/qemu-arm-static"
342 343 Sets the QEMU enviornment for the Debian archive. If not set, `QEMU_BINARY` will be set to "/usr/bin/qemu-aarch64-static" automatically if building for arm64.
343 344
344 345 ##### `KERNEL_DEFCONFIG`="bcm2709_defconfig"
345 346 Sets the default config for kernel compiling. If not set, `KERNEL_DEFCONFIG` will be set to "bcmrpi3\_defconfig" automatically if building for arm64.
346 347
347 348 ##### `KERNEL_REDUCE`=false
348 349 Reduce the size of the generated kernel by removing unwanted devices, network and filesystem drivers (experimental).
349 350
350 351 ##### `KERNEL_THREADS`=1
351 352 Number of parallel kernel building threads. If the parameter is left untouched the script will automatically determine the number of CPU cores to set the number of parallel threads to speed the kernel compilation.
352 353
353 354 ##### `KERNEL_HEADERS`=true
354 355 Install kernel headers with the built kernel.
355 356
356 357 ##### `KERNEL_MENUCONFIG`=false
357 358 Start `make menuconfig` interactive menu-driven kernel configuration. The script will continue after `make menuconfig` was terminated.
358 359
359 360 ##### `KERNEL_OLDDEFCONFIG`=false
360 361 Run `make olddefconfig` to automatically set all new kernel configuration options to their recommended default values.
361 362
362 363 ##### `KERNEL_CCACHE`=false
363 364 Compile the kernel using ccache. This speeds up kernel recompilation by caching previous compilations and detecting when the same compilation is being done again.
364 365
365 366 ##### `KERNEL_REMOVESRC`=true
366 367 Remove all kernel sources from the generated OS image after it was built and installed.
367 368
368 369 ##### `KERNELSRC_DIR`=""
369 370 Path to a directory (`linux`) of [RaspberryPi Linux kernel sources](https://github.com/raspberrypi/linux) that will be copied, configured, build and installed inside the chroot.
370 371
371 372 ##### `KERNELSRC_CLEAN`=false
372 373 Clean the existing kernel sources directory `KERNELSRC_DIR` (using `make mrproper`) after it was copied to the chroot and before the compilation of the kernel has started. This parameter will be ignored if no `KERNELSRC_DIR` was specified or if `KERNELSRC_PREBUILT`=true.
373 374
374 375 ##### `KERNELSRC_CONFIG`=true
375 376 Run `make bcm2709_defconfig` (and optional `make menuconfig`) to configure the kernel sources before building. This parameter is automatically set to `true` if no existing kernel sources directory was specified using `KERNELSRC_DIR`. This parameter is ignored if `KERNELSRC_PREBUILT`=true.
376 377
377 378 ##### `KERNELSRC_USRCONFIG`=""
378 379 Copy own config file to kernel `.config`. If `KERNEL_MENUCONFIG`=true then running after copy.
379 380
380 381 ##### `KERNELSRC_PREBUILT`=false
381 382 With this parameter set to true the script expects the existing kernel sources directory to be already successfully cross-compiled. The parameters `KERNELSRC_CLEAN`, `KERNELSRC_CONFIG`, `KERNELSRC_USRCONFIG` and `KERNEL_MENUCONFIG` are ignored and no kernel compilation tasks are performed.
382 383
383 384 ##### `RPI_FIRMWARE_DIR`=""
384 385 The directory (`firmware`) containing a local copy of the firmware from the [RaspberryPi firmware project](https://github.com/raspberrypi/firmware). Default is to download the latest firmware directly from the project.
385 386
386 387 ##### `KERNEL_DEFAULT_GOV`="ONDEMAND"
387 388 Set the default cpu governor at kernel compilation. Supported values are: PERFORMANCE POWERSAVE USERSPACE ONDEMAND CONSERVATIVE SCHEDUTIL
388 389
389 390 ##### `KERNEL_NF`=false
390 391 Enable Netfilter modules as kernel modules
391 392
392 393 ##### `KERNEL_VIRT`=false
393 394 Enable Kernel KVM support (/dev/kvm)
394 395
395 396 ##### `KERNEL_ZSWAP`=false
396 397 Enable Kernel Zswap support. Best use on high RAM load and mediocre CPU load usecases
397 398
398 399 ##### `KERNEL_BPF`=true
399 400 Allow attaching eBPF programs to a cgroup using the bpf syscall (CONFIG_BPF_SYSCALL CONFIG_CGROUP_BPF) [systemd compilations about it - File /lib/systemd/system/systemd-journald.server:36 configures an IP firewall (IPAddressDeny=all), but the local system does not support BPF/cgroup based firewalls]
400 401
401 402 ##### `KERNEL_SECURITY`=false
402 403 Enables Apparmor, integrity subsystem, auditing.
403 404
404 405 ---
405 406
406 407 #### Reduce disk usage:
407 408 The following list of parameters is ignored if `ENABLE_REDUCE`=false.
408 409
409 410 ##### `REDUCE_APT`=true
410 411 Configure APT to use compressed package repository lists and no package caching files.
411 412
412 413 ##### `REDUCE_DOC`=true
413 414 Remove all doc files (harsh). Configure APT to not include doc files on future `apt-get` package installations.
414 415
415 416 ##### `REDUCE_MAN`=true
416 417 Remove all man pages and info files (harsh). Configure APT to not include man pages on future `apt-get` package installations.
417 418
418 419 ##### `REDUCE_VIM`=false
419 420 Replace `vim-tiny` package by `levee` a tiny vim clone.
420 421
421 422 ##### `REDUCE_BASH`=false
422 423 Remove `bash` package and switch to `dash` shell (experimental).
423 424
424 425 ##### `REDUCE_HWDB`=true
425 426 Remove PCI related hwdb files (experimental).
426 427
427 428 ##### `REDUCE_SSHD`=true
428 429 Replace `openssh-server` with `dropbear`.
429 430
430 431 ##### `REDUCE_LOCALE`=true
431 432 Remove all `locale` translation files.
432 433
433 434 ---
434 435
435 436 #### Encrypted root partition:
436 437 ##### `KERNEL_CRYPTFS`=false
437 438 Enable Kernel Moduls for crypto
438 439
439 440 ##### `ENABLE_CRYPTFS`=false
440 441 Enable full system encryption with dm-crypt. Setup a fully LUKS encrypted root partition (aes-xts-plain64:sha512) and generate required initramfs. The /boot directory will not be encrypted. This parameter will be ignored if `BUILD_KERNEL`=false. `ENABLE_CRYPTFS` is experimental. SSH-to-initramfs is currently not supported but will be soon - feel free to help.
441 442
442 443 ##### `CRYPTFS_PASSWORD`=""
443 444 Set password of the encrypted root partition. This parameter is mandatory if `ENABLE_CRYPTFS`=true.
444 445
445 446 ##### `CRYPTFS_MAPPING`="secure"
446 447 Set name of dm-crypt managed device-mapper mapping.
447 448
448 449 ##### `CRYPTFS_CIPHER`="aes-xts-plain64:sha512"
449 450 Set cipher specification string. `aes-xts*` ciphers are strongly recommended.
450 451
451 452 ##### `CRYPTFS_XTSKEYSIZE`=512
452 453 Sets key size in bits. The argument has to be a multiple of 8.
453 454
454 455 ##### `CRYPTFS_DROPBEAR`=false
455 456 Enable Dropbear Initramfs support
456 457
457 458 ##### `CRYPTFS_DROPBEAR_PUBKEY`=""
458 459 Provide path to dropbear Public RSA-OpenSSH Key
459 460
460 461 ---
461 462
462 463 #### Build settings:
463 464 ##### `BASEDIR`=$(pwd)/images/${RELEASE}
464 465 Set a path to a working directory used by the script to generate an image.
465 466
466 467 ##### `IMAGE_NAME`=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}
467 468 Set a filename for the output file(s). Note: the script will create $IMAGE_NAME.img if `ENABLE_SPLITFS`=false or $IMAGE_NAME-frmw.img and $IMAGE_NAME-root.img if `ENABLE_SPLITFS`=true. Note 2: If the KERNEL_BRANCH is not set, the word "CURRENT" is used.
468 469
469 470 ## Understanding the script
470 471 The functions of this script that are required for the different stages of the bootstrapping are split up into single files located inside the `bootstrap.d` directory. During the bootstrapping every script in this directory gets executed in lexicographical order:
471 472
472 473 | Script | Description |
473 474 | --- | --- |
474 475 | `10-bootstrap.sh` | Debootstrap basic system |
475 476 | `11-apt.sh` | Setup APT repositories |
476 477 | `12-locale.sh` | Setup Locales and keyboard settings |
477 478 | `13-kernel.sh` | Build and install RPi 0/1/2/3 Kernel |
478 479 | `14-fstab.sh` | Setup fstab and initramfs |
479 480 | `15-rpi-config.sh` | Setup RPi 0/1/2/3 config and cmdline |
480 481 | `20-networking.sh` | Setup Networking |
481 482 | `21-firewall.sh` | Setup Firewall |
482 483 | `30-security.sh` | Setup Users and Security settings |
483 484 | `31-logging.sh` | Setup Logging |
484 485 | `32-sshd.sh` | Setup SSH and public keys |
485 486 | `41-uboot.sh` | Build and Setup U-Boot |
486 487 | `42-fbturbo.sh` | Build and Setup fbturbo Xorg driver |
487 488 | `43-videocore.sh` | Build and Setup videocore libraries |
488 489 | `50-firstboot.sh` | First boot actions |
489 490 | `99-reduce.sh` | Reduce the disk space usage |
490 491
491 492 All the required configuration files that will be copied to the generated OS image are located inside the `files` directory. It is not recommended to modify these configuration files manually.
492 493
493 494 | Directory | Description |
494 495 | --- | --- |
495 496 | `apt` | APT management configuration files |
496 497 | `boot` | Boot and RPi 0/1/2/3 configuration files |
497 498 | `dpkg` | Package Manager configuration |
498 499 | `etc` | Configuration files and rc scripts |
499 500 | `firstboot` | Scripts that get executed on first boot |
500 501 | `initramfs` | Initramfs scripts |
501 502 | `iptables` | Firewall configuration files |
502 503 | `locales` | Locales configuration |
503 504 | `modules` | Kernel Modules configuration |
504 505 | `mount` | Fstab configuration |
505 506 | `network` | Networking configuration files |
506 507 | `sysctl.d` | Swapping and Network Hardening configuration |
507 508 | `xorg` | fbturbo Xorg driver configuration |
508 509
509 510 ## Custom packages and scripts
510 511 Debian custom packages, i.e. those not in the debian repositories, can be installed by placing them in the `packages` directory. They are installed immediately after packages from the repositories are installed. Any dependencies listed in the custom packages will be downloaded automatically from the repositories. Do not list these custom packages in `APT_INCLUDES`.
511 512
512 513 Scripts in the custom.d directory will be executed after all other installation is complete but before the image is created.
513 514
514 515 ## Logging of the bootstrapping process
515 516 All information related to the bootstrapping process and the commands executed by the `rpi23-gen-image.sh` script can easily be saved into a logfile. The common shell command `script` can be used for this purpose:
516 517
517 518 ```shell
518 519 script -c 'APT_SERVER=ftp.de.debian.org ./rpi23-gen-image.sh' ./build.log
519 520 ```
520 521
521 522 ## Flashing the image file
522 523 After the image file was successfully created by the `rpi23-gen-image.sh` script it can be copied to the microSD card that will be used by the RPi 0/1/2/3 computer. This can be performed by using the tools `bmaptool` or `dd`. Using `bmaptool` will probably speed-up the copy process because `bmaptool` copies more wisely than `dd`.
523 524
524 525 ##### Flashing examples:
525 526 ```shell
526 527 bmaptool copy ./images/buster/2017-01-23-rpi3-buster.img /dev/mmcblk0
527 528 dd bs=4M if=./images/buster/2017-01-23-rpi3-buster.img of=/dev/mmcblk0
528 529 ```
529 530 If you have set `ENABLE_SPLITFS`, copy the `-frmw` image on the microSD card, then the `-root` one on the USB drive:
530 531 ```shell
531 532 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-frmw.img /dev/mmcblk0
532 533 bmaptool copy ./images/buster/2017-01-23-rpi3-buster-root.img /dev/sdc
533 534 ```
534 535
535 536 ## QEMU emulation
536 537 Start QEMU full system emulation:
537 538 ```shell
538 539 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=tty1"
539 540 ```
540 541
541 542 Start QEMU full system emulation and output to console:
542 543 ```shell
543 544 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
544 545 ```
545 546
546 547 Start QEMU full system emulation with SMP and output to console:
547 548 ```shell
548 549 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -smp cpus=2,maxcpus=2 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -append "root=/dev/mmcblk0p2 rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
549 550 ```
550 551
551 552 Start QEMU full system emulation with cryptfs, initramfs and output to console:
552 553 ```shell
553 554 qemu-system-arm -m 2048M -M vexpress-a15 -cpu cortex-a15 -kernel kernel7.img -no-reboot -dtb vexpress-v2p-ca15_a7.dtb -sd ${IMAGE_NAME}.qcow2 -initrd "initramfs-${KERNEL_VERSION}" -append "root=/dev/mapper/secure cryptdevice=/dev/mmcblk0p2:secure rw rootfstype=ext4 console=ttyAMA0,115200 init=/bin/systemd" -serial stdio
554 555 ```
555 556
556 557 ## External links and references
557 558 * [Debian worldwide mirror sites](https://www.debian.org/mirror/list)
558 559 * [Debian Raspberry Pi 2 Wiki](https://wiki.debian.org/RaspberryPi2)
559 560 * [Debian CrossToolchains Wiki](https://wiki.debian.org/CrossToolchains)
560 561 * [Official Raspberry Pi Firmware on github](https://github.com/raspberrypi/firmware)
561 562 * [Official Raspberry Pi Kernel on github](https://github.com/raspberrypi/linux)
562 563 * [U-BOOT git repository](https://git.denx.de/?p=u-boot.git;a=summary)
563 564 * [Xorg DDX driver fbturbo](https://github.com/ssvb/xf86-video-fbturbo)
564 565 * [RPi3 Wireless interface firmware](https://github.com/RPi-Distro/firmware-nonfree/tree/master/brcm)
565 566 * [Collabora RPi2 Kernel precompiled](https://repositories.collabora.co.uk/debian/)
Show file before | Show file after | Hide comments
@@ -1,888 +1,889
1 1 #
2 2 # Build and Setup RPi2/3 Kernel
3 3 #
4 4
5 5 # Load utility functions
6 6 . ./functions.sh
7 7
8 8 # Need to use kali kernel src if nexmon is enabled
9 9 if [ "$ENABLE_NEXMON" = true ] ; then
10 10 KERNEL_URL="${KALI_KERNEL_URL}"
11 11 # Clear Branch and KernelSRC_DIR if using nexmon. Everyone will forget to clone kali kernel instead of nomrla kernel
12 12 KERNEL_BRANCH=""
13 13 KERNELSRC_DIR=""
14 14 fi
15 15
16 16 # Fetch and build latest raspberry kernel
17 17 if [ "$BUILD_KERNEL" = true ] ; then
18 18 # Setup source directory
19 19 mkdir -p "${KERNEL_DIR}"
20 20
21 21 # Copy existing kernel sources into chroot directory
22 22 if [ -n "$KERNELSRC_DIR" ] && [ -d "$KERNELSRC_DIR" ] ; then
23 23 # Copy kernel sources and include hidden files
24 24 cp -r "${KERNELSRC_DIR}/". "${KERNEL_DIR}"
25 25
26 26 # Clean the kernel sources
27 27 if [ "$KERNELSRC_CLEAN" = true ] && [ "$KERNELSRC_PREBUILT" = false ] ; then
28 28 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" mrproper
29 29 fi
30 30 else # KERNELSRC_DIR=""
31 31 # Create temporary directory for kernel sources
32 32 temp_dir=$(as_nobody mktemp -d)
33 33
34 34 # Fetch current RPi2/3 kernel sources
35 35 if [ -z "${KERNEL_BRANCH}" ] ; then
36 36 as_nobody -H git -C "${temp_dir}" clone --depth=1 "${KERNEL_URL}" linux
37 37 else
38 38 as_nobody -H git -C "${temp_dir}" clone --depth=1 --branch "${KERNEL_BRANCH}" "${KERNEL_URL}" linux
39 39 fi
40 40
41 41 # Copy downloaded kernel sources
42 42 cp -r "${temp_dir}/linux/"* "${KERNEL_DIR}"
43 43
44 44 # Remove temporary directory for kernel sources
45 45 rm -fr "${temp_dir}"
46 46
47 47 # Set permissions of the kernel sources
48 48 chown -R root:root "${R}/usr/src"
49 49 fi
50 50
51 51 # Calculate optimal number of kernel building threads
52 52 if [ "$KERNEL_THREADS" = "1" ] && [ -r /proc/cpuinfo ] ; then
53 53 KERNEL_THREADS=$(grep -c processor /proc/cpuinfo)
54 54 fi
55 55
56 #Copy 32bit config to 64bit
56 57 if [ "$ENABLE_QEMU" = true ] && [ "$KERNEL_ARCH" = arm64 ]; then
57 58 cp "${KERNEL_DIR}"/arch/arm/configs/vexpress_defconfig "${KERNEL_DIR}"/arch/arm64/configs/
58 59 fi
59 60
60 61 # Configure and build kernel
61 62 if [ "$KERNELSRC_PREBUILT" = false ] ; then
62 63 # Remove device, network and filesystem drivers from kernel configuration
63 64 if [ "$KERNEL_REDUCE" = true ] ; then
64 65 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
65 66 sed -i\
66 67 -e "s/\(^CONFIG_SND.*\=\).*/\1n/"\
67 68 -e "s/\(^CONFIG_SOUND.*\=\).*/\1n/"\
68 69 -e "s/\(^CONFIG_AC97.*\=\).*/\1n/"\
69 70 -e "s/\(^CONFIG_VIDEO_.*\=\).*/\1n/"\
70 71 -e "s/\(^CONFIG_MEDIA_TUNER.*\=\).*/\1n/"\
71 72 -e "s/\(^CONFIG_DVB.*\=\)[ym]/\1n/"\
72 73 -e "s/\(^CONFIG_REISERFS.*\=\).*/\1n/"\
73 74 -e "s/\(^CONFIG_JFS.*\=\).*/\1n/"\
74 75 -e "s/\(^CONFIG_XFS.*\=\).*/\1n/"\
75 76 -e "s/\(^CONFIG_GFS2.*\=\).*/\1n/"\
76 77 -e "s/\(^CONFIG_OCFS2.*\=\).*/\1n/"\
77 78 -e "s/\(^CONFIG_BTRFS.*\=\).*/\1n/"\
78 79 -e "s/\(^CONFIG_HFS.*\=\).*/\1n/"\
79 80 -e "s/\(^CONFIG_JFFS2.*\=\)[ym]/\1n/"\
80 81 -e "s/\(^CONFIG_UBIFS.*\=\).*/\1n/"\
81 82 -e "s/\(^CONFIG_SQUASHFS.*\=\)[ym]/\1n/"\
82 83 -e "s/\(^CONFIG_W1.*\=\)[ym]/\1n/"\
83 84 -e "s/\(^CONFIG_HAMRADIO.*\=\).*/\1n/"\
84 85 -e "s/\(^CONFIG_CAN.*\=\).*/\1n/"\
85 86 -e "s/\(^CONFIG_IRDA.*\=\).*/\1n/"\
86 87 -e "s/\(^CONFIG_BT_.*\=\).*/\1n/"\
87 88 -e "s/\(^CONFIG_WIMAX.*\=\)[ym]/\1n/"\
88 89 -e "s/\(^CONFIG_6LOWPAN.*\=\).*/\1n/"\
89 90 -e "s/\(^CONFIG_IEEE802154.*\=\).*/\1n/"\
90 91 -e "s/\(^CONFIG_NFC.*\=\).*/\1n/"\
91 92 -e "s/\(^CONFIG_FB_TFT=.*\=\).*/\1n/"\
92 93 -e "s/\(^CONFIG_TOUCHSCREEN.*\=\).*/\1n/"\
93 94 -e "s/\(^CONFIG_USB_GSPCA_.*\=\).*/\1n/"\
94 95 -e "s/\(^CONFIG_DRM.*\=\).*/\1n/"\
95 96 "${KERNEL_DIR}/.config"
96 97 fi
97 98
98 99 if [ "$KERNELSRC_CONFIG" = true ] ; then
99 100 # Load default raspberry kernel configuration
100 101 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" "${KERNEL_DEFCONFIG}"
101 102
102 103 #Switch to KERNELSRC_DIR so we can use set_kernel_config
103 104 cd "${KERNEL_DIR}" || exit
104 105
105 106 # Enable RPI POE HAT fan
106 107 if [ "$KERNEL_POEHAT" = true ]; then
107 108 set_kernel_config CONFIG_SENSORS_RPI_POE_FAN m
108 109 fi
109 110
110 111 # Enable per-interface network priority control
111 112 # (for systemd-nspawn)
112 113 if [ "$KERNEL_NSPAN" = true ]; then
113 114 set_kernel_config CONFIG_CGROUP_NET_PRIO y
114 115 fi
115 116
116 117 # Compile in BTRFS
117 118 if [ "$KERNEL_BTRFS" = true ]; then
118 119 set_kernel_config CONFIG_BTRFS_FS y
119 120 set_kernel_config CONFIG_BTRFS_FS_POSIX_ACL y
120 121 set_kernel_config CONFIG_BTRFS_FS_REF_VERIFY y
121 122 fi
122 123
123 124 # Diffie-Hellman operations on retained keys
124 125 # (required for >keyutils-1.6)
125 126 if [ "$KERNEL_DHKEY" = true ]; then
126 127 set_kernel_config CONFIG_KEY_DH_OPERATIONS y
127 128 fi
128 129
129 130 if [ "$KERNEL_ARCH" = arm64 ] && [ "$ENABLE_QEMU" = false ]; then
130 131 # Mask this temporarily during switch to rpi-4.19.y
131 132 #Fix SD_DRIVER upstream and downstream mess in 64bit RPIdeb_config
132 133 # use correct driver MMC_BCM2835_MMC instead of MMC_BCM2835_SDHOST - see https://www.raspberrypi.org/forums/viewtopic.php?t=210225
133 134 #set_kernel_config CONFIG_MMC_BCM2835 n
134 135 #set_kernel_config CONFIG_MMC_SDHCI_IPROC n
135 136 #set_kernel_config CONFIG_USB_DWC2 n
136 137 #sed -i "s|depends on MMC_BCM2835_MMC && MMC_BCM2835_DMA|depends on MMC_BCM2835_MMC|" "${KERNEL_DIR}"/drivers/mmc/host/Kconfig
137 138
138 139 #VLAN got disabled without reason in arm64bit
139 140 set_kernel_config CONFIG_IPVLAN m
140 141 fi
141 142
142 143 # enable ZSWAP see https://askubuntu.com/a/472227 or https://wiki.archlinux.org/index.php/zswap
143 144 if [ "$KERNEL_ZSWAP" = true ] ; then
144 145 set_kernel_config CONFIG_ZPOOL y
145 146 set_kernel_config CONFIG_ZSWAP y
146 147 set_kernel_config CONFIG_ZBUD y
147 148 set_kernel_config CONFIG_Z3FOLD y
148 149 set_kernel_config CONFIG_ZSMALLOC y
149 150 set_kernel_config CONFIG_PGTABLE_MAPPING y
150 151 set_kernel_config CONFIG_LZO_COMPRESS y
151 152 fi
152 153
153 154 if [ "$RPI_MODEL" = 4 ] ; then
154 155 # Following are set in current 32-bit LPAE kernel
155 156 set_kernel_config CONFIG_CGROUP_PIDS y
156 157 set_kernel_config CONFIG_NET_IPVTI m
157 158 set_kernel_config CONFIG_NF_TABLES_SET m
158 159 set_kernel_config CONFIG_NF_TABLES_INET y
159 160 set_kernel_config CONFIG_NF_TABLES_NETDEV y
160 161 set_kernel_config CONFIG_NF_FLOW_TABLE m
161 162 set_kernel_config CONFIG_NFT_FLOW_OFFLOAD m
162 163 set_kernel_config CONFIG_NFT_CONNLIMIT m
163 164 set_kernel_config CONFIG_NFT_TUNNEL m
164 165 set_kernel_config CONFIG_NFT_OBJREF m
165 166 set_kernel_config CONFIG_NFT_FIB_IPV4 m
166 167 set_kernel_config CONFIG_NFT_FIB_IPV6 m
167 168 set_kernel_config CONFIG_NFT_FIB_INET m
168 169 set_kernel_config CONFIG_NFT_SOCKET m
169 170 set_kernel_config CONFIG_NFT_OSF m
170 171 set_kernel_config CONFIG_NFT_TPROXY m
171 172 set_kernel_config CONFIG_NF_DUP_NETDEV m
172 173 set_kernel_config CONFIG_NFT_DUP_NETDEV m
173 174 set_kernel_config CONFIG_NFT_FWD_NETDEV m
174 175 set_kernel_config CONFIG_NFT_FIB_NETDEV m
175 176 set_kernel_config CONFIG_NF_FLOW_TABLE_INET m
176 177 set_kernel_config CONFIG_NF_FLOW_TABLE m
177 178 set_kernel_config CONFIG_NETFILTER_XT_MATCH_SOCKET m
178 179 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV6 m
179 180 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV6 m
180 181 set_kernel_config CONFIG_NFT_MASQ_IPV6 m
181 182 set_kernel_config CONFIG_NFT_REDIR_IPV6 m
182 183 set_kernel_config CONFIG_NFT_REJECT_IPV6 m
183 184 set_kernel_config CONFIG_NFT_DUP_IPV6 m
184 185 set_kernel_config CONFIG_NFT_FIB_IPV6 m
185 186 set_kernel_config CONFIG_NF_FLOW_TABLE_IPV6 m
186 187 set_kernel_config CONFIG_NF_TABLES_BRIDGE m
187 188 set_kernel_config CONFIG_NFT_BRIDGE_REJECT m
188 189 set_kernel_config CONFIG_NF_LOG_BRIDGE m
189 190 set_kernel_config CONFIG_MT76_CORE m
190 191 set_kernel_config CONFIG_MT76_LEDS m
191 192 set_kernel_config CONFIG_MT76_USB m
192 193 set_kernel_config CONFIG_MT76x2_COMMON m
193 194 set_kernel_config CONFIG_MT76x0U m
194 195 set_kernel_config CONFIG_MT76x2U m
195 196 set_kernel_config CONFIG_TOUCHSCREEN_ILI210X m
196 197 set_kernel_config CONFIG_BCM_VC_SM m
197 198 set_kernel_config CONFIG_BCM2835_SMI_DEV m
198 199 set_kernel_config CONFIG_RPIVID_MEM m
199 200 set_kernel_config CONFIG_HW_RANDOM_BCM2835 y
200 201 set_kernel_config CONFIG_TCG_TPM m
201 202 set_kernel_config CONFIG_HW_RANDOM_TPM y
202 203 set_kernel_config CONFIG_TCG_TIS m
203 204 set_kernel_config CONFIG_TCG_TIS_SPI m
204 205 set_kernel_config CONFIG_I2C_MUX m
205 206 set_kernel_config CONFIG_I2C_MUX_GPMUX m
206 207 set_kernel_config CONFIG_I2C_MUX_PCA954x m
207 208 set_kernel_config CONFIG_SPI_GPIO m
208 209 set_kernel_config CONFIG_BATTERY_MAX17040 m
209 210 set_kernel_config CONFIG_SENSORS_GPIO_FAN m
210 211 set_kernel_config CONFIG_SENSORS_RASPBERRYPI_HWMON m
211 212 set_kernel_config CONFIG_BCM2835_THERMAL y
212 213 set_kernel_config CONFIG_RC_CORE y
213 214 set_kernel_config CONFIG_RC_MAP y
214 215 set_kernel_config CONFIG_LIRC y
215 216 set_kernel_config CONFIG_RC_DECODERS y
216 217 set_kernel_config CONFIG_IR_NEC_DECODER m
217 218 set_kernel_config CONFIG_IR_RC5_DECODER m
218 219 set_kernel_config CONFIG_IR_RC6_DECODER m
219 220 set_kernel_config CONFIG_IR_JVC_DECODER m
220 221 set_kernel_config CONFIG_IR_SONY_DECODER m
221 222 set_kernel_config CONFIG_IR_SANYO_DECODER m
222 223 set_kernel_config CONFIG_IR_SHARP_DECODER m
223 224 set_kernel_config CONFIG_IR_MCE_KBD_DECODER m
224 225 set_kernel_config CONFIG_IR_XMP_DECODER m
225 226 set_kernel_config CONFIG_IR_IMON_DECODER m
226 227 set_kernel_config CONFIG_RC_DEVICES y
227 228 set_kernel_config CONFIG_RC_ATI_REMOTE m
228 229 set_kernel_config CONFIG_IR_IMON m
229 230 set_kernel_config CONFIG_IR_MCEUSB m
230 231 set_kernel_config CONFIG_IR_REDRAT3 m
231 232 set_kernel_config CONFIG_IR_STREAMZAP m
232 233 set_kernel_config CONFIG_IR_IGUANA m
233 234 set_kernel_config CONFIG_IR_TTUSBIR m
234 235 set_kernel_config CONFIG_RC_LOOPBACK m
235 236 set_kernel_config CONFIG_IR_GPIO_CIR m
236 237 set_kernel_config CONFIG_IR_GPIO_TX m
237 238 set_kernel_config CONFIG_IR_PWM_TX m
238 239 set_kernel_config CONFIG_VIDEO_V4L2_SUBDEV_API y
239 240 set_kernel_config CONFIG_VIDEO_AU0828_RC y
240 241 set_kernel_config CONFIG_VIDEO_CX231XX m
241 242 set_kernel_config CONFIG_VIDEO_CX231XX_RC y
242 243 set_kernel_config CONFIG_VIDEO_CX231XX_ALSA m
243 244 set_kernel_config CONFIG_VIDEO_CX231XX_DVB m
244 245 set_kernel_config CONFIG_VIDEO_TM6000 m
245 246 set_kernel_config CONFIG_VIDEO_TM6000_ALSA m
246 247 set_kernel_config CONFIG_VIDEO_TM6000_DVB m
247 248 set_kernel_config CONFIG_DVB_USB m
248 249 set_kernel_config CONFIG_DVB_USB_DIB3000MC m
249 250 set_kernel_config CONFIG_DVB_USB_A800 m
250 251 set_kernel_config CONFIG_DVB_USB_DIBUSB_MB m
251 252 set_kernel_config CONFIG_DVB_USB_DIBUSB_MB_FAULTY y
252 253 set_kernel_config CONFIG_DVB_USB_DIBUSB_MC m
253 254 set_kernel_config CONFIG_DVB_USB_DIB0700 m
254 255 set_kernel_config CONFIG_DVB_USB_UMT_010 m
255 256 set_kernel_config CONFIG_DVB_USB_CXUSB m
256 257 set_kernel_config CONFIG_DVB_USB_M920X m
257 258 set_kernel_config CONFIG_DVB_USB_DIGITV m
258 259 set_kernel_config CONFIG_DVB_USB_VP7045 m
259 260 set_kernel_config CONFIG_DVB_USB_VP702X m
260 261 set_kernel_config CONFIG_DVB_USB_GP8PSK m
261 262 set_kernel_config CONFIG_DVB_USB_NOVA_T_USB2 m
262 263 set_kernel_config CONFIG_DVB_USB_TTUSB2 m
263 264 set_kernel_config CONFIG_DVB_USB_DTT200U m
264 265 set_kernel_config CONFIG_DVB_USB_OPERA1 m
265 266 set_kernel_config CONFIG_DVB_USB_AF9005 m
266 267 set_kernel_config CONFIG_DVB_USB_AF9005_REMOTE m
267 268 set_kernel_config CONFIG_DVB_USB_PCTV452E m
268 269 set_kernel_config CONFIG_DVB_USB_DW2102 m
269 270 set_kernel_config CONFIG_DVB_USB_CINERGY_T2 m
270 271 set_kernel_config CONFIG_DVB_USB_DTV5100 m
271 272 set_kernel_config CONFIG_DVB_USB_AZ6027 m
272 273 set_kernel_config CONFIG_DVB_USB_TECHNISAT_USB2 m
273 274 set_kernel_config CONFIG_DVB_USB_AF9015 m
274 275 set_kernel_config CONFIG_DVB_USB_LME2510 m
275 276 set_kernel_config CONFIG_DVB_USB_RTL28XXU m
276 277 set_kernel_config CONFIG_VIDEO_EM28XX_RC m
277 278 set_kernel_config CONFIG_SMS_SIANO_RC m
278 279 set_kernel_config CONFIG_VIDEO_IR_I2C m
279 280 set_kernel_config CONFIG_VIDEO_ADV7180 m
280 281 set_kernel_config CONFIG_VIDEO_TC358743 m
281 282 set_kernel_config CONFIG_VIDEO_OV5647 m
282 283 set_kernel_config CONFIG_DVB_M88DS3103 m
283 284 set_kernel_config CONFIG_DVB_AF9013 m
284 285 set_kernel_config CONFIG_DVB_RTL2830 m
285 286 set_kernel_config CONFIG_DVB_RTL2832 m
286 287 set_kernel_config CONFIG_DVB_SI2168 m
287 288 set_kernel_config CONFIG_DVB_GP8PSK_FE m
288 289 set_kernel_config CONFIG_DVB_USB m
289 290 set_kernel_config CONFIG_DVB_LGDT3306A m
290 291 set_kernel_config CONFIG_FB_SIMPLE y
291 292 set_kernel_config CONFIG_SND_BCM2708_SOC_IQAUDIO_CODEC m
292 293 set_kernel_config CONFIG_SND_BCM2708_SOC_I_SABRE_Q2M m
293 294 set_kernel_config CONFIG_SND_AUDIOSENSE_PI m
294 295 set_kernel_config CONFIG_SND_SOC_AD193X m
295 296 set_kernel_config CONFIG_SND_SOC_AD193X_SPI m
296 297 set_kernel_config CONFIG_SND_SOC_AD193X_I2C m
297 298 set_kernel_config CONFIG_SND_SOC_CS4265 m
298 299 set_kernel_config CONFIG_SND_SOC_DA7213 m
299 300 set_kernel_config CONFIG_SND_SOC_ICS43432 m
300 301 set_kernel_config CONFIG_SND_SOC_TLV320AIC32X4 m
301 302 set_kernel_config CONFIG_SND_SOC_TLV320AIC32X4_I2C m
302 303 set_kernel_config CONFIG_SND_SOC_I_SABRE_CODEC m
303 304 set_kernel_config CONFIG_HID_BIGBEN_FF m
304 305 #set_kernel_config CONFIG_USB_XHCI_PLATFORM y
305 306 set_kernel_config CONFIG_USB_TMC m
306 307 set_kernel_config CONFIG_USB_UAS y
307 308 set_kernel_config CONFIG_USBIP_VUDC m
308 309 set_kernel_config CONFIG_USB_CONFIGFS m
309 310 set_kernel_config CONFIG_USB_CONFIGFS_SERIAL y
310 311 set_kernel_config CONFIG_USB_CONFIGFS_ACM y
311 312 set_kernel_config CONFIG_USB_CONFIGFS_OBEX y
312 313 set_kernel_config CONFIG_USB_CONFIGFS_NCM y
313 314 set_kernel_config CONFIG_USB_CONFIGFS_ECM y
314 315 set_kernel_config CONFIG_USB_CONFIGFS_ECM_SUBSET y
315 316 set_kernel_config CONFIG_USB_CONFIGFS_RNDIS y
316 317 set_kernel_config CONFIG_USB_CONFIGFS_EEM y
317 318 set_kernel_config CONFIG_USB_CONFIGFS_MASS_STORAGE y
318 319 set_kernel_config CONFIG_USB_CONFIGFS_F_LB_SS y
319 320 set_kernel_config CONFIG_USB_CONFIGFS_F_FS y
320 321 set_kernel_config CONFIG_USB_CONFIGFS_F_UAC1 y
321 322 set_kernel_config CONFIG_USB_CONFIGFS_F_UAC2 y
322 323 set_kernel_config CONFIG_USB_CONFIGFS_F_MIDI y
323 324 set_kernel_config CONFIG_USB_CONFIGFS_F_HID y
324 325 set_kernel_config CONFIG_USB_CONFIGFS_F_UVC y
325 326 set_kernel_config CONFIG_USB_CONFIGFS_F_PRINTER y
326 327 set_kernel_config CONFIG_LEDS_PCA963X m
327 328 set_kernel_config CONFIG_LEDS_IS31FL32XX m
328 329 set_kernel_config CONFIG_LEDS_TRIGGER_NETDEV m
329 330 set_kernel_config CONFIG_RTC_DRV_RV3028 m
330 331 set_kernel_config CONFIG_AUXDISPLAY y
331 332 set_kernel_config CONFIG_HD44780 m
332 333 set_kernel_config CONFIG_FB_TFT_SH1106 m
333 334 set_kernel_config CONFIG_VIDEO_CODEC_BCM2835 m
334 335 set_kernel_config CONFIG_BCM2835_POWER y
335 336 set_kernel_config CONFIG_INV_MPU6050_IIO m
336 337 set_kernel_config CONFIG_INV_MPU6050_I2C m
337 338 set_kernel_config CONFIG_SECURITYFS y
338 339
339 340 # Safer to build this in
340 341 set_kernel_config CONFIG_BINFMT_MISC y
341 342
342 343 # pulseaudio wants a buffer of at least this size
343 344 set_kernel_config CONFIG_SND_HDA_PREALLOC_SIZE 2048
344 345
345 346 # PR#3063: enable 3D acceleration with 64-bit kernel on RPi4
346 347 # set the appropriate kernel configs unlocked by this PR
347 348 set_kernel_config CONFIG_ARCH_BCM y
348 349 set_kernel_config CONFIG_ARCH_BCM2835 y
349 350 set_kernel_config CONFIG_DRM_V3D m
350 351 set_kernel_config CONFIG_DRM_VC4 m
351 352 set_kernel_config CONFIG_DRM_VC4_HDMI_CEC y
352 353
353 354 # PR#3144: add arm64 pcie bounce buffers; enables 4GiB on RPi4
354 355 # required by PR#3144; should already be applied, but just to be safe
355 356 set_kernel_config CONFIG_PCIE_BRCMSTB y
356 357 set_kernel_config CONFIG_BCM2835_MMC y
357 358
358 359 # Snap needs squashfs. The ubuntu eoan-preinstalled-server image at
359 360 # http://cdimage.ubuntu.com/ubuntu-server/daily-preinstalled/current/ uses snap
360 361 # during cloud-init setup at first boot. Without this the login accounts are not
361 362 # created and the user can not login.
362 363 set_kernel_config CONFIG_SQUASHFS y
363 364
364 365 # Ceph support for Block Device (RBD) and Filesystem (FS)
365 366 # https://docs.ceph.com/docs/master/
366 367 set_kernel_config CONFIG_CEPH_LIB m
367 368 set_kernel_config CONFIG_CEPH_LIB_USE_DNS_RESOLVER y
368 369 set_kernel_config CONFIG_CEPH_FS m
369 370 set_kernel_config CONFIG_CEPH_FSCACHE y
370 371 set_kernel_config CONFIG_CEPH_FS_POSIX_ACL y
371 372 set_kernel_config CONFIG_BLK_DEV_RBD m
372 373 fi
373 374
374 375 # enable basic KVM support; see https://www.raspberrypi.org/forums/viewtopic.php?f=63&t=210546&start=25#p1300453
375 376 if [ "$KERNEL_VIRT" = true ] && { [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ]; } ; then
376 377 set_kernel_config CONFIG_HAVE_KVM y
377 378 set_kernel_config CONFIG_HIGH_RES_TIMERS y
378 379 set_kernel_config CONFIG_HAVE_KVM_IRQCHIP y
379 380 set_kernel_config CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL y
380 381 set_kernel_config CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT y
381 382 set_kernel_config CONFIG_HAVE_KVM_EVENTFD y
382 383 set_kernel_config CONFIG_HAVE_KVM_IRQFD y
383 384 set_kernel_config CONFIG_HAVE_KVM_IRQ_ROUTING y
384 385 set_kernel_config CONFIG_HAVE_KVM_MSI y
385 386 set_kernel_config CONFIG_KVM y
386 387 set_kernel_config CONFIG_KVM_ARM_HOST y
387 388 set_kernel_config CONFIG_KVM_ARM_PMU y
388 389 set_kernel_config CONFIG_KVM_COMPAT y
389 390 set_kernel_config CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT y
390 391 set_kernel_config CONFIG_KVM_MMIO y
391 392 set_kernel_config CONFIG_KVM_VFIO y
392 393 set_kernel_config CONFIG_KVM_MMU_AUDIT y
393 394 set_kernel_config CONFIG_VHOST m
394 395 set_kernel_config CONFIG_VHOST_CROSS_ENDIAN_LEGACY y
395 396 set_kernel_config CONFIG_VHOST_NET m
396 397 set_kernel_config CONFIG_VIRTUALIZATION y
397 set_kernel_config CONFIG_MMU_NOTIFIER y
398
399 set_kernel_config CONFIG_SLAB_FREELIST_RANDOM=y
400 set_kernel_config CONFIG_SLAB_FREELIST_HARDENED=y
401
402 # erratum
403 set_kernel_config ARM64_ERRATUM_834220 y
404 # https://sourceforge.net/p/kvm/mailman/message/18440797/
405 set_kernel_config CONFIG_PREEMPT_NOTIFIERS y
406 fi
398 set_kernel_config CONFIG_SLAB_FREELIST_RANDOM=y
399 set_kernel_config CONFIG_SLAB_FREELIST_HARDENED=y
400 set_kernel_config CONFIG_MMU_NOTIFIER y
401
402 # erratum
403 set_kernel_config ARM64_ERRATUM_834220 y
404
405 # https://sourceforge.net/p/kvm/mailman/message/18440797/
406 set_kernel_config CONFIG_PREEMPT_NOTIFIERS y
407 fi
407 408
408 409 # enable apparmor,integrity audit,
409 410 if [ "$KERNEL_SECURITY" = true ] ; then
410 411
411 412 # security filesystem, security models and audit
412 413 set_kernel_config CONFIG_SECURITYFS y
413 414 set_kernel_config CONFIG_SECURITY y
414 415 set_kernel_config CONFIG_AUDIT y
415 416
416 417 # harden strcpy and memcpy
417 418 set_kernel_config CONFIG_HARDENED_USERCOPY y
418 419 set_kernel_config CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR y
419 420 set_kernel_config CONFIG_FORTIFY_SOURCE y
420 421
421 422 # integrity sub-system
422 423 set_kernel_config CONFIG_INTEGRITY y
423 424 set_kernel_config CONFIG_INTEGRITY_ASYMMETRIC_KEYS y
424 425 set_kernel_config CONFIG_INTEGRITY_AUDIT y
425 426 set_kernel_config CONFIG_INTEGRITY_SIGNATURE y
426 427 set_kernel_config CONFIG_INTEGRITY_TRUSTED_KEYRING y
427 428
428 429 # This option provides support for retaining authentication tokens and access keys in the kernel.
429 430 set_kernel_config CONFIG_KEYS y
430 431 set_kernel_config CONFIG_KEYS_COMPAT y
431 432
432 433 # Apparmor
433 434 set_kernel_config CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE 0
434 435 set_kernel_config CONFIG_SECURITY_APPARMOR_HASH_DEFAULT y
435 436 set_kernel_config CONFIG_DEFAULT_SECURITY_APPARMOR y
436 437 set_kernel_config CONFIG_SECURITY_APPARMOR y
437 438 set_kernel_config CONFIG_SECURITY_APPARMOR_HASH y
438 439 set_kernel_config CONFIG_DEFAULT_SECURITY "apparmor"
439 440
440 441 # restrictions on unprivileged users reading the kernel
441 442 set_kernel_config CONFIG_SECURITY_DMESG_RESTRICT y
442 443
443 444 # network security hooks
444 445 set_kernel_config CONFIG_SECURITY_NETWORK y
445 446 set_kernel_config CONFIG_SECURITY_NETWORK_XFRM y
446 447 set_kernel_config CONFIG_SECURITY_PATH y
447 448 set_kernel_config CONFIG_SECURITY_YAMA n
448 449
449 450 set_kernel_config CONFIG_SECURITY_SELINUX n
450 451 set_kernel_config CONFIG_SECURITY_SMACK n
451 452 set_kernel_config CONFIG_SECURITY_TOMOYO n
452 453 set_kernel_config CONFIG_SECURITY_APPARMOR_DEBUG n
453 454 set_kernel_config CONFIG_SECURITY_LOADPIN n
454 455 set_kernel_config CONFIG_HARDENED_USERCOPY_PAGESPAN n
455 456 set_kernel_config CONFIG_IMA n
456 457 set_kernel_config CONFIG_EVM n
457 458 set_kernel_config CONFIG_FANOTIFY_ACCESS_PERMISSIONS y
458 459 set_kernel_config CONFIG_NFSD_V4_SECURITY_LABEL y
459 460 set_kernel_config CONFIG_PKCS7_MESSAGE_PARSER y
460 461 set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYRING y
461 462 set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE y
462 463 set_kernel_config CONFIG_SECONDARY_TRUSTED_KEYRING y
463 464 set_kernel_config CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY n
464 465 set_kernel_config CONFIG_SYSTEM_TRUSTED_KEYS m
465 466 set_kernel_config CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE 4096
466 467
467 468 set_kernel_config CONFIG_ARM64_CRYPTO y
468 469 set_kernel_config CONFIG_CRYPTO_SHA256_ARM64 m
469 470 set_kernel_config CONFIG_CRYPTO_SHA512_ARM64 m
470 471 set_kernel_config CONFIG_CRYPTO_SHA1_ARM64_CE m
471 472 set_kernel_config CRYPTO_GHASH_ARM64_CE m
472 473 set_kernel_config CRYPTO_SHA2_ARM64_CE m
473 474 set_kernel_config CONFIG_CRYPTO_CRCT10DIF_ARM64_CE m
474 475 set_kernel_config CONFIG_CRYPTO_CRC32_ARM64_CE m
475 476 set_kernel_config CONFIG_CRYPTO_AES_ARM64 m
476 477 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE m
477 478 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_CCM y
478 479 set_kernel_config CONFIG_CRYPTO_AES_ARM64_CE_BLK y
479 480 set_kernel_config CONFIG_CRYPTO_AES_ARM64_NEON_BLK m
480 481 set_kernel_config CONFIG_CRYPTO_CHACHA20_NEON m
481 482 set_kernel_config CONFIG_CRYPTO_AES_ARM64_BS m
482 483 fi
483 484
484 485 # Netfilter kernel support See https://github.com/raspberrypi/linux/issues/2177#issuecomment-354647406
485 486 if [ "$KERNEL_NF" = true ] ; then
486 487 set_kernel_config CONFIG_IP_NF_SECURITY m
487 488 set_kernel_config CONFIG_NETLABEL y
488 489 set_kernel_config CONFIG_IP6_NF_SECURITY m
489 490 set_kernel_config CONFIG_IP_NF_TARGET_SYNPROXY m
490 491 set_kernel_config CONFIG_NETFILTER_XT_TARGET_AUDIT m
491 492 set_kernel_config CONFIG_NETFILTER_XT_MATCH_CGROUP m
492 493 set_kernel_config CONFIG_NETFILTER_XT_MATCH_IPCOMP m
493 494 set_kernel_config CONFIG_NETFILTER_XT_MATCH_SOCKET m
494 495 set_kernel_config CONFIG_NFT_FIB_INET m
495 496 set_kernel_config CONFIG_NFT_FIB_IPV4 m
496 497 set_kernel_config CONFIG_NFT_FIB_IPV6 m
497 498 set_kernel_config CONFIG_NFT_FIB_NETDEV m
498 499 set_kernel_config CONFIG_NFT_OBJREF m
499 500 set_kernel_config CONFIG_NFT_RT m
500 501 set_kernel_config CONFIG_NFT_SET_BITMAP m
501 502 set_kernel_config CONFIG_NF_CONNTRACK_TIMEOUT y
502 503 set_kernel_config CONFIG_NF_LOG_ARP m
503 504 set_kernel_config CONFIG_NF_SOCKET_IPV4 m
504 505 set_kernel_config CONFIG_NF_SOCKET_IPV6 m
505 506 set_kernel_config CONFIG_BRIDGE_EBT_BROUTE m
506 507 set_kernel_config CONFIG_BRIDGE_EBT_T_FILTER m
507 508 set_kernel_config CONFIG_BRIDGE_NF_EBTABLES m
508 509 set_kernel_config CONFIG_IP6_NF_IPTABLES m
509 510 set_kernel_config CONFIG_IP6_NF_MATCH_AH m
510 511 set_kernel_config CONFIG_IP6_NF_MATCH_EUI64 m
511 512 set_kernel_config CONFIG_IP6_NF_NAT m
512 513 set_kernel_config CONFIG_IP6_NF_TARGET_MASQUERADE m
513 514 set_kernel_config CONFIG_IP6_NF_TARGET_NPT m
514 515 set_kernel_config CONFIG_IP_SET_BITMAP_IPMAC m
515 516 set_kernel_config CONFIG_IP_SET_BITMAP_PORT m
516 517 set_kernel_config CONFIG_IP_SET_HASH_IP m
517 518 set_kernel_config CONFIG_IP_SET_HASH_IPMARK m
518 519 set_kernel_config CONFIG_IP_SET_HASH_IPPORT m
519 520 set_kernel_config CONFIG_IP_SET_HASH_IPPORTIP m
520 521 set_kernel_config CONFIG_IP_SET_HASH_IPPORTNET m
521 522 set_kernel_config CONFIG_IP_SET_HASH_MAC m
522 523 set_kernel_config CONFIG_IP_SET_HASH_NET m
523 524 set_kernel_config CONFIG_IP_SET_HASH_NETIFACE m
524 525 set_kernel_config CONFIG_IP_SET_HASH_NETNET m
525 526 set_kernel_config CONFIG_IP_SET_HASH_NETPORT m
526 527 set_kernel_config CONFIG_IP_SET_HASH_NETPORTNET m
527 528 set_kernel_config CONFIG_IP_SET_LIST_SET m
528 529 set_kernel_config CONFIG_NETFILTER_XTABLES m
529 530 set_kernel_config CONFIG_NETFILTER_XTABLES m
530 531 set_kernel_config CONFIG_NFT_BRIDGE_META m
531 532 set_kernel_config CONFIG_NFT_BRIDGE_REJECT m
532 533 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV4 m
533 534 set_kernel_config CONFIG_NFT_CHAIN_NAT_IPV6 m
534 535 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV4 m
535 536 set_kernel_config CONFIG_NFT_CHAIN_ROUTE_IPV6 m
536 537 set_kernel_config CONFIG_NFT_COMPAT m
537 538 set_kernel_config CONFIG_NFT_COUNTER m
538 539 set_kernel_config CONFIG_NFT_CT m
539 540 set_kernel_config CONFIG_NFT_DUP_IPV4 m
540 541 set_kernel_config CONFIG_NFT_DUP_IPV6 m
541 542 set_kernel_config CONFIG_NFT_DUP_NETDEV m
542 543 set_kernel_config CONFIG_NFT_EXTHDR m
543 544 set_kernel_config CONFIG_NFT_FWD_NETDEV m
544 545 set_kernel_config CONFIG_NFT_HASH m
545 546 set_kernel_config CONFIG_NFT_LIMIT m
546 547 set_kernel_config CONFIG_NFT_LOG m
547 548 set_kernel_config CONFIG_NFT_MASQ m
548 549 set_kernel_config CONFIG_NFT_MASQ_IPV4 m
549 550 set_kernel_config CONFIG_NFT_MASQ_IPV6 m
550 551 set_kernel_config CONFIG_NFT_META m
551 552 set_kernel_config CONFIG_NFT_NAT m
552 553 set_kernel_config CONFIG_NFT_NUMGEN m
553 554 set_kernel_config CONFIG_NFT_QUEUE m
554 555 set_kernel_config CONFIG_NFT_QUOTA m
555 556 set_kernel_config CONFIG_NFT_REDIR m
556 557 set_kernel_config CONFIG_NFT_REDIR_IPV4 m
557 558 set_kernel_config CONFIG_NFT_REDIR_IPV6 m
558 559 set_kernel_config CONFIG_NFT_REJECT m
559 560 set_kernel_config CONFIG_NFT_REJECT_INET m
560 561 set_kernel_config CONFIG_NFT_REJECT_IPV4 m
561 562 set_kernel_config CONFIG_NFT_REJECT_IPV6 m
562 563 set_kernel_config CONFIG_NFT_SET_HASH m
563 564 set_kernel_config CONFIG_NFT_SET_RBTREE m
564 565 set_kernel_config CONFIG_NF_CONNTRACK_IPV4 m
565 566 set_kernel_config CONFIG_NF_CONNTRACK_IPV6 m
566 567 set_kernel_config CONFIG_NF_DEFRAG_IPV4 m
567 568 set_kernel_config CONFIG_NF_DEFRAG_IPV6 m
568 569 set_kernel_config CONFIG_NF_DUP_IPV4 m
569 570 set_kernel_config CONFIG_NF_DUP_IPV6 m
570 571 set_kernel_config CONFIG_NF_DUP_NETDEV m
571 572 set_kernel_config CONFIG_NF_LOG_BRIDGE m
572 573 set_kernel_config CONFIG_NF_LOG_IPV4 m
573 574 set_kernel_config CONFIG_NF_LOG_IPV6 m
574 575 set_kernel_config CONFIG_NF_NAT_IPV4 m
575 576 set_kernel_config CONFIG_NF_NAT_IPV6 m
576 577 set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV4 y
577 578 set_kernel_config CONFIG_NF_NAT_MASQUERADE_IPV6 y
578 579 set_kernel_config CONFIG_NF_NAT_PPTP m
579 580 set_kernel_config CONFIG_NF_NAT_PROTO_GRE m
580 581 set_kernel_config CONFIG_NF_NAT_REDIRECT y
581 582 set_kernel_config CONFIG_NF_NAT_SIP m
582 583 set_kernel_config CONFIG_NF_NAT_SNMP_BASIC m
583 584 set_kernel_config CONFIG_NF_NAT_TFTP m
584 585 set_kernel_config CONFIG_NF_REJECT_IPV4 m
585 586 set_kernel_config CONFIG_NF_REJECT_IPV6 m
586 587 set_kernel_config CONFIG_NF_TABLES m
587 588 set_kernel_config CONFIG_NF_TABLES_ARP m
588 589 set_kernel_config CONFIG_NF_TABLES_BRIDGE m
589 590 set_kernel_config CONFIG_NF_TABLES_INET m
590 591 set_kernel_config CONFIG_NF_TABLES_IPV4 y
591 592 set_kernel_config CONFIG_NF_TABLES_IPV6 y
592 593 set_kernel_config CONFIG_NF_TABLES_NETDEV m
593 594 set_kernel_config CONFIG_NF_TABLES_SET m
594 595 set_kernel_config CONFIG_NF_TABLES_INET y
595 596 set_kernel_config CONFIG_NF_TABLES_NETDEV y
596 597 set_kernel_config CONFIG_NFT_CONNLIMIT m
597 598 set_kernel_config CONFIG_NFT_TUNNEL m
598 599 set_kernel_config CONFIG_NFT_SOCKET m
599 600 set_kernel_config CONFIG_NFT_TPROXY m
600 601 set_kernel_config CONFIG_NF_FLOW_TABLE m
601 602 set_kernel_config CONFIG_NFT_FLOW_OFFLOAD m
602 603 set_kernel_config CONFIG_NF_FLOW_TABLE_INET m
603 604 set_kernel_config CONFIG_NF_TABLES_ARP y
604 605 set_kernel_config CONFIG_NF_FLOW_TABLE_IPV4 y
605 606 set_kernel_config CONFIG_NF_FLOW_TABLE_IPV6 y
606 607 set_kernel_config CONFIG_NF_TABLES_BRIDGE y
607 608 set_kernel_config CONFIG_NF_CT_NETLINK_TIMEOUT m
608 609 set_kernel_config CONFIG_NFT_OSF m
609 610
610 611 fi
611 612
612 613 # Enables BPF syscall for systemd-journald see https://github.com/torvalds/linux/blob/master/init/Kconfig#L848 or https://groups.google.com/forum/#!topic/linux.gentoo.user/_2aSc_ztGpA
613 614 if [ "$KERNEL_BPF" = true ] ; then
614 615 set_kernel_config CONFIG_BPF_SYSCALL y
615 616 set_kernel_config CONFIG_BPF_EVENTS y
616 617 set_kernel_config CONFIG_BPF_STREAM_PARSER y
617 618 set_kernel_config CONFIG_CGROUP_BPF y
618 619 set_kernel_config CONFIG_XDP_SOCKETS y
619 620 fi
620 621
621 622 # KERNEL_DEFAULT_GOV was set by user
622 623 if [ "$KERNEL_DEFAULT_GOV" != powersave ] && [ -n "$KERNEL_DEFAULT_GOV" ] ; then
623 624
624 625 case "$KERNEL_DEFAULT_GOV" in
625 626 performance)
626 627 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE y
627 628 ;;
628 629 userspace)
629 630 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE y
630 631 ;;
631 632 ondemand)
632 633 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND y
633 634 ;;
634 635 conservative)
635 636 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE y
636 637 ;;
637 638 shedutil)
638 639 set_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL y
639 640 ;;
640 641 *)
641 642 echo "error: unsupported default cpu governor"
642 643 exit 1
643 644 ;;
644 645 esac
645 646
646 647 # unset previous default governor
647 648 unset_kernel_config CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE
648 649 fi
649 650
650 651 #Revert to previous directory
651 652 cd "${WORKDIR}" || exit
652 653
653 654 # Set kernel configuration parameters to enable qemu emulation
654 655 if [ "$ENABLE_QEMU" = true ] ; then
655 656 echo "CONFIG_FHANDLE=y" >> "${KERNEL_DIR}"/.config
656 657 echo "CONFIG_LBDAF=y" >> "${KERNEL_DIR}"/.config
657 658
658 659 if [ "$KERNEL_CRYPTFS" = true ] ; then
659 660 {
660 661 echo "CONFIG_EMBEDDED=y"
661 662 echo "CONFIG_EXPERT=y"
662 663 echo "CONFIG_DAX=y"
663 664 echo "CONFIG_MD=y"
664 665 echo "CONFIG_BLK_DEV_MD=y"
665 666 echo "CONFIG_MD_AUTODETECT=y"
666 667 echo "CONFIG_BLK_DEV_DM=y"
667 668 echo "CONFIG_BLK_DEV_DM_BUILTIN=y"
668 669 echo "CONFIG_DM_CRYPT=y"
669 670 echo "CONFIG_CRYPTO_BLKCIPHER=y"
670 671 echo "CONFIG_CRYPTO_CBC=y"
671 672 echo "CONFIG_CRYPTO_XTS=y"
672 673 echo "CONFIG_CRYPTO_SHA512=y"
673 674 echo "CONFIG_CRYPTO_MANAGER=y"
674 675 } >> "${KERNEL_DIR}"/.config
675 676 fi
676 677 fi
677 678
678 679 # Copy custom kernel configuration file
679 680 if [ -n "$KERNELSRC_USRCONFIG" ] ; then
680 681 cp "$KERNELSRC_USRCONFIG" "${KERNEL_DIR}"/.config
681 682 fi
682 683
683 684 # Set kernel configuration parameters to their default values
684 685 if [ "$KERNEL_OLDDEFCONFIG" = true ] ; then
685 686 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" olddefconfig
686 687 fi
687 688
688 689 # Start menu-driven kernel configuration (interactive)
689 690 if [ "$KERNEL_MENUCONFIG" = true ] ; then
690 691 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" menuconfig
691 692 fi
692 693 # end if "$KERNELSRC_CONFIG" = true
693 694 fi
694 695
695 696 # Use ccache to cross compile the kernel
696 697 if [ "$KERNEL_CCACHE" = true ] ; then
697 698 cc="ccache ${CROSS_COMPILE}gcc"
698 699 else
699 700 cc="${CROSS_COMPILE}gcc"
700 701 fi
701 702
702 703 # Cross compile kernel and dtbs
703 704 make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" "${KERNEL_BIN_IMAGE}" dtbs
704 705
705 706 # Cross compile kernel modules
706 707 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
707 708 make -C "${KERNEL_DIR}" -j"${KERNEL_THREADS}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" CC="${cc}" modules
708 709 fi
709 710 # end if "$KERNELSRC_PREBUILT" = false
710 711 fi
711 712
712 713 # Check if kernel compilation was successful
713 714 if [ ! -r "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" ] ; then
714 715 echo "error: kernel compilation failed! (kernel image not found)"
715 716 cleanup
716 717 exit 1
717 718 fi
718 719
719 720 # Install kernel modules
720 721 if [ "$ENABLE_REDUCE" = true ] ; then
721 722 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
722 723 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_STRIP=1 INSTALL_MOD_PATH=../../.. modules_install
723 724 fi
724 725 else
725 726 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
726 727 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_MOD_PATH=../../.. modules_install
727 728 fi
728 729
729 730 # Install kernel firmware
730 731 if grep -q "^firmware_install:" "${KERNEL_DIR}/Makefile" ; then
731 732 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_FW_PATH=../../../lib firmware_install
732 733 fi
733 734 fi
734 735
735 736 # Install kernel headers
736 737 if [ "$KERNEL_HEADERS" = true ] && [ "$KERNEL_REDUCE" = false ] ; then
737 738 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" INSTALL_HDR_PATH=../.. headers_install
738 739 fi
739 740
740 741 # Prepare boot (firmware) directory
741 742 mkdir "${BOOT_DIR}"
742 743
743 744 # Get kernel release version
744 745 KERNEL_VERSION=$(cat "${KERNEL_DIR}/include/config/kernel.release")
745 746
746 747 # Copy kernel configuration file to the boot directory
747 748 install_readonly "${KERNEL_DIR}/.config" "${R}/boot/config-${KERNEL_VERSION}"
748 749
749 750 # Prepare device tree directory
750 751 mkdir "${BOOT_DIR}/overlays"
751 752
752 753 # Ensure the proper .dtb is located
753 754 if [ "$KERNEL_ARCH" = "arm" ] ; then
754 755 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/"*.dtb ; do
755 756 if [ -f "${dtb}" ] ; then
756 757 install_readonly "${dtb}" "${BOOT_DIR}/"
757 758 fi
758 759 done
759 760 else
760 761 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/broadcom/"*.dtb ; do
761 762 if [ -f "${dtb}" ] ; then
762 763 install_readonly "${dtb}" "${BOOT_DIR}/"
763 764 fi
764 765 done
765 766 fi
766 767
767 768 # Copy compiled dtb device tree files
768 769 if [ -d "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays" ] ; then
769 770 for dtb in "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/"*.dtbo ; do
770 771 if [ -f "${dtb}" ] ; then
771 772 install_readonly "${dtb}" "${BOOT_DIR}/overlays/"
772 773 fi
773 774 done
774 775
775 776 if [ -f "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" ] ; then
776 777 install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/dts/overlays/README" "${BOOT_DIR}/overlays/README"
777 778 fi
778 779 fi
779 780
780 781 if [ "$ENABLE_UBOOT" = false ] ; then
781 782 # Convert and copy kernel image to the boot directory
782 783 "${KERNEL_DIR}/scripts/mkknlimg" "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
783 784 else
784 785 # Copy kernel image to the boot directory
785 786 install_readonly "${KERNEL_DIR}/arch/${KERNEL_ARCH}/boot/${KERNEL_BIN_IMAGE}" "${BOOT_DIR}/${KERNEL_IMAGE}"
786 787 fi
787 788
788 789 # Remove kernel sources
789 790 if [ "$KERNEL_REMOVESRC" = true ] ; then
790 791 rm -fr "${KERNEL_DIR}"
791 792 else
792 793 # Prepare compiled kernel modules
793 794 if grep -q "CONFIG_MODULES=y" "${KERNEL_DIR}/.config" ; then
794 795 if grep -q "^modules_prepare:" "${KERNEL_DIR}/Makefile" ; then
795 796 make -C "${KERNEL_DIR}" ARCH="${KERNEL_ARCH}" CROSS_COMPILE="${CROSS_COMPILE}" modules_prepare
796 797 fi
797 798
798 799 # Create symlinks for kernel modules
799 800 chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/build"
800 801 chroot_exec ln -sf /usr/src/linux "/lib/modules/${KERNEL_VERSION}/source"
801 802 fi
802 803 fi
803 804
804 805 else # BUILD_KERNEL=false
805 806 if [ "$SET_ARCH" = 64 ] ; then
806 807 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] ; then
807 808 # Use Sakakis modified kernel if ZSWAP is active
808 809 if [ "$KERNEL_ZSWAP" = true ] || [ "$KERNEL_VIRT" = true ] || [ "$KERNEL_NF" = true ] || [ "$KERNEL_BPF" = true ] ; then
809 810 RPI3_64_KERNEL_URL="${RPI3_64_BIS_KERNEL_URL}"
810 811 fi
811 812
812 813 # Create temporary directory for dl
813 814 temp_dir=$(as_nobody mktemp -d)
814 815
815 816 # Fetch kernel dl
816 817 as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI3_64_KERNEL_URL"
817 818 fi
818 819 if [ "$SET_ARCH" = 64 ] && [ "$RPI_MODEL" = 4 ] ; then
819 820 # Create temporary directory for dl
820 821 temp_dir=$(as_nobody mktemp -d)
821 822
822 823 # Fetch kernel dl
823 824 as_nobody wget -O "${temp_dir}"/kernel.tar.xz -c "$RPI4_64_KERNEL_URL"
824 825 fi
825 826
826 827 #extract download
827 828 tar -xJf "${temp_dir}"/kernel.tar.xz -C "${temp_dir}"
828 829
829 830 #move extracted kernel to /boot/firmware
830 831 mkdir "${R}/boot/firmware"
831 832 cp "${temp_dir}"/boot/* "${R}"/boot/firmware/
832 833 cp -r "${temp_dir}"/lib/* "${R}"/lib/
833 834
834 835 # Remove temporary directory for kernel sources
835 836 rm -fr "${temp_dir}"
836 837
837 838 # Set permissions of the kernel sources
838 839 chown -R root:root "${R}/boot/firmware"
839 840 chown -R root:root "${R}/lib/modules"
840 841 fi
841 842
842 843 # Install Kernel from hypriot comptabile with all Raspberry PI (dunno if its compatible with RPI4 - better compile your own kernel)
843 844 if [ "$SET_ARCH" = 32 ] && [ "$RPI_MODEL" != 4 ] ; then
844 845 # Create temporary directory for dl
845 846 temp_dir=$(as_nobody mktemp -d)
846 847
847 848 # Fetch kernel
848 849 as_nobody wget -O "${temp_dir}"/kernel.deb -c "$RPI_32_KERNEL_URL"
849 850
850 851 # Copy downloaded kernel package
851 852 mv "${temp_dir}"/kernel.deb "${R}"/tmp/kernel.deb
852 853
853 854 # Set permissions
854 855 chown -R root:root "${R}"/tmp/kernel.deb
855 856
856 857 # Install kernel
857 858 chroot_exec dpkg -i /tmp/kernel.deb
858 859
859 860 # move /boot to /boot/firmware to fit script env.
860 861 #mkdir "${BOOT_DIR}"
861 862 mkdir "${temp_dir}"/firmware
862 863 mv "${R}"/boot/* "${temp_dir}"/firmware/
863 864 mv "${temp_dir}"/firmware "${R}"/boot/
864 865
865 866 #same for kernel headers
866 867 if [ "$KERNEL_HEADERS" = true ] ; then
867 868 # Fetch kernel header
868 869 as_nobody wget -O "${temp_dir}"/kernel-header.deb -c "$RPI_32_KERNELHEADER_URL"
869 870 mv "${temp_dir}"/kernel-header.deb "${R}"/tmp/kernel-header.deb
870 871 chown -R root:root "${R}"/tmp/kernel-header.deb
871 872 # Install kernel header
872 873 chroot_exec dpkg -i /tmp/kernel-header.deb
873 874 rm -f "${R}"/tmp/kernel-header.deb
874 875 fi
875 876
876 877 # Remove temporary directory and files
877 878 rm -fr "${temp_dir}"
878 879 rm -f "${R}"/tmp/kernel.deb
879 880 fi
880 881
881 882 # Check if kernel installation was successful
882 883 KERNEL="$(ls -1 "${R}"/boot/firmware/kernel* | sort | tail -n 1)"
883 884 if [ -z "$KERNEL" ] ; then
884 885 echo "error: kernel installation failed! (/boot/kernel* not found)"
885 886 cleanup
886 887 exit 1
887 888 fi
888 889 fi
Show file before | Show file after | Hide comments
@@ -1,304 +1,304
1 1 #
2 2 # Setup RPi2/3 config and cmdline
3 3 #
4 4
5 5 # Load utility functions
6 6 . ./functions.sh
7 7
8 8 if [ -n "$RPI_FIRMWARE_DIR" ] && [ -d "$RPI_FIRMWARE_DIR" ] ; then
9 9 # Install boot binaries from local directory
10 10 cp "${RPI_FIRMWARE_DIR}"/boot/bootcode.bin "${BOOT_DIR}"/bootcode.bin
11 11 cp "${RPI_FIRMWARE_DIR}"/boot/fixup.dat "${BOOT_DIR}"/fixup.dat
12 12 cp "${RPI_FIRMWARE_DIR}"/boot/fixup_cd.dat "${BOOT_DIR}"/fixup_cd.dat
13 13 cp "${RPI_FIRMWARE_DIR}"/boot/fixup_x.dat "${BOOT_DIR}"/fixup_x.dat
14 14 cp "${RPI_FIRMWARE_DIR}"/boot/start.elf "${BOOT_DIR}"/start.elf
15 15 cp "${RPI_FIRMWARE_DIR}"/boot/start_cd.elf "${BOOT_DIR}"/start_cd.elf
16 16 cp "${RPI_FIRMWARE_DIR}"/boot/start_x.elf "${BOOT_DIR}"/start_x.elf
17 17 else
18 18 # Create temporary directory for boot binaries
19 19 temp_dir=$(as_nobody mktemp -d)
20 20
21 21 # Install latest boot binaries from raspberry/firmware github
22 22 as_nobody wget -q -O "${temp_dir}/bootcode.bin" "${FIRMWARE_URL}/bootcode.bin"
23 23 as_nobody wget -q -O "${temp_dir}/fixup.dat" "${FIRMWARE_URL}/fixup.dat"
24 24 as_nobody wget -q -O "${temp_dir}/fixup_cd.dat" "${FIRMWARE_URL}/fixup_cd.dat"
25 25 as_nobody wget -q -O "${temp_dir}/fixup_x.dat" "${FIRMWARE_URL}/fixup_x.dat"
26 26 as_nobody wget -q -O "${temp_dir}/start.elf" "${FIRMWARE_URL}/start.elf"
27 27 as_nobody wget -q -O "${temp_dir}/start_cd.elf" "${FIRMWARE_URL}/start_cd.elf"
28 28 as_nobody wget -q -O "${temp_dir}/start_x.elf" "${FIRMWARE_URL}/start_x.elf"
29 29
30 30 # Move downloaded boot binaries
31 31 mv "${temp_dir}/"* "${BOOT_DIR}/"
32 32
33 33 # Remove temporary directory for boot binaries
34 34 rm -fr "${temp_dir}"
35 35
36 36 # Set permissions of the boot binaries
37 37 chown -R root:root "${BOOT_DIR}"
38 38 chmod -R 600 "${BOOT_DIR}"
39 39 fi
40 40
41 41 # Setup firmware boot cmdline
42 42 if [ "$ENABLE_USBBOOT" = true ] ; then
43 43 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/sda2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline console=tty1 rootwait init=/bin/systemd"
44 44 else
45 45 if [ "$ENABLE_SPLITFS" = true ] ; then
46 46 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/sda1 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline console=tty1 rootwait init=/bin/systemd"
47 47 else
48 48 CMDLINE="dwc_otg.lpm_enable=0 root=/dev/mmcblk0p2 rootfstype=ext4 rootflags=commit=100,data=writeback elevator=deadline console=tty1 rootwait init=/bin/systemd"
49 49 fi
50 50 fi
51 51
52 52 # Add encrypted root partition to cmdline.txt
53 53 if [ "$ENABLE_CRYPTFS" = true ] ; then
54 54 if [ "$ENABLE_SPLITFS" = true ] ; then
55 55 CMDLINE=$(echo "${CMDLINE}" | sed "s/sda1/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/sda1:${CRYPTFS_MAPPING}/")
56 56 else
57 57 if [ "$ENABLE_USBBOOT" = true ] ; then
58 58 CMDLINE=$(echo "${CMDLINE}" | sed "s/sda2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/sda2:${CRYPTFS_MAPPING}/")
59 59 else
60 60 CMDLINE=$(echo "${CMDLINE}" | sed "s/mmcblk0p2/mapper\/${CRYPTFS_MAPPING} cryptdevice=\/dev\/mmcblk0p2:${CRYPTFS_MAPPING}/")
61 61 fi
62 62 fi
63 63 fi
64 64
65 65 # Enable Kernel messages on standard output
66 66 if [ "$ENABLE_PRINTK" = true ] ; then
67 67 install_readonly files/sysctl.d/83-rpi-printk.conf "${ETC_DIR}/sysctl.d/83-rpi-printk.conf"
68 68 fi
69 69
70 70 # Enable Kernel messages on standard output
71 71 if [ "$KERNEL_SECURITY" = true ] ; then
72 72 install_readonly files/sysctl.d/84-rpi-ASLR.conf "${ETC_DIR}/sysctl.d/84-rpi-ASLR.conf"
73 73 fi
74 74
75 75 # Install udev rule for serial alias - serial0 = console serial1=bluetooth
76 76 install_readonly files/etc/99-com.rules "${LIB_DIR}/udev/rules.d/99-com.rules"
77 77
78 78 # Remove IPv6 networking support
79 79 if [ "$ENABLE_IPV6" = false ] ; then
80 80 CMDLINE="${CMDLINE} ipv6.disable=1"
81 81 fi
82 82
83 83 # Automatically assign predictable network interface names
84 84 if [ "$ENABLE_IFNAMES" = false ] ; then
85 85 CMDLINE="${CMDLINE} net.ifnames=0"
86 86 else
87 87 CMDLINE="${CMDLINE} net.ifnames=1"
88 88 fi
89 89
90 90 # Disable Raspberry Pi console logo
91 91 if [ "$ENABLE_LOGO" = false ] ; then
92 92 CMDLINE="${CMDLINE} logo.nologo"
93 93 fi
94 94
95 95 # Strictly limit verbosity of boot up console messages
96 96 if [ "$ENABLE_SILENT_BOOT" = true ] ; then
97 97 CMDLINE="${CMDLINE} quiet loglevel=0 rd.systemd.show_status=auto rd.udev.log_priority=0"
98 98 fi
99 99
100 100 # Install firmware config
101 101 install_readonly files/boot/config.txt "${BOOT_DIR}/config.txt"
102 102
103 103 # Disable Raspberry Pi console logo
104 104 if [ "$ENABLE_SLASH" = false ] ; then
105 105 echo "disable_splash=1" >> "${BOOT_DIR}/config.txt"
106 106 fi
107 107
108 108 # Locks CPU frequency at maximum
109 109 if [ "$ENABLE_TURBO" = true ] ; then
110 110 echo "force_turbo=1" >> "${BOOT_DIR}/config.txt"
111 111 # helps to avoid sdcard corruption when force_turbo is enabled.
112 112 echo "boot_delay=1" >> "${BOOT_DIR}/config.txt"
113 113 fi
114 114
115 115 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ]; then
116 116
117 117 # Bluetooth enabled
118 118 if [ "$ENABLE_BLUETOOTH" = true ] ; then
119 119 # Create temporary directory for Bluetooth sources
120 120 temp_dir=$(as_nobody mktemp -d)
121 121
122 122 # Fetch Bluetooth sources
123 123 as_nobody git -C "${temp_dir}" clone "${BLUETOOTH_URL}"
124 124
125 125 # Copy downloaded sources
126 126 mv "${temp_dir}/pi-bluetooth" "${R}/tmp/"
127 127
128 128 # Set permissions
129 129 chown -R root:root "${R}/tmp/pi-bluetooth"
130 130
131 131 # Bluetooth firmware from arch aur https://aur.archlinux.org/packages/pi-bluetooth/
132 132 wget -q -O "${R}/tmp/pi-bluetooth/LICENCE.broadcom_bcm43xx" https://aur.archlinux.org/cgit/aur.git/plain/LICENCE.broadcom_bcm43xx?h=pi-bluetooth
133 133 wget -q -O "${R}/tmp/pi-bluetooth/BCM43430A1.hcd" https://raw.githubusercontent.com/RPi-Distro/bluez-firmware/master/broadcom/BCM43430A1.hcd
134 134
135 135 # Install tools
136 136 install_readonly "${R}/tmp/pi-bluetooth/usr/bin/btuart" "${R}/usr/bin/btuart"
137 137 install_readonly "${R}/tmp/pi-bluetooth/usr/bin/bthelper" "${R}/usr/bin/bthelper"
138 138
139 139 # make scripts executable
140 140 chmod +x "${R}/usr/bin/bthelper"
141 141 chmod +x "${R}/usr/bin/btuart"
142 142
143 143 # Install bluetooth udev rule
144 144 install_readonly "${R}/tmp/pi-bluetooth/lib/udev/rules.d/90-pi-bluetooth.rules" "${LIB_DIR}/udev/rules.d/90-pi-bluetooth.rules"
145 145
146 146 # Install Firmware Flash file and apropiate licence
147 147 mkdir -p "$BLUETOOTH_FIRMWARE_DIR"
148 148 install_readonly "${R}/tmp/pi-bluetooth/LICENCE.broadcom_bcm43xx" "${BLUETOOTH_FIRMWARE_DIR}/LICENCE.broadcom_bcm43xx"
149 149 install_readonly "${R}/tmp/pi-bluetooth/BCM43430A1.hcd" "${BLUETOOTH_FIRMWARE_DIR}/BCM43430A1.hcd"
150 150 install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.bthelper@.service" "${ETC_DIR}/systemd/system/pi-bluetooth.bthelper@.service"
151 151 install_readonly "${R}/tmp/pi-bluetooth/debian/pi-bluetooth.hciuart.service" "${ETC_DIR}/systemd/system/pi-bluetooth.hciuart.service"
152 152
153 153 # Remove temporary directories
154 154 rm -fr "${temp_dir}"
155 155 rm -fr "${R}"/tmp/pi-bluetooth
156 156
157 157 # Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore UART0/ttyAMA0 over GPIOs 14 & 15. Slow Bluetooth and slow cpu. Use /dev/ttyS0 instead of /dev/ttyAMA0
158 158 if [ "$ENABLE_MINIUART_OVERLAY" = true ] ; then
159 159 # set overlay to swap ttyAMA0 and ttyS0
160 160 echo "dtoverlay=pi3-miniuart-bt" >> "${BOOT_DIR}/config.txt"
161 161
162 162 if [ "$ENABLE_TURBO" = false ] ; then
163 163 echo "core_freq=250" >> "${BOOT_DIR}/config.txt"
164 164 fi
165 165
166 166 fi
167 167
168 168 # Activate services
169 169 chroot_exec systemctl enable pi-bluetooth.hciuart.service
170 170
171 171 else # if ENABLE_BLUETOOTH = false
172 172 # set overlay to disable bluetooth
173 173 echo "dtoverlay=pi3-disable-bt" >> "${BOOT_DIR}/config.txt"
174 174 fi # ENABLE_BLUETOOTH end
175 175 fi
176 176
177 177 # may need sudo systemctl disable hciuart
178 178 if [ "$ENABLE_CONSOLE" = true ] ; then
179 179 echo "enable_uart=1" >> "${BOOT_DIR}/config.txt"
180 180 # add string to cmdline
181 181 CMDLINE="${CMDLINE} console=serial0,115200"
182 182
183 183 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ]|| [ "$RPI_MODEL" = 0 ]; then
184 184 # if force_turbo didn't lock cpu at high speed, lock it at low speed (XOR logic) or miniuart will be broken
185 185 if [ "$ENABLE_TURBO" = false ] ; then
186 186 echo "core_freq=250" >> "${BOOT_DIR}/config.txt"
187 187 fi
188 188 fi
189 189
190 190 # Enable serial console systemd style
191 191 chroot_exec systemctl enable serial-getty@serial0.service
192 192 else
193 193 echo "enable_uart=0" >> "${BOOT_DIR}/config.txt"
194 194 fi
195 195
196 196 # Disable dphys-swapfile service. Will get enabled on first boot
197 197 if [ "$ENABLE_DPHYSSWAP" = true ] ; then
198 198 chroot_exec systemctl disable dphys-swapfile
199 199 fi
200 200
201 201 if [ "$ENABLE_SYSTEMDSWAP" = true ] ; then
202 202 # Create temporary directory for systemd-swap sources
203 203 temp_dir=$(as_nobody mktemp -d)
204 204
205 205 # Fetch systemd-swap sources
206 206 as_nobody git -C "${temp_dir}" clone "${SYSTEMDSWAP_URL}"
207 207
208 208 # Copy downloaded systemd-swap sources
209 209 mv "${temp_dir}/systemd-swap" "${R}/tmp/"
210 210
211 211 # Change into downloaded src dir
212 212 cd "${R}/tmp/systemd-swap" || exit
213 213
214 214 # Get Verion
215 215 VERSION=$(git tag | tail -n 1)
216 sed -i "s/DEB_NAME=.*/DEB_NAME=systemd-swap_all/g" "${R}/tmp/systemd-swap/package.sh"
216 #sed -i "s/DEB_NAME=.*/DEB_NAME=systemd-swap_all/g" "${R}/tmp/systemd-swap/package.sh"
217 217
218 218 # Build package
219 219 bash ./package.sh debian
220 220
221 221 # Change back into script root dir
222 222 cd "${WORKDIR}" || exit
223 223
224 224 # Set permissions of the systemd-swap sources
225 225 chown -R root:root "${R}/tmp/systemd-swap"
226 226
227 227 # Install package - IMPROVE AND MAKE IT POSSIBLE WITHOUT VERSION NR.
228 chroot_exec dpkg -i /tmp/systemd-swap/systemd-swap_all.deb
228 chroot_exec dpkg -i /tmp/systemd-swap/systemd-swap_"$VERSION"_all.deb
229 229
230 230 # Enable service
231 231 chroot_exec systemctl enable systemd-swap
232 232
233 233 # Remove temporary directory for systemd-swap sources
234 234 rm -fr "${temp_dir}"
235 235 else
236 236 # Enable ZSWAP in cmdline if systemd-swap is not used
237 237 if [ "$KERNEL_ZSWAP" = true ] ; then
238 238 CMDLINE="${CMDLINE} zswap.enabled=1 zswap.max_pool_percent=25 zswap.compressor=lz4"
239 239 fi
240 240 fi
241 241 if [ "$KERNEL_SECURITY" = true ] ; then
242 242 CMDLINE="${CMDLINE} apparmor=1 security=apparmor"
243 243 fi
244 244
245 245 # Install firmware boot cmdline
246 246 echo "${CMDLINE}" > "${BOOT_DIR}/cmdline.txt"
247 247
248 248 # Setup minimal GPU memory allocation size: 16MB (no X)
249 249 if [ "$ENABLE_MINGPU" = true ] ; then
250 250 echo "gpu_mem=16" >> "${BOOT_DIR}/config.txt"
251 251 fi
252 252
253 253 # Setup boot with initramfs
254 254 if [ "$ENABLE_INITRAMFS" = true ] ; then
255 255 echo "initramfs initramfs-${KERNEL_VERSION} followkernel" >> "${BOOT_DIR}/config.txt"
256 256 fi
257 257
258 258 # Create firmware configuration and cmdline symlinks
259 259 ln -sf firmware/config.txt "${R}/boot/config.txt"
260 260 ln -sf firmware/cmdline.txt "${R}/boot/cmdline.txt"
261 261
262 262 # Install and setup kernel modules to load at boot
263 263 mkdir -p "${LIB_DIR}/modules-load.d/"
264 264 install_readonly files/modules/rpi2.conf "${LIB_DIR}/modules-load.d/rpi2.conf"
265 265
266 266 # Load hardware random module at boot
267 267 if [ "$ENABLE_HWRANDOM" = true ] && [ "$BUILD_KERNEL" = false ] ; then
268 268 sed -i "s/^# bcm2708_rng/bcm2708_rng/" "${LIB_DIR}/modules-load.d/rpi2.conf"
269 269 fi
270 270
271 271 # Load sound module at boot
272 272 if [ "$ENABLE_SOUND" = true ] ; then
273 273 sed -i "s/^# snd_bcm2835/snd_bcm2835/" "${LIB_DIR}/modules-load.d/rpi2.conf"
274 274 else
275 275 echo "dtparam=audio=off" >> "${BOOT_DIR}/config.txt"
276 276 fi
277 277
278 278 # Enable I2C interface
279 279 if [ "$ENABLE_I2C" = true ] ; then
280 280 echo "dtparam=i2c_arm=on" >> "${BOOT_DIR}/config.txt"
281 281 sed -i "s/^# i2c-bcm2708/i2c-bcm2708/" "${LIB_DIR}/modules-load.d/rpi2.conf"
282 282 sed -i "s/^# i2c-dev/i2c-dev/" "${LIB_DIR}/modules-load.d/rpi2.conf"
283 283 fi
284 284
285 285 # Enable SPI interface
286 286 if [ "$ENABLE_SPI" = true ] ; then
287 287 echo "dtparam=spi=on" >> "${BOOT_DIR}/config.txt"
288 288 echo "spi-bcm2708" >> "${LIB_DIR}/modules-load.d/rpi2.conf"
289 289 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ]; then
290 290 sed -i "s/spi-bcm2708/spi-bcm2835/" "${LIB_DIR}/modules-load.d/rpi2.conf"
291 291 fi
292 292 fi
293 293
294 294 # Disable RPi2/3 under-voltage warnings
295 295 if [ -n "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
296 296 echo "avoid_warnings=${DISABLE_UNDERVOLT_WARNINGS}" >> "${BOOT_DIR}/config.txt"
297 297 fi
298 298
299 299 # Install kernel modules blacklist
300 300 mkdir -p "${ETC_DIR}/modprobe.d/"
301 301 install_readonly files/modules/raspi-blacklist.conf "${ETC_DIR}/modprobe.d/raspi-blacklist.conf"
302 302
303 303 # Install sysctl.d configuration files
304 304 install_readonly files/sysctl.d/81-rpi-vm.conf "${ETC_DIR}/sysctl.d/81-rpi-vm.conf"
Show file before | Show file after | Hide comments
@@ -1,895 +1,896
1 1 #!/bin/sh
2 2 ########################################################################
3 3 # rpi23-gen-image.sh 2015-2017
4 4 #
5 5 # Advanced Debian "stretch" and "buster" bootstrap script for Raspberry Pi
6 6 #
7 7 # This program is free software; you can redistribute it and/or
8 8 # modify it under the terms of the GNU General Public License
9 9 # as published by the Free Software Foundation; either version 2
10 10 # of the License, or (at your option) any later version.
11 11 #
12 12 # Copyright (C) 2015 Jan Wagner <mail@jwagner.eu>
13 13 #
14 14 # Big thanks for patches and enhancements by 20+ github contributors!
15 15 ########################################################################
16 16
17 17 # Are we running as root?
18 18 if [ "$(id -u)" -ne "0" ] ; then
19 19 echo "error: this script must be executed with root privileges!"
20 20 exit 1
21 21 fi
22 22
23 23 # Check if ./functions.sh script exists
24 24 if [ ! -r "./functions.sh" ] ; then
25 25 echo "error: './functions.sh' required script not found!"
26 26 exit 1
27 27 fi
28 28
29 29 # Load utility functions
30 30 . ./functions.sh
31 31
32 32 # Load parameters from configuration template file
33 33 if [ -n "$CONFIG_TEMPLATE" ] ; then
34 34 use_template
35 35 fi
36 36
37 37 # Introduce settings
38 38 set -e
39 39 echo -n -e "\n#\n# RPi 0/1/2/3 Bootstrap Settings\n#\n"
40 40 set -x
41 41
42 42 # Raspberry Pi model configuration
43 43 RPI_MODEL=${RPI_MODEL:=2}
44 44
45 45 # Debian release
46 46 RELEASE=${RELEASE:=buster}
47 47 if [ $RELEASE = "bullseye" ] ; then
48 48 RELEASE=testing
49 49 fi
50 50
51 51 # Kernel Branch
52 52 KERNEL_BRANCH=${KERNEL_BRANCH:=""}
53 53
54 54 # URLs
55 55 KERNEL_URL=${KERNEL_URL:=https://github.com/raspberrypi/linux}
56 56 FIRMWARE_URL=${FIRMWARE_URL:=https://github.com/raspberrypi/firmware/raw/master/boot}
57 57 WLAN_FIRMWARE_URL=${WLAN_FIRMWARE_URL:=https://github.com/RPi-Distro/firmware-nonfree/raw/master/brcm}
58 58 FBTURBO_URL=${FBTURBO_URL:=https://github.com/ssvb/xf86-video-fbturbo.git}
59 59 UBOOT_URL=${UBOOT_URL:=https://git.denx.de/u-boot.git}
60 60 VIDEOCORE_URL=${VIDEOCORE_URL:=https://github.com/raspberrypi/userland}
61 61 BLUETOOTH_URL=${BLUETOOTH_URL:=https://github.com/RPi-Distro/pi-bluetooth.git}
62 62 NEXMON_URL=${NEXMON_URL:=https://github.com/seemoo-lab/nexmon.git}
63 63 SYSTEMDSWAP_URL=${SYSTEMDSWAP_URL:=https://github.com/Nefelim4ag/systemd-swap.git}
64 64
65 65 # Kernel deb packages for 32bit kernel
66 66 RPI_32_KERNEL_URL=${RPI_32_KERNEL_URL:=https://github.com/hypriot/rpi-kernel/releases/download/v4.14.34/raspberrypi-kernel_20180422-141901_armhf.deb}
67 67 RPI_32_KERNELHEADER_URL=${RPI_32_KERNELHEADER_URL:=https://github.com/hypriot/rpi-kernel/releases/download/v4.14.34/raspberrypi-kernel-headers_20180422-141901_armhf.deb}
68 68 # Kernel has KVM and zswap enabled - use if KERNEL_* parameters and precompiled kernel are used
69 RPI3_64_BIS_KERNEL_URL=${RPI3_64_BIS_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel-bis/releases/download/4.14.80.20181113/bcmrpi3-kernel-bis-4.14.80.20181113.tar.xz}
69 RPI3_64_BIS_KERNEL_URL=${RPI3_64_BIS_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel-bis/releases/download/4.19.80.20191022/bcmrpi3-kernel-bis-4.19.80.20191022.tar.xz}
70 70 # Default precompiled 64bit kernel
71 RPI3_64_DEF_KERNEL_URL=${RPI3_64_DEF_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel/releases/download/4.14.80.20181113/bcmrpi3-kernel-4.14.80.20181113.tar.xz}
72 # Sakaki BIS Kernel RPI4
73 RPI4_64_DEF_KERNEL_URL=https://github.com/sakaki-/bcm2711-kernel-bis/releases/download/4.19.59.20190724/bcm2711-kernel-bis-4.19.59.20190724.tar.xz
71 RPI3_64_DEF_KERNEL_URL=${RPI3_64_DEF_KERNEL_URL:=https://github.com/sakaki-/bcmrpi3-kernel/releases/download/4.19.80.20191022/bcmrpi3-kernel-4.19.80.20191022.tar.xz}
72 # Sakaki BIS Kernel RPI4 - https://github.com/sakaki-/bcm2711-kernel-bis
73 RPI4_64_BIS_KERNEL_URL=${RPI4_64_BIS_KERNEL_URL:=https://github.com/sakaki-/bcm2711-kernel-bis/releases/download/4.19.59.20190724/bcm2711-kernel-bis-4.19.59.20190724.tar.xz}
74 # Default precompiled 64bit kernel - https://github.com/sakaki-/bcm2711-kernel
75 RPI4_64_DEF_KERNEL_URL=${RPI4_64_DEF_KERNEL_URL:=https://github.com/sakaki-/bcm2711-kernel-bis/releases/download/4.19.59.20190724/bcm2711-kernel-bis-4.19.59.20190724.tar.xz}
74 76 # Generic
75 77 RPI3_64_KERNEL_URL=${RPI3_64_KERNEL_URL:=$RPI3_64_DEF_KERNEL_URL}
76 RPI4_64_KERNEL_URL=${RPI3_64_KERNEL_URL:=$RPI4_64_DEF_KERNEL_URL}
78 RPI4_64_KERNEL_URL=${RPI4_64_KERNEL_URL:=$RPI4_64_DEF_KERNEL_URL}
77 79 # Kali kernel src - used if ENABLE_NEXMON=true (they patch the wlan kernel modul)
78 80 KALI_KERNEL_URL=${KALI_KERNEL_URL:=https://github.com/Re4son/re4son-raspberrypi-linux.git}
79 81
80 82 # Build directories
81 83 WORKDIR=$(pwd)
82 84 BASEDIR=${BASEDIR:=${WORKDIR}/images/${RELEASE}}
83 85 BUILDDIR="${BASEDIR}/build"
84 86
85 87 # Chroot directories
86 88 R="${BUILDDIR}/chroot"
87 89 ETC_DIR="${R}/etc"
88 90 LIB_DIR="${R}/lib"
89 91 BOOT_DIR="${R}/boot/firmware"
90 92 KERNEL_DIR="${R}/usr/src/linux"
91 93 WLAN_FIRMWARE_DIR="${LIB_DIR}/firmware/brcm"
92 94 BLUETOOTH_FIRMWARE_DIR="${ETC_DIR}/firmware/bt"
93 95
94 96 # Firmware directory: Blank if download from github
95 97 RPI_FIRMWARE_DIR=${RPI_FIRMWARE_DIR:=""}
96 98
97 99 # General settings
98 100 SET_ARCH=${SET_ARCH:=32}
99 101 HOSTNAME=${HOSTNAME:=rpi${RPI_MODEL}-${RELEASE}}
100 102 PASSWORD=${PASSWORD:=raspberry}
101 103 USER_PASSWORD=${USER_PASSWORD:=raspberry}
102 104 DEFLOCAL=${DEFLOCAL:="en_US.UTF-8"}
103 105 TIMEZONE=${TIMEZONE:="Europe/Berlin"}
104 106 EXPANDROOT=${EXPANDROOT:=true}
105 107 ENABLE_DPHYSSWAP=${ENABLE_DPHYSSWAP:=true}
106 108
107 109 # Keyboard settings
108 110 XKB_MODEL=${XKB_MODEL:=""}
109 111 XKB_LAYOUT=${XKB_LAYOUT:=""}
110 112 XKB_VARIANT=${XKB_VARIANT:=""}
111 113 XKB_OPTIONS=${XKB_OPTIONS:=""}
112 114
113 115 # Network settings (DHCP)
114 116 ENABLE_DHCP=${ENABLE_DHCP:=true}
115 117
116 118 # Network settings (static)
117 119 NET_ADDRESS=${NET_ADDRESS:=""}
118 120 NET_GATEWAY=${NET_GATEWAY:=""}
119 121 NET_DNS_1=${NET_DNS_1:=""}
120 122 NET_DNS_2=${NET_DNS_2:=""}
121 123 NET_DNS_DOMAINS=${NET_DNS_DOMAINS:=""}
122 124 NET_NTP_1=${NET_NTP_1:=""}
123 125 NET_NTP_2=${NET_NTP_2:=""}
124 126
125 127 # APT settings
126 128 APT_PROXY=${APT_PROXY:=""}
127 129 APT_SERVER=${APT_SERVER:="ftp.debian.org"}
128 130 KEEP_APT_PROXY=${KEEP_APT_PROXY:=false}
129 131
130 132 # Feature settings
131 133 ENABLE_PRINTK=${ENABLE_PRINTK:=false}
132 134 ENABLE_BLUETOOTH=${ENABLE_BLUETOOTH:=false}
133 135 ENABLE_MINIUART_OVERLAY=${ENABLE_MINIUART_OVERLAY:=false}
134 136 ENABLE_CONSOLE=${ENABLE_CONSOLE:=true}
135 137 ENABLE_I2C=${ENABLE_I2C:=false}
136 138 ENABLE_SPI=${ENABLE_SPI:=false}
137 139 ENABLE_IPV6=${ENABLE_IPV6:=true}
138 140 ENABLE_SSHD=${ENABLE_SSHD:=true}
139 141 ENABLE_NONFREE=${ENABLE_NONFREE:=false}
140 142 ENABLE_WIRELESS=${ENABLE_WIRELESS:=false}
141 143 ENABLE_SOUND=${ENABLE_SOUND:=true}
142 144 ENABLE_DBUS=${ENABLE_DBUS:=true}
143 145 ENABLE_HWRANDOM=${ENABLE_HWRANDOM:=true}
144 146 ENABLE_MINGPU=${ENABLE_MINGPU:=false}
145 147 ENABLE_XORG=${ENABLE_XORG:=false}
146 148 ENABLE_WM=${ENABLE_WM:=""}
147 149 ENABLE_RSYSLOG=${ENABLE_RSYSLOG:=true}
148 150 ENABLE_USER=${ENABLE_USER:=true}
149 151 USER_NAME=${USER_NAME:="pi"}
150 152 ENABLE_ROOT=${ENABLE_ROOT:=false}
151 153 ENABLE_QEMU=${ENABLE_QEMU:=false}
152 154 ENABLE_SYSVINIT=${ENABLE_SYSVINIT:=false}
153 155
154 156 # SSH settings
155 157 SSH_ENABLE_ROOT=${SSH_ENABLE_ROOT:=false}
156 158 SSH_DISABLE_PASSWORD_AUTH=${SSH_DISABLE_PASSWORD_AUTH:=false}
157 159 SSH_LIMIT_USERS=${SSH_LIMIT_USERS:=false}
158 160 SSH_ROOT_PUB_KEY=${SSH_ROOT_PUB_KEY:=""}
159 161 SSH_USER_PUB_KEY=${SSH_USER_PUB_KEY:=""}
160 162
161 163 # Advanced settings
162 164 ENABLE_SYSTEMDSWAP=${ENABLE_SYSTEMDSWAP:=false}
163 165 ENABLE_MINBASE=${ENABLE_MINBASE:=false}
164 166 ENABLE_REDUCE=${ENABLE_REDUCE:=false}
165 167 ENABLE_UBOOT=${ENABLE_UBOOT:=false}
166 168 UBOOTSRC_DIR=${UBOOTSRC_DIR:=""}
167 169 ENABLE_USBBOOT=${ENABLE_USBBOOT=false}
168 170 ENABLE_FBTURBO=${ENABLE_FBTURBO:=false}
169 171 ENABLE_VIDEOCORE=${ENABLE_VIDEOCORE:=false}
170 172 ENABLE_NEXMON=${ENABLE_NEXMON:=false}
171 173 VIDEOCORESRC_DIR=${VIDEOCORESRC_DIR:=""}
172 174 FBTURBOSRC_DIR=${FBTURBOSRC_DIR:=""}
173 175 NEXMONSRC_DIR=${NEXMONSRC_DIR:=""}
174 176 ENABLE_HARDNET=${ENABLE_HARDNET:=false}
175 177 ENABLE_IPTABLES=${ENABLE_IPTABLES:=false}
176 178 ENABLE_SPLITFS=${ENABLE_SPLITFS:=false}
177 179 ENABLE_INITRAMFS=${ENABLE_INITRAMFS:=false}
178 180 ENABLE_IFNAMES=${ENABLE_IFNAMES:=true}
179 181 ENABLE_SPLASH=${ENABLE_SPLASH:=true}
180 182 ENABLE_LOGO=${ENABLE_LOGO:=true}
181 183 ENABLE_SILENT_BOOT=${ENABLE_SILENT_BOOT=false}
182 184 DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS:=}
183 185
184 186 # Kernel compilation settings
185 187 BUILD_KERNEL=${BUILD_KERNEL:=true}
186 188 KERNEL_REDUCE=${KERNEL_REDUCE:=false}
187 189 KERNEL_THREADS=${KERNEL_THREADS:=1}
188 190 KERNEL_HEADERS=${KERNEL_HEADERS:=true}
189 191 KERNEL_MENUCONFIG=${KERNEL_MENUCONFIG:=false}
190 192 KERNEL_REMOVESRC=${KERNEL_REMOVESRC:=true}
191 193 KERNEL_OLDDEFCONFIG=${KERNEL_OLDDEFCONFIG:=false}
192 194 KERNEL_CCACHE=${KERNEL_CCACHE:=false}
193 195 KERNEL_ZSWAP=${KERNEL_ZSWAP:=false}
194 196 KERNEL_VIRT=${KERNEL_VIRT:=false}
195 197 KERNEL_BPF=${KERNEL_BPF:=false}
196 198 KERNEL_DEFAULT_GOV=${KERNEL_DEFAULT_GOV:=ondemand}
197 199 KERNEL_SECURITY=${KERNEL_SECURITY:=false}
198 200 KERNEL_NF=${KERNEL_NF:=false}
199 201 KERNEL_DHKEY=${KERNEL_DHKEY:=true}
200 202 KERNEL_BTRFS=${KERNEL_BTRFS:=false}
201 203 KERNEL_NSPAN=${KERNEL_NSPAN:=false}
202 204 KERNEL_POEHAT=${KERNEL_POEHAT:=false}
203 205
204 206 # Kernel compilation from source directory settings
205 207 KERNELSRC_DIR=${KERNELSRC_DIR:=""}
206 208 KERNELSRC_CLEAN=${KERNELSRC_CLEAN:=false}
207 209 KERNELSRC_CONFIG=${KERNELSRC_CONFIG:=true}
208 210 KERNELSRC_PREBUILT=${KERNELSRC_PREBUILT:=false}
209 211
210 212 # Reduce disk usage settings
211 213 REDUCE_APT=${REDUCE_APT:=true}
212 214 REDUCE_DOC=${REDUCE_DOC:=true}
213 215 REDUCE_MAN=${REDUCE_MAN:=true}
214 216 REDUCE_VIM=${REDUCE_VIM:=false}
215 217 REDUCE_BASH=${REDUCE_BASH:=false}
216 218 REDUCE_HWDB=${REDUCE_HWDB:=true}
217 219 REDUCE_SSHD=${REDUCE_SSHD:=true}
218 220 REDUCE_LOCALE=${REDUCE_LOCALE:=true}
219 221
220 222 # Encrypted filesystem settings
221 223 ENABLE_CRYPTFS=${ENABLE_CRYPTFS:=false}
222 224 CRYPTFS_PASSWORD=${CRYPTFS_PASSWORD:=""}
223 225 CRYPTFS_MAPPING=${CRYPTFS_MAPPING:="secure"}
224 226 CRYPTFS_CIPHER=${CRYPTFS_CIPHER:="aes-xts-plain64:sha512"}
225 227 CRYPTFS_XTSKEYSIZE=${CRYPTFS_XTSKEYSIZE:=512}
226 228 #Dropbear-initramfs supports unlocking encrypted filesystem via SSH on bootup
227 229 CRYPTFS_DROPBEAR=${CRYPTFS_DROPBEAR:=false}
228 230 #Provide your own Dropbear Public RSA-OpenSSH Key otherwise it will be generated
229 231 CRYPTFS_DROPBEAR_PUBKEY=${CRYPTFS_DROPBEAR_PUBKEY:=""}
230 232
231 233 # Chroot scripts directory
232 234 CHROOT_SCRIPTS=${CHROOT_SCRIPTS:=""}
233 235
234 236 # Packages required in the chroot build environment
235 237 APT_INCLUDES=${APT_INCLUDES:=""}
236 238 APT_INCLUDES="${APT_INCLUDES},flex,bison,libssl-dev,apt-transport-https,apt-utils,ca-certificates,debian-archive-keyring,dialog,sudo,systemd,sysvinit-utils,locales,keyboard-configuration,console-setup,libnss-systemd"
237 239
238 240 # Packages to exclude from chroot build environment
239 241 APT_EXCLUDES=${APT_EXCLUDES:=""}
240 242
241 243 # Packages required for bootstrapping
242 244 REQUIRED_PACKAGES="debootstrap debian-archive-keyring qemu-user-static binfmt-support dosfstools rsync bmap-tools whois git bc psmisc dbus sudo"
243 245 MISSING_PACKAGES=""
244 246
245 247 # Packages installed for c/c++ build environment in chroot (keep empty)
246 248 COMPILER_PACKAGES=""
247 249
248 250 # Check if apt-cacher-ng has port 3142 open and set APT_PROXY
249 251 APT_CACHER_RUNNING=$(lsof -i :3142 | cut -d ' ' -f3 | uniq | sed '/^\s*$/d')
250 252 if [ "${APT_CACHER_RUNNING}" = "apt-cacher-ng" ] ; then
251 253 APT_PROXY=http://127.0.0.1:3142/
252 254 fi
253 255
254 256 # Setup architecture specific settings
255 257 if [ -n "$SET_ARCH" ] ; then
256 258 # 64-bit configuration
257 259 if [ "$SET_ARCH" = 64 ] ; then
258 260 # General 64-bit depended settings
259 261 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-aarch64-static}
260 262 KERNEL_ARCH=${KERNEL_ARCH:=arm64}
261 263 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="Image"}
262 264
263 265 # Raspberry Pi model specific settings
264 266 if [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
265 267 if [ "$RPI_MODEL" != 4 ] ; then
266 268 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi3_defconfig}
267 269 else
268 270 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2711_defconfig}
269 271 fi
270 272
271 273 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-arm64"
272 274 RELEASE_ARCH=${RELEASE_ARCH:=arm64}
273 275 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel8.img}
274 276 CROSS_COMPILE=${CROSS_COMPILE:=aarch64-linux-gnu-}
275 277 else
276 278 echo "error: Only Raspberry PI 3, 3B+ and 4 support 64-bit"
277 279 exit 1
278 280 fi
279 281 fi
280 282
281 283 # 32-bit configuration
282 284 if [ "$SET_ARCH" = 32 ] ; then
283 285 # General 32-bit dependend settings
284 286 QEMU_BINARY=${QEMU_BINARY:=/usr/bin/qemu-arm-static}
285 287 KERNEL_ARCH=${KERNEL_ARCH:=arm}
286 288 KERNEL_BIN_IMAGE=${KERNEL_BIN_IMAGE:="zImage"}
287 289
288 290 # Raspberry Pi model specific settings
289 291 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 1 ] || [ "$RPI_MODEL" = 1P ] ; then
290 292 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armel"
291 293 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcmrpi_defconfig}
292 294 RELEASE_ARCH=${RELEASE_ARCH:=armel}
293 295 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel.img}
294 296 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabi-}
295 297 fi
296 298
297 299 # Raspberry Pi model specific settings
298 300 if [ "$RPI_MODEL" = 2 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
299 301 if [ "$RPI_MODEL" != 4 ] ; then
300 302 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2709_defconfig}
301 303 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7.img}
302 304 else
303 305 KERNEL_DEFCONFIG=${KERNEL_DEFCONFIG:=bcm2711_defconfig}
304 306 KERNEL_IMAGE=${KERNEL_IMAGE:=kernel7l.img}
305 307 fi
306 308
307 309 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} crossbuild-essential-armhf"
308 310 RELEASE_ARCH=${RELEASE_ARCH:=armhf}
309 311
310 312 CROSS_COMPILE=${CROSS_COMPILE:=arm-linux-gnueabihf-}
311 313 fi
312 314 fi
313 315 # SET_ARCH not set
314 316 else
315 317 echo "error: Please set '32' or '64' as value for SET_ARCH"
316 318 exit 1
317 319 fi
318 320 # Device specific configuration and U-Boot configuration
319 321 case "$RPI_MODEL" in
320 322 0)
321 323 DTB_FILE=${DTB_FILE:=bcm2708-rpi-0-w.dtb}
322 324 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
323 325 ;;
324 326 1)
325 327 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b.dtb}
326 328 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
327 329 ;;
328 330 1P)
329 331 DTB_FILE=${DTB_FILE:=bcm2708-rpi-b-plus.dtb}
330 332 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_defconfig}
331 333 ;;
332 334 2)
333 335 DTB_FILE=${DTB_FILE:=bcm2709-rpi-2-b.dtb}
334 336 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_2_defconfig}
335 337 ;;
336 338 3)
337 339 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
338 340 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
339 341 ;;
340 342 3P)
341 343 DTB_FILE=${DTB_FILE:=bcm2710-rpi-3-b.dtb}
342 344 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_3_defconfig}
343 345 ;;
344 346 4)
345 347 DTB_FILE=${DTB_FILE:=bcm2711-rpi-4-b.dtb}
346 348 UBOOT_CONFIG=${UBOOT_CONFIG:=rpi_4_defconfig}
347 349 ;;
348 350 *)
349 351 echo "error: Raspberry Pi model $RPI_MODEL is not supported!"
350 352 exit 1
351 353 ;;
352 354 esac
353 355
354 356 # Raspberry PI 0,3,3P with Bluetooth and Wifi onboard
355 357 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 3 ] || [ "$RPI_MODEL" = 3P ] || [ "$RPI_MODEL" = 4 ] ; then
356 358 # Include bluetooth packages on supported boards
357 359 if [ "$ENABLE_BLUETOOTH" = true ] ; then
358 360 APT_INCLUDES="${APT_INCLUDES},bluetooth,bluez"
359 361 fi
360 362 if [ "$ENABLE_WIRELESS" = true ] ; then
361 363 APT_INCLUDES="${APT_INCLUDES},wireless-tools,crda,wireless-regdb"
362 364 fi
363 365 else # Raspberry PI 1,1P,2 without Wifi and bluetooth onboard
364 366 # Check if the internal wireless interface is not supported by the RPi model
365 367 if [ "$ENABLE_WIRELESS" = true ] || [ "$ENABLE_BLUETOOTH" = true ]; then
366 368 echo "error: The selected Raspberry Pi model has no integrated interface for wireless or bluetooth"
367 369 exit 1
368 370 fi
369 371 fi
370 372
371 373 if [ "$BUILD_KERNEL" = false ] && [ "$ENABLE_NEXMON" = true ]; then
372 374 echo "error: You have to compile kernel sources, if you want to enable nexmon"
373 375 exit 1
374 376 fi
375 377
376 378 # Prepare date string for default image file name
377 379 DATE="$(date +%Y-%m-%d)"
378 380 if [ -z "$KERNEL_BRANCH" ] ; then
379 381 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
380 382 else
381 383 IMAGE_NAME=${IMAGE_NAME:=${BASEDIR}/${DATE}-${KERNEL_ARCH}-${KERNEL_BRANCH}-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
382 384 fi
383 385
384 386 # Check if DISABLE_UNDERVOLT_WARNINGS parameter value is supported
385 387 if [ -n "$DISABLE_UNDERVOLT_WARNINGS" ] ; then
386 388 if [ "$DISABLE_UNDERVOLT_WARNINGS" != 1 ] && [ "$DISABLE_UNDERVOLT_WARNINGS" != 2 ] ; then
387 389 echo "error: DISABLE_UNDERVOLT_WARNINGS=${DISABLE_UNDERVOLT_WARNINGS} is not supported"
388 390 exit 1
389 391 fi
390 392 fi
391 393
392 394 # Add cmake to compile videocore sources
393 395 if [ "$ENABLE_VIDEOCORE" = true ] ; then
394 396 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cmake"
395 397 fi
396 398
397 399 # Add deps for nexmon
398 400 if [ "$ENABLE_NEXMON" = true ] ; then
399 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libgmp3-dev gawk qpdf bison flex make autoconf automake build-essential libtool"
401 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libgmp3-dev gawk qpdf make autoconf automake build-essential libtool"
400 402 fi
401 403
402 404 # Add libncurses5 to enable kernel menuconfig
403 405 if [ "$KERNEL_MENUCONFIG" = true ] ; then
404 406 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} libncurses-dev"
405 407 fi
406 408
407 409 # Add ccache compiler cache for (faster) kernel cross (re)compilation
408 410 if [ "$KERNEL_CCACHE" = true ] ; then
409 411 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} ccache"
410 412 fi
411 413
412 414 # Add cryptsetup package to enable filesystem encryption
413 415 if [ "$ENABLE_CRYPTFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
414 416 REQUIRED_PACKAGES="${REQUIRED_PACKAGES} cryptsetup"
415 417 APT_INCLUDES="${APT_INCLUDES},cryptsetup,busybox,console-setup"
416 418
417 419 # If cryptfs,dropbear and initramfs are enabled include dropbear-initramfs package
418 420 if [ "$CRYPTFS_DROPBEAR" = true ] && [ "$ENABLE_INITRAMFS" = true ]; then
419 421 APT_INCLUDES="${APT_INCLUDES},dropbear-initramfs"
420 422 fi
421 423
422 424 if [ -z "$CRYPTFS_PASSWORD" ] ; then
423 425 echo "error: no password defined (CRYPTFS_PASSWORD)!"
424 426 exit 1
425 427 fi
426 428 ENABLE_INITRAMFS=true
427 429 fi
428 430
429 431 # Add initramfs generation tools
430 432 if [ "$ENABLE_INITRAMFS" = true ] && [ "$BUILD_KERNEL" = true ] ; then
431 433 APT_INCLUDES="${APT_INCLUDES},initramfs-tools"
432 434 fi
433 435
434 436 # Add device-tree-compiler required for building the U-Boot bootloader
435 437 if [ "$ENABLE_UBOOT" = true ] ; then
436 438 APT_INCLUDES="${APT_INCLUDES},device-tree-compiler,bison,flex,bc"
437 439 fi
438 440
439 441 if [ "$ENABLE_USBBOOT" = true ] ; then
440 442 if [ "$RPI_MODEL" = 0 ] || [ "$RPI_MODEL" = 1P ] || [ "$RPI_MODEL" = 1 ] || [ "$RPI_MODEL" = 2 ]; then
441 443 echo "error: Booting from USB alone is only supported by Raspberry Pi 3 and 3P"
442 444 exit 1
443 445 fi
444 446 fi
445 447
446 448 # Check if root SSH (v2) public key file exists
447 449 if [ -n "$SSH_ROOT_PUB_KEY" ] ; then
448 450 if [ ! -f "$SSH_ROOT_PUB_KEY" ] ; then
449 451 echo "error: '$SSH_ROOT_PUB_KEY' specified SSH public key file not found (SSH_ROOT_PUB_KEY)!"
450 452 exit 1
451 453 fi
452 454 fi
453 455
454 456 # Check if $USER_NAME SSH (v2) public key file exists
455 457 if [ -n "$SSH_USER_PUB_KEY" ] ; then
456 458 if [ ! -f "$SSH_USER_PUB_KEY" ] ; then
457 459 echo "error: '$SSH_USER_PUB_KEY' specified SSH public key file not found (SSH_USER_PUB_KEY)!"
458 460 exit 1
459 461 fi
460 462 fi
461 463
462 464 if [ "$ENABLE_NEXMON" = true ] && [ -n "$KERNEL_BRANCH" ] ; then
463 465 echo "error: Please unset KERNEL_BRANCH if using ENABLE_NEXMON"
464 466 exit 1
465 467 fi
466 468
467 469 # Check if all required packages are installed on the build system
468 470 for package in $REQUIRED_PACKAGES ; do
469 471 if [ "$(dpkg-query -W -f='${Status}' "$package")" != "install ok installed" ] ; then
470 472 MISSING_PACKAGES="${MISSING_PACKAGES} $package"
471 473 fi
472 474 done
473 475
474 476 # If there are missing packages ask confirmation for install, or exit
475 477 if [ -n "$MISSING_PACKAGES" ] ; then
476 478 echo "the following packages needed by this script are not installed:"
477 479 echo "$MISSING_PACKAGES"
478 480
479 481 printf "\ndo you want to install the missing packages right now? [y/n] "
480 482 read -r confirm
481 483 [ "$confirm" != "y" ] && exit 1
482 484
483 485 # Make sure all missing required packages are installed
484 apt-get update
485 apt-get -qq -y install `echo "${MISSING_PACKAGES}" | sed "s/ //"`
486 apt-get update && apt-get -qq -y install `echo "${MISSING_PACKAGES}" | sed "s/ //"`
486 487 fi
487 488
488 489 # Check if ./bootstrap.d directory exists
489 490 if [ ! -d "./bootstrap.d/" ] ; then
490 491 echo "error: './bootstrap.d' required directory not found!"
491 492 exit 1
492 493 fi
493 494
494 495 # Check if ./files directory exists
495 496 if [ ! -d "./files/" ] ; then
496 497 echo "error: './files' required directory not found!"
497 498 exit 1
498 499 fi
499 500
500 501 # Check if specified KERNELSRC_DIR directory exists
501 502 if [ -n "$KERNELSRC_DIR" ] && [ ! -d "$KERNELSRC_DIR" ] ; then
502 503 echo "error: '${KERNELSRC_DIR}' specified directory not found (KERNELSRC_DIR)!"
503 504 exit 1
504 505 fi
505 506
506 507 # Check if specified UBOOTSRC_DIR directory exists
507 508 if [ -n "$UBOOTSRC_DIR" ] && [ ! -d "$UBOOTSRC_DIR" ] ; then
508 509 echo "error: '${UBOOTSRC_DIR}' specified directory not found (UBOOTSRC_DIR)!"
509 510 exit 1
510 511 fi
511 512
512 513 # Check if specified VIDEOCORESRC_DIR directory exists
513 514 if [ -n "$VIDEOCORESRC_DIR" ] && [ ! -d "$VIDEOCORESRC_DIR" ] ; then
514 515 echo "error: '${VIDEOCORESRC_DIR}' specified directory not found (VIDEOCORESRC_DIR)!"
515 516 exit 1
516 517 fi
517 518
518 519 # Check if specified FBTURBOSRC_DIR directory exists
519 520 if [ -n "$FBTURBOSRC_DIR" ] && [ ! -d "$FBTURBOSRC_DIR" ] ; then
520 521 echo "error: '${FBTURBOSRC_DIR}' specified directory not found (FBTURBOSRC_DIR)!"
521 522 exit 1
522 523 fi
523 524
524 525 # Check if specified NEXMONSRC_DIR directory exists
525 526 if [ -n "$NEXMONSRC_DIR" ] && [ ! -d "$NEXMONSRC_DIR" ] ; then
526 527 echo "error: '${NEXMONSRC_DIR}' specified directory not found (NEXMONSRC_DIR)!"
527 528 exit 1
528 529 fi
529 530
530 531 # Check if specified CHROOT_SCRIPTS directory exists
531 532 if [ -n "$CHROOT_SCRIPTS" ] && [ ! -d "$CHROOT_SCRIPTS" ] ; then
532 533 echo "error: ${CHROOT_SCRIPTS} specified directory not found (CHROOT_SCRIPTS)!"
533 534 exit 1
534 535 fi
535 536
536 537 # Check if specified device mapping already exists (will be used by cryptsetup)
537 538 if [ -r "/dev/mapping/${CRYPTFS_MAPPING}" ] ; then
538 539 echo "error: mapping /dev/mapping/${CRYPTFS_MAPPING} already exists, not proceeding"
539 540 exit 1
540 541 fi
541 542
542 543 # Don't clobber an old build
543 544 if [ -e "$BUILDDIR" ] ; then
544 545 echo "error: directory ${BUILDDIR} already exists, not proceeding"
545 546 exit 1
546 547 fi
547 548
548 549 # Setup chroot directory
549 550 mkdir -p "${R}"
550 551
551 552 # Check if build directory has enough of free disk space >512MB
552 553 if [ "$(df --output=avail "${BUILDDIR}" | sed "1d")" -le "524288" ] ; then
553 554 echo "error: ${BUILDDIR} not enough space left to generate the output image!"
554 555 exit 1
555 556 fi
556 557
557 558 set -x
558 559
559 560 # Call "cleanup" function on various signals and errors
560 561 trap cleanup 0 1 2 3 6
561 562
562 563 # Add required packages for the minbase installation
563 564 if [ "$ENABLE_MINBASE" = true ] ; then
564 565 APT_INCLUDES="${APT_INCLUDES},vim-tiny,netbase,net-tools,ifupdown"
565 566 fi
566 567
567 568 # Add parted package, required to get partprobe utility
568 569 if [ "$EXPANDROOT" = true ] ; then
569 570 APT_INCLUDES="${APT_INCLUDES},parted"
570 571 fi
571 572
572 573 # Add dphys-swapfile package, required to enable swap
573 574 if [ "$ENABLE_DPHYSSWAP" = true ] ; then
574 575 APT_INCLUDES="${APT_INCLUDES},dphys-swapfile"
575 576 fi
576 577
577 578 # Add dbus package, recommended if using systemd
578 579 if [ "$ENABLE_DBUS" = true ] ; then
579 580 APT_INCLUDES="${APT_INCLUDES},dbus"
580 581 fi
581 582
582 583 # Add iptables IPv4/IPv6 package
583 584 if [ "$ENABLE_IPTABLES" = true ] ; then
584 585 APT_INCLUDES="${APT_INCLUDES},iptables,iptables-persistent"
585 586 fi
586 587 # Add apparmor for KERNEL_SECURITY
587 588 if [ "$KERNEL_SECURITY" = true ] ; then
588 589 APT_INCLUDES="${APT_INCLUDES},apparmor,apparmor-utils,apparmor-profiles,apparmor-profiles-extra,libapparmor-perl"
589 590 fi
590 591
591 592 # Add openssh server package
592 593 if [ "$ENABLE_SSHD" = true ] ; then
593 594 APT_INCLUDES="${APT_INCLUDES},openssh-server"
594 595 fi
595 596
596 597 # Add alsa-utils package
597 598 if [ "$ENABLE_SOUND" = true ] ; then
598 599 APT_INCLUDES="${APT_INCLUDES},alsa-utils"
599 600 fi
600 601
601 602 # Add rng-tools package
602 603 if [ "$ENABLE_HWRANDOM" = true ] ; then
603 604 APT_INCLUDES="${APT_INCLUDES},rng-tools"
604 605 fi
605 606
606 607 # Add fbturbo video driver
607 608 if [ "$ENABLE_FBTURBO" = true ] ; then
608 609 # Enable xorg package dependencies
609 610 ENABLE_XORG=true
610 611 fi
611 612
612 613 # Add user defined window manager package
613 614 if [ -n "$ENABLE_WM" ] ; then
614 615 APT_INCLUDES="${APT_INCLUDES},${ENABLE_WM}"
615 616
616 617 # Enable xorg package dependencies
617 618 ENABLE_XORG=true
618 619 fi
619 620
620 621 # Add xorg package
621 622 if [ "$ENABLE_XORG" = true ] ; then
622 623 APT_INCLUDES="${APT_INCLUDES},xorg,dbus-x11"
623 624 fi
624 625
625 626 # Replace selected packages with smaller clones
626 627 if [ "$ENABLE_REDUCE" = true ] ; then
627 628 # Add levee package instead of vim-tiny
628 629 if [ "$REDUCE_VIM" = true ] ; then
629 630 APT_INCLUDES="$(echo ${APT_INCLUDES} | sed "s/vim-tiny/levee/")"
630 631 fi
631 632
632 633 # Add dropbear package instead of openssh-server
633 634 if [ "$REDUCE_SSHD" = true ] ; then
634 635 APT_INCLUDES="$(echo "${APT_INCLUDES}" | sed "s/openssh-server/dropbear/")"
635 636 fi
636 637 fi
637 638
638 639 # Configure systemd-sysv exclude to make halt/reboot/shutdown scripts available
639 640 if [ "$ENABLE_SYSVINIT" = false ] ; then
640 641 APT_EXCLUDES="--exclude=${APT_EXCLUDES},init,systemd-sysv"
641 642 fi
642 643
643 644 # Configure kernel sources if no KERNELSRC_DIR
644 645 if [ "$BUILD_KERNEL" = true ] && [ -z "$KERNELSRC_DIR" ] ; then
645 646 KERNELSRC_CONFIG=true
646 647 fi
647 648
648 649 # Configure reduced kernel
649 650 if [ "$KERNEL_REDUCE" = true ] ; then
650 651 KERNELSRC_CONFIG=false
651 652 fi
652 653
653 654 # Configure qemu compatible kernel
654 655 if [ "$ENABLE_QEMU" = true ] ; then
655 656 DTB_FILE=vexpress-v2p-ca15_a7.dtb
656 657 UBOOT_CONFIG=vexpress_ca15_tc2_defconfig
657 658 KERNEL_DEFCONFIG="vexpress_defconfig"
658 659 if [ "$KERNEL_MENUCONFIG" = false ] ; then
659 660 KERNEL_OLDDEFCONFIG=true
660 661 fi
661 662 fi
662 663
663 664 # Execute bootstrap scripts
664 665 for SCRIPT in bootstrap.d/*.sh; do
665 666 head -n 3 "$SCRIPT"
666 667 . "$SCRIPT"
667 668 done
668 669
669 670 ## Execute custom bootstrap scripts
670 671 if [ -d "custom.d" ] ; then
671 672 for SCRIPT in custom.d/*.sh; do
672 673 . "$SCRIPT"
673 674 done
674 675 fi
675 676
676 677 # Execute custom scripts inside the chroot
677 678 if [ -n "$CHROOT_SCRIPTS" ] && [ -d "$CHROOT_SCRIPTS" ] ; then
678 679 cp -r "${CHROOT_SCRIPTS}" "${R}/chroot_scripts"
679 680 chroot_exec /bin/bash -x <<'EOF'
680 681 for SCRIPT in /chroot_scripts/* ; do
681 682 if [ -f $SCRIPT -a -x $SCRIPT ] ; then
682 683 $SCRIPT
683 684 fi
684 685 done
685 686 EOF
686 687 rm -rf "${R}/chroot_scripts"
687 688 fi
688 689
689 690 # Remove c/c++ build environment from the chroot
690 691 chroot_remove_cc
691 692
692 693 # Generate required machine-id
693 694 MACHINE_ID=$(dbus-uuidgen)
694 695 echo -n "${MACHINE_ID}" > "${R}/var/lib/dbus/machine-id"
695 696 echo -n "${MACHINE_ID}" > "${ETC_DIR}/machine-id"
696 697
697 698 # APT Cleanup
698 699 chroot_exec apt-get -y clean
699 700 chroot_exec apt-get -y autoclean
700 701 chroot_exec apt-get -y autoremove
701 702
702 703 # Unmount mounted filesystems
703 704 umount -l "${R}/proc"
704 705 umount -l "${R}/sys"
705 706
706 707 # Clean up directories
707 708 rm -rf "${R}/run/*"
708 709 rm -rf "${R}/tmp/*"
709 710
710 711 # Clean up APT proxy settings
711 712 if [ "$KEEP_APT_PROXY" = false ] ; then
712 713 rm -f "${ETC_DIR}/apt/apt.conf.d/10proxy"
713 714 fi
714 715
715 716 # Clean up files
716 717 rm -f "${ETC_DIR}/ssh/ssh_host_*"
717 718 rm -f "${ETC_DIR}/dropbear/dropbear_*"
718 719 rm -f "${ETC_DIR}/apt/sources.list.save"
719 720 rm -f "${ETC_DIR}/resolvconf/resolv.conf.d/original"
720 721 rm -f "${ETC_DIR}/*-"
721 722 rm -f "${ETC_DIR}/resolv.conf"
722 723 rm -f "${R}/root/.bash_history"
723 724 rm -f "${R}/var/lib/urandom/random-seed"
724 725 rm -f "${R}/initrd.img"
725 726 rm -f "${R}/vmlinuz"
726 727 rm -f "${R}${QEMU_BINARY}"
727 728
728 729 if [ "$ENABLE_QEMU" = true ] ; then
729 730 # Setup QEMU directory
730 731 mkdir "${BASEDIR}/qemu"
731 732
732 733 # Copy kernel image to QEMU directory
733 734 install_readonly "${BOOT_DIR}/${KERNEL_IMAGE}" "${BASEDIR}/qemu/${KERNEL_IMAGE}"
734 735
735 736 # Copy kernel config to QEMU directory
736 737 install_readonly "${R}/boot/config-${KERNEL_VERSION}" "${BASEDIR}/qemu/config-${KERNEL_VERSION}"
737 738
738 739 # Copy kernel dtbs to QEMU directory
739 740 for dtb in "${BOOT_DIR}/"*.dtb ; do
740 741 if [ -f "${dtb}" ] ; then
741 742 install_readonly "${dtb}" "${BASEDIR}/qemu/"
742 743 fi
743 744 done
744 745
745 746 # Copy kernel overlays to QEMU directory
746 747 if [ -d "${BOOT_DIR}/overlays" ] ; then
747 748 # Setup overlays dtbs directory
748 749 mkdir "${BASEDIR}/qemu/overlays"
749 750
750 751 for dtb in "${BOOT_DIR}/overlays/"*.dtbo ; do
751 752 if [ -f "${dtb}" ] ; then
752 753 install_readonly "${dtb}" "${BASEDIR}/qemu/overlays/"
753 754 fi
754 755 done
755 756 fi
756 757
757 758 # Copy u-boot files to QEMU directory
758 759 if [ "$ENABLE_UBOOT" = true ] ; then
759 760 if [ -f "${BOOT_DIR}/u-boot.bin" ] ; then
760 761 install_readonly "${BOOT_DIR}/u-boot.bin" "${BASEDIR}/qemu/u-boot.bin"
761 762 fi
762 763 if [ -f "${BOOT_DIR}/uboot.mkimage" ] ; then
763 764 install_readonly "${BOOT_DIR}/uboot.mkimage" "${BASEDIR}/qemu/uboot.mkimage"
764 765 fi
765 766 if [ -f "${BOOT_DIR}/boot.scr" ] ; then
766 767 install_readonly "${BOOT_DIR}/boot.scr" "${BASEDIR}/qemu/boot.scr"
767 768 fi
768 769 fi
769 770
770 771 # Copy initramfs to QEMU directory
771 772 if [ -f "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" ] ; then
772 773 install_readonly "${BOOT_DIR}/initramfs-${KERNEL_VERSION}" "${BASEDIR}/qemu/initramfs-${KERNEL_VERSION}"
773 774 fi
774 775 fi
775 776
776 777 # Calculate size of the chroot directory in KB
777 778 CHROOT_SIZE=$(expr "$(du -s "${R}" | awk '{ print $1 }')")
778 779
779 780 # Calculate the amount of needed 512 Byte sectors
780 781 TABLE_SECTORS=$(expr 1 \* 1024 \* 1024 \/ 512)
781 782 FRMW_SECTORS=$(expr 64 \* 1024 \* 1024 \/ 512)
782 783 ROOT_OFFSET=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}")
783 784
784 785 # The root partition is EXT4
785 786 # This means more space than the actual used space of the chroot is used.
786 787 # As overhead for journaling and reserved blocks 35% are added.
787 788 ROOT_SECTORS=$(expr "$(expr "${CHROOT_SIZE}" + "${CHROOT_SIZE}" \/ 100 \* 35)" \* 1024 \/ 512)
788 789
789 790 # Calculate required image size in 512 Byte sectors
790 791 IMAGE_SECTORS=$(expr "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}")
791 792
792 793 # Prepare image file
793 794 if [ "$ENABLE_SPLITFS" = true ] ; then
794 795 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count="${TABLE_SECTORS}"
795 796 dd if=/dev/zero of="$IMAGE_NAME-frmw.img" bs=512 count=0 seek="${FRMW_SECTORS}"
796 797 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count="${TABLE_SECTORS}"
797 798 dd if=/dev/zero of="$IMAGE_NAME-root.img" bs=512 count=0 seek="${ROOT_SECTORS}"
798 799
799 800 # Write firmware/boot partition tables
800 801 sfdisk -q -L -uS -f "$IMAGE_NAME-frmw.img" 2> /dev/null <<EOM
801 802 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
802 803 EOM
803 804
804 805 # Write root partition table
805 806 sfdisk -q -L -uS -f "$IMAGE_NAME-root.img" 2> /dev/null <<EOM
806 807 ${TABLE_SECTORS},${ROOT_SECTORS},83
807 808 EOM
808 809
809 810 # Setup temporary loop devices
810 811 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME"-frmw.img)"
811 812 ROOT_LOOP="$(losetup -o 1M -f --show "$IMAGE_NAME"-root.img)"
812 813 else # ENABLE_SPLITFS=false
813 814 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count="${TABLE_SECTORS}"
814 815 dd if=/dev/zero of="$IMAGE_NAME.img" bs=512 count=0 seek="${IMAGE_SECTORS}"
815 816
816 817 # Write partition table
817 818 sfdisk -q -L -uS -f "$IMAGE_NAME.img" 2> /dev/null <<EOM
818 819 ${TABLE_SECTORS},${FRMW_SECTORS},c,*
819 820 ${ROOT_OFFSET},${ROOT_SECTORS},83
820 821 EOM
821 822
822 823 # Setup temporary loop devices
823 824 FRMW_LOOP="$(losetup -o 1M --sizelimit 64M -f --show "$IMAGE_NAME".img)"
824 825 ROOT_LOOP="$(losetup -o 65M -f --show "$IMAGE_NAME".img)"
825 826 fi
826 827
827 828 if [ "$ENABLE_CRYPTFS" = true ] ; then
828 829 # Create dummy ext4 fs
829 830 mkfs.ext4 "$ROOT_LOOP"
830 831
831 832 # Setup password keyfile
832 833 touch .password
833 834 chmod 600 .password
834 835 echo -n ${CRYPTFS_PASSWORD} > .password
835 836
836 837 # Initialize encrypted partition
837 838 echo "YES" | cryptsetup luksFormat "${ROOT_LOOP}" -c "${CRYPTFS_CIPHER}" -s "${CRYPTFS_XTSKEYSIZE}" .password
838 839
839 840 # Open encrypted partition and setup mapping
840 841 cryptsetup luksOpen "${ROOT_LOOP}" -d .password "${CRYPTFS_MAPPING}"
841 842
842 843 # Secure delete password keyfile
843 844 shred -zu .password
844 845
845 846 # Update temporary loop device
846 847 ROOT_LOOP="/dev/mapper/${CRYPTFS_MAPPING}"
847 848
848 849 # Wipe encrypted partition (encryption cipher is used for randomness)
849 850 dd if=/dev/zero of="${ROOT_LOOP}" bs=512 count="$(blockdev --getsz "${ROOT_LOOP}")"
850 851 fi
851 852
852 853 # Build filesystems
853 854 mkfs.vfat "$FRMW_LOOP"
854 855 mkfs.ext4 "$ROOT_LOOP"
855 856
856 857 # Mount the temporary loop devices
857 858 mkdir -p "$BUILDDIR/mount"
858 859 mount "$ROOT_LOOP" "$BUILDDIR/mount"
859 860
860 861 mkdir -p "$BUILDDIR/mount/boot/firmware"
861 862 mount "$FRMW_LOOP" "$BUILDDIR/mount/boot/firmware"
862 863
863 864 # Copy all files from the chroot to the loop device mount point directory
864 865 rsync -a "${R}/" "$BUILDDIR/mount/"
865 866
866 867 # Unmount all temporary loop devices and mount points
867 868 cleanup
868 869
869 870 # Create block map file(s) of image(s)
870 871 if [ "$ENABLE_SPLITFS" = true ] ; then
871 872 # Create block map files for "bmaptool"
872 873 bmaptool create -o "$IMAGE_NAME-frmw.bmap" "$IMAGE_NAME-frmw.img"
873 874 bmaptool create -o "$IMAGE_NAME-root.bmap" "$IMAGE_NAME-root.img"
874 875
875 876 # Image was successfully created
876 877 echo "$IMAGE_NAME-frmw.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
877 878 echo "$IMAGE_NAME-root.img ($(expr \( "${TABLE_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
878 879 else
879 880 # Create block map file for "bmaptool"
880 881 bmaptool create -o "$IMAGE_NAME.bmap" "$IMAGE_NAME.img"
881 882
882 883 # Image was successfully created
883 884 echo "$IMAGE_NAME.img ($(expr \( "${TABLE_SECTORS}" + "${FRMW_SECTORS}" + "${ROOT_SECTORS}" \) \* 512 \/ 1024 \/ 1024)M)" ": successfully created"
884 885
885 886 # Create qemu qcow2 image
886 887 if [ "$ENABLE_QEMU" = true ] ; then
887 888 QEMU_IMAGE=${QEMU_IMAGE:=${BASEDIR}/qemu/${DATE}-${KERNEL_ARCH}-CURRENT-rpi${RPI_MODEL}-${RELEASE}-${RELEASE_ARCH}}
888 889 QEMU_SIZE=16G
889 890
890 891 qemu-img convert -f raw -O qcow2 "$IMAGE_NAME".img "$QEMU_IMAGE".qcow2
891 892 qemu-img resize "$QEMU_IMAGE".qcow2 $QEMU_SIZE
892 893
893 894 echo "$QEMU_IMAGE.qcow2 ($QEMU_SIZE)" ": successfully created"
894 895 fi
895 896 fi
General Comments 0
Vous devez vous connecter pour laisser un commentaire. Se connecter maintenant